* [PATCH 7.3 0000/1257] 7.3.4-rc1 review
@ 2026-11-07 13:38 Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0001/1257] drm/xe: Implement Wa_22016122933 Greg Kroah-Hartman
` (998 more replies)
0 siblings, 999 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 7.3.4 release.
There are 1257 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon, 09 Nov 2026 13:46:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.3.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.3.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 7.3.4-rc1
John Johansen <john.johansen@canonical.com>
apparmor: on failed load ensure profile files are removed before parent
John Johansen <john.johansen@canonical.com>
apparmor: fix uninitialized variable warning in aa_inherit_files
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: read the xattr entry hash before defragmenting the bucket
Avi Weiss <thnkslprpt@gmail.com>
init/bootconfig: pass init arguments in documented order
Amir Goldstein <amir73il@gmail.com>
fs: don't fail __d_obtain_alias() for unlinked inodes
Christian Brauner <brauner@kernel.org>
ns: don't add init_ipc_ns and init_net without namespace support
Hungyu Lin <dennylin0707@gmail.com>
fs: skip copy_file_range write limits when there is no data
Edvard Conrad <edvard@tuta.io>
fs: let backing files inherit FMODE_NONOTIFY from the user file
Daehyeon Ko <4ncienth@gmail.com>
splice: avoid stale f_pos writeback on error
Chris Mason <mason@kernel.org>
backing-file: always end a queued write
Chris Mason <mason@kernel.org>
iov_iter: fix NULL deref in iov_iter_alignment()
Christian Brauner <brauner@kernel.org>
backing-file: enforce append-only and immutable backing inodes
Chris Mason <mason@kernel.org>
aio: fix NULL deref when a fault races ring truncation
Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
arm64/gcs: release GCS on failed fork
Georgia Garcia <georgia.garcia@canonical.com>
apparmor: fix profile leak when a policy load fails
Georgia Garcia <georgia.garcia@canonical.com>
apparmor: remove fs entries created by a failed policy load
Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
apparmor: fix query_data() output overlapping the lookup key
Kyle Zeng <kylebot@openai.com>
tcp: fix reordering addition overflow in MTU probing
Kyle Zeng <kylebot@openai.com>
net/packet: check TX_RING fragments before memory accounting
Guanglei Zhu <zhugl3@xiaopeng.com>
apparmor: check accept index + 1 is in bounds
Li RongQing <lirongqing@baidu.com>
apparmor: avoid potential double free when remapping DFA tables
John Johansen <john.johansen@canonical.com>
apparmor: fix refcount leak in aa_get_newest_profile()
Josef Bacik <josef@toxicpanda.com>
pidfs: don't let PIDFD_GET_INFO miss a reaped task
Josef Bacik <josef@toxicpanda.com>
nstree: don't end listns() at an inactive namespace
Zhiling Zou <zhilinz@nebusec.ai>
tcp: check congestion control restriction first
Christian Brauner <brauner@kernel.org>
proc: don't let an entry below /proc/<pid>/net be a mountpoint
Kunhai Dai <daikunhai@didiglobal.com>
blk-iocost: abort weight transfer on invalid donation weights
Christian Brauner <brauner@kernel.org>
userns: don't drop the exec securebits
Josef Bacik <josef@toxicpanda.com>
mount: refuse setns() with a shared fs_struct again
Josef Bacik <josef@toxicpanda.com>
iomap: keep large chunks from defeating the bio cap
Christian Brauner <brauner@kernel.org>
iomap: don't mark unwritten parts of a folio uptodate
Noam D. Eliyahu <noam.d.eliyahu@gmail.com>
tg3: Invert restart quirk logic to restrict SNP power-down bypass
Linmao Li <lilinmao@kylinos.cn>
r8152: Use BMSR to detect the link state
Georgia Garcia <georgia.garcia@canonical.com>
apparmor: don't revalidate inherited files under files->file_lock
Maxime Bélair <maxime.belair@canonical.com>
apparmor: fix NULL ctx->peer derefs in unix socket ctx updates
Yongjian Wang <echoowall@gmail.com>
Revert "net: advertise TCP MSS from the configured MTU, not the learned PMTU"
Avi Weiss <thnkslprpt@gmail.com>
irqchip/irq-msi-lib: Free wired MSI descriptors
Avi Weiss <thnkslprpt@gmail.com>
irqchip/riscv-imsic: Report successful hardware retrigger
Eric Biggers <ebiggers@kernel.org>
fsverity: Tell LSMs about signature only after verity is enabled
Eric Biggers <ebiggers@kernel.org>
fsverity: Be more careful with return value of ->get_verity_descriptor()
Eric Biggers <ebiggers@kernel.org>
fsverity: Explicitly require FMODE_READ to retrieve hashes
Fang Xieyan <fangxy@xiaopeng.com>
kgdb: Fix buffer overflow in the qRcmd packet handler
Fang Xieyan <fangxy@xiaopeng.com>
kgdb: Fix buffer overflow in the 'M' and 'X' packet handlers
Fang Xieyan <fangxy@xiaopeng.com>
kgdb: Fix buffer overflow in the 'm' packet handler
Yingjie Wang <1075151112@qq.com>
nvme-tcp: validate the TLS handshake timeout
Yingjie Wang <1075151112@qq.com>
nvmet-tcp: validate the TLS handshake timeout
Guixin Liu <kanie@linux.alibaba.com>
nvmet: Free the old negotiation state when restarting authentication
Guixin Liu <kanie@linux.alibaba.com>
nvmet: Finish the blk plug when integrity allocation fails
Seiji Nishikawa <snishika@redhat.com>
nvme-tcp: fix io_work priority inversion when send_mutex is held
Martin Belanger <martin.belanger@dell.com>
nvme-tcp: start error recovery when read_sock fails
Guixin Liu <kanie@linux.alibaba.com>
nvmet-fc: Tear down the association when the admin queue allocation fails
Shao Mingyin <shao.mingyin@zte.com.cn>
nvmet-auth: fix error handling on CHALLENGE failure
Andrea Parri <parri.andrea@gmail.com>
nvmet: pci-epf: require SGLs to match the command data length
Andrea Parri <parri.andrea@gmail.com>
nvmet: pci-epf: report transport errors in command completions
Andrea Parri <parri.andrea@gmail.com>
nvmet-fc: only send read data for successful commands
Andrew Stellman <astellman@stellman-greene.com>
nvmet-rdma: fix out-of-bounds write in nvmet_rdma_map_sgl_inline()
Weiming Shi <bestswngs@gmail.com>
nvmet-rdma: reject short connection requests
Tristan Madani <tristan@talencesecurity.com>
ppp: fix stale pointer access after pskb_may_pull in ppp_ccp_peek
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
inet: frags: prevent acceptance of partially authenticated reassembly
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: hdac_hda: Keep runtime PM state in sync across codec remove/probe
Huacai Chen <chenhuacai@kernel.org>
soc: loongson: loongson2_pm: Fix build warnings for 32BIT
Hongling Zeng <zenghongling@kylinos.cn>
ntfs3: fix mapping pairs bounds check for alignment
Hyeontae Lee <wonju345@naver.com>
fs/ntfs3: bound DeleteAttribute asize against rec->used in do_action
Hyeontae Lee <wonju345@naver.com>
fs/ntfs3: bound CreateAttribute asize against record_size in do_action
David Yang <mmyangfl@gmail.com>
net: hisilicon: hisi_femac: Stop the receiver before releasing the RX ring
Xia Yan <yanxia@cmss.chinamobile.com>
macvlan: fix passthru promiscuity accounting while down
Kamil Sawicki <user148783812897@gmail.com>
net: limit priority VLAN untag depth
Fangzhi Zuo <jerry.zuo@amd.com>
drm/amd/display: Poll passive DVI sinks for EDID readiness
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdgpu: drop the gang leader reference when freeing gang jobs
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdkfd: send SMI process and VM fault events only to allowed clients
Jiale Yao <yaojiale02@163.com>
drm/amdkfd: validate SRAT subtables before parsing
Kevin Wang <kevin.wang@amd.com>
drm/amd/pm: preserve committed OD features for SMU 14.0.2
Kevin Wang <kevin.wang@amd.com>
drm/amd/pm: preserve committed OD features for SMU 13.0.0/13.0.7
Avi Weiss <thnkslprpt@gmail.com>
drm/amd/display: Initialize missing TD-LUT programming inputs
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mapping
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdgpu: reject CS chunks too large for kvmalloc()
Luigi Lauro <luigi.lauro@gmail.com>
drm/amd/display: take a runtime PM reference only when a CRTC turns on
Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
drm/amdgpu: guard VCE/UVD sched entity teardown on failed probe
Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
drm/amdkfd: stop restore retries on device unplug
Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
drm/amdkfd: tear down KFD processes before early fini_sw on disconnect
William Palacek <William.Palacek@amd.com>
drm/amdkfd: Validate the control stack of a restored queue
lvyating <lv.yating@zte.com.cn>
perf machine: Fix NULL deref in thread__resolve_callchain_sample()
Karl Mehltretter <kmehltretter@gmail.com>
clocksource: Prevent immediate watchdog rerun after a delay
Zhao Gongyi <zhaogongyi@bytedance.com>
arm64/mm: restrict transparent contpte mappings to valid PTEs
Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
cpufreq: stats: Fix potential out-of-bounds access in deferred reset
Tiezhu Yang <yangtiezhu@loongson.cn>
LoongArch: Fix one-shot limitation for perf hardware breakpoints
Tiezhu Yang <yangtiezhu@loongson.cn>
LoongArch: Fix perf hardware breakpoint failure via installation
Tiezhu Yang <yangtiezhu@loongson.cn>
LoongArch: Only send SIGTRAP signal if necessary in do_watch()
Tiezhu Yang <yangtiezhu@loongson.cn>
LoongArch: Fix architectural naming typo for CSR_FWPS_SKIP
Tiezhu Yang <yangtiezhu@loongson.cn>
LoongArch: Fix bitmask corruption in update_bp_registers()
Tiezhu Yang <yangtiezhu@loongson.cn>
LoongArch: Remove redundant call in update_bp_registers()
Tiezhu Yang <yangtiezhu@loongson.cn>
LoongArch: Remove arch-specific __smp_mb__{before,after}_atomic()
Huacai Chen <chenhuacai@kernel.org>
LoongArch: Use pa_to_nid()/nid_to_addrbase() rather than hard-code
Huacai Chen <chenhuacai@kernel.org>
LoongArch: Don't init & online empty nodes
Huacai Chen <chenhuacai@kernel.org>
LoongArch: Call cpu_final_simd() with pure_initcall()
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: hdac_hda: Balance the runtime PM disable in codec remove
Eric Dumazet <edumazet@kernel.org>
ixgbe: reserve TX timestamp after skb preparation
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ALSA: hda: Reject codec reset on ASoC (ext_ops) buses
Tejun Heo <tj@kernel.org>
sched_ext: Fix the stall watchdog testing and blaming the wrong sched under bypass
Sinan Turunc <enscrpt@pm.me>
ALSA: ua101: Bound packet copies by the PCM buffer size
Sinan Turunc <enscrpt@pm.me>
ALSA: usb-audio: Bound packet copies by the PCM buffer size
Dominik Maier <dmnk@google.com>
loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl()
Paul Moses <p@1g4.org>
xsk: restore UMEM flags after failed pool assignment
Yingjie Wang <1075151112@qq.com>
tcp: limit tcp_tso_rtt_log to a valid shift count
Miquel Raynal <miquel.raynal@bootlin.com>
dt-bindings: clock: ma35d1: Document the missing crystal inputs
Zhiling Zou <zhilinz@nebusec.ai>
ipmr: drop packets with unknown ingress VIF
Ido Schimmel <idosch@nvidia.com>
ipmr, ip6mr: validate packets injected into the register vif on xmit
Ido Schimmel <idosch@nvidia.com>
ipmr: fully initialize the synthetic IP header in ipmr_get_route()
Jiayuan Chen <jiayuan.chen@linux.dev>
bonding: fix out-of-bounds read of arp_ip_target
Wei Jie Law <law.wei.jie@gt.tech.gov.sg>
net: usb: pegasus: check rx pkt_len against the received length
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: SDCA: drop pm_runtime reference on probe failure path
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: SDCA: propagate sdw_slave_read_prop() failure in class_read_prop
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: codecs: wsa883x: Accept temperatures across the full trim range
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: codecs: wsa884x: Accept temperatures across the full trim range
Ravi Hothi <ravi.hothi@oss.qualcomm.com>
ASoC: qcom: audioreach: fix module cfg blob size handling
Shawn Guo <shengchao.guo@oss.qualcomm.com>
ASoC: qcom: q6apm: Unmap DSP buffers before removing the topology
Shawn Guo <shengchao.guo@oss.qualcomm.com>
ASoC: qcom: q6apm: Clear the right handle on pos buffer unmap
Shawn Guo <shengchao.guo@oss.qualcomm.com>
ASoC: qcom: q6apm: Fix unmap regions response handling
Val Packett <val@packett.cool>
ASoC: qcom: qdsp6: q6afe: fix clk vote response type mismatch
Chao Yu <chao@kernel.org>
f2fs: fix to update superblock crc in sanity_check_area_boundary()
Alex Markuze <amarkuze@redhat.com>
ceph: fix uninitialized err in ceph_netfs_issue_read()
sung byeongchan <tjdqudcks0424@naver.com>
ceph: validate encoded xattr name lengths
sung byeongchan <tjdqudcks0424@naver.com>
ceph: validate MDS reply fragtree split array length
sung byeongchan <tjdqudcks0424@naver.com>
ceph: bound name skips in ceph_mdsmap_decode() by the message end
sung byeongchan <tjdqudcks0424@naver.com>
ceph: validate fscrypt auth blob length
Venky Shankar <vshankar@redhat.com>
ceph: don't fail write_begin with -EAGAIN after flushing old snapc
Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>
ceph: clamp MDS reply result code to the errno range
Darong Lu <zzyy19904204639@163.com>
libceph: initialize CRUSH choose argument weights
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
libceph: fix out-of-bounds reads from repeated CRUSH bucket entries
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
ceph: fix 32-bit overflow in readdir reply count check
Wentao Liang <vulab@iscas.ac.cn>
ceph: Fix mds session leak in __open_export_target_session()
Wentao Liang <vulab@iscas.ac.cn>
ceph: Fix xattr buffer leak in __send_cap()
Xiang Mei <xmei5@asu.edu>
ceph: fix integer overflow in the snap trace bounds check
Yogesh Gaur <yogeshgaur.83@gmail.com>
libceph: reject an initial monmap with no monitors
Felix Hoffmann <f3lix.dev@gmx.de>
libceph: reject mismatched CRUSH weight-set sizes
Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
libceph: Fix multiple unsafe decodes in ceph_oloc_decode()
Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
libceph: Fix unsafe decode in ceph_redirect_decode()
Xiubo Li <xiubo.li@clyso.com>
libceph: only set read_from_replica on read requests
Xiang Mei <xmei5@asu.edu>
ceph: require the dentry lease record to cover struct ceph_mds_reply_lease
Xiang Mei <xmei5@asu.edu>
ceph: reject mdsmaps that claim more than CEPH_MAX_MDS ranks
Guanglei Zhu <zhugl3@xiaopeng.com>
ceph: fix out-of-bounds read in ceph_netfs_issue_op_inline()
Jiangshan Yi <yijiangshan@kylinos.cn>
ceph: fix longname buffer overflow in ceph_fname_to_usr()
Max Kellermann <max.kellermann@ionos.com>
ceph: avoid pending truncate during nonblocking cap acquire
Marc Zyngier <maz@kernel.org>
KVM: arm64: Sanitise ID_AA64MMFR3_EL1.S1P[IO]E
Vincent Donnefort <vdonnefort@google.com>
tracing/remotes: Fix TRACE_REMOTE build when TRACING=n
Fuad Tabba <fuad.tabba@linux.dev>
KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests
Peng Wang <peng_wang@linux.alibaba.com>
tick/nohz: Reevaluate the tick for kicks flushed outside hardirq
Hung-Jui Lin <alex.lin.programmer@gmail.com>
posix-timers: Report zero remaining time for disarmed SIGEV_NONE timers
Hungyu Lin <dennylin0707@gmail.com>
time/namespace: Fix overflow when converting absolute deadlines
Hungyu Lin <dennylin0707@gmail.com>
timers/itimer: Keep a nonzero value at CPU timer expiry
Hungyu Lin <dennylin0707@gmail.com>
posix-timers: Accept NULL clock_getres() output in stubs
Gao Xiang <xiang@kernel.org>
erofs: hold real inodes for shared files
Wang Haoran <haoranwangsec@gmail.com>
fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe
Alberto Garcia <berto@igalia.com>
ext4: reject encrypted inodes when block size > page size
Alberto Garcia <berto@igalia.com>
ext4: refuse encryption when block size > page size
Baokun Li <libaokun@linux.alibaba.com>
fscrypt: Fix missing barrier in fscrypt_find_mode_key()
Siddharth Chintamaneni <sidchintamaneni@gmail.com>
mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
Lorenzo Stoakes (ARM) <ljs@kernel.org>
mm/vma: avoid broken uffd merge on mremap
Yunhui Cui <cuiyunhui@bytedance.com>
riscv: mm: exclude invalid THP PMDs from page table check
SJ Park <sj@kernel.org>
mm/damon/core: filter out damos address filter-split failed region
Gregory Price (Meta) <gourry@gourry.net>
mm/mempolicy: apply bind policies against the scoped allocation zone
Gregory Price (Meta) <gourry@gourry.net>
mm/vmscan: reclaim every zone in per-node proactive reclaim
Lorenzo Stoakes (ARM) <ljs@kernel.org>
mm/mremap: correctly uncharge accountable VMAs in error path
Lorenzo Stoakes (ARM) <ljs@kernel.org>
mm/mremap: populate calculated fields in vrm state correctly
Kyle Zeng <kylebot@openai.com>
mm/page_vma_mapped: continue past nonmatching huge PMDs
Nickolai Zeldovich <nickolai@csail.mit.edu>
mm/truncate: fix the zeroing end of pagecache_isize_extended()
Rik van Riel <riel@surriel.com>
mm/page_alloc: count guard pages as free again when their buddy merges
Jiayuan Chen <jiayuan.chen@shopee.com>
mm/swap: fix swap_cache_get_folio() returning a folio that left the swap cache
Vernon Yang <yanglincheng@kylinos.cn>
mm: vmscan: don't count per-node proactive reclaim as memory pressure
Weilin Tong <tongweilin@linux.alibaba.com>
ipc/shm: fix RSS accounting for hugetlb shared memory
Pedro Falcato <pfalcato@suse.de>
mm/madvise: atomically clear the young bit on THP MADV_COLD
Harry Yoo (Meta) <harry@kernel.org>
mm/percpu: account full object size for percpu memory allocations
Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
userfaultfd: fix UFFDIO_MOVE livelock on large folio with extra references
Nickolai Zeldovich <nickolai@csail.mit.edu>
mm/mlock: use a long for the page count in mlock_fixup()
Kiryl Shutsemau (Meta) <kas@kernel.org>
mm: page_alloc: make defrag_mode retries follow the promoted order
Wei Yang <albinwyang@tencent.com>
mm/madvise: add cond_resched() in THP branch of madvise_cold_or_pageout_pte_range()
Hongfu Li <lihongfu@kylinos.cn>
mm/memfd: fix hugetlb reservation accounting in error paths
David Hildenbrand (Arm) <david@kernel.org>
mm: disallow ioremap'ing ordinary RAM in generic_access_phys()
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
mm/damon/core: prevent size quota overflow in the temporal goal tuner
Karl Mehltretter <kmehltretter@gmail.com>
mm/damon/core: preserve the quota passed to damon_new_scheme()
Hongfu Li <lihongfu@kylinos.cn>
mm/memcg: migrate per-node hugetlb lruvec stat together with hugetlb folio
Hongfu Li <lihongfu@kylinos.cn>
mm/hugetlb: account migration target folio in per-node NR_HUGETLB vmstat
David Hildenbrand (Arm) <david@kernel.org>
mm/mremap: fix calling fixup_hugetlb_reservations() on the wrong VMA
Josef Bacik <josef@toxicpanda.com>
mm/hugetlb: don't leave a uffd-wp marker when zapping an RWP entry
David Hildenbrand (Arm) <david@kernel.org>
mm/hugetlb: tolerate UFFD_WP markers outside uffd-wp VMAs
David Hildenbrand (Arm) <david@kernel.org>
mm/hugetlb: tolerate uffd bits set without uffd for PROT_NONE PTEs
Josef Bacik <josef@toxicpanda.com>
mm/hugetlb: fix endless write fault on a leftover uffd bit
Josef Bacik <josef@toxicpanda.com>
mm/hugetlb: don't clear the resv_map of a VMA whose lock is held
Josef Bacik <josef@toxicpanda.com>
mm/hugetlb: unmap the page where the other VMA maps it
Josef Bacik <josef@toxicpanda.com>
mm/vma: don't leak the commit charge on mmap failure
Cen Zhang <zzzccc427@gmail.com>
ocfs2/cluster: remove zero-address nodes from IP tree on teardown
Cen Zhang <zzzccc427@gmail.com>
ocfs2: snapshot the dentry name while tracing file release
Caleb Kan <ckan@cloudflare.com>
stackdepot: stop preallocating after the final pool
Hungyu Lin <dennylin0707@gmail.com>
compat: avoid double rounding in times()
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: core: Do not release a reserved request in ufshcd_abort()
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort()
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: core: Fix double release in ufshcd_eh_timed_out()
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: core: Fix double completion in ufshcd_clear_lu_cmds()
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: core: Add a helper for clearing hba->outstanding_reqs
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: core: Remove an always-false WARN_ONCE()
Yingjie Wang <x-professor@outlook.com>
scsi: handle out-of-range SG_SET_TIMEOUT values
Bart Van Assche <bvanassche@acm.org>
scsi: sd: Mark the disk dead if runtime resume fails in sd_remove()
Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
scsi: libiscsi_tcp: Prevent R2T range check overflow
Joonhoe Kim <26rote@gmail.com>
scsi: ufs: core: Fix a deadlock between clock scaling and device commands
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: core: Clear stale UIC result byte before peer DME retries
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: bsg: Reject UIC commands with a non-zero result byte
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: bsg: Validate request_len before accessing request
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: bsg: Clear the reply buffer before use
Stanley Jhu <stanleyjhu@google.com>
scsi: ufs: bsg: Complete the job on error
yanxia <yanxia@cmss.chinamobile.com>
veth: fix stale peer max_mtu on XDP program replacement
Igor Velkov <iav@iav.lv>
genirq/kexec: Do not take the bus lock of an interrupt chip on the crash path
Aamir Ahmed <elb12345@hotmail.co.uk>
gve: fix out-of-bounds read in gve_get_flow_rule_entry()
Sasha Levin <sashal@kernel.org>
cgroup: don't kill migrated processes through their exiting threads
Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
timekeeping: Update offsets on sequence counter retry in ktime_get_update_offsets_now()
Daehyeon Ko <4ncienth@gmail.com>
timekeeping: Require permission to set auxiliary clocks
Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() signal path
Zhiling Zou <zhilinz@nebusec.ai>
ipmr: only copy pktinfo to cache reports
Pufan Jin <cyan2254650260@gmail.com>
spi: zynq-qspi: fix address buffer corruption and support 4-byte address
Yafang Shao <laoar.shao@gmail.com>
sched: fix stale get_pref_llc() stub for !CONFIG_SCHED_CACHE
Tim Chen <tim.c.chen@linux.intel.com>
sched/cache: Honor asym packing over cache aware scheduling on hybrid systems
Christian Marangi <ansuelsmth@gmail.com>
i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len
Alex Kazinsky <a.kazinsky@ideco.ru>
ASoC: tlv320aic32x4: Prevent division by zero in divider callbacks
Jean Delu <jeandelu@tutamail.com>
parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer
Adrian Ambrozewicz <aambrozewicz@nvidia.com>
gpiolib: don't report -ENOMEM for a requested line without a label
Pei Xiao <xiaopei01@kylinos.cn>
tpm: fix zero-length read discarding the pending response
Pei Xiao <xiaopei01@kylinos.cn>
tpm: tpm_nsc: stop using the cleanup callback as dev.release
Pei Xiao <xiaopei01@kylinos.cn>
tpm: tpm_nsc: fix NULL pointer dereference on init failure
Alexander Sverdlin <alexander.sverdlin@siemens.com>
tpm: tpm2_probe: propagate transport errors
Navon John Lukose <navonjohnlukose@gmail.com>
i2c: designware: queue only one read command for block reads
Ma Ke <make_ruc2021@163.com>
i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()
Karl Mehltretter <kmehltretter@gmail.com>
PM: EM: allocate the cpumask for every perf domain
Tristan Madani <tristan@talencesecurity.com>
cpufreq: intel_pstate: cancel HWP notify work in driver cleanup
Nickolai Zeldovich <nickolai@csail.mit.edu>
ucount: take the rlimit reference before checking the limit
Christian Brauner <brauner@kernel.org>
listns: don't wrap around with a U64_MAX cursor
Nikolaos Karaolidis <nick@karaolidis.com>
fs: don't lose inodes that another LRU walker is isolating
Christian Brauner <brauner@kernel.org>
listmount: don't wrap around with a U64_MAX cursor
Christian Brauner <brauner@kernel.org>
statmount: don't copy the reserved empty string past the buffer
Chuck Lever <cel@kernel.org>
exportfs: Release the get_name() directory file synchronously
Liz Fong-Jones <lizf@honeycomb.io>
writeback: keep cleanup_offline_cgwb()'s scan out of syncs
Nikolaos Karaolidis <nick@karaolidis.com>
fs: rotate inodes whose page cache could not be dropped
Guopeng Zhang <zhangguopeng@kylinos.cn>
cgroup/cpuset: Fix task checking when enabling a partition
Henry Martin <bsdhenrymartin@gmail.com>
tipc: fix broadcast sender hang on last acker departure
Niklas Cassel <cassel@kernel.org>
ata: libata-sff: fix race between IRQ deferral and ata_sff_flush_pio_task()
Liu Chao <liuc63@xiaopeng.com>
net: wwan: iosm: validate msg_head before indexing msg_ring
Qingfang Deng <qingfang.deng@linux.dev>
pppoe: delete session hash entries by pointer match
Daehyeon Ko <4ncienth@gmail.com>
mshv_vtl: reject poll files with multiple waitqueues
Yu Zhang <yuz08559@gmail.com>
nvmet: take subsys->lock while force-reconnecting in nvmet_subsys_attr_qid_max_store()
Shawn Lin <shawn.lin@rock-chips.com>
PCI/pwrctrl: Only destroy devices created by pwrctrl core
Alexey Charkov <alchark@flipper.net>
PCI/pwrctrl: generic: Fix leaking array from of_regulator_bulk_get_all()
Runyu Xiao <runyu.xiao@seu.edu.cn>
sh: maple: Use the matching IRQ cookie when invoking free_irq()
Henrik Enquist <henrik.enquist@gmail.com>
ALSA: aloop: Update the PCM Slave controls for a matching playback
Julian Sun <sunjunchao@bytedance.com>
writeback: clear old wb dirty state after inode switches
Julian Sun <sunjunchao@bytedance.com>
writeback: reset dirtied_when when switching wbs
Bartu Alev <bartualev@gmail.com>
platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming
Michael Kelley <mhkelley58@gmail.com>
Documentation: hyperv: Update documentation for sending VMBus packets
Cen Zhang <zzzccc427@gmail.com>
ocfs2/cluster: initialize heartbeat regions before publishing them
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: deal with legacy signed xattr name hash values
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: use the stored hash when checking xattr bucket collision
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: deal with legacy signed dir index name hash values
Armaan Sandhu <armaan.sandhu0504@gmail.com>
lib/cmdline: fix get_options() count and overflow with large ranges
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: reserve value tree metadata when moving an xattr into the inode
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: reserve metadata for a new xattr block and its value tree
Matt Turner <mattst88@gmail.com>
alpha: determine tininess after rounding in the FP emulation
Bryam Vargas <hexlabsecurity@proton.me>
net/smc: queue the copied chunk when smc_tx_sendmsg() faults
Hengyu Liang <hengyul@cs.unc.edu>
exfat: fix reading a directory whose FAT chain is longer than its size
Hengyu Liang <hengyul@cs.unc.edu>
exfat: free clusters beyond EOF when a write fails or is short
Yuezhang Mo <Yuezhang.Mo@sony.com>
exfat: mark straddling folio RO and zero the post-EOF range
Hengyu Liang <hengyul@cs.unc.edu>
exfat: fix a large buffered write failing when the volume is nearly full
Namjae Jeon <linkinjeon@kernel.org>
exfat: zero invalid tail on partial overwrites
Jiale Yao <yaojiale02@163.com>
exfat: drain in-flight DIO before buffered writes
Chi Zhiling <chizhiling@kylinos.cn>
exfat: make valid_size and zeroed_size atomic
Chi Zhiling <chizhiling@kylinos.cn>
exfat: dirty all new pages when extending valid_size
Chi Zhiling <chizhiling@kylinos.cn>
exfat: hold the invalidate lock while truncating
Chi Zhiling <chizhiling@kylinos.cn>
exfat: advance valid_size to EOF for append writes
Til Kaiser <mail@tk154.de>
mlxsw: Initialize register query payloads
Yingjie Wang <1075151112@qq.com>
net: unix: reject negative max_dgram_qlen values
Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
net/rds: ib: don't enable IRQs in rds_ib_conn_free()
Guangshuo Li <lgs201920130244@gmail.com>
PCI: qcom-ep: Deinitialize endpoint on remove
Yao Yiqi <yaoyiqi3@huawei.com>
fbcon: Retry rotated font allocation after failure
Yao Yiqi <yaoyiqi3@huawei.com>
fbcon: Rebuild rotated font buffer on font change
Yao Yiqi <yaoyiqi3@huawei.com>
fbcon: Include font geometry in the rotated font cache
Tingjie Zhong <catme0w@live.cn>
fbdev: bitblit: Fix glyph clipping when fbcon pans
Daehyeon Ko <4ncienth@gmail.com>
ipv6: do not restart DAD for a dead ifaddr
Daehyeon Ko <4ncienth@gmail.com>
ipv6: initialize temporary ifaddr before publication
Daehyeon Ko <4ncienth@gmail.com>
ipv6: serialize address publication with device teardown
Daehyeon Ko <4ncienth@gmail.com>
ipv6: remove ifaddr from hash during ifdown list cleanup
Kees Cook <kees@kernel.org>
netdev: Hide the netdev_priv() origin from GCC in netdev_from_priv()
Zhen Han <Zhen.Han@amd.com>
drm/amdkfd: correct vram_available calculation
Daniel Phillips <daniel.phillips@amd.com>
amdkfd: Fix memory availability double accounting of kfd pinned objects
Kenneth Feng <kenneth.feng@amd.com>
drm/amd/pm:restate all customized OD features on every table upload for smu 13.0.0/smu 14.0.2
John Fisher <jfisher84@gmail.com>
drm/amdgpu: wait for pending page table updates before switching a VM to CPU updates
William Palacek <William.Palacek@amd.com>
drm/amdkfd: wait for a GPU reset before freeing a BO
Keita Morisaki <kmta1236@gmail.com>
drm/amd/display: Fix swap in median3() for DSC rate control
Elena Sakhnovitch <Elena.Sakhnovitch@amd.com>
drm/amdgpu/gmc9: add extra type-2 TLB flush for gfx942/gfx950
Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
drm/amdkfd: fix NULL deref in SDMA HQD debugfs dump on GC 12.1
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdkfd: don't drop an SVM CWSR reference that was never taken
Kevin Wang <kevin.wang@amd.com>
drm/amd/pm: reapply umd profile state after recovery
Jesse Zhang <Jesse.Zhang@amd.com>
drm/amdgpu: reject ANONONLY userptrs that span multiple VMAs
Mario Limonciello <mario.limonciello@amd.com>
drm/amd/display: don't WARN when removing an unallocated MST payload
Henry Martin <bsdhenrymartin@gmail.com>
drm/amdkfd: fix doorbell allocation race creating duplicate allocations
Maciej Kucharek <qchcio@gmail.com>
drm/amdgpu: reset VI ASIC on Apple boards with VRAM at 0
Maciej Kucharek <qchcio@gmail.com>
drm/amdgpu: reset CIK ASIC on Apple boards with VRAM at 0
Maciej Kucharek <qchcio@gmail.com>
drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0
Luigi Lauro <luigi.lauro@gmail.com>
drm/amdgpu: require _PR3 for BOCO
Daeho Jeong <daehojeong@google.com>
f2fs: don't use truncate_inode_pages_final() on live inodes
Wang Yan <wangyan01@kylinos.cn>
selftests/landlock: Fix snprintf truncation checks in test files
Nirmoy Das <nirmoyd@nvidia.com>
blk-mq: clear stale inactive flag on hctx reuse
Sahaj Chaudhari <sahaj123.sc@gmail.com>
gpio: pca953x: Handle direction register read errors in IRQ paths
Sahaj Chaudhari <sahaj123.sc@gmail.com>
gpio: pca953x: Preserve wakeup accounting on parent IRQ failure
Sahaj Chaudhari <sahaj123.sc@gmail.com>
gpio: davinci: Clear interrupt status in every bank on suspend
Takashi Iwai <tiwai@suse.de>
ALSA: line6: Handle period elapsed calls outside the locks
Baek Kyu, Kim <pocj8ur4in@gmail.com>
gpiolib: Free chip resources when allocating the label fails
Rong Zhang <i@rong.moe>
platform/x86: lenovo-wmi-capdata: Do not stop the AC notifier chain on error
Takashi Iwai <tiwai@suse.de>
ALSA: emux: Stop voices before freeing zones in all cases
Wang Yan <wangyan01@kylinos.cn>
ALSA: mtpav: restore negation dropped in guard() conversion
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: roll back the ACL xattr commit when the WSL mode update fails
DaeMyung Kang <charsyam@gmail.com>
ntfs: flush the block device when syncing a directory
DaeMyung Kang <charsyam@gmail.com>
ntfs: report block device flush failures from fsync
Karl Mehltretter <kmehltretter@gmail.com>
ntfs: fix kmap_local leak in ntfs_check_logfile()
Karl Mehltretter <kmehltretter@gmail.com>
ntfs: fix kunmap_local() of advanced pointers in check_mft_mirror()
Matthias Goergens <matthias.goergens@gmail.com>
ntfs: balance the $MFT runlist lock in data extension error paths
Matthias Goergens <matthias.goergens@gmail.com>
ntfs: add a runlist merge that leaves the source runlist to the caller
Matthias Goergens <matthias.goergens@gmail.com>
ntfs: do not use a stale runlist pointer when undoing $MFT extension
Matthias Goergens <matthias.goergens@gmail.com>
ntfs: hold the runlist lock while expanding a non-resident attribute
Matthias Goergens <matthias.goergens@gmail.com>
ntfs: fail the mount when $MFT's data size exceeds its allocation
Matthias Goergens <matthias.goergens@gmail.com>
ntfs: do not map a vcn as a hole when its runlist lookup failed
Matthias Goergens <matthias.goergens@gmail.com>
ntfs: fail the mount when $MFT needs its own extent records
Matthias Goergens <matthias.goergens@gmail.com>
ntfs: do not turn an unmappable runlist fragment into delalloc on write
Matthias Goergens <matthias.goergens@gmail.com>
ntfs: do not map an unmappable runlist fragment as a hole
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: validate attribute-list sizes before allocation
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: mount hibernated volumes read-only regardless of errors=
Karl Mehltretter <kmehltretter@gmail.com>
ntfs: include the final partial cluster in sync writes
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: fail remount on sync errors and keep the dirty bit on SB_FORCE
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: check the dirty-state commit on remount and unmount
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: do not clear the volume dirty bit during sync
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: persist the dirty state after the final put_super() commits
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: sync the volume dirty bit with the recorded error state
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: set the volume dirty bit unconditionally on metadata changes
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: fix volume flag update races
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: avoid truncate and writeback deadlock
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: use fatal_signal_pending() for fallocate interruption checks
Hongling Zeng <zenghongling@kylinos.cn>
ntfs: NULL vol->vol_ino in the load_system_files() error teardown
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: wait for attribute folio writeback before update
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: trigger page_mkwrite for native 4Kn size extension
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: use sync flag for direct MFT writes
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: write MFT records through containing I/O units
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: write MFT folios through mapped I/O units
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: track direct MFT writes until BIO completion
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: serialize raw MFT updates against folio writeback
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: write MFT mirror data in mapped I/O units
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: validate the MFT I/O geometry
Hyunchul Lee <hyc.lee@gmail.com>
ntfs: read MFT writeback bounds under size_lock
Chengfeng Ye <nicoyip.dev@gmail.com>
l2tp: snapshot sequencing state when building transmit headers
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ALSA: compress: reject restarting an ACTIVE task via origin_seqno
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ALSA: compress: add missing OPEN-state gate to SET_METADATA
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ALSA: compress: reject buffer geometry change on gapless next_track
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ALSA: compress: fix buffer leak on failed SET_PARAMS
Thomas Nemer <thomas.nemer@fortytwo.fr>
ALSA: usb-audio: Skip sample-rate read-back on PreSonus AudioBox USB
Sorah Fukumori <her@sorah.jp>
net: gro: don't chain linear parts larger than gso_size into frag_list
Jamal Hadi Salim <jhs@mojatatu.com>
netdevsim: reject cls_bpf programs bound to another device
Kir Kolyshkin <kolyshkin@gmail.com>
cgroup: fix cgroup.kill for exited thread group leader
Michal Blaszczyk <michalblk@google.com>
sched_ext: Reset runnable_at when a task leaves its scheduler
Alexander Kochetkov <al.kochet@gmail.com>
Revert "Input: matrix_keypad - force switch rows to input mode"
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: always accept EV_SYN in input_event()
Armin Wolf <W_Armin@gmx.de>
hwmon: (acpi_power_meter) Fix 18.45 TW bug
Baek Kyu, Kim <pocj8ur4in@gmail.com>
hwmon: (sht3x) Return the consumed count for heater writes
Baek Kyu, Kim <pocj8ur4in@gmail.com>
hwmon: (mcp9982) Update the interval cache only after successful writes
Igor Velkov <iav@iav.lv>
rtc: pcf8563: pass the driver data to the alarm interrupt handler
Ma Ke <make_ruc2021@163.com>
platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc()
Gregory Price <gourry@gourry.net>
rtc: cmos: Honor explicit use_acpi_alarm parameter value
Gregory Price <gourry@gourry.net>
rtc: cmos: Disable ACPI RTC event before handling it
Jianyun Gao <jianyungao89@gmail.com>
dax: fix wrong error code returned from dax_dedupe_file_range_compare()
Seongjae Jeong <jsjlee1020@gmail.com>
f2fs: fix submit accounting for IPU writeback
Wenjie Qi <qwjhust@gmail.com>
f2fs: flush SIT journal during filesystem resize
Vaibhav Nagare <vnagare@redhat.com>
bnxt_en: don't leave an XDP program installed when the open fails
Jiale Yao <yaojiale02@163.com>
hwmon: (gigabyte_waterforce) reject short input reports
Ximing Zhang <xzhangjr@gmail.com>
hwmon: (coretemp) Fix handling of isolated SMT siblings
Kyle Zeng <kylebot@openai.com>
netfilter: nf_reject: initialize IPCB at inet ingress
Thomas Nemer <thomas.nemer@fortytwo.fr>
ALSA: usb-audio: Fix missing sample-rate control for PreSonus AudioBox USB
George Christidis <gxristidis@gmail.com>
ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3402VA
Adrian Ambrozewicz <aambrozewicz@nvidia.com>
gpiolib: cdev: don't set GPIOD_FLAG_IS_OUT
Nickolai Zeldovich <nickolai@csail.mit.edu>
lib/buildid: reject file offsets that do not fit in pgoff_t
Sanan Hasanov <sanan.hasanov@ucf.edu>
hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe
Baek Kyu, Kim <pocj8ur4in@gmail.com>
hwmon: (sht4x) Reject incomplete heater command transfers
Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
hwmon: (coretemp) Return -ENODATA for invalid temperature readings
Tom Verdonck <tom.verdonck@inspiral.be>
hwmon: (sht4x) Fix jiffies wraparound in heater-ready check
Weibin Liu <liuwb@xiaopeng.com>
spi: ch341: handle transfers without a TX or RX buffer
Deep Shah <deepshah146@gmail.com>
RDMA/uverbs: Fix uobject leak in DMABUF release
Vasiliy Kovalev <kovalev@altlinux.org>
ALSA: hda/via: Apply runtime PM workaround for ASUS X55A
Magnus Lindholm <linmag7@gmail.com>
alpha: do not skip TLB shootdown IPIs for kthread-borrowed mms
Magnus Lindholm <linmag7@gmail.com>
alpha: do not clear remote MMU contexts in migrate_flush_tlb_page()
Magnus Lindholm <linmag7@gmail.com>
alpha: invalidate the local context in flush_icache_user_page()
Magnus Lindholm <linmag7@gmail.com>
alpha: invalidate the local context in flush_tlb_mm()
Magnus Lindholm <linmag7@gmail.com>
alpha: fix the local TLB invalidate in the UP flush_tlb_page()
Magnus Lindholm <linmag7@gmail.com>
alpha: fix the local TLB invalidate in flush_tlb_page()
Magnus Lindholm <linmag7@gmail.com>
alpha: invalidate the local context in flush_tlb_page()
Magnus Lindholm <linmag7@gmail.com>
alpha: only use a targeted tbi() when the target mm is really current
Magnus Lindholm <linmag7@gmail.com>
alpha: run check_mmu_context() from finish_arch_post_lock_switch()
Magnus Lindholm <linmag7@gmail.com>
alpha: load the MMU context when switch_mm() switches the current task
Matt Turner <mattst88@gmail.com>
alpha: handle VM_FAULT_HWPOISON in do_page_fault()
Andrea Righi <arighi@nvidia.com>
sched_ext: Don't queue balance callbacks from a core-sched pick
Brandon Williams <turbine.bmw@gmail.com>
power: supply: qcom_battmgr: Notify charger supplies of online changes
Tim Douglas <me@timdoug.com>
power: supply: generic-adc-battery: fix status with no supplier
Andrew Pam <andrew@fastmailteam.com>
power: supply: cros_charge-control: restore EC state on resume
Fabricio Akio <fabricioakio@gmail.com>
power: supply: qcom_smbx: set the charge enable after software control
Andrea Righi <arighi@nvidia.com>
sched_ext: Don't leave balance callbacks queued across a pick retry
Arnaldo Carvalho de Melo <acme@redhat.com>
perf python: Free the parse error entries when parsing fails
Fuad Tabba <fuad.tabba@linux.dev>
KVM: arm64: vgic-its: Don't map an LPI from more than one event
Luis Gerardo Lopez Hernandez <gamaerry@gmail.com>
ALSA: hda/realtek: Fix internal speakers on Acer Aspire AL16-31P
José Miguel Castellanos Valladolid <josstamy@gmail.com>
ALSA: hda/realtek: Enable mute LEDs on HP OmniBook X Flip 14-fm0xxx
Takashi Iwai <tiwai@suse.de>
ALSA: seq: oss: Skip events until fully initialized
Paolo Abeni <pabeni@redhat.com>
mptcp: fix subflow bitfield misuse
Quanye Yang <quanyeyang@proton.me>
mptcp: reset msk state on early connect failure
Kees Cook <kees@kernel.org>
ipc, msg: Account msg_msg allocations with GFP_KERNEL_ACCOUNT again
sonotri <sono7ri@gmail.com>
ublk: pin module while release work is pending
Chengfeng Ye <nicoyip.dev@gmail.com>
fuse: fix copy_file_range reply handling race
Art O Cathain <art.home@gmail.com>
ASoC: amd: acp-config: force SoundWire probe on Dell 14S DS14265
Sung Byeongchan <tjdqudcks0424@naver.com>
virtiofs: validate fixed-output response length
Fan Wu <fanwu01@zju.edu.cn>
virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree
Joanne Koong <joannelkoong@gmail.com>
fuse: don't launder folios of a bad inode
Huacai Chen <chenhuacai@kernel.org>
cpufreq: loongson3: Replace IOCSR read/write with MMIO ones
Huacai Chen <chenhuacai@kernel.org>
cpufreq: loongson3: Use global physical CPU ID in get/target callbacks
Huacai Chen <chenhuacai@kernel.org>
cpufreq: loongson3: Replace per-package mutex with per-node
Huacai Chen <chenhuacai@kernel.org>
cpufreq: loongson3: Adjust the width of id and val in smc_message
Huacai Chen <chenhuacai@kernel.org>
cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64
Rosen Penev <rosenp@gmail.com>
net: bgmac: enable interrupts only after NAPI is ready
Shubham Antil <shubham@octane.security>
RDS/IB: validate receive fragment completions
Seung Min Shin <guncraft2000@naver.com>
sctp: hold transport reference across connect wait
Zixuan Chai <petalzu987@gmail.com>
ipv6: defrag: orphan skb before queuing
Henry Martin <bsdhenrymartin@gmail.com>
rds: fix out-of-bounds conn_path walks via handshake exthdrs
Josef Bacik <josef@toxicpanda.com>
net: skbuff: don't BUG() on a bad csum_start in skb_copy_and_csum_dev()
Ming Lei <tom.leiming@gmail.com>
ublk: let STOP_DEV cancel the server's commands before its release
Ming Lei <tom.leiming@gmail.com>
ublk: reset the FETCH round under ub->mutex
Ming Lei <tom.leiming@gmail.com>
ublk: reset the FETCH round in release also without a disk
Ming Lei <tom.leiming@gmail.com>
ublk: mark the batch fetch command cancelable before linking it
Ming Lei <tom.leiming@gmail.com>
ublk: mark the io command cancelable before publishing it
Ming Lei <tom.leiming@gmail.com>
ublk: keep a canceled FETCH round canceling until the server is gone
Yun Zhou <yun.zhou@windriver.com>
net: erspan: set lltx to avoid sch_direct_xmit deadlock
Jianyun Gao <jianyungao89@gmail.com>
dax: fix dax_range_compare_iter() to use correct size and address offset
Jianyun Gao <jianyungao89@gmail.com>
dax: Return errors from dax_core_init()
David Carlier <devnexen@gmail.com>
ring-buffer: Take cpus_read_lock() when changing the subbuf order
Gyokhan Kochmarla <gyokhan@amazon.de>
erofs: use on-disk blkszbits for lz4 max pcluster bound
Weibin Liu <liuwb@xiaopeng.com>
spi: amd: fix len==0 underflow and FIFO overflow
Keng-Yu Lin <keng-yu.lin@hpe.com>
PCI/PM: Restore BARs after powering up during enumeration
Weibin Liu <liuwb@xiaopeng.com>
spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op
Jason Gunthorpe <jgg@ziepe.ca>
iommupt: Do not allow PTEs to be split when dirty logging
Vladyslav Tymoshchuk <tvlad744@gmail.com>
ASoC: qcom: q6asm-dai: wrap the position of a full ring to 0
Vladyslav Tymoshchuk <tvlad744@gmail.com>
ASoC: qcom: q6apm: reset the hw pointer with the fragment queue
Vladyslav Tymoshchuk <tvlad744@gmail.com>
ASoC: qcom: q6apm-dai: wrap the position of a full ring to 0
Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
mfd: tps65217: Use devres for IRQ domain and wake teardown
Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
mfd: tps65217: Check return value when masking interrupt sources
Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
mfd: tps65217: Fix NULL pointer dereference on IRQ init failure
Guixin Liu <kanie@linux.alibaba.com>
cxl/events: Test CME counter expiry with equality, not bitwise AND
Alexey Charkov <alchark@flipper.net>
mfd: bq257xx: Mark self-modifying BQ25792 registers volatile
Weibin Liu <liuwb@xiaopeng.com>
spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer
Marc Zyngier <maz@kernel.org>
KVM: arm64: Turn vcpu->arch.pause into a counter
Marc Zyngier <maz@kernel.org>
KVM: arm64: Move IN_GUEST_MODE ahead of state being loaded
Marc Zyngier <maz@kernel.org>
KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved
Marc Zyngier <maz@kernel.org>
KVM: arm64: nv: Move L2->L1 switch on interrupt early
Ard Biesheuvel <ardb@kernel.org>
efi/libstub: Don't replace an existing LINUX_EFI_MEMRESERVE table
Ard Biesheuvel <ardb@kernel.org>
efi/libstub: arm64: Don't use the platform register x18
Weibin Liu <liuwb@xiaopeng.com>
spi: jcore: fix divide-by-zero when speed_hz is zero
Tal Zussman <tz2294@columbia.edu>
gfs2: fix the escaped block copy in gfs2_before_commit()
Takashi Iwai <tiwai@suse.de>
ALSA: ump: Correct return size of fill_rpn()
Au Dang <au.dang.jx@renesas.com>
irqchip/renesas-rzv2h: Preserve TIEN state in rzv2h_tint_set_type()
Karl Mehltretter <kmehltretter@gmail.com>
irqchip/jcore-aic: Fix lost IPIs on SMP
Karl Mehltretter <kmehltretter@gmail.com>
irqchip/atmel-aic[5]: Disable interrupts in the irq_pm_shutdown() callbacks
Wentao Liang <vulab@iscas.ac.cn>
irqchip/mchp-eic: Fix clock reference leak in mchp_eic_probe()
Guangshuo Li <lgs201920130244@gmail.com>
irqchip/imx-intmux: Fix runtime PM teardown on remove
Fuad Tabba <fuad.tabba@linux.dev>
irqchip/gic-v3-its: Don't clamp nvecs to zero when id_bits is 32
Ahsan Atta <ahsan.atta@intel.com>
crypto: qat - fix use of destroyed vf2pf_lock on VF restart
Ahsan Atta <ahsan.atta@intel.com>
crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev()
Zhang Heng <zhangheng@kylinos.cn>
ALSA: hda/realtek: Fix quirk for HP Laptop 15-fc0xxx
Andrea Parri <parri.andrea@gmail.com>
iommufd: Reject a zero-length dirty bitmap request
Andrea Parri <parri.andrea@gmail.com>
iommufd: Keep dmabuf PFNs MMIO when filling another domain
Nathan Chancellor <nathan@kernel.org>
kbuild: AutoFDO: Update split machine function argument for upstream rename
Wentao Liang <vulab@iscas.ac.cn>
PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain()
Hui Su <sh_def@163.com>
cpufreq: schedutil: Serialize sugov_start() against rate limit updates
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: Use default TxWindow for zero socket option
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: Reject mode changes on connected channels
Bui Viet Dung <dungvn2345@gmail.com>
Bluetooth: selftest: Pin module for selftest debugfs file operations
Bui Viet Dung <dungvn2345@gmail.com>
Bluetooth: hci_debugfs: Pin module for debugfs file operations
Bui Viet Dung <dungvn2345@gmail.com>
Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file
Nikolaj Klitlund Børty <nbn@sj.dk>
Bluetooth: btusb: Add device ID for Realtek RTL8761BUE (StarTech AV53C1)
Francesco Orlando <francesco.orlando99@libero.it>
Input: xpad - add GameSir Nova Lite support
Stian Halseth <stian@itx.no>
PCI: Set supported_speeds in set_pcie_port_type()
Karl Mehltretter <kmehltretter@gmail.com>
ARM: 9523/1: topology: allocate the cacheinfo early on the boot CPU
Karl Mehltretter <kmehltretter@gmail.com>
ARM: 9522/1: cacheinfo: guard the CLIDR read in populate_cache_leaves()
Karl Mehltretter <kmehltretter@gmail.com>
ARM: 9521/1: cacheinfo: count external caches in early_cache_level()
Karl Mehltretter <kmehltretter@gmail.com>
ARM: 9520/1: cacheinfo: avoid out-of-bounds write in populate_cache_leaves()
Karl Mehltretter <kmehltretter@gmail.com>
ARM: 9491/1: alignment: restore uaccess state on emulation fault
Karl Mehltretter <kmehltretter@gmail.com>
ARM: 9488/1: smp: set current pointer in assembly before jumping into C
Weibin Liu <liuwb@xiaopeng.com>
spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path
Weibin Liu <liuwb@xiaopeng.com>
spi: cadence-xspi: reject SDMA transfers larger than the requested length
Guangshuo Li <lgs201920130244@gmail.com>
mfd: ab8500: Fix child device leaks on probe failure
Martin Belanger <martin.nvme.dev@gmail.com>
nvme: make the DH-HMAC-CHAP secret attributes readable by root only
Matt Fleming <mfleming@cloudflare.com>
iommu/amd: Don't allocate kdump device table from DMA32
Matt Fleming <mfleming@cloudflare.com>
iommu/amd: Program device table when kdump reuse fails
Tim Douglas <me@timdoug.com>
serial: pmac_zilog: push received data to the port that received it
Nicolai Buchwitz <nb@tipi-net.de>
serial: amba-pl011: keep transmitter enabled when disabling RS485
Nicolai Buchwitz <nb@tipi-net.de>
serial: amba-pl011: honour delay_rts_before_send for every write
Ferry Toth <ftoth@exalondelft.nl>
Revert "serial: 8250_port: Drop duplicate NULL check"
Jiri Slaby (SUSE) <jirislaby@kernel.org>
serial: 8250_omap: set priv->line before enabling the IRQ
Jiri Slaby (SUSE) <jirislaby@kernel.org>
serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit()
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: NUL-terminate the SPM auth token
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: allow clearing current_password
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: return -E2BIG from validate_password_input()
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: fix non-ASCII truncation in hp_get_string_from_buffer()
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer()
Denis Arefev <arefev@swemel.ru>
ALSA: cs46xx: fix unit mismatch in DSP code area bounds check
Aaron Erhardt <aer@tuxedocomputers.com>
platform/x86/tuxedo: Fix keyboard LED map ordering
Rudi Heitbaum <rudi@heitbaum.com>
PCI: imx6: Avoid dereferencing a NULL clock name
Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
ALSA: hda/realtek: keep headset mic on Acer SSID 0x1640
Gergo Koteles <soyer@irl.hu>
ALSA: hda/tas2781: Skip invalid TAS2563 UEFI calibration data
Gergo Koteles <soyer@irl.hu>
ALSA: hda/tas2781: Assign total_sz at the end of the function
Kazuki Hanai <hnkz.64@gmail.com>
tmpfs: fix unicode_map leaks in casefold option handling
Giorgi Kobakhia <gkobakhi@asu.edu>
ocfs2: fix array out of bound access in __ocfs2_find_path()
Su Yue <glass.su@suse.com>
ocfs2: update xattr count before moving bucket entries
Aamir Ahmed <elb12345@hotmail.co.uk>
lib: decompress_bunzip2: fix integer overflow in run-length decoding
Bradley Morgan <brads@mainlining.org>
panic: kill the "buffer unavailable" redirect fallback
Bradley Morgan <brads@mainlining.org>
panic: allow force_cpu redirect from an NMI
Bradley Morgan <brads@mainlining.org>
panic: restore variable arguments to nmi_panic()
Bradley Morgan <brads@mainlining.org>
panic: fix va_list reuse in panic_try_force_cpu()
Bradley Morgan <brads@mainlining.org>
panic: flatten nmi_panic control flow
Bradley Morgan <brads@mainlining.org>
panic: fix redirect CPU race in panic_try_force_cpu()
Matt Turner <mattst88@gmail.com>
lib/decompress_bunzip2: fix off-by-one in run-length bounds check
Ma Ke <make_ruc2021@163.com>
pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank()
Weibin Liu <liuwb@xiaopeng.com>
spi: ljca: validate the response length before copying the data
Chao Yu <chao@kernel.org>
f2fs: fix to use bio_in_atomic() in f2fs_read_end_io()
Daeho Jeong <daehojeong@google.com>
f2fs: disallow mmap write and data-modifying fallocate on atomic files
Zhan Xusheng <zhanxusheng1024@gmail.com>
f2fs: fix defragment writeback range truncation on 32-bit
Hengyu Liang <hengyul@cs.unc.edu>
f2fs: allow empty strings for journaled quota options
Kaixuan Li <kaixuanli0131@gmail.com>
f2fs: check every cur_*_segno[] entry on readonly images
Nanzhe Zhao <zhaonanzhe@xiaomi.com>
f2fs: read i_size once in f2fs_vm_page_mkwrite
Joanne Chang <joannechien@google.com>
f2fs: allow pinning empty compressed files
Nanzhe Zhao <zhaonanzhe@xiaomi.com>
f2fs: remove mappedtodisk flag usage in mmap write path
Myeonghun Pak <mhun512@gmail.com>
accel/qaic: Cancel Sahara read data work on removal
Karl Mehltretter <kmehltretter@gmail.com>
sh: intc: Sort the prio and sense lists after filling them
Geraldo Nascimento <geraldogabriel@gmail.com>
PCI: rockchip: Drive at 2.5 GT/s, error other speeds
Geraldo Nascimento <geraldogabriel@gmail.com>
PCI: rockchip-host: Do not attempt 5.0 GT/s retraining
Geraldo Nascimento <geraldogabriel@gmail.com>
PCI: rockchip-ep: Do not attempt 5.0 GT/s retraining
Daeho Jeong <daehojeong@google.com>
f2fs: convert inline quota files when turning quota on
Andrea Parri <parri.andrea@gmail.com>
nvmet: zns: don't leak stale memory in zone management receive
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme: bound FDP config log reads to the received buffer
Sung Byeongchan <tjdqudcks0424@naver.com>
nvmet: require authentication before property set
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
nvmet: free the bvec on file namespace range errors
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme-auth: fail when the controller does not authenticate itself
Daejun Park <daejun7.park@samsung.com>
nvmet: fix preempt of another registrant by the reservation holder
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme-rdma: don't complete a request after a bogus remote invalidation
Andrea Parri <parri.andrea@gmail.com>
iomap: don't lose a failed direct I/O bio's error when zeroing the tail
Andrea Parri <parri.andrea@gmail.com>
iomap: don't lose a fiemap iteration error when emitting the last extent
Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
clk: qcom: ipq5210: add 24MHz rate for USB UTMI clock
Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
clk: qcom: ipq5332: add 24MHz rate for USB UTMI clock
Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
clk: qcom: ipq5018: add 24MHz rate for USB UTMI clock
Aamir Ahmed <elb12345@hotmail.co.uk>
clk: qcom: ipq-cmn-pll: Assign .num before accessing .hws
Samuel Thibault <samuel.thibault@ens-lyon.org>
speakup: Fix NULL pointer dereference on VT switch + selection
Wentao Guan <guanwentao@uniontech.com>
mei: vsc: Fix packet CRC computed over pointer size
Joshua Mulloy <joshuamulloy@gmail.com>
misc: tifm: don't clear dev->driver in tifm_device_remove()
Peter Robinson <pbrobinson@gmail.com>
misc: issei: Fix issei architecture deps
Mikulas Patocka <mpatocka@redhat.com>
dm-bufio: fix a race leading to an unsigned integer underflow
Mikulas Patocka <mpatocka@redhat.com>
dm-bufio: fix non-working memory limit
Jiri Slaby (SUSE) <jirislaby@kernel.org>
serial: 8250_exar: store the GPIO platform device in struct exar8250
Hugo Villeneuve <hvilleneuve@dimonoff.com>
serial: sc16is7xx: declare MCR and IER as volatile registers
Martin Fuzzey <martin.fuzzey@flowbird.group>
serial: sc16is7xx: fix data corruption due to unexpected xon/xoff
Sasha Levin <sashal@kernel.org>
tools/dma: fix building from the top level with O=
Ard Biesheuvel <ardb@kernel.org>
arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults
Myeonghun Pak <mhun512@gmail.com>
fbdev: nvidia: Release write-combining handle on probe failure
Myeonghun Pak <mhun512@gmail.com>
fbdev: kyro: Release WC setup on registration failure
Lorenzo Stoakes (ARM) <ljs@kernel.org>
fbdev: sh_mobile_lcdc: check for fb_deferred_io_init() error
Lorenzo Stoakes (ARM) <ljs@kernel.org>
fbdev: smscufx: check for fb_deferred_io_init() error
Lorenzo Stoakes (ARM) <ljs@kernel.org>
fbdev: udlfb: check for fb_deferred_io_init() error
Lorenzo Stoakes (ARM) <ljs@kernel.org>
fbdev: xen-fbfront: check for fb_deferred_io_init() error
Lorenzo Stoakes (ARM) <ljs@kernel.org>
fbdev: ssd1307fb: check for fb_deferred_io_init() error
Andrey Misiurov <andrey.misyrov@gmail.com>
fbdev: core: Initialize modelist in framebuffer_alloc()
Karl Mehltretter <kmehltretter@gmail.com>
fbdev: sh_mobile_lcdcfb: Restore the per-overlay sysfs attributes
David E. Box <david.e.box@linux.intel.com>
platform/x86/intel/vsec: Fix inverted walk_header() test in get_features()
Guixiong Wei <weiguixiong@bytedance.com>
platform/x86/intel-uncore-freq: Continue restoring limits on resume
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd: hfi: Fix out-of-bounds reads when parsing ranking data
Guangshuo Li <lgs201920130244@gmail.com>
platform/x86: simatic-ipc: fix platform device leak on registration failure
Antheas Kapenekakis <lkml@antheas.dev>
platform/x86: oxpec: Fix Apex charge limit control
Marco Scardovi <scardracs@disroot.org>
platform/x86: asus-wmi: Serialize WMI method evaluations with a mutex
Jack Boykin <jtboykin.jb@gmail.com>
platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop()
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token
Denis Benato <denis.benato@linux.dev>
platform/x86: asus-wmi: fix screenpad power state detection
Denis Benato <denis.benato@linux.dev>
platform/x86: asus-wmi: fix unclear usage of bd->props.power
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd: Stop counting intermediate cycles with metrics table
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd/pmf: Validate the APTS state index
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd/pmf: Add AMDI0112 ACPI ID
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
mm/damon/core: charge only the part of a region the filter left
David Carlier <devnexen@gmail.com>
mm/shmem: don't release a swapin-error marker as a swap entry
Hao Ge <hao.ge@linux.dev>
mm/alloc_tag: account for reserved tag ids in the kernel tag check
Breno Leitao <leitao@debian.org>
mm/shmem: report RCU-tasks quiescent states while undoing a range
Hongfu Li <lihongfu@kylinos.cn>
mm/hugetlb_cgroup: move per-node usage on cgroup reparenting
Hongfu Li <lihongfu@kylinos.cn>
mm/hugetlb_cgroup: move per-node usage on cross node migration
Yuanhe Shu <xiangzao@linux.alibaba.com>
mm/page_alloc: do not boost watermarks in kdump capture kernels
Gregory Price <gourry@gourry.net>
mm/madvise: use folio_trylock() in the cold/pageout PMD split
Gregory Price <gourry@gourry.net>
mm/madvise: reclaim isolated folios if PTE restart fails
Gregory Price <gourry@gourry.net>
proc/task_mmu: handle special PMDs in clear_refs and pagemap
SJ Park <sj@kernel.org>
mm/damon/core-kunit: test invalid damos filter commits
SJ Park <sj@kernel.org>
mm/damon/core-kunit: extend damos_commit_filter_for() for wrong input
SJ Park <sj@kernel.org>
mm/damon/core: return an error from damos_commit_filter_arg()
SJ Park <sj@kernel.org>
mm/damon/sysfs-schemes: read sysfs_filter->addr_range only once
Vladimir Nedoshivin <gvozd188@mail.ru>
PCI: vmd: Flush DMA writes before handling MSI on Arrow Lake
Rickey Bartlett <subtexel@gmail.com>
PCI: vmd: Flush DMA writes before handling MSI on Meteor Lake
Imre Kaloz <kaloz@kernel.org>
PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream ports
Yongjian Mu <ymu@everpuredata.com>
xprtrdma: trim head iovec when the payload arrives via a Write chunk
Tim Menninger <tmenninger@everpuredata.com>
xprtrdma: prevent disconnect feedback during endpoint teardown
Weigang He <geoffreyhe2@gmail.com>
mtd: parsers: qcom: fix offset/size overflow on large partitions
Gabor Juhos <j4g8y7@gmail.com>
mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read()
Hengyu Liang <hengyul@cs.unc.edu>
btrfs: return -ENOTTY for unknown ioctls on the control device
Wentao Liang <vulab@iscas.ac.cn>
btrfs: zoned: fix block group reference leak in btrfs_repair_one_zone()
Ard Biesheuvel <ardb@kernel.org>
arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO
Breno Leitao <leitao@debian.org>
ACPI: APEI: accumulate the queued flag across error sections
Ma Ke <make_ruc2021@163.com>
ALSA: hda: cs35l41: Fix ACPI device reference leak on probe failure
Mikulas Patocka <mpatocka@redhat.com>
dm-snapshot: fix crash if dm_io_client_create fails
Bjoern Doebel <doebel@amazon.de>
selftests/filesystems: Fix idmapped_tmpfile layer dir ownership
Johan Hovold <johan@kernel.org>
USB: serial: sierra: fix urb leak on write completion
Christopher Lusk <clusk@northecho.dev>
m68k: Fix seccomp filtering on ColdFire and 68000
Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
mailbox: qcom-ipcc: Guard against NULL con_priv in send_data()
Wentao Liang <vulab@iscas.ac.cn>
mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush()
Florian Fainelli <florian.fainelli@broadcom.com>
mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM
Runyu Xiao <runyu.xiao@seu.edu.cn>
mailbox: altera: shut down RX polling timer on channel teardown
Wayne Chang <waynec@nvidia.com>
usb: typec: ucsi_ccg: Add retry mechanism in ccg_read
Stephen Horvath <linux@stevetech.au>
usb: xhci-pci: Add AMD 600 series to xhci-pci-prom21
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: Prevent invalid vdev dereference during sideband unregister
Michal Pecio <michal.pecio@gmail.com>
usb: xhci: Fix bounce buffer overflow
Seungjin Bae <eeodqql09@gmail.com>
usb: typec: ucsi: ccg: Validate altmode index in GET_CURRENT_CAM response
Gris Ge <cnfourt@gmail.com>
usb: typec: ucsi: Skip CAM query when partner has no alt modes
Ali Resool Tuama <aliresool567@gmail.com>
USB: quirks: add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for GameSir G7 SE
Drobyshev Vladimir <enigma_137@icloud.com>
USB: cdc-acm: add VeriFone VX820 device ID
Orgad Shaneh <orgads@gmail.com>
usb: octeon-hcd: keep SOF interrupts while a pipe needs them
Orgad Shaneh <orgads@gmail.com>
usb: octeon-hcd: release the USB block when initialization fails
Danilo Krummrich <dakr@kernel.org>
usb: core: don't set drvdata to NULL in usb_unbind_interface()
Adam Harshbarger <handyhandyman.adam@gmail.com>
lib/plist: fix plist_requeue() corrupting order in the last bucket
Vincent Donnefort <vdonnefort@google.com>
KVM: arm64: Prevent 64-bit overflow when computing hyp clock rate
Evgeny Akhtimirov <evgeny@devduty.com>
ALSA: hda/realtek: Enable all four speaker amps on Lenovo ThinkBook X G2 IAH
Koichiro Den <den@valinux.co.jp>
cxl/acpi: Convert QTG _DSM latencies to picoseconds
Koichiro Den <den@valinux.co.jp>
cxl: Account for link width in latency calculation
Koichiro Den <den@valinux.co.jp>
cxl/port: Convert PCIe link latency to nanoseconds
Guixin Liu <kanie@linux.alibaba.com>
cxl/pci: Program the Port GPF timeouts before caching the DVSEC
Guixin Liu <kanie@linux.alibaba.com>
cxl/pci: Use the Device GPF DVSEC for restricted endpoints
Dave Jiang <dave.jiang@intel.com>
cxl/port: Clear cached dport pointers when a dport is removed
Seongjun Hong <hsj0512@snu.ac.kr>
vfio/mlx5: Fix boundary check in set_report_output()
Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
RISC-V: KVM: Fix IPI delivery for out-of-order vcpu_id
Ross Lagerwall <ross.lagerwall@citrix.com>
xen-blkfront: Fix IO race during unplug
Zongmin Zhou <zhouzongmin@kylinos.cn>
slimbus: messaging: fix leaked PM vote on tid allocation failure
Alexey Charkov <alchark@flipper.net>
nvmem: rockchip-otp: Serialize reads
Jianping Li <jianping.li@oss.qualcomm.com>
misc: fastrpc: Allocate entire reserved memory for Audio PD in probe
Yifei Gao <gyf161023@gmail.com>
misc: fastrpc: fix double-free in fastrpc_map_attach() error path
Johan Hovold <johan@kernel.org>
USB: serial: usb_wwan: fix urb leak on disconnect
Michael Wyraz <michael@wyraz.de>
USB: serial: option: add support for ASR 1286:4e3c modem
Reinhard Speyerer <rspmn@arcor.de>
USB: serial: option: add Rolling Wireless RN947R
Johan Hovold <johan@kernel.org>
USB: cdc-acm: fix urb leak on disconnect
Jiale Yao <yaojiale02@163.com>
wifi: ath12k: validate MAC/PHY capability count before saving
Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
ALSA: usb-audio: Add mic resolution quirk for Logitech Webcam C200
Jesse Zhang <Jesse.Zhang@amd.com>
drm/ttm: return an error when kmapping a BO without pages
Krzysztof Karas <krzysztof.karas@intel.com>
iommu/dma: Catch scatterlist length overflows
Wentao Liang <vulab@iscas.ac.cn>
xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf()
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
xen/pcifront: check that an AER callback exists before calling it
Wentao Liang <vulab@iscas.ac.cn>
xen/gntdev: Fix gntdev_dmabuf ref leak in dmabuf_exp_wait_released()
Koichiro Den <den@valinux.co.jp>
xen/privcmd: Only claim ioreqs matching an ioeventfd
Myeonghun Pak <mhun512@gmail.com>
soc: fsl: dpio: Free the IRQ before releasing the I/O object
Myeonghun Pak <mhun512@gmail.com>
soc: fsl: dpio: Fix cleanup on IRQ registration failure
Wentao Liang <vulab@iscas.ac.cn>
soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()
Abdifatah Suruur <suruurism@gmail.com>
xen/gntdev: prevent private mappings from becoming writable
Wentao Liang <vulab@iscas.ac.cn>
clk: imx: Fix clock reference leak in imx_obtain_fixed_clock_hw()
Wentao Liang <vulab@iscas.ac.cn>
clk: imx: Fix clock reference leak in imx_get_clk_hw_by_name()
Gregory Price <gourry@gourry.net>
mm/madvise: use vm_normal_folio_pmd() in cold/pageout PMD range
Gregory Price <gourry@gourry.net>
mm/mempolicy: use vm_normal_folio_pmd() in queue_folios_pmd()
Longlong Xia <xialonglong@kylinos.cn>
mm/zswap: enable zswap_ever_enabled in zswap_pool_create()
Ridong Chen <chenridong@xiaomi.com>
mm/mglru: fix ineffective memory protection for non-kswapd reclaim
Ridong Chen <chenridong@xiaomi.com>
mm/page_counter: avoid integer overflow in effective_protection()
Bingfang Guo <bingfangguo@tencent.com>
mm/memcg: clear folio memcg after changing per memcg stats
Longlong Xia <xialonglong@kylinos.cn>
mm/zswap: publish the initial pool with list_add_rcu()
Jinmeng Zhou <jinmengzhou22@gmail.com>
mm/hugetlb: fix subpool minimum reservation rollback
Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
mm/nommu: reject wrapping ranges in access_remote_vm()
Mike Rapoport (Microsoft) <rppt@kernel.org>
mm/execmem: free ROX cache chunks only when they span an entire vm area
Hui Zhu <zhuhui@kylinos.cn>
mm: memcg: reparent non-hierarchical lruvec stats on cgroup v2
Hui Zhu <zhuhui@kylinos.cn>
mm: memcg: skip the RCU lock when the memcg is not dying
Hui Zhu <zhuhui@kylinos.cn>
mm: workingset: use lruvec_page_state_local() to count lru pages
Hui Zhu <zhuhui@kylinos.cn>
mm: memcg: redirect stats updates of dying memcgs for all hierarchies
Luxiao Xu <rakukuip@gmail.com>
mm/memory: constrain generic_access_phys() to page boundary
Jinmeng Zhou <jinmengzhou22@gmail.com>
mm/hugetlb: charge folios to the target mm's memcg
Yogesh Gaur <yogeshgaur.83@gmail.com>
md: don't hand out the array before md_alloc() has added mddev->kobj
Samuel Holland <samuel.holland@sifive.com>
riscv: cfi: Only write envcfg CSR when task is current
Samuel Holland <samuel.holland@sifive.com>
riscv: cfi: Bounds check restore token before swap
Jake Labelle <southampton.jake.labelle@gmail.com>
nilfs2: validate directory position after llseek in readdir
Jinjie Ruan <ruanjinjie@huawei.com>
ext4: fix out-of-bounds read in ext4_get_group_info()
Sergey Senozhatsky <senozhatsky@chromium.org>
ext4: fix ABBA deadlock in ext4_rmdir()
Daejun Park <daejun7.park@samsung.com>
ext4: don't report delalloc data as a hole on indirect-mapped inodes
Hemanth Selam <hemanth.selam@gmail.com>
ext4: skip extra isize expansion while unmounting
Daejun Park <daejun7.park@samsung.com>
jbd2: don't advance j_fc_off before the buffer is recorded
guzebing <guzebing1612@gmail.com>
ext4: reject delalloc to nodelalloc before applying remount options
Hsiu-Hsien Lee <swinds24@gmail.com>
ext4: fix fast commit replay failing on a read-only mount
guzebing <guzebing1612@gmail.com>
ext4: only update tune mount options when requested
Matthias Goergens <matthias.goergens@gmail.com>
fanotify: report names longer than NAME_MAX
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ALSA: hda/hdmi: clamp sad_count in ELD proc write handler
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ALSA: hda/hdmi: clamp num_cvts against cvt_nids[] in hdmi_read_pin_conn
Daehyeon Ko <4ncienth@gmail.com>
crypto: algif_skcipher - rewind rounded output bytes
Matej Sochan <matej.sochan@gmail.com>
ALSA: hda/realtek: Fix silent speakers on Lenovo Legion S7 15IMH05
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: rtw89: usb: shorten the RX aggregation hold on RTL8922AU over USB 3
Tristan Madani <tristan@talencesecurity.com>
wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/sysfs: Pass the device name length in UTF-16 code units
Josef Bacik <josef@toxicpanda.com>
aoe: pull in the headers each received packet type reads
Pin-Hao Chen <billy920225@gmail.com>
spi: stm32: fix double free of SRAM buffer on MDMA fallback
Wentao Liang <vulab@iscas.ac.cn>
clocksource/drivers/digicolor: Fix clk reference leak on request_irq failure
Wentao Liang <vulab@iscas.ac.cn>
clocksource/drivers/fttmr010: Fix clk reference leak in error paths
Linlin Yang <yanglinlin@kylinos.cn>
wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2()
Yi Cong <yicong@kylinos.cn>
wifi: mt76: mt792x: fix negative errno truncation in offload capability
Wentao Liang <vulab@iscas.ac.cn>
wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits()
Jiale Yao <yaojiale02@163.com>
wifi: mt76: mt7615: cancel reset work during unregister
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mt76: move the channel survey when the channel changes
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mt76: take rcu_read_lock in the USB/SDIO tx completion path
Myeonghun Pak <mhun512@gmail.com>
wifi: mt76: mt7615: restore DBDC state after ext PHY failure
Eason Lai <eason.lai@mediatek.com>
wifi: mt76: fix memory leak in USB TX path
Eason Lai <eason.lai@mediatek.com>
wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory
Mark Anthony Agarro <markanthonyagarro@gmail.com>
wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs
Mark Anthony Agarro <markanthonyagarro@gmail.com>
wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff
Fuad Tabba <fuad.tabba@linux.dev>
KVM: arm64: timers: Compute an offset-applied CVAL from the current count
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: skip uninitialized lockres in ocfs2_mark_lockres_freeing()
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to system inodes
Karl Mehltretter <kmehltretter@gmail.com>
fork: honor task_struct's declared alignment
Eric Biggers <ebiggers@kernel.org>
raid6: add missing vzeroupper to AVX-512 code
Eric Biggers <ebiggers@kernel.org>
raid6: add missing vzeroupper to AVX2 code
Eric Biggers <ebiggers@kernel.org>
xor: add missing vzeroupper to AVX code
Konstantin Khorenko <khorenko@virtuozzo.com>
selftests/core: fix unshare_test with large fs.nr_open
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: free replay slots in ocfs2_recovery_exit()
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: exit recovery thread on mount error path
Thorsten Blum <blum@kernel.org>
init: fix early boot crash with bare hostname parameter
Zi Yan <ziy@nvidia.com>
USB: gadgetfs: do not WARN about excessively large memory allocations
Michael Liang <mliang@purestorage.com>
fault-inject: fix dentry leak
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
fat: fix fat_ent_write() for reverting the value
DAI RENJIE <drj19981414013@gmail.com>
resource: fix lost wakeup when waiting for a muxed region
Ackerley Tng <ackerleytng@google.com>
mm: hugetlb: drop refcount before freeing on memcg charge failure
Ackerley Tng <ackerleytng@google.com>
mm: hugetlb: return -ENOSPC on memcg charge failure
SJ Park <sj@kernel.org>
mm/damon/sysfs: set next refresh jiffies per sysfs context
SJ Park <sj@kernel.org>
mm/damon/core: copy nid for eligible_mem_bp damos quota goal commit
Karl Mehltretter <kmehltretter@gmail.com>
mm/damon/core: keep the temporal tuner quota over an unmeasured PSI round
SJ Park <sj@kernel.org>
mm/damon/core: handle uninitialized damos_quota_goal->last_psi_total
SJ Park <sj@kernel.org>
mm/damon/tests/core-kunit: test committing psi goal to psi goal
Qinyun Tan <qinyuntan@linux.alibaba.com>
mm/list_lru: don't copy stale shrinker id from non-memcg-aware shrinkers
SJ Park <sj@kernel.org>
mm/damon/core: handle extreme memory state in get_in_active_mem_bp()
SJ Park <sj@kernel.org>
mm/damon/core: handle extreme memory state in get_node_memcg_used_bp()
SJ Park <sj@kernel.org>
mm/damon/core: handle extreme memory state in damon_get_node_mem_bp()
SJ Park <sj@kernel.org>
mm/damon/vaddr: respect folio end for DAMOS_MIGRATE_{HOT,COLD}
SJ Park <sj@kernel.org>
mm/damon/vaddr: respect folio end for DAMOS_STAT
SJ Park <sj@kernel.org>
mm/damon/paddr: respect folio end for DAMOS actions except STAT
SJ Park <sj@kernel.org>
mm/damon/paddr: respect folio end for DAMOS_STAT
SJ Park <sj@kernel.org>
mm/damon/core: skip applying scheme if region split for quota fails
Zhiling Zou <roxy520tt@gmail.com>
mm/page_table_check: skip zero pages
Kiryl Shutsemau (Meta) <kas@kernel.org>
mm/huge_memory: do not touch frozen folios in deferred_split_isolate()
Joe Damato <joe@dama.to>
mm: memcontrol: raise MEMCG_MAX for charges that fail without reclaiming
Gregory Price <gourry@gourry.net>
mm/mempolicy: skip zone device folios when queueing folios
Gregory Price <gourry@gourry.net>
mm/madvise: skip zone device folios in cold/pageout PMD range
Gregory Price <gourry@gourry.net>
mm/huge_memory: skip zone device folios in madvise_free_huge_pmd()
Gregory Price <gourry@gourry.net>
mm/mempolicy: take a cpuset cookie for the interleave node count
Rik van Riel <riel@surriel.com>
mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus
Hao Jia <jiahao1@lixiang.com>
zram: fix idle age_sec underflow in idle_store()
Qi Xi <xiqi2@huawei.com>
mm/page_isolation: guard compound_order() against racing
Qi Xi <xiqi2@huawei.com>
mm/page_isolation: fix UBSAN shift-out-of-bounds warning
Jiayuan Chen <jiayuan.chen@linux.dev>
mm/memcontrol: fix data-race on reading jiffies_64
Chengfeng Ye <nicoyip.dev@gmail.com>
mm/ksm: mark migration stores with WRITE_ONCE()
Nathan Chancellor <nathan@kernel.org>
wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz
Darrick J. Wong <djwong@kernel.org>
xfs: cross-reference the primary superblock
Priyank Rathod <rathodpriyank@google.com>
PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
PCI/DOE: Fix double free of a duplicate feature's sysfs name
Eric Dumazet <edumazet@kernel.org>
dlm: fix send buffer backpressure handling
Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
dmaengine: sh: rz-dmac: Fix off-by-one in residue lmdesc lookup
Denis Efremov (Oracle) <efremov@linux.com>
floppy: return the drive state flags from the 32-bit FDGETDRVSTAT
Denis Efremov (Oracle) <efremov@linux.com>
floppy: don't store a stack buffer in timeout_message
Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
dmaengine: loongson2-apb-cmc: fix descriptor leak in prep_slave_sg()
Myeonghun Pak <mhun512@gmail.com>
ASoC: codecs: rt5682s: disable jack detection work on shutdown
Myeonghun Pak <mhun512@gmail.com>
ASoC: stm: stm32_i2s: request IRQ after regmap initialization
Darrick J. Wong <djwong@kernel.org>
xfarray: don't crash when sorting if array element crosses a folio
Chuck Lever <cel@kernel.org>
svcrdma: Grant credits from the clamped sc_max_requests
Runyu Xiao <runyu.xiao@seu.edu.cn>
perf: xgene: initialize lock before requesting IRQ
Karl Mehltretter <kmehltretter@gmail.com>
spi: atmel-quadspi: balance runtime PM and pclk across system sleep
Linus Walleij <linusw@kernel.org>
power: supply: ab8500_fg: Report sub-percent charge changes
Linus Walleij <linusw@kernel.org>
power: supply: ab8500_fg: Accept status from supplied power
Henrik Enquist <henrik.enquist@gmail.com>
ALSA: aloop: Don't constrain playback params in notify mode
Andrey Albershteyn <aalbersh@kernel.org>
fsverity: hoist statx reporting of fs-verity flag
Wentao Liang <vulab@iscas.ac.cn>
power: supply: ltc2941: Fix of_node reference leak in ltc294x_i2c_probe()
Maurizio Casciano <mauriziocasciano7@gmail.com>
power: supply: core: Honor supplied-from with CONFIG_OF=y
Tharit Tangkijwanichakul <tharitt97@gmail.com>
media: hantro: disable runtime PM before hardware teardown
Jiawen Liu <1298662399@qq.com>
media: amphion: fix runtime PM imbalance on probe failure
Tharit Tangkijwanichakul <tharitt97@gmail.com>
media: hantro: release runtime resources when device_run fails
Tharit Tangkijwanichakul <tharitt97@gmail.com>
media: hantro: Harden MPEG-2 control access against NULL
Junrui Luo <moonafterrain@outlook.com>
media: vicodec: fix NULL deref on oversized frame
Pengpeng Hou <pengpeng@iscas.ac.cn>
media: mediatek: jpeg: retry HW selection after successful wait
Michail Tatas <michail.tatas@gmail.com>
media: verisilicon: rockchip: Fix leaks in init
Kazuki Hanai <hnkz.64@gmail.com>
media: mediatek: jpeg: Avoid context access after job finish
Guangshuo Li <lgs201920130244@gmail.com>
media: mediatek: vpu: release reserved memory on remove
Guangshuo Li <lgs201920130244@gmail.com>
media: mediatek: vcodec: destroy core workqueue on remove
Guangshuo Li <lgs201920130244@gmail.com>
media: rkvdec: do not destroy borrowed SRAM pool
Wentao Liang <vulab@iscas.ac.cn>
media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker()
Wentao Liang <vulab@iscas.ac.cn>
media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker()
Wentao Liang <vulab@iscas.ac.cn>
media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init()
Fan Wu <fanwu01@zju.edu.cn>
media: mediatek: vpu: free IRQ before destroying watchdog workqueue
Myeonghun Pak <mhun512@gmail.com>
media: amphion: prevent unbind while video instances are open
Myeonghun Pak <mhun512@gmail.com>
media: amphion: drain message work before releasing core state
John Keeping <jkeeping@inmusicbrands.com>
media: rockchip: rga: fix rotation on rev0 hardware
Michael Freidkin <freidkin@gmail.com>
media: meson: vdec: size capture planes from the aligned canvas
Guangshuo Li <lgs201920130244@gmail.com>
media: chips-media: wave5: Check decoder qbuf runtime resume
Linmao Li <lilinmao@kylinos.cn>
media: chips-media: wave5: Balance runtime PM on encoder close errors
Linmao Li <lilinmao@kylinos.cn>
media: chips-media: wave5: Handle polling IRQ thread failure
Fan Wu <fanwu01@zju.edu.cn>
media: rockchip: rga: quiesce IRQ before releasing m2m state
Runyu Xiao <runyu.xiao@seu.edu.cn>
media: sti: delta: use unaligned accessors for MJPEG SOF fields
Nas Chung <nas.chung@chipsnmedia.com>
media: v4l2-common: Fix P010 format info
Thorsten Blum <blum@kernel.org>
media: imagination: Fix value clamping in calculate_qp_tables
Karl Mehltretter <kmehltretter@gmail.com>
KVM: arm64: vgic-v3: Roll back assignments from the new region
Sven Peter <sven@kernel.org>
phy: apple: atc: Support DUMMY PIPEHANDLER state in configure_pipehandler
Alexey Klimov <alexey.klimov@linaro.org>
soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup
Karl Mehltretter <kmehltretter@gmail.com>
KVM: arm64: vgic-v3: Undo assignment on iodev registration failure
Kim Phillips <kim.phillips@amd.com>
x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n mitigation reporting
Fuad Tabba <fuad.tabba@linux.dev>
KVM: arm64: Pin the host vCPU before adjusting its PC under pKVM
Fuad Tabba <fuad.tabba@linux.dev>
KVM: arm64: Validate the host vCPU's VM before reading it under pKVM
Fabio Estevam <festevam@nabladev.com>
drm/panel: simple: Add Raystar RFF500F-AWH-DNN enable delay
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
crypto: ecc - Handle exceptional points in Shamir multiplication
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
crypto: nx - validate 'ignore' before subtracting in decompress
Thorsten Blum <blum@kernel.org>
hwrng: core - reject unknown RNG names
Thorsten Blum <blum@kernel.org>
hwrng: ba431 - fix reported byte count
Thorsten Blum <blum@kernel.org>
hwrng: amd - report partial reads in non-blocking mode
ZhaoJinming <zhaojinming@uniontech.com>
crypto: caam - fix double-free in caam_rsa_set_priv_key_form()
Eric Biggers <ebiggers@kernel.org>
crypto: sa2ul - Fix HMAC key preparation
Wei Jie Law <98lawweijie@gmail.com>
media: uvcvideo: Fix NULL deref on events for uninitialized controls
Imre Kaloz <kaloz@kernel.org>
PCI: Disable MSI for ULi M1575 EHCI controller
Anandu Krishnan E <anandu.e@oss.qualcomm.com>
arm64: dts: qcom: shikra: Remove cdsp compute-cb@9
Runyu Xiao <runyu.xiao@seu.edu.cn>
block: amiflop: synchronize flush timer before track flush
Vasileios Almpanis <vasileios.almpanis@virtuozzo.com>
block: drop the cached plug time when blk_add_rq_to_plug() flushes
Danish Khateeb <danishkhateeb03@gmail.com>
pps: generators: stop the generator on unregister
Vincent Donnefort <vdonnefort@google.com>
KVM: arm64: Fix MMFR0 TGRAN advertisement for pVMs
Mikulas Patocka <mpatocka@redhat.com>
dm-writecache: fix REQ_FUA processing
Mikulas Patocka <mpatocka@redhat.com>
dm-writecache: fix uncommitted_blocks underflow
Mikulas Patocka <mpatocka@redhat.com>
dm-writecache: fix a crash if we attempt to use non-dax device
Mikulas Patocka <mpatocka@redhat.com>
dm-writecache: fix a quirk in statistics
Mikulas Patocka <mpatocka@redhat.com>
dm-writecache: report I/O error if flush failed
Mikulas Patocka <mpatocka@redhat.com>
dm: fix a bug in dm_accept_partial_bio
Christopher Snowhill <chris@kode54.net>
media: em28xx: fix inverted tuner capability check for VBI device
Kaho Jiang <kj2864@nyu.edu>
media: em28xx: fix double free in em28xx_alloc_urbs
Ginger Li <ginger.jzllee@gmail.com>
media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler
Guangshuo Li <lgs201920130244@gmail.com>
media: rtl28xxu: fix SDR platform device leak
Wentao Liang <vulab@iscas.ac.cn>
media: pvrusb2: Fix USB parent device leak in class_dev_create()
Guangshuo Li <lgs201920130244@gmail.com>
media: tw686x: fix V4L2 device lifetime on probe failure
Linus Walleij <linusw@kernel.org>
media: mali-c55: Ignore disconnected queues when checking readiness
David Carlier <devnexen@gmail.com>
media: mali-c55: Check the statistics buffer address before filling
David Carlier <devnexen@gmail.com>
media: mali-c55: Check the parameters buffer address before copying
David Carlier <devnexen@gmail.com>
media: mali-c55: Free the ISP control handler on unregister
Pengpeng Hou <pengpeng@iscas.ac.cn>
media: mali-c55: fail power-on when safe stop times out
David Carlier <devnexen@gmail.com>
media: v4l2-isp: reject zero-sized parameter blocks
Myeonghun Pak <mhun512@gmail.com>
media: renesas: rzv2h-ivc: manage runtime PM with devres
Arnd Bergmann <arnd@arndb.de>
media: mali-c55: add padding to mali_c55_params_ccm structure
Tianchu Chen <flynnnchen@tencent.com>
staging: rtl8723bs: fix RX buffer OOB write from device-reported length
Johan Hovold <johan@kernel.org>
staging: greybus: uart: fix racy TIOCMIWAIT implementation
Wentao Liang <vulab@iscas.ac.cn>
drm/msm/dsi: Fix VM leak in dsi_tx_buf_alloc_6g()
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
drm/msm/hdmi_bridge: Correct poweroff/audio cleanup order in post_disable
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
drm/msm/hdmi: Handle msm_hdmi_power_on() errors during .atomic_pre_enable()
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure
Fan Wu <fanwu01@zju.edu.cn>
i3c: master: adi: free the IRQ before unregistering the master
Franz Schnyder <franz.schnyder@toradex.com>
arm64: dts: freescale: imx95-aquila: Enable I2C_3_DSI1 on Clover board
Runyu Xiao <runyu.xiao@seu.edu.cn>
IB/hfi1: Shutdown self-rearming timers before freeing
Alexander Sverdlin <alexander.sverdlin@siemens.com>
pwm: tiehrpwm: Clear period on disable to allow reconfiguration
Ryusuke Konishi <konishi.ryusuke@gmail.com>
nilfs2: ignore non-fatal signals during synchronous log write wait
Li RongQing <lirongqing@baidu.com>
vfio/pci: Restore 8-byte ioeventfd support
Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
clk: tenstorrent: Fix refcount leak on shared gate clk enable failure
Aamir Ahmed <elb12345@hotmail.co.uk>
clk: tenstorrent: Assign .num before accessing .hws
Ryusuke Konishi <konishi.ryusuke@gmail.com>
nilfs2: clear dirty flag on bdev buffers on log write failure
Runyu Xiao <runyu.xiao@seu.edu.cn>
ASoC: pcm6240: do not free an unrequested IRQ
Gaurav Batra <gbatra@linux.ibm.com>
powerpc/pseries/iommu: Add TCEs for 16GB pages when RAM is pre-mapped
Srish Srinivasan <ssrish@linux.ibm.com>
pseries/plpks: hide wrapping_features when unsupported
Srish Srinivasan <ssrish@linux.ibm.com>
pseries/plpks: fix self-reference in plpks_var initializer
Srish Srinivasan <ssrish@linux.ibm.com>
pseries/plpks: clear SED key data after use
Srish Srinivasan <ssrish@linux.ibm.com>
pseries/plpks: clear signed update authentication buffer
Srish Srinivasan <ssrish@linux.ibm.com>
pseries/plpks: clear sensitive buffers in wrapping operations
Srish Srinivasan <ssrish@linux.ibm.com>
pseries/plpks: clear sensitive PLPKS buffers
Srish Srinivasan <ssrish@linux.ibm.com>
pseries/plpks: validate input to plpks_signed_update_var()
Srish Srinivasan <ssrish@linux.ibm.com>
pseries/plpks: fix error code for wrapping key reads
Srish Srinivasan <ssrish@linux.ibm.com>
pseries/plpks: fix error handling in plpks_read_var()
Abhishek Dubey <adubey@linux.ibm.com>
powerpc/bpf: fix alignment of long branch trampoline address
Abhishek Dubey <adubey@linux.ibm.com>
powerpc/bpf: fix buffer overflow in JIT for large BPF programs
Abhishek Dubey <adubey@linux.ibm.com>
powerpc64/bpf: fix percpu private stack leak on JIT failure
Wentao Liang <vulab@iscas.ac.cn>
clk: starfive: jh7110-isp: fix refcount leak in jh7110_ispcrg_probe()
Takashi Iwai <tiwai@suse.de>
ALSA: core: Check shutdown flag at D0 power-state, too
Runyu Xiao <runyu.xiao@seu.edu.cn>
m68k: dmasound: Keep the Q40 IRQ handler registered
Runyu Xiao <runyu.xiao@seu.edu.cn>
ALSA: sgio2audio: Only free successfully requested IRQs
Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
media: iris: Fix frame interval enumeration for non-divisor framerates
Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
media: iris: Fix power-off ordering to disable power domain after clocks
Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
media: iris: Fix bus_info prefix in VIDIOC_QUERYCAP
Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
media: iris: Fix iova allocation from restrict region
Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
media: iris: avoid bit depth validation for capture formats
Vikash Garodia <vikash.garodia@oss.qualcomm.com>
media: iris: reset AHB bridge before enabling HW mode
Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
media: venus: Fix iova allocation from restrict region
Hans de Goede <johannes.goede@oss.qualcomm.com>
media: qcom: camss: Add "gcc_axi_hf" to 8775p VFE lite clock lists
Hitesh Patel <hitesh@ebytelogic.com>
media: qcom: camss: vfe: Fix VFE reset while another line is streaming
Hitesh Patel <hitesh@ebytelogic.com>
media: qcom: camss: vfe-17x: Fix write master selection for RDI lines
Hitesh Patel <hitesh@ebytelogic.com>
media: qcom: camss: vfe-17x: Fix write master buffer done being dropped
Danish Khateeb <danishkhateeb03@gmail.com>
ALSA: timer: Handle userspace-driven timer ioctls from 32-bit tasks
Jiale Yao <yaojiale02@163.com>
cxl/acpi: Check ACPI companion before use
Michael Bommarito <michael.bommarito@gmail.com>
fs/ntfs3: reject an oversized resident attribute on the inline iomap path
Ibrahim Hashimov <security@auditcode.ai>
fs/ntfs3: fix integer overflow in find_log_rec() causing OOB read
Lucas Costa <2000.costalucas@gmail.com>
spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup()
Rupesh Majhi <zoone.rupert@gmail.com>
iio: pressure: dps310: fix CFG_REG bit definitions
Cheick Traore <cheick.traore-ext@st.com>
iio: adc: stm32: fix minimum sampling time values
Ariana Lazar <ariana.lazar@microchip.com>
iio: dac: mcp47feb02: Avoid unjustified probe error on missing label
Jiale Yao <yaojiale02@163.com>
iio: accel: sca3000: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: accel: adxl380: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: accel: adxl372: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: accel: adxl313: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: adc: ti-ads7950: validate SPI match data
Jiale Yao <yaojiale02@163.com>
iio: adc: ti-ads131m02: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: adc: ti-ads1018: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: adc: ti-adc128s052: validate SPI match data
Jiale Yao <yaojiale02@163.com>
iio: adc: mcp3911: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: adc: max11205: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: adc: ad7768-1: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: adc: ad7606: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: adc: ad7192: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: pressure: bmp280: validate SPI match data
Jiale Yao <yaojiale02@163.com>
iio: potentiometer: x9250: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: imu: adis16400: validate SPI match data
Jiale Yao <yaojiale02@163.com>
iio: frequency: adf4377: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: dac: mcp4821: reject devices without match data
Jiale Yao <yaojiale02@163.com>
iio: dac: ad5755: validate SPI match data
Jiale Yao <yaojiale02@163.com>
iio: amplifiers: ad8366: reject devices without match data
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: adc: ad4080: enable address ascension for chip identification
Wentao Liang <vulab@iscas.ac.cn>
ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status()
Runyu Xiao <runyu.xiao@seu.edu.cn>
ALSA: mpu401: shut down timer before freeing MPU
Karl Mehltretter <kmehltretter@gmail.com>
fuse: fix GCC 8 build with CONFIG_PROFILE_ALL_BRANCHES
Lu Baolu <baolu.lu@linux.intel.com>
iommu/vt-d: Avoid out-of-range shift in qi_desc_dev_iotlb_pasid()
Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
arm64: dts: qcom: ipq9574: Wire up USB3 PHY PIPE clock to GCC
David Heidelberg <david@ixit.cz>
arm64: dts: qcom: sdm845-xiaomi-polaris: Extend the xbl_mem region
David Heidelberg <david@ixit.cz>
arm64: dts: qcom: sdm845-xiaomi-beryllium: Extend the xbl_mem region
Piotr Kubik <piotr@kubik.pl>
netfilter: ctnetlink: fix inverted IPv6 address match in dump filter
Orgad Shaneh <orgads@gmail.com>
MIPS: mm: do not write a huge TLB entry when the probe misses
Orgad Shaneh <orgads@gmail.com>
MIPS: mm: align hugetlb mappings in arch_get_unmapped_area()
Tom Verdonck <tom.verdonck@inspiral.be>
hwmon: (tmp108) Fix jiffies wraparound in conversion-ready check
Tom Verdonck <tom.verdonck@inspiral.be>
hwmon: (tmp102) Fix jiffies wraparound in conversion-ready check
Runyu Xiao <runyu.xiao@seu.edu.cn>
peci: npcm: Initialize state before requesting IRQ
Runyu Xiao <runyu.xiao@seu.edu.cn>
peci: aspeed: Initialize state before requesting IRQ
Ma Ke <make_ruc2021@163.com>
ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status()
David Cemin <dcemin@nvidia.com>
ASoC: sdw_utils: clear stale RT711 device reference on exit
Breno Leitao <leitao@debian.org>
dcache: report a Tasks-RCU quiescent state in dentry_kill()
Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
hwmon: (coretemp) Refresh the temperature on the first read
Richard Weinberger <richard@nod.at>
mtd: Call get_wunit() on the master partition
Wentao Liang <vulab@iscas.ac.cn>
mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb()
Wentao Liang <vulab@iscas.ac.cn>
mtd: maps: l440gx: Fix double put of the PM device in init_l440gx()
Wentao Liang <vulab@iscas.ac.cn>
mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx()
Wentao Liang <vulab@iscas.ac.cn>
mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one()
Orgad Shaneh <orgads@gmail.com>
mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device
Myeonghun Pak <mhun512@gmail.com>
mtd: maps: pci: balance PCI enable on cleanup
Wentao Liang <vulab@iscas.ac.cn>
mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init()
Guangshuo Li <lgs201920130244@gmail.com>
mtd: rawnand: nuvoton: fix clock cleanup on probe failure
Michael J. Ruhl <michael.j.ruhl@intel.com>
platform/x86/intel/pmt: Block mmap when callback is present
Joanne Koong <joannelkoong@gmail.com>
fuse: don't drop destination page cache on a zero byte copy reply
Joanne Koong <joannelkoong@gmail.com>
fuse: don't shorten the folio descriptor at LLONG_MAX
Ridham Khurana <khurana.ridham222@gmail.com>
hwmon: (lm70) Fix rounding of negative temperatures
Ridham Khurana <khurana.ridham222@gmail.com>
hwmon: (lm95245) Fix negative temperature conversion
Wentao Liang <vulab@iscas.ac.cn>
regulator: core: Fix coupled regulators reference leak on removal
Wei-Lin Chang <weilin.chang@arm.com>
KVM: arm64: ptdump: Fix shadow ptdump sleep-in-atomic-context problem
Wei-Lin Chang <weilin.chang@arm.com>
KVM: arm64: ptdump: Check the page tables aren't freed when accessing
Aamir Ahmed <elb12345@hotmail.co.uk>
clk: mvebu: ap-cpu-clk: Assign .num before accessing .hws
Junjie Cao <junjie.cao@intel.com>
ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls
Guangshuo Li <lgs201920130244@gmail.com>
ASoC: Intel: atom: Fix platform device leak on probe failure
Jiacheng Xu <stitch@zju.edu.cn>
kobject: fix out-of-bounds access in kobject_action_type()
Ryusuke Konishi <konishi.ryusuke@gmail.com>
nilfs2: fix deadlock between nilfs_evict_inode() and find_inode()
Tiezhu Yang <yangtiezhu@loongson.cn>
perf loongarch: Fix discarded const qualifier in _get_field()
Lin Wang <wanglin@open-hieco.net>
hwmon: (k10temp) Stop matching Hygon devices
Myeonghun Pak <mhun512@gmail.com>
mfd: twl-core: Unregister the auxiliary platform device on unbind
David Heidelberg <david@ixit.cz>
mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
David Heidelberg <david@ixit.cz>
mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set"
David Heidelberg <david@ixit.cz>
mfd: Fix MAX77705 dependency on regmap
Hongyan Xu <getshell@seu.edu.cn>
mfd: da903x: Cancel IRQ work during teardown
Casey Connolly <casey.connolly@linaro.org>
drm/panel: ebbg-ft8719: Set prepare_prev_first
Gabor Juhos <j4g8y7@gmail.com>
clk: qcom: gcc-ipq5018: mark 'gpll0_main' clock as critical
Francesco Dolcini <francesco.dolcini@toradex.com>
arm64: dts: freescale: imx95-toradex-smarc: enable Wi-Fi SD interface
Francesco Dolcini <francesco.dolcini@toradex.com>
arm64: dts: freescale: imx8mp-verdin-yavia: fix external GPIOs
Francesco Dolcini <francesco.dolcini@toradex.com>
arm64: dts: freescale: imx8mp-toradex-smarc: fix SMARC_SLEEP# gpio-line-names typo
Francesco Dolcini <francesco.dolcini@toradex.com>
arm64: dts: freescale: imx95-aquila: fix gpio-line-names padding
Francesco Dolcini <francesco.dolcini@toradex.com>
arm64: dts: freescale: imx8mp-verdin-ivy: fix DIGI_1/DIGI_2 gpio-line-names
Francesco Dolcini <francesco.dolcini@toradex.com>
arm64: dts: freescale: imx8mm-verdin-ivy: fix DIGI_1/DIGI_2 gpio-line-names
Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
memory: stm32_omm: fix child clock leak on set_amcr() error path
Myeonghun Pak <mhun512@gmail.com>
ASoC: fsl_xcvr: free IRQ before canceling reset work
Guangshuo Li <lgs201920130244@gmail.com>
media: atmel-isi: release unregistered video device on remove
Guangshuo Li <lgs201920130244@gmail.com>
media: i2c: ov5647: fix power cleanup on remove
Lucas Sinn <lucas.sinn@wolfvision.net>
media: synopsys: hdmirx: fetch colordepth before calculating pixelclock
Wentao Liang <vulab@iscas.ac.cn>
media: vpif_display: Fix i2c adapter reference leak in vpif_probe()
Wentao Liang <vulab@iscas.ac.cn>
media: vpif_capture: Fix i2c adapter reference leak in vpif_probe()
Wentao Liang <vulab@iscas.ac.cn>
media: au0828: Fix media device leak in au0828_usb_probe()
Runyu Xiao <runyu.xiao@seu.edu.cn>
media: adv7180: Initialize mutex before ancillary clients
Myeonghun Pak <mhun512@gmail.com>
media: tw68: balance PCI enable on cleanup
Myeonghun Pak <mhun512@gmail.com>
media: cx18: Disable PCI device on probe failure
Myeonghun Pak <mhun512@gmail.com>
media: go7007: unregister the I2C adapter on USB probe failure
Myeonghun Pak <mhun512@gmail.com>
media: marvell: manage the MMP camera clock provider
Ruoyu Wang <ruoyuw560@gmail.com>
media: adv748x: Fix endpoint reference leaks on probe failure
Rohinthan P <rokinthanp03@gmail.com>
media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions
Pengpeng Hou <hppiscas@163.com>
media: cec: extron: clear response tail before dispatch
Karl Mehltretter <kmehltretter@gmail.com>
crypto: qat - zero the VF migration state buffer on save
Weili Qian <qianweili@huawei.com>
crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent
Weili Qian <qianweili@huawei.com>
crypto: hisilicon/hpre - fix ECDH destination DMA mapping
Weili Qian <qianweili@huawei.com>
crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer
Weili Qian <qianweili@huawei.com>
crypto: hisilicon/hpre - fix pointer dereference before length check
Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
crypto: amlogic - Fix IRQ handler return value and fallthrough logic
Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com>
crypto: qat - fix error source for QAT GEN6 transmit interface faults
Yuchao Zhang <ndaugoing@gmail.com>
md: validate bblog_size when loading v1.x badblocks metadata
Wentao Liang <vulab@iscas.ac.cn>
EDAC/i10nm: Fix mdev reference leak in i10nm_get_ddr_munits()
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
nilfs2: fix checkpoint root lifetime on sysfs errors
Wentao Guan <guanwentao@uniontech.com>
cpufreq/amd-pstate: Skip auto_sel write when it already matches the mode
Wentao Liang <vulab@iscas.ac.cn>
drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable()
Francesco Dolcini <francesco.dolcini@toradex.com>
arm64: dts: ti: k3-am62p5-verdin: build zinnia dtbs
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am62x-phyboard-lyra: Set SD clock pin as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am625-var-som: Set MMC clock pins as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am625-var-som-symphony: Set SD clock pins as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am625-tqma62xx: Set MMC clock pins as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am62-phycore-som: Set eMMC clock pin as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am625-sk-common: Set eMMC clock pin as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am62x-sk-common: Set SD clock pin as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am625-beagleplay: Set MMC clock pins as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am62-pocketbeagle2: Set SD clock pin as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am62-lp-sk: Set eMMC clock pins as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am62a-phycore-som: Set eMMC clock pin as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am62a7-sk: Set SD clock pin as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am62a7-sk: Set eMMC clock pin as OUTPUT
Judith Mendez <jm@ti.com>
arm64: dts: ti: k3-am62a: Fix MMC0_CLK register address
Wentao Liang <vulab@iscas.ac.cn>
ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv()
Sean Young <sean@mess.org>
media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse()
Sean Young <sean@mess.org>
media: ir_toy: Validate the maximum tx carrier
Sean Young <sean@mess.org>
media: serial_ir: Fix race condition where timer can be re-armed
Sean Young <sean@mess.org>
media: ene_ir: Ensure teardown is done in the correct order
Myeonghun Pak <mhun512@gmail.com>
leds: ktd2692: Pass context to regulator cleanup
Cong Nguyen <congnt264@gmail.com>
staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error
Hui Peng <benquike@gmail.com>
seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted
Oleg Nesterov <oleg@redhat.com>
signalfd: don't dequeue the forced fatal signals
Adrian Hunter <adrian.hunter@intel.com>
i3c: mipi-i3c-hci-pci: Set drvdata before creating LTR sysfs attribute
Adrian Hunter <adrian.hunter@intel.com>
i3c: mipi-i3c-hci: Bounce short reads irrespective of the IOMMU
Adrian Hunter <adrian.hunter@intel.com>
i3c: master: Fix out-of-bounds read in DMA bounce buffer setup
Runyu Xiao <runyu.xiao@seu.edu.cn>
PCI: pciehp: Make 'pciehp_poll_mode' parameter read-only
Hui Peng <benquike@gmail.com>
ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0
Tsz Shan Chan <tsz.chan.dev@gmail.com>
iio: light: apds9306: fix default sampling frequency definition
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: force accel odr change when switching power mode
Shehryar Ahmad <shehryar.amd@gmail.com>
iio: accel: adis16201: fix channel order for buffer mode
Ariana Lazar <ariana.lazar@microchip.com>
iio: dac: mcp47feb02: Increase EEPROM Programming Write Cycle Time
Ariana Lazar <ariana.lazar@microchip.com>
iio: dac: mcp47feb02: Return len when disabling EEPROM store
Ariana Lazar <ariana.lazar@microchip.com>
iio: dac: mcp47feb02: Fix gain field initialization for active channels
Ariana Lazar <ariana.lazar@microchip.com>
iio: dac: mcp47feb02: initialize dac_data field in channel data struct at probe
Wentao Liang <vulab@iscas.ac.cn>
regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable()
Karl Mehltretter <kmehltretter@gmail.com>
fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs
Wentao Liang <vulab@iscas.ac.cn>
ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect()
Christian Loehle <christian.loehle@arm.com>
cpufreq: CPPC: Create the FIE worker before enabling PCC callbacks
Christian Loehle <christian.loehle@arm.com>
ACPI: CPPC: Propagate errors from cross-CPU FFH calls
Guangshuo Li <lgs201920130244@gmail.com>
crypto: omap-sham - fix crypto engine cleanup
Guangshuo Li <lgs201920130244@gmail.com>
crypto: omap-des - fix crypto engine cleanup
Thorsten Blum <blum@kernel.org>
crypto: xilinx - clear AES key buffer before freeing it
Thorsten Blum <blum@kernel.org>
crypto: zynqmp-sha - fix NULL pointer dereference in init_tfm
Maciej W. Rozycki <macro@orcam.me.uk>
PCI: Skip Target Speed quirk on clamped ports with no link
Wentao Liang <vulab@iscas.ac.cn>
regulator: core: Fix rdev reference leak in regulator_resolve_supply()
Wentao Liang <vulab@iscas.ac.cn>
regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling()
Jiaming Zhang <r772577952@gmail.com>
nilfs2: force clear dirty state when restoring from the shadow map
Shengming Hu <hu.shengming@zte.com.cn>
cpufreq: conservative: Restrict deferred downscaling to low load
Johan Alvarado <contact@c127.dev>
spi: spi-qpic-snand: publish the ECC context to snandc->qspi
Sakari Ailus <sakari.ailus@linux.intel.com>
media: imx219: The horizontal blanking step is 8
Sakari Ailus <sakari.ailus@linux.intel.com>
media: imx219: Account for rate_factor in control steps
Sakari Ailus <sakari.ailus@linux.intel.com>
media: imx219: Account rate_factor in setting upper exposure limit
Junjie Cao <junjie.cao@intel.com>
media: i2c: cvs: Get the wake IRQ without claiming the GPIO
Thomas Zimmermann <tzimmermann@suse.de>
drm/panic: Test address from kmap op for NULL
Thomas Zimmermann <tzimmermann@suse.de>
drm/panic: Do not use un-escaped URL as format string
Martin Wilck <martin.wilck@suse.com>
md/raid5: validate payload size before calculating payload_len
Cao Guanghui <caoguanghui@kylinos.cn>
md/raid5: fix NULL pointer dereference in raid5_free_percpu
Cao Guanghui <caoguanghui@kylinos.cn>
md/raid5: track disks array size to fix extra_page leak on error paths
Guangshuo Li <lgs201920130244@gmail.com>
iio: adc: at91-sama5d2: disable autosuspend on remove
Guangshuo Li <lgs201920130244@gmail.com>
iio: accel: mma9553: disable autosuspend on remove
Guangshuo Li <lgs201920130244@gmail.com>
iio: accel: mma9551: disable autosuspend on remove
Guangshuo Li <lgs201920130244@gmail.com>
iio: accel: kxcjk-1013: Disable autosuspend on remove
Wentao Liang <vulab@iscas.ac.cn>
ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id()
Wentao Liang <vulab@iscas.ac.cn>
ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe()
Liu Chao <liuc63@xiaopeng.com>
usb: fotg210: validate endpoint index in ep0 handlers
Karl Mehltretter <kmehltretter@gmail.com>
crypto: atmel-tdes - sync output bounce buffer before DMA
Yousef Alhouseen <alhouseenyousef@gmail.com>
ntfs3: bound index head insertions by buffer capacity
Yousef Alhouseen <alhouseenyousef@gmail.com>
ntfs3: reject empty iomap before reading its LCN
Muhammad Bilal <meatuni001@gmail.com>
platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str()
Guangshuo Li <lgs201920130244@gmail.com>
media: i2c: ov2735: fix power cleanup on remove
Guangshuo Li <lgs201920130244@gmail.com>
media: i2c: og01a1b: power off sensor on remove
Guangshuo Li <lgs201920130244@gmail.com>
media: i2c: alvium-csi2: balance runtime PM usage count on remove
Niklas Cassel <cassel@kernel.org>
ata: libata: Do not leave ata_host_stop() registered when activation fails
Niklas Cassel <cassel@kernel.org>
ata: libahci: Free the IRQs when activating a multi-IRQ host fails
Niklas Cassel <cassel@kernel.org>
ata: ahci_st: Assert the power down reset in the probe() error path
Niklas Cassel <cassel@kernel.org>
ata: ahci_st: Do not ignore errors when getting the reset controls
Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
pinctrl: renesas: rzt2h: Fix reading pin value in IRQ function
Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
pinctrl: renesas: rzt2h: Setup IRQ in .irq_{request,release}_resources()
Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
pinctrl: renesas: rzt2h: Restore correct pin mode on IRQ free
Ethan Nelson-Moore <enelsonmoore@gmail.com>
ata: sata_inic162x: remove dangerous broken driver
Guangshuo Li <lgs201920130244@gmail.com>
ACPI: SBS: Fix NULL pointer dereference on allocation failure
Chao Yu <chao@kernel.org>
f2fs: compress: fix to handle race between truncate and writeback
Jiucheng Xu <jiucheng.xu@amlogic.com>
f2fs: force out-place update for all writes on compressed file
Daeho Jeong <daehojeong@google.com>
f2fs: drop pending discard commands before reserving device alias
Matthew Sakai <msakai@redhat.com>
dm vdo indexer: validate record page numbers better
Matthew Sakai <msakai@redhat.com>
dm vdo indexer: prevent delta list overflow on load
Kyle Zeng <kylebot@openai.com>
affs: validate blocks before freeing them
Joshua Crofts <joshua.crofts1@gmail.com>
iio: adc: max14001: add missing MODULE_DEVICE_TABLE macro
Fabio Cesari <fabio.cesari@gmail.com>
iio: light: isl29028: fix runtime PM reference leak on error paths
Koichiro Den <den@valinux.co.jp>
PCI: endpoint: pci-epf-vntb: Manage virtual NTB and PCI bus lifetime
Nicolin Chen <nicolinc@nvidia.com>
iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands
Bradley Morgan <include@grrlz.net>
PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier()
Jiaming Zhang <r772577952@gmail.com>
gfs2: reject invalid inode sizes
Runyu Xiao <runyu.xiao@seu.edu.cn>
crypto: ccp - Initialize DBC ioctl mutex before registering device
Karl Mehltretter <kmehltretter@gmail.com>
lib/842: require a complete history block for repeat templates
Karl Mehltretter <kmehltretter@gmail.com>
lib/842: reject output overflows from index and short data
Karl Mehltretter <kmehltretter@gmail.com>
crypto: atmel-aes - fix AADLENR for standalone GHASH
Karl Mehltretter <kmehltretter@gmail.com>
crypto: atmel-tdes - zero-initialize device state
Junrui Luo <moonafterrain@outlook.com>
media: vicodec: zero-initialize stateful decoder heap buffers
Fan Wu <fanwu01@zju.edu.cn>
media: vivid: cancel svid ctrl work on release
Juan Perdomo <jcperdomo100@gmail.com>
media: cx231xx: preserve I2C transfer length
Maxim Skokov <skokovmaksimevg@gmail.com>
media: vivid: round the height down to the vertical subsampling factor
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
PCI: rzg3s: Fix IRQ domain initialization error handling
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
PCI: rzg3s: Propagate platform_get_irq_byname() errors
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
PCI: rzg3s: Disable refclk on probe failure
Eric Kim <seohyun.kim@outlook.kr>
sched/fair: Reset NUMA fault locality after scan period update
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: fix odr change not caught in certain cases
Fan Wu <fanwu01@zju.edu.cn>
power: supply: bq27xxx: Ensure poll work is cancelled on remove
Shengzhuo Wei <me@cherr.cc>
power: supply: bq27xxx: synchronize work cancellation on suspend
Robin Snyders <robin@snyders.xyz>
power: supply: qcom_smbx: notify battery overvoltage recovery
Robin Snyders <robin@snyders.xyz>
power: supply: qcom_smbx: validate battery float voltage
Robin Snyders <robin@snyders.xyz>
power: supply: qcom_smbx: fix float voltage selector
Robin Snyders <robin@snyders.xyz>
power: supply: qcom_smbx: test battery health status bits
Robin Snyders <robin@snyders.xyz>
power: supply: qcom_smbx: include base when petting watchdog
Runyu Xiao <runyu.xiao@seu.edu.cn>
hte: tegra194-test: shut down timer before GPIO release
Karl Mehltretter <kmehltretter@gmail.com>
ACPI: pfr_update: zero-initialize capability query result
Runyu Xiao <runyu.xiao@seu.edu.cn>
dmaengine: altera-msgdma: initialize state before requesting IRQ
Damon Ding <damon.ding@rock-chips.com>
drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties
Pengpeng Hou <pengpeng@iscas.ac.cn>
media: require two-byte Cypress type 04 records
Tharit Tangkijwanichakul <tharitt97@gmail.com>
media: v4l2-ctrls: default HEVC SPS chroma format to 4:2:0
Fan Wu <fanwu01@zju.edu.cn>
media: nuvoton: npcm-video: quiesce VCD IRQ before teardown
Alexander Shiyan <eagle.alexander923@gmail.com>
media: synopsys: hdmirx: use request_any_context_irq() for 5V detection IRQ
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
media: stv0900: bound DiSEqC reply length to msg[] size
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
media: stv090x: bound DiSEqC reply length to msg[] size
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
media: adv7604: avoid negative array index in log_status when cp_read fails
Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
pinctrl: renesas: rzt2h: Fix used_irqs indexing in clear path
James Hilliard <james.hilliard1@gmail.com>
mtd: rawnand: sunxi: fix free OOB section offsets
James Hilliard <james.hilliard1@gmail.com>
mtd: rawnand: sunxi: reject ECC maximization on small pages
Myeonghun Pak <mhun512@gmail.com>
media: stm32: csi: unregister async notifier on cleanup
Alain Volmat <alain.volmat@foss.st.com>
media: stm32: csi: correct remote pad retrieval
Balakrishnan Sambath <balakrishnan.s@microchip.com>
media: microchip-isc: don't sleep in the clk .is_enabled callback
Balakrishnan Sambath <balakrishnan.s@microchip.com>
media: microchip-isc: fix PM runtime leak in AWB work handler
Balakrishnan Sambath <balakrishnan.s@microchip.com>
media: microchip-isc: do not touch WB registers when not streaming
Balakrishnan Sambath <balakrishnan.s@microchip.com>
media: microchip-isc: disable histogram and flush AWB work on teardown
Balakrishnan Sambath <balakrishnan.s@microchip.com>
media: microchip-isc: synchronize the IRQ before disabling clocks on stop
Balakrishnan Sambath <balakrishnan.s@microchip.com>
media: microchip-isc: fix awb_mutex and lock lifecycle
Wang Yan <wangyan01@kylinos.cn>
perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+
Stanislaw Gruszka <stf_xl@wp.pl>
wifi: mac80211: queue frames while off-channel
Xu Rao <raoxu@uniontech.com>
media: m2m-deinterlace: fix default capture field
Punnay Sharma <punnaysharma805@gmail.com>
staging: media: av7110: fix sp8870 initialization failure state
Punnay Sharma <punnaysharma805@gmail.com>
staging: media: av7110: fix corrupted BER reporting in sp8870
Julian Braha <julianbraha@gmail.com>
media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA
Jeffin Philip <jeffinphilip14@gmail.com>
media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail
Piyush Patle <piyushpatle228@gmail.com>
media: vidtv: fix frontend reference leak on unbind
Junrui Luo <moonafterrain@outlook.com>
media: vicodec: make encoder CAPTURE dimensions read-only
Junrui Luo <moonafterrain@outlook.com>
media: vicodec: fix out-of-bounds write on under-rounded coded dimensions
Faizel K B <faizel.kb@gmail.com>
media: vimc: sensor: fix pixel_rate type to resolve do_div() warning
Younho Choi <gdool88@mju.ac.kr>
media: vim2m: keep transaction buffer count stable while streaming
Runyu Xiao <runyu.xiao@seu.edu.cn>
media: saa7146: Initialize interrupt lock before requesting IRQ
Shengzhuo Wei <me@cherr.cc>
media: go7007: bound EZ-USB I2C transfers to the usb_buf size
Linkai Gong <gonglinkai@kylinos.cn>
media: i2c: tc358743: add missing color-space strings
Ruoyu Wang <ruoyuw560@gmail.com>
media: au0828: Free URBs when starting DVB streaming fails
Takashi Sakamoto <o-takashi@sakamocchi.jp>
firewire: core: fix source bus ID detection for AT context in big-endian systems
Andi Shyti <andi.shyti@kernel.org>
media: cx231xx: Fix cleanup path on failure
Fan Wu <fanwu01@zju.edu.cn>
media: cx231xx-audio: drain wq_trigger before audio fini
Linkai Gong <gonglinkai@kylinos.cn>
media: pci: hws: only init channels the device actually has
Hao-Qun Huang <alvinhuang0603@gmail.com>
media: hws: Wait for IRQ handler before returning buffers
Ben Hoff <hoff.benjamin.k@gmail.com>
media: hws: report measured colorimetry
Andrea Pesaresi <andreapesaresi82@gmail.com>
arm64: dts: mediatek: mt7986: correct timer frequency
Baolin Liu <liubaolin@kylinos.cn>
isofs: fix Rock Ridge CE extent validation on multisession media
GUO Ren (XuanTie) <guoren@kernel.org>
riscv: dts: spacemit: k3: fix IMSIC num-guest-ids
Rosen Penev <rosenp@gmail.com>
mtd: rawnand: ndfc: use devm_platform_ioremap_resource()
Thorsten Blum <blum@kernel.org>
thermal: intel: int340x: Fix temperature selection around 0 C
Thorsten Blum <blum@kernel.org>
thermal: intel: powerclamp: Reject invalid window_size values
Francesco Dolcini <francesco.dolcini@toradex.com>
arm64: dts: ti: k3-am62-verdin: Set MMC clock pins as OUTPUT
Amir Goldstein <amir73il@gmail.com>
fs: make sure to call fsnotify_inoderemove() only once when inode is dead
Karl Mehltretter <kmehltretter@gmail.com>
fs_pin: publish pins with RCU list helpers
Miquel Raynal <miquel.raynal@bootlin.com>
mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption
HyeongJun An <sammiee5311@gmail.com>
mtd: spi-nor: sfdp: check the length of the SCCR map
HyeongJun An <sammiee5311@gmail.com>
mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table
Marek Vasut <marek.vasut+renesas@mailbox.org>
PCI: rcar-gen4: Limit Max_Read_Request_Size to 256 Bytes
Serin Yeh <serin.yeh@intel.com>
media: i2c: ov8856: fix debug message to report actual CSI-2 lane count
Serin Yeh <serin.yeh@intel.com>
media: i2c: ov8856 : remove ACPI node bypass mechanism
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup()
Ricardo Ribalda <ribalda@chromium.org>
clk: mediatek: Add missing depend for COMMON_CLK_MT8173
David Heidelberg <david@ixit.cz>
arm64: dts: qcom: sdm845-google: Set i2c3 frequency to 400 kHz
Antti Laakso <antti.laakso@linux.intel.com>
media: i2c: cvs: Add sensor node in bound callback
Runyu Xiao <runyu.xiao@seu.edu.cn>
hte: tegra194: Initialize slice locks before registering chip
Yuan Chen <chenyuan@kylinos.cn>
bpf: Fix queue/stack map u32 index overflow
Yo'av Moshe <linux@yoavmoshe.com>
ARM: imx: Fix suspend/resume crash with Clang CFI
hanzhijian <hanzhijian1991@gmail.com>
clk: mstar: msc313-mpll: fix off-by-one in clock array allocation
Hans de Goede <johannes.goede@oss.qualcomm.com>
platform/x86: int3472: Increase handshake GPIO delay to 200 ms
Sakari Ailus <sakari.ailus@linux.intel.com>
platform/x86: int3472: Fix uninitialised variable warning
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
wifi: rtw89: cap firmware section_num before parsing
Yi Cong <yicong@kylinos.cn>
wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields
イムティヤズ <reza1234khan1234@gmail.com>
wifi: rtw88: fix out-of-bounds CAM write when key table is full
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile
Justin Chen <justin.chen@broadcom.com>
memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT
Justin Chen <justin.chen@broadcom.com>
memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset
Liu Zhenlong <dragonliu2018@gmail.com>
PCI: aspeed: Fix clk and PHY leak in aspeed_pcie_port_init() error paths
Sam Price <thesamprice@gmail.com>
microblaze: preserve the MSR carry flags across signals
Ramin Moussavi <ramin.moussavi@yacoub.de>
microblaze: restore the ABI argument home area below pt_regs (PTO)
Ramin Moussavi <ramin.moussavi@yacoub.de>
microblaze: don't clobber r3/r4 restored by rt_sigreturn
Ramin Moussavi <ramin.moussavi@yacoub.de>
microblaze: reserve the ABI argument-home area in the signal frame
Yunpeng Tian <shionthanatos@gmail.com>
udf: validate the device specification EA before using it
Christopher Obbard <chris.obbard@oss.qualcomm.com>
PCI: qcom: Only check bridge nodes for PERST# GPIOs
Abel Vesa <abelvesa@kernel.org>
soc: qcom: pmic_glink: Fix device access from worker during suspend
Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
soc: qcom: geni-se: Fix write to read-only firmware buffer
Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller
Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around
Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison
HyeongJun An <sammiee5311@gmail.com>
remoteproc: elf_loader: Bound the section header table
Maxi Saparov <masaparov@coreweave.com>
kho: do not reserve scratch memory in the kdump kernel
Daehyeon Ko <4ncienth@gmail.com>
ipc/mqueue: release notification resources during inode eviction
Daehyeon Ko <4ncienth@gmail.com>
aio: prevent eventfd/epoll recursion on poll
Jan Kara <jack@suse.cz>
udf: Make sure there's enough space for LVID implementation use field
Eric Sandeen <sandeen@redhat.com>
devtmpfs: restore mount option reconfiguration on get_tree
Karl Mehltretter <kmehltretter@gmail.com>
microblaze: Fix MB_MANAGER build with older binutils
Fan Wu <fanwu01@zju.edu.cn>
media: imx-jpeg: finish the job on device_run() error paths
Sean Young <sean@mess.org>
media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled
Sean Young <sean@mess.org>
media: meson-ir-tx: Ensure probe error is propagated
Sean Young <sean@mess.org>
media: meson-ir-tx: Ensure rc_free_device() is called on unbind
Sean Young <sean@mess.org>
media: meson-ir-tx: Ensure clock is disabled on unbind
Sean Young <sean@mess.org>
media: sunxi-cir: Ensure no more interrupts can occur before free
Sean Young <sean@mess.org>
media: redrat3: Error path leaves device in transmitting state
Sean Young <sean@mess.org>
media: redrat3: Ensure all urbs are suspended
Sean Young <sean@mess.org>
media: redrat3: Ensure we don't read beyond the end of the packet
Sean Young <sean@mess.org>
media: streamzap: Add missing rc_unregister_device()
Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
cpufreq: airoha: fix probe failure with correct error check
Esben Haabendal <esben@geanix.com>
iio: light: ltr501: Power down chip if request irq fails
Jakub Szczudlo <jakubszczudlo40@gmail.com>
iio: adc: ti-ads1100: Fix incorrect reading when datarate changed in single mode
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG
YuBiao Wang <YuBiao.Wang@amd.com>
drm/amdgpu: recompute the dw estimate after allocating a new VM update job
Marek Czernohous <marek@czernohous.de>
drm/nouveau: don't dereference outp before checking it in nouveau_dp_irq
Marek Czernohous <marek@czernohous.de>
drm/nouveau: cancel the DP IRQ work before freeing the connector
Marek Czernohous <marek@czernohous.de>
drm/nouveau: disable the fence uevent work instead of just cancelling it
Marek Czernohous <marek@czernohous.de>
drm/nouveau/pci: use config-space MSI rearm on MCP79/MCP7A (NVAC)
Zhenhao Wan <whi4ed0g@gmail.com>
drm/nouveau/svm: drain fault handler before freeing svmm
Zhenhao Wan <whi4ed0g@gmail.com>
drm/nouveau: reject zero-size notifier object allocation
Lyude Paul <lyude@redhat.com>
drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr
Matt Turner <mattst88@gmail.com>
alpha: honor force_successful_syscall_return() again
Sean Young <sean@mess.org>
media: rc: Add missing locking for keymap
Sean Young <sean@mess.org>
media: rc: Replace open coded krealloc() for keymap
Sami Tolvanen <samitolvanen@google.com>
rust: dma: declare cfi_encoding for dma_data_direction
Sami Tolvanen <samitolvanen@google.com>
rust: hrtimer: declare cfi_encoding for hrtimer_restart
Sami Tolvanen <samitolvanen@google.com>
rust: irq: declare cfi_encoding for irqreturn
Hyunwoo Kim <imv4bel@gmail.com>
inet: reject unhashed sockets during established lookups
Mike Rapoport (Microsoft) <rppt@kernel.org>
x86/mm/pat: Use pr_warn() for early W^X warnings
Ruide Cao <caoruide123@gmail.com>
mptcp: fix MP_CAPABLE token migration when cloning reqsk
Sean Young <sean@mess.org>
media: saa7134: Specify rc type at rc_allocate_type()
Sean Young <sean@mess.org>
media: cx88: Specify rc type at rc_allocate_type()
Tales A. Mendonça <talesam@gmail.com>
drm/xe: Implement Wa_22016122933
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 10 +
Documentation/block/ublk.rst | 7 +
.../bindings/clock/nuvoton,ma35d1-clk.yaml | 16 +-
Documentation/filesystems/fsverity.rst | 3 +
Documentation/hwmon/coretemp.rst | 3 +
Documentation/hwmon/k10temp.rst | 8 +-
Documentation/hwmon/prom21-xhci.rst | 2 +-
Documentation/networking/ip-sysctl.rst | 5 +-
Documentation/userspace-api/check_exec.rst | 4 +
Documentation/virt/hyperv/vmbus.rst | 17 +-
Makefile | 4 +-
arch/alpha/include/asm/mmu_context.h | 35 +-
arch/alpha/include/asm/sfp-machine.h | 4 +
arch/alpha/include/asm/switch_to.h | 1 -
arch/alpha/include/asm/tlbflush.h | 3 +-
arch/alpha/kernel/entry.S | 14 +
arch/alpha/kernel/smp.c | 67 +-
arch/alpha/mm/fault.c | 23 +-
arch/alpha/mm/tlbflush.c | 18 +-
arch/arm/include/asm/linkage.h | 29 +
arch/arm/include/asm/smp.h | 2 +-
arch/arm/kernel/cacheinfo.c | 51 +-
arch/arm/kernel/head-nommu.S | 1 +
arch/arm/kernel/head.S | 1 +
arch/arm/kernel/smp.c | 15 +-
arch/arm/kernel/topology.c | 13 +
arch/arm/mach-imx/pm-imx6.c | 26 +-
arch/arm/mach-imx/suspend-imx6.S | 6 +-
arch/arm/mm/alignment.c | 51 +-
arch/arm64/Kconfig | 1 +
.../boot/dts/freescale/imx8mm-verdin-ivy.dtsi | 4 +-
.../boot/dts/freescale/imx8mp-toradex-smarc.dtsi | 2 +-
.../boot/dts/freescale/imx8mp-verdin-ivy.dtsi | 4 +-
.../boot/dts/freescale/imx8mp-verdin-yavia.dtsi | 7 +-
.../boot/dts/freescale/imx95-aquila-clover.dts | 5 +
arch/arm64/boot/dts/freescale/imx95-aquila.dtsi | 8 +-
.../boot/dts/freescale/imx95-toradex-smarc.dtsi | 1 +
arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 1 +
arch/arm64/boot/dts/qcom/ipq9574.dtsi | 2 +-
arch/arm64/boot/dts/qcom/sdm845-google-common.dtsi | 2 +
.../dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 6 +
arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 6 +
arch/arm64/boot/dts/qcom/shikra.dtsi | 6 -
arch/arm64/boot/dts/ti/Makefile | 2 +
arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts | 2 +-
arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts | 2 +-
arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 6 +-
arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts | 6 +-
arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi | 2 +-
.../boot/dts/ti/k3-am625-tqma62xx-mba62xx.dts | 4 +-
arch/arm64/boot/dts/ti/k3-am625-tqma62xx.dtsi | 2 +-
.../boot/dts/ti/k3-am625-var-som-symphony.dts | 2 +-
arch/arm64/boot/dts/ti/k3-am625-var-som.dtsi | 4 +-
arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 5 +-
arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi | 2 +-
arch/arm64/include/asm/kvm_arm.h | 2 +-
arch/arm64/include/asm/kvm_host.h | 8 +-
arch/arm64/include/asm/kvm_mmu.h | 6 +-
arch/arm64/include/asm/pgtable.h | 3 +
arch/arm64/kernel/efi.c | 8 +-
arch/arm64/kernel/process.c | 17 +
arch/arm64/kernel/topology.c | 2 +-
arch/arm64/kvm/Kconfig | 2 +-
arch/arm64/kvm/arch_timer.c | 27 +-
arch/arm64/kvm/arm.c | 53 +-
arch/arm64/kvm/config.c | 78 ++
arch/arm64/kvm/hyp/exception.c | 5 +-
arch/arm64/kvm/hyp/include/hyp/adjust_pc.h | 28 +
arch/arm64/kvm/hyp/include/nvhe/pkvm.h | 2 +
arch/arm64/kvm/hyp/nvhe/hyp-main.c | 21 +-
arch/arm64/kvm/hyp/nvhe/pkvm.c | 37 +
arch/arm64/kvm/hyp/nvhe/sys_regs.c | 3 +
arch/arm64/kvm/hyp/vhe/switch.c | 11 +-
arch/arm64/kvm/hyp_trace.c | 12 +-
arch/arm64/kvm/nested.c | 17 +-
arch/arm64/kvm/ptdump.c | 75 +-
arch/arm64/kvm/sys_regs.c | 2 +
arch/arm64/kvm/vgic/vgic-its.c | 26 +-
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 33 +-
arch/arm64/kvm/vgic/vgic.c | 8 +-
arch/arm64/mm/contpte.c | 4 +-
arch/arm64/mm/fault.c | 5 +-
arch/loongarch/include/asm/barrier.h | 3 -
arch/loongarch/include/asm/hw_breakpoint.h | 8 +-
arch/loongarch/include/asm/loongarch.h | 7 +-
arch/loongarch/include/asm/numa.h | 2 +-
arch/loongarch/include/asm/processor.h | 1 +
arch/loongarch/include/asm/switch_to.h | 2 +-
arch/loongarch/kernel/cpu-probe.c | 2 +-
arch/loongarch/kernel/hw_breakpoint.c | 66 +-
arch/loongarch/kernel/irq.c | 3 +-
arch/loongarch/kernel/numa.c | 8 +-
arch/loongarch/kernel/traps.c | 13 +-
arch/loongarch/pci/pci.c | 3 +-
arch/m68k/68000/entry.S | 3 +-
arch/m68k/coldfire/entry.S | 3 +-
arch/microblaze/include/asm/entry.h | 13 +
arch/microblaze/include/asm/processor.h | 2 +-
arch/microblaze/kernel/entry.S | 348 ++++----
arch/microblaze/kernel/hw_exception_handler.S | 5 +
arch/microblaze/kernel/process.c | 5 +-
arch/microblaze/kernel/signal.c | 26 +
arch/mips/mm/mmap.c | 6 +-
arch/mips/mm/tlb-r4k.c | 21 +-
arch/powerpc/net/bpf_jit.h | 14 +-
arch/powerpc/net/bpf_jit_comp.c | 74 +-
arch/powerpc/net/bpf_jit_comp32.c | 7 +-
arch/powerpc/net/bpf_jit_comp64.c | 7 +-
arch/powerpc/platforms/pseries/iommu.c | 67 +-
arch/powerpc/platforms/pseries/plpks-sysfs.c | 20 +-
arch/powerpc/platforms/pseries/plpks.c | 41 +-
arch/powerpc/platforms/pseries/plpks_sed_ops.c | 12 +-
arch/riscv/boot/dts/spacemit/k3.dtsi | 2 +-
arch/riscv/include/asm/pgtable.h | 9 +-
arch/riscv/kernel/usercfi.c | 20 +-
arch/riscv/kvm/vcpu_sbi_replace.c | 12 +-
arch/x86/kernel/cpu/bugs.c | 2 +-
arch/x86/mm/pat/set_memory.c | 15 +
block/blk-iocost.c | 2 +
block/blk-mq.c | 2 +
block/bsg.c | 5 +-
crypto/algif_skcipher.c | 8 +-
crypto/ecc.c | 33 +-
crypto/testmgr.c | 11 +-
crypto/testmgr.h | 327 ++++++-
drivers/accel/qaic/sahara.c | 1 +
drivers/accessibility/speakup/selection.c | 6 +
drivers/acpi/apei/ghes.c | 6 +-
drivers/acpi/pfr_update.c | 2 +-
drivers/acpi/riscv/cppc.c | 26 +-
drivers/acpi/sbs.c | 6 +-
drivers/ata/Kconfig | 7 -
drivers/ata/Makefile | 1 -
drivers/ata/ahci_st.c | 78 +-
drivers/ata/libahci.c | 28 +-
drivers/ata/libahci_platform.c | 4 +
drivers/ata/libata-core.c | 75 +-
drivers/ata/libata-scsi.c | 5 +
drivers/ata/libata-sff.c | 37 +-
drivers/ata/sata_fsl.c | 6 +-
drivers/ata/sata_inic162x.c | 903 -------------------
drivers/ata/sata_qstor.c | 8 +-
drivers/base/devtmpfs.c | 108 ++-
drivers/block/amiflop.c | 71 +-
drivers/block/aoe/aoenet.c | 14 +-
drivers/block/floppy.c | 8 +-
drivers/block/loop.c | 6 +-
drivers/block/ublk_drv.c | 204 ++++-
drivers/block/xen-blkfront.c | 4 +-
drivers/block/zram/zram_drv.c | 21 +-
drivers/bluetooth/btusb.c | 2 +
drivers/char/hw_random/amd-rng.c | 2 +-
drivers/char/hw_random/ba431-rng.c | 2 +-
drivers/char/hw_random/core.c | 1 +
drivers/char/tpm/tpm-dev-common.c | 3 +
drivers/char/tpm/tpm2-cmd.c | 3 +-
drivers/char/tpm/tpm_nsc.c | 8 +-
drivers/clk/imx/clk.c | 15 +-
drivers/clk/mediatek/Kconfig | 1 +
drivers/clk/mstar/clk-msc313-mpll.c | 2 +-
drivers/clk/mvebu/ap-cpu-clk.c | 4 +-
drivers/clk/qcom/gcc-ipq5018.c | 10 +
drivers/clk/qcom/gcc-ipq5210.c | 1 +
drivers/clk/qcom/gcc-ipq5332.c | 1 +
drivers/clk/qcom/ipq-cmn-pll.c | 3 +-
drivers/clk/starfive/clk-starfive-jh7110-isp.c | 2 +-
drivers/clk/tenstorrent/atlantis-prcm.c | 24 +-
drivers/clocksource/timer-digicolor.c | 2 +
drivers/clocksource/timer-fttmr010.c | 2 +
drivers/cpufreq/Kconfig | 1 +
drivers/cpufreq/airoha-cpufreq.c | 2 +-
drivers/cpufreq/amd-pstate.c | 6 +-
drivers/cpufreq/cppc_cpufreq.c | 39 +-
drivers/cpufreq/cpufreq_conservative.c | 8 +-
drivers/cpufreq/cpufreq_governor.c | 29 +-
drivers/cpufreq/cpufreq_governor.h | 2 +
drivers/cpufreq/cpufreq_stats.c | 4 +
drivers/cpufreq/intel_pstate.c | 2 +
drivers/cpufreq/loongson3_cpufreq.c | 73 +-
drivers/crypto/amlogic/amlogic-gxl-core.c | 7 +-
drivers/crypto/atmel-aes.c | 2 +-
drivers/crypto/atmel-tdes.c | 6 +-
drivers/crypto/caam/caampkc.c | 6 +
drivers/crypto/ccp/dbc.c | 4 +-
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 20 +-
drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 10 +-
.../crypto/intel/qat/qat_common/adf_gen4_vf_mig.c | 5 +
drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c | 20 +-
drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h | 24 +-
drivers/crypto/intel/qat/qat_common/adf_vf_isr.c | 2 -
drivers/crypto/nx/nx-842.c | 2 +
drivers/crypto/omap-des.c | 2 +
drivers/crypto/omap-sham.c | 1 +
drivers/crypto/sa2ul.c | 119 +--
drivers/crypto/xilinx/zynqmp-aes-gcm.c | 2 +-
drivers/crypto/xilinx/zynqmp-sha.c | 2 +-
drivers/cxl/acpi.c | 20 +-
drivers/cxl/core/mbox.c | 8 +-
drivers/cxl/core/pci.c | 53 +-
drivers/cxl/core/port.c | 32 +
drivers/dax/super.c | 2 +-
drivers/dma/altera-msgdma.c | 10 +-
drivers/dma/loongson/loongson2-apb-cmc-dma.c | 4 +-
drivers/dma/sh/rz-dmac.c | 6 +-
drivers/edac/i10nm_base.c | 1 +
drivers/firewire/ohci-serdes-test.c | 4 +-
drivers/firewire/ohci.h | 2 +-
drivers/firmware/efi/libstub/Makefile | 2 +-
drivers/firmware/efi/libstub/efi-stub.c | 8 +
drivers/fpga/fpga-mgr.c | 2 +-
drivers/gpio/gpio-davinci.c | 6 +-
drivers/gpio/gpio-pca953x.c | 21 +-
drivers/gpio/gpiolib-cdev.c | 5 -
drivers/gpio/gpiolib.c | 12 +-
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 19 +
.../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v12_1.c | 44 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 105 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 17 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 14 -
drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 24 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 33 +
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 5 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 5 +
drivers/gpu/drm/amd/amdgpu/cik.c | 10 +
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 18 +-
drivers/gpu/drm/amd/amdgpu/si.c | 10 +
drivers/gpu/drm/amd/amdgpu/vi.c | 10 +
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 48 +-
drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 35 +-
drivers/gpu/drm/amd/amdkfd/kfd_device.c | 9 +-
.../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 9 +
drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c | 23 +-
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h | 9 +
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c | 2 +
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 2 +
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c | 2 +
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12_1.c | 2 +
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 2 +
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c | 2 +
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 4 +
drivers/gpu/drm/amd/amdkfd/kfd_process.c | 4 +-
.../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 30 +-
drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 23 +-
drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 60 +-
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 21 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 15 +-
.../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 24 +-
.../gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c | 2 +-
.../dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 2 +
.../drm/amd/display/modules/color/color_gamma.c | 3 +-
drivers/gpu/drm/amd/include/kgd_pp_interface.h | 2 +
drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 85 ++
drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 1 +
drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 33 +-
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 87 +-
drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 2 +
.../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 200 +++--
.../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 199 +++--
.../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 226 +++--
drivers/gpu/drm/arm/malidp_crtc.c | 1 +
drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 13 +-
drivers/gpu/drm/drm_panic.c | 5 +-
drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +
drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 32 +-
drivers/gpu/drm/msm/hdmi/hdmi_phy.c | 16 +-
drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h | 1 +
drivers/gpu/drm/nouveau/nouveau_abi16.c | 4 +
drivers/gpu/drm/nouveau/nouveau_connector.c | 1 +
drivers/gpu/drm/nouveau/nouveau_dp.c | 4 +-
drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_svm.c | 13 +
drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 2 +-
.../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild | 1 +
drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c | 35 +
drivers/gpu/drm/panel/panel-ebbg-ft8719.c | 2 +
drivers/gpu/drm/panel/panel-simple.c | 3 +
drivers/gpu/drm/ttm/ttm_bo_util.c | 11 +-
drivers/gpu/drm/xe/xe_guc.c | 16 +
drivers/gpu/drm/xe/xe_guc.h | 2 +
drivers/gpu/drm/xe/xe_guc_ads.c | 3 +-
drivers/gpu/drm/xe/xe_guc_ct.c | 6 +-
drivers/gpu/drm/xe/xe_guc_engine_activity.c | 6 +-
drivers/gpu/drm/xe/xe_guc_log.c | 7 +-
drivers/gpu/drm/xe/xe_guc_pc.c | 3 +-
drivers/gpu/drm/xe/xe_wa_oob.rules | 1 +
drivers/hte/hte-tegra194-test.c | 2 +-
drivers/hte/hte-tegra194.c | 10 +-
drivers/hv/mshv_vtl_main.c | 23 +-
drivers/hwmon/acpi_power_meter.c | 10 +-
drivers/hwmon/coretemp.c | 52 +-
drivers/hwmon/corsair-cpro.c | 9 +-
drivers/hwmon/gigabyte_waterforce.c | 5 +
drivers/hwmon/k10temp.c | 5 +-
drivers/hwmon/lm70.c | 8 +-
drivers/hwmon/lm95245.c | 6 +-
drivers/hwmon/mcp9982.c | 7 +-
drivers/hwmon/sht3x.c | 5 +-
drivers/hwmon/sht4x.c | 22 +-
drivers/hwmon/tmp102.c | 8 +-
drivers/hwmon/tmp108.c | 8 +-
drivers/i2c/busses/i2c-designware-master.c | 8 +
drivers/i2c/busses/i2c-mt7621.c | 9 +-
drivers/i2c/i2c-core-acpi.c | 6 +-
drivers/i3c/master.c | 7 +-
drivers/i3c/master/adi-i3c-master.c | 4 +
drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +-
drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c | 4 +-
drivers/iio/accel/adis16201.c | 10 +-
drivers/iio/accel/adxl313_spi.c | 2 +
drivers/iio/accel/adxl372_spi.c | 2 +
drivers/iio/accel/adxl380_spi.c | 2 +
drivers/iio/accel/kxcjk-1013.c | 1 +
drivers/iio/accel/mma9551.c | 1 +
drivers/iio/accel/mma9553.c | 1 +
drivers/iio/accel/sca3000.c | 2 +
drivers/iio/adc/ad4080.c | 3 +-
drivers/iio/adc/ad7192.c | 3 +
drivers/iio/adc/ad7606_spi.c | 6 +-
drivers/iio/adc/ad7768-1.c | 3 +
drivers/iio/adc/at91-sama5d2_adc.c | 1 +
drivers/iio/adc/max11205.c | 2 +
drivers/iio/adc/max14001.c | 1 +
drivers/iio/adc/mcp3911.c | 2 +
drivers/iio/adc/stm32-adc.c | 4 +-
drivers/iio/adc/ti-adc128s052.c | 8 +-
drivers/iio/adc/ti-ads1018.c | 6 +-
drivers/iio/adc/ti-ads1100.c | 107 ++-
drivers/iio/adc/ti-ads131m02.c | 2 +
drivers/iio/adc/ti-ads7950.c | 4 +-
drivers/iio/amplifiers/ad8366.c | 2 +
drivers/iio/dac/ad5755.c | 3 +
drivers/iio/dac/mcp47feb02.c | 31 +-
drivers/iio/dac/mcp4821.c | 7 +-
drivers/iio/frequency/adf4377.c | 3 +
drivers/iio/imu/adis16400.c | 3 +
drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 +
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 17 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 2 +
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 9 +
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 8 +-
drivers/iio/light/apds9306.c | 2 +-
drivers/iio/light/isl29028.c | 33 +-
drivers/iio/light/ltr501.c | 2 +-
drivers/iio/potentiometer/x9250.c | 7 +-
drivers/iio/pressure/bmp280-spi.c | 2 +
drivers/iio/pressure/dps310.c | 6 +-
drivers/infiniband/core/uverbs_std_types_dmabuf.c | 7 +-
drivers/infiniband/hw/hfi1/chip.c | 4 +-
drivers/infiniband/hw/hfi1/fault.c | 1 -
drivers/input/input.c | 4 +-
drivers/input/joystick/xpad.c | 1 +
drivers/input/keyboard/matrix_keypad.c | 3 -
drivers/iommu/amd/init.c | 23 +-
.../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 131 ++-
drivers/iommu/dma-iommu.c | 20 +-
drivers/iommu/generic_pt/iommu_pt.h | 30 +-
drivers/iommu/intel/iommu.h | 17 +-
drivers/iommu/iommufd/io_pagetable.c | 3 +
drivers/iommu/iommufd/pages.c | 13 +-
drivers/irqchip/irq-atmel-aic.c | 2 +-
drivers/irqchip/irq-atmel-aic5.c | 2 +-
drivers/irqchip/irq-gic-v3-its.c | 2 +-
drivers/irqchip/irq-imx-intmux.c | 15 +-
drivers/irqchip/irq-jcore-aic.c | 4 +-
drivers/irqchip/irq-mchp-eic.c | 4 +-
drivers/irqchip/irq-msi-lib.c | 1 +
drivers/irqchip/irq-renesas-rzv2h.c | 6 +-
drivers/irqchip/irq-riscv-imsic-platform.c | 2 +-
drivers/leds/flash/leds-ktd2692.c | 10 +-
drivers/mailbox/bcm74110-mailbox.c | 13 +
drivers/mailbox/mailbox-altera.c | 2 +-
drivers/mailbox/mtk-cmdq-mailbox.c | 7 +-
drivers/mailbox/qcom-ipcc.c | 6 +
drivers/md/dm-bufio.c | 45 +-
drivers/md/dm-snap-persistent.c | 7 +-
drivers/md/dm-vdo/indexer/chapter-index.c | 15 +-
drivers/md/dm-vdo/indexer/delta-index.c | 17 +-
drivers/md/dm-vdo/indexer/volume.c | 6 -
drivers/md/dm-writecache.c | 54 +-
drivers/md/dm.c | 2 +-
drivers/md/md.c | 17 +-
drivers/md/raid5-cache.c | 34 +-
drivers/md/raid5.c | 8 +-
drivers/md/raid5.h | 1 +
.../extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 4 +-
drivers/media/common/cypress_firmware.c | 2 +
drivers/media/common/saa7146/saa7146_core.c | 3 +-
drivers/media/dvb-frontends/stv0900_core.c | 2 +
drivers/media/dvb-frontends/stv090x.c | 2 +
drivers/media/i2c/adv7180.c | 2 +-
drivers/media/i2c/adv748x/adv748x-core.c | 13 +-
drivers/media/i2c/adv7604.c | 3 +-
drivers/media/i2c/alvium-csi2.c | 1 +
drivers/media/i2c/cvs/core.c | 16 +-
drivers/media/i2c/cvs/v4l2.c | 13 +-
drivers/media/i2c/imx219.c | 30 +-
drivers/media/i2c/og01a1b.c | 5 +
drivers/media/i2c/ov2735.c | 1 +
drivers/media/i2c/ov5647.c | 4 +
drivers/media/i2c/ov8856.c | 32 +-
drivers/media/i2c/tc358743.c | 3 +-
drivers/media/pci/cx18/cx18-driver.c | 9 +-
drivers/media/pci/cx88/cx88-input.c | 22 +-
drivers/media/pci/hws/hws.h | 4 +-
drivers/media/pci/hws/hws_pci.c | 2 +-
drivers/media/pci/hws/hws_reg.h | 3 +-
drivers/media/pci/hws/hws_v4l2_ioctl.c | 5 +-
drivers/media/pci/hws/hws_video.c | 6 +-
drivers/media/pci/saa7134/saa7134-input.c | 7 +-
drivers/media/pci/tw68/tw68-core.c | 2 +-
drivers/media/pci/tw686x/tw686x-core.c | 10 +
drivers/media/platform/amphion/vpu_core.c | 19 +-
drivers/media/platform/amphion/vpu_drv.c | 1 +
.../media/platform/arm/mali-c55/mali-c55-core.c | 20 +-
drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 1 +
.../media/platform/arm/mali-c55/mali-c55-params.c | 3 +
.../media/platform/arm/mali-c55/mali-c55-stats.c | 18 +-
drivers/media/platform/atmel/atmel-isi.c | 7 +-
.../platform/chips-media/wave5/wave5-vpu-dec.c | 8 +-
.../media/platform/chips-media/wave5/wave5-vpu.c | 7 +
.../platform/chips-media/wave5/wave5-vpuapi.c | 15 +-
.../media/platform/imagination/e5010-jpeg-enc.c | 4 +-
drivers/media/platform/m2m-deinterlace.c | 2 +-
drivers/media/platform/marvell/Kconfig | 1 +
drivers/media/platform/marvell/mmp-driver.c | 5 +-
.../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 21 +-
.../media/platform/mediatek/mdp3/mtk-mdp3-comp.c | 14 +-
.../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 2 +
drivers/media/platform/mediatek/vpu/mtk_vpu.c | 2 +
.../media/platform/microchip/microchip-isc-base.c | 56 +-
.../media/platform/microchip/microchip-isc-clk.c | 7 +-
drivers/media/platform/microchip/microchip-isc.h | 1 +
.../platform/microchip/microchip-sama5d2-isc.c | 11 +
.../platform/microchip/microchip-sama7g5-isc.c | 11 +
drivers/media/platform/nuvoton/npcm-video.c | 9 +-
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 21 +-
drivers/media/platform/qcom/camss/camss-vfe-17x.c | 46 +-
drivers/media/platform/qcom/camss/camss-vfe.c | 14 +-
drivers/media/platform/qcom/camss/camss.c | 25 +-
drivers/media/platform/qcom/iris/iris_core.h | 6 +
drivers/media/platform/qcom/iris/iris_probe.c | 62 +-
drivers/media/platform/qcom/iris/iris_vdec.c | 10 -
drivers/media/platform/qcom/iris/iris_vidc.c | 6 +-
drivers/media/platform/qcom/iris/iris_vpu_common.c | 7 +-
drivers/media/platform/qcom/venus/core.c | 66 +-
drivers/media/platform/qcom/venus/core.h | 6 +
.../platform/renesas/rzv2h-ivc/rzv2h-ivc-dev.c | 11 +-
drivers/media/platform/rockchip/rga/rga-hw.c | 8 -
drivers/media/platform/rockchip/rga/rga.c | 4 +-
drivers/media/platform/rockchip/rga/rga.h | 1 +
drivers/media/platform/rockchip/rkvdec/rkvdec.c | 3 -
.../media/platform/samsung/exynos4-is/fimc-lite.c | 3 +-
.../media/platform/st/sti/delta/delta-mjpeg-hdr.c | 7 +-
drivers/media/platform/st/stm32/stm32-csi.c | 5 +-
.../media/platform/synopsys/hdmirx/snps_hdmirx.c | 80 +-
drivers/media/platform/ti/davinci/vpif_capture.c | 5 +-
drivers/media/platform/ti/davinci/vpif_display.c | 3 +
drivers/media/platform/verisilicon/hantro_drv.c | 75 +-
.../platform/verisilicon/hantro_g1_mpeg2_dec.c | 5 +
.../verisilicon/rockchip_vpu981_hw_av1_dec.c | 68 +-
drivers/media/rc/ene_ir.c | 4 +-
drivers/media/rc/ir-hix5hd2.c | 5 +-
drivers/media/rc/ir_toy.c | 2 +-
drivers/media/rc/meson-ir-tx.c | 20 +-
drivers/media/rc/rc-main.c | 125 +--
drivers/media/rc/redrat3.c | 28 +-
drivers/media/rc/serial_ir.c | 2 +-
drivers/media/rc/streamzap.c | 1 +
drivers/media/rc/sunxi-cir.c | 2 +-
drivers/media/test-drivers/vicodec/codec-fwht.h | 2 +-
drivers/media/test-drivers/vicodec/vicodec-core.c | 16 +-
drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +
drivers/media/test-drivers/vidtv/vidtv_demod.c | 9 -
drivers/media/test-drivers/vim2m.c | 29 +-
drivers/media/test-drivers/vimc/vimc-sensor.c | 8 +-
drivers/media/test-drivers/vivid/vivid-core.c | 1 +
drivers/media/test-drivers/vivid/vivid-vid-cap.c | 13 +
drivers/media/usb/au0828/au0828-core.c | 4 +
drivers/media/usb/au0828/au0828-dvb.c | 19 +-
drivers/media/usb/cx231xx/cx231xx-audio.c | 15 +-
drivers/media/usb/cx231xx/cx231xx-cards.c | 2 +-
drivers/media/usb/cx231xx/cx231xx.h | 2 +-
drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 14 +-
drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 2 +
drivers/media/usb/em28xx/em28xx-core.c | 3 -
drivers/media/usb/em28xx/em28xx-video.c | 2 +-
drivers/media/usb/go7007/go7007-usb.c | 8 +
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c | 1 +
drivers/media/usb/uvc/uvc_ctrl.c | 2 +-
drivers/media/v4l2-core/v4l2-common.c | 2 +-
drivers/media/v4l2-core/v4l2-ctrls-core.c | 19 +-
drivers/media/v4l2-core/v4l2-isp.c | 15 +-
drivers/memory/brcmstb_dpfe.c | 24 +-
drivers/memory/renesas-rpc-if.c | 1 +
drivers/memory/stm32_omm.c | 2 +
drivers/mfd/Kconfig | 2 +
drivers/mfd/ab8500-core.c | 44 +-
drivers/mfd/bq257xx.c | 10 +
drivers/mfd/da903x.c | 34 +-
drivers/mfd/tps65217.c | 69 +-
drivers/mfd/twl-core.c | 23 +-
drivers/mfd/wcd934x.c | 8 +-
drivers/misc/fastrpc.c | 192 +++--
drivers/misc/issei/Kconfig | 1 +
drivers/misc/mei/vsc-tp.c | 2 +-
drivers/misc/tifm_core.c | 1 -
drivers/mtd/chips/cfi_cmdset_0002.c | 15 +
drivers/mtd/maps/amd76xrom.c | 2 +
drivers/mtd/maps/l440gx.c | 2 -
drivers/mtd/maps/pci.c | 2 +-
drivers/mtd/mtdcore.c | 2 +-
drivers/mtd/mtdsuper.c | 4 +-
drivers/mtd/nand/raw/atmel/nand-controller.c | 6 +-
drivers/mtd/nand/raw/ndfc.c | 21 +-
.../mtd/nand/raw/nuvoton-ma35d1-nand-controller.c | 1 -
drivers/mtd/nand/raw/qcom_nandc.c | 8 +-
drivers/mtd/nand/raw/sunxi_nand.c | 5 +-
drivers/mtd/parsers/qcomsmempart.c | 4 +-
drivers/mtd/spi-nor/core.c | 9 +
drivers/mtd/spi-nor/sfdp.c | 8 +
drivers/net/bonding/bond_main.c | 2 +-
drivers/net/ethernet/broadcom/bgmac.c | 10 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 49 +-
drivers/net/ethernet/broadcom/tg3.c | 42 +-
drivers/net/ethernet/google/gve/gve_flow_rule.c | 1 +
drivers/net/ethernet/hisilicon/hisi_femac.c | 1 +
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 40 +-
drivers/net/ethernet/mellanox/mlxsw/core.c | 4 +-
drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c | 4 +-
.../net/ethernet/mellanox/mlxsw/spectrum_span.c | 2 +-
drivers/net/macvlan.c | 3 +-
drivers/net/netdevsim/bpf.c | 11 +
drivers/net/ppp/ppp_generic.c | 1 +
drivers/net/ppp/pppoe.c | 22 +-
drivers/net/usb/pegasus.c | 12 +-
drivers/net/usb/r8152.c | 10 +-
drivers/net/veth.c | 5 +-
drivers/net/wireless/ath/ath11k/dp.c | 2 +
drivers/net/wireless/ath/ath12k/wmi.c | 17 +
.../broadcom/brcm80211/brcmsmac/phy/phy_n.c | 2 +-
drivers/net/wireless/mediatek/mt76/eeprom.c | 17 +-
drivers/net/wireless/mediatek/mt76/mac80211.c | 14 +
drivers/net/wireless/mediatek/mt76/mt76.h | 2 +
drivers/net/wireless/mediatek/mt76/mt7615/init.c | 17 +-
drivers/net/wireless/mediatek/mt76/mt7615/main.c | 6 +-
.../net/wireless/mediatek/mt76/mt7615/pci_init.c | 1 +
drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 19 +-
.../net/wireless/mediatek/mt76/mt76x02_usb_mcu.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 3 +
drivers/net/wireless/mediatek/mt76/mt7921/main.c | 1 +
drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 3 +
drivers/net/wireless/mediatek/mt76/mt7925/main.c | 2 +
drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 11 +-
drivers/net/wireless/mediatek/mt76/mt792x_core.c | 12 +-
drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 12 +-
drivers/net/wireless/mediatek/mt76/tx.c | 2 +-
drivers/net/wireless/mediatek/mt76/usb.c | 31 +-
drivers/net/wireless/realtek/rtw88/mac80211.c | 2 +-
drivers/net/wireless/realtek/rtw89/fw.c | 32 +
drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c | 4 +-
drivers/net/wireless/realtek/rtw89/usb.c | 13 +-
drivers/net/wireless/realtek/rtw89/wow.c | 6 +-
drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | 5 +
drivers/nvme/host/auth.c | 15 +-
drivers/nvme/host/core.c | 15 +-
drivers/nvme/host/rdma.c | 1 +
drivers/nvme/host/sysfs.c | 14 +-
drivers/nvme/host/tcp.c | 58 +-
drivers/nvme/target/auth.c | 1 +
drivers/nvme/target/configfs.c | 2 +
drivers/nvme/target/fabrics-cmd-auth.c | 8 +-
drivers/nvme/target/fabrics-cmd.c | 4 +
drivers/nvme/target/fc.c | 10 +-
drivers/nvme/target/io-cmd-bdev.c | 5 +-
drivers/nvme/target/io-cmd-file.c | 4 +-
drivers/nvme/target/pci-epf.c | 30 +-
drivers/nvme/target/pr.c | 2 +-
drivers/nvme/target/rdma.c | 5 +-
drivers/nvme/target/tcp.c | 26 +-
drivers/nvme/target/zns.c | 10 +
drivers/nvmem/rockchip-otp.c | 15 +-
drivers/parisc/eisa_enumerator.c | 15 +-
drivers/pci/controller/dwc/pci-imx6.c | 5 +-
drivers/pci/controller/dwc/pcie-qcom-ep.c | 2 +
drivers/pci/controller/dwc/pcie-qcom.c | 5 +-
drivers/pci/controller/dwc/pcie-rcar-gen4.c | 54 ++
drivers/pci/controller/pcie-aspeed.c | 9 +-
drivers/pci/controller/pcie-rockchip-ep.c | 13 -
drivers/pci/controller/pcie-rockchip-host.c | 20 -
drivers/pci/controller/pcie-rockchip.c | 14 +-
drivers/pci/controller/pcie-rockchip.h | 3 -
drivers/pci/controller/pcie-rzg3s-host.c | 51 +-
drivers/pci/controller/pcie-xilinx-dma-pl.c | 10 +-
drivers/pci/controller/vmd.c | 55 +-
drivers/pci/doe.c | 5 +-
drivers/pci/endpoint/functions/pci-epf-vntb.c | 85 +-
drivers/pci/hotplug/pciehp_core.c | 2 +-
drivers/pci/pci-label.c | 2 +-
drivers/pci/pci.c | 33 +-
drivers/pci/pcie/aer.c | 7 +-
drivers/pci/probe.c | 5 +-
drivers/pci/pwrctrl/core.c | 3 +
drivers/pci/pwrctrl/generic.c | 1 +
drivers/pci/quirks.c | 26 +-
drivers/pci/xen-pcifront.c | 11 +-
drivers/peci/controller/peci-aspeed.c | 6 +-
drivers/peci/controller/peci-npcm.c | 6 +-
drivers/perf/xgene_pmu.c | 4 +-
drivers/phy/apple/atc.c | 8 +-
drivers/pinctrl/renesas/pinctrl-rzt2h.c | 126 ++-
drivers/pinctrl/stm32/pinctrl-stm32.c | 6 +-
drivers/platform/x86/amd/hfi/hfi.c | 20 +-
drivers/platform/x86/amd/pmc/pmc.c | 20 +-
drivers/platform/x86/amd/pmf/core.c | 1 +
drivers/platform/x86/amd/pmf/spc.c | 8 +-
drivers/platform/x86/amd/pmf/sps.c | 10 +-
drivers/platform/x86/asus-wmi.c | 72 +-
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 82 +-
.../x86/hp/hp-bioscfg/passwdobj-attributes.c | 16 +-
.../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 5 +-
drivers/platform/x86/hp/hp-wmi.c | 7 +-
drivers/platform/x86/intel/int3472/discrete.c | 37 +-
drivers/platform/x86/intel/pmt/class.c | 9 +-
.../x86/intel/uncore-frequency/uncore-frequency.c | 2 +-
drivers/platform/x86/intel/vsec.c | 2 +-
drivers/platform/x86/lenovo/wmi-capdata.c | 18 +-
drivers/platform/x86/oxpec.c | 68 +-
drivers/platform/x86/siemens/simatic-ipc.c | 21 +-
drivers/platform/x86/tuxedo/nb04/wmi_ab.c | 8 +-
drivers/power/supply/ab8500_fg.c | 69 +-
drivers/power/supply/bq27xxx_battery.c | 12 +-
drivers/power/supply/cros_charge-control.c | 29 +-
drivers/power/supply/generic-adc-battery.c | 2 +-
drivers/power/supply/ltc2941-battery-gauge.c | 6 +-
drivers/power/supply/power_supply_core.c | 84 +-
drivers/power/supply/qcom_battmgr.c | 26 +-
drivers/power/supply/qcom_smbx.c | 109 ++-
drivers/pps/generators/pps_gen.c | 11 +-
drivers/pwm/pwm-tiehrpwm.c | 3 +
drivers/regulator/core.c | 4 +
drivers/regulator/rt6190-regulator.c | 18 +-
drivers/remoteproc/remoteproc_elf_loader.c | 23 +-
drivers/rtc/rtc-cmos.c | 32 +-
drivers/rtc/rtc-pcf8563.c | 2 +-
drivers/scsi/libiscsi_tcp.c | 3 +-
drivers/scsi/scsi_ioctl.c | 11 +-
drivers/scsi/sd.c | 10 +-
drivers/sh/intc/core.c | 11 +-
drivers/sh/maple/maple.c | 4 +-
drivers/slimbus/messaging.c | 2 +-
drivers/soc/fsl/dpio/dpio-driver.c | 9 +-
drivers/soc/fsl/qe/tsa.c | 16 +-
drivers/soc/loongson/loongson2_pm.c | 2 +-
drivers/soc/qcom/pmic_glink_altmode.c | 4 +-
drivers/soc/qcom/qcom-geni-se.c | 49 +-
drivers/soc/samsung/exynos-pmu.c | 61 +-
drivers/spi/atmel-quadspi.c | 24 +-
drivers/spi/spi-amd.c | 17 +
drivers/spi/spi-bcm-qspi.c | 3 +-
drivers/spi/spi-bcm2835.c | 4 +-
drivers/spi/spi-cadence-xspi.c | 52 +-
drivers/spi/spi-ch341.c | 6 +
drivers/spi/spi-jcore.c | 2 +
drivers/spi/spi-ljca.c | 7 +-
drivers/spi/spi-npcm-fiu.c | 8 +
drivers/spi/spi-qpic-snand.c | 3 +
drivers/spi/spi-stm32.c | 3 +-
drivers/spi/spi-zynq-qspi.c | 13 +-
drivers/staging/greybus/uart.c | 32 +-
drivers/staging/media/av7110/sp8870.c | 5 +-
drivers/staging/media/imx/imx-media-csc-scaler.c | 1 +
drivers/staging/media/meson/vdec/vdec.c | 2 +-
drivers/staging/rtl8723bs/hal/sdio_ops.c | 7 +
.../int340x_thermal/processor_thermal_device.c | 10 +-
drivers/thermal/intel/intel_powerclamp.c | 3 +-
drivers/tty/serial/8250/8250_exar.c | 36 +-
drivers/tty/serial/8250/8250_lpss.c | 7 +-
drivers/tty/serial/8250/8250_omap.c | 3 +
drivers/tty/serial/8250/8250_port.c | 4 +-
drivers/tty/serial/amba-pl011.c | 37 +-
drivers/tty/serial/pmac_zilog.c | 4 +-
drivers/tty/serial/sc16is7xx.c | 4 +-
drivers/ufs/core/ufs_bsg.c | 23 +-
drivers/ufs/core/ufshcd.c | 91 +-
drivers/usb/class/cdc-acm.c | 6 +-
drivers/usb/core/driver.c | 3 +-
drivers/usb/core/quirks.c | 3 +
drivers/usb/fotg210/fotg210-udc.c | 17 +-
drivers/usb/gadget/legacy/inode.c | 4 +-
drivers/usb/host/octeon-hcd.c | 41 +-
drivers/usb/host/xhci-pci-prom21.c | 3 +
drivers/usb/host/xhci-pci.c | 3 +
drivers/usb/host/xhci-pci.h | 3 +
drivers/usb/host/xhci-ring.c | 9 +-
drivers/usb/host/xhci.c | 11 +-
drivers/usb/serial/option.c | 5 +
drivers/usb/serial/sierra.c | 3 +-
drivers/usb/serial/usb_wwan.c | 3 +
drivers/usb/typec/ucsi/ucsi.c | 3 +-
drivers/usb/typec/ucsi/ucsi_ccg.c | 37 +-
drivers/vfio/pci/mlx5/cmd.c | 2 +-
drivers/vfio/pci/vfio_pci_rdwr.c | 3 -
drivers/video/fbdev/atmel_lcdfb.c | 13 +-
drivers/video/fbdev/core/bitblit.c | 7 +-
drivers/video/fbdev/core/fb_info.c | 1 +
drivers/video/fbdev/core/fbcon.c | 46 +
drivers/video/fbdev/core/fbcon.h | 19 +-
drivers/video/fbdev/core/fbcon_rotate.c | 10 +-
drivers/video/fbdev/kyro/fbdev.c | 4 +-
drivers/video/fbdev/nvidia/nvidia.c | 1 +
drivers/video/fbdev/sh_mobile_lcdcfb.c | 43 +-
drivers/video/fbdev/smscufx.c | 9 +-
drivers/video/fbdev/ssd1307fb.c | 6 +-
drivers/video/fbdev/udlfb.c | 9 +-
drivers/video/fbdev/xen-fbfront.c | 7 +-
drivers/watchdog/hpwdt.c | 2 +-
drivers/xen/gntdev-dmabuf.c | 4 +-
drivers/xen/gntdev.c | 7 +
drivers/xen/privcmd.c | 47 +-
drivers/xen/xen-pciback/pci_stub.c | 7 +-
fs/affs/bitmap.c | 2 +-
fs/aio.c | 18 +-
fs/backing-file.c | 44 +-
fs/btrfs/inode.c | 3 -
fs/btrfs/super.c | 3 +
fs/btrfs/volumes.c | 6 +-
fs/ceph/addr.c | 15 +-
fs/ceph/caps.c | 6 +
fs/ceph/crypto.c | 11 +
fs/ceph/mds_client.c | 28 +-
fs/ceph/mdsmap.c | 12 +-
fs/ceph/snap.c | 7 +-
fs/ceph/xattr.c | 10 +
fs/crypto/keysetup.c | 8 +-
fs/dax.c | 14 +-
fs/dcache.c | 16 +-
fs/dlm/lowcomms.c | 6 +-
fs/erofs/decompressor.c | 2 +-
fs/erofs/ishare.c | 43 +-
fs/exfat/exfat_fs.h | 88 +-
fs/exfat/file.c | 258 +++---
fs/exfat/inode.c | 16 +-
fs/exfat/iomap.c | 53 +-
fs/exfat/namei.c | 4 +-
fs/exportfs/expfs.c | 6 +-
fs/ext4/balloc.c | 2 +-
fs/ext4/crypto.c | 9 +
fs/ext4/ext4.h | 3 +
fs/ext4/extents.c | 26 +-
fs/ext4/indirect.c | 17 +
fs/ext4/inode.c | 19 +-
fs/ext4/ioctl.c | 3 +-
fs/ext4/namei.c | 11 +-
fs/ext4/super.c | 29 +-
fs/f2fs/compress.c | 10 +-
fs/f2fs/data.c | 13 +-
fs/f2fs/f2fs.h | 3 +
fs/f2fs/file.c | 52 +-
fs/f2fs/segment.c | 59 +-
fs/f2fs/super.c | 54 +-
fs/fat/fat.h | 2 +-
fs/fat/fatent.c | 21 +-
fs/fat/file.c | 3 +-
fs/fat/misc.c | 6 +-
fs/fs-writeback.c | 15 +-
fs/fs_pin.c | 9 +-
fs/fuse/file.c | 53 +-
fs/fuse/notify.c | 2 +-
fs/fuse/virtio_fs.c | 51 +-
fs/gfs2/glops.c | 10 +-
fs/gfs2/lops.c | 4 +-
fs/inode.c | 15 +-
fs/iomap/bio.c | 2 +-
fs/iomap/buffered-io.c | 3 +-
fs/iomap/direct-io.c | 16 +-
fs/iomap/fiemap.c | 8 +-
fs/iomap/internal.h | 9 +
fs/iomap/ioend.c | 3 +-
fs/isofs/inode.c | 2 +
fs/isofs/isofs.h | 2 +
fs/isofs/rock.c | 11 +-
fs/jbd2/journal.c | 2 +-
fs/namespace.c | 7 +-
fs/nilfs2/dir.c | 34 +
fs/nilfs2/inode.c | 8 +-
fs/nilfs2/ioctl.c | 2 +-
fs/nilfs2/mdt.c | 6 +-
fs/nilfs2/page.c | 50 +-
fs/nilfs2/page.h | 4 +-
fs/nilfs2/recovery.c | 2 +-
fs/nilfs2/segment.c | 12 +-
fs/nilfs2/sysfs.c | 5 +-
fs/nilfs2/the_nilfs.c | 34 +-
fs/notify/fanotify/fanotify.c | 7 +-
fs/notify/fanotify/fanotify.h | 21 +-
fs/ntfs/attrib.c | 142 ++-
fs/ntfs/attrlist.c | 10 +-
fs/ntfs/dir.c | 2 +
fs/ntfs/ea.c | 67 +-
fs/ntfs/file.c | 58 +-
fs/ntfs/inode.c | 46 +-
fs/ntfs/iomap.c | 16 +-
fs/ntfs/logfile.c | 11 +-
fs/ntfs/mft.c | 954 ++++++++++++++-------
fs/ntfs/mft.h | 19 +-
fs/ntfs/namei.c | 24 +-
fs/ntfs/ntfs.h | 3 +-
fs/ntfs/runlist.c | 98 ++-
fs/ntfs/runlist.h | 3 +
fs/ntfs/super.c | 401 +++++++--
fs/ntfs/volume.h | 15 +
fs/ntfs3/attrib.c | 15 +
fs/ntfs3/fslog.c | 29 +-
fs/ntfs3/index.c | 13 +-
fs/ntfs3/inode.c | 7 +-
fs/ocfs2/alloc.c | 9 +-
fs/ocfs2/cluster/heartbeat.c | 26 +-
fs/ocfs2/cluster/nodemanager.c | 7 +-
fs/ocfs2/dir.c | 76 +-
fs/ocfs2/dlmglue.c | 4 +
fs/ocfs2/file.c | 18 +-
fs/ocfs2/inode.c | 37 +-
fs/ocfs2/journal.c | 3 +-
fs/ocfs2/journal.h | 1 -
fs/ocfs2/super.c | 16 +-
fs/ocfs2/xattr.c | 149 +++-
fs/pidfs.c | 43 +-
fs/proc/generic.c | 5 +-
fs/proc/task_mmu.c | 6 +-
fs/read_write.c | 8 +-
fs/signalfd.c | 28 +-
fs/splice.c | 12 +-
fs/stat.c | 6 +-
fs/udf/inode.c | 43 +-
fs/udf/super.c | 5 +-
fs/verity/enable.c | 8 +
fs/verity/fsverity_private.h | 8 +
fs/verity/measure.c | 10 +
fs/verity/open.c | 47 +-
fs/verity/read_metadata.c | 14 +-
fs/verity/signature.c | 55 +-
fs/xfs/scrub/agheader.c | 15 +-
fs/xfs/scrub/xfarray.c | 69 +-
include/kvm/arm_arch_timer.h | 15 +
include/kvm/arm_vgic.h | 1 +
include/linux/fault-inject.h | 10 +-
include/linux/fs.h | 4 +-
include/linux/hugetlb.h | 3 +-
include/linux/libata.h | 1 +
include/linux/memcontrol.h | 26 +-
include/linux/netdevice.h | 7 +
include/linux/panic.h | 3 +-
include/linux/pci.h | 2 +-
include/linux/rtc.h | 2 +
include/math-emu/op-common.h | 23 +-
include/math-emu/soft-fp.h | 8 +
include/media/rc-map.h | 2 -
include/media/v4l2-ctrls.h | 6 +
include/net/addrconf.h | 3 +
include/net/inet_frag.h | 1 +
include/net/ip.h | 25 -
include/net/ip6_route.h | 37 -
include/net/xfrm.h | 17 +
include/uapi/linux/iommufd.h | 4 +-
include/uapi/linux/media/arm/mali-c55-config.h | 2 +
init/main.c | 6 +-
init/version.c | 3 +
ipc/mqueue.c | 7 +
ipc/msgutil.c | 3 +-
ipc/namespace.c | 7 +
ipc/shm.c | 25 +-
kernel/bpf/queue_stack_maps.c | 3 +
kernel/cgroup/cgroup.c | 2 +-
kernel/cgroup/cpuset.c | 4 +-
kernel/cpu_pm.c | 9 +-
kernel/debug/gdbstub.c | 55 +-
kernel/fork.c | 3 +-
kernel/irq/internals.h | 1 +
kernel/irq/kexec.c | 2 +-
kernel/irq/manage.c | 43 +-
kernel/liveupdate/kexec_handover.c | 7 +
kernel/nstree.c | 80 +-
kernel/panic.c | 82 +-
kernel/power/energy_model.c | 4 +-
kernel/resource.c | 2 +-
kernel/sched/cpufreq_schedutil.c | 14 +-
kernel/sched/ext/ext.c | 150 ++--
kernel/sched/fair.c | 29 +-
kernel/seccomp.c | 7 +-
kernel/sys.c | 3 +
kernel/time/clocksource.c | 2 +-
kernel/time/itimer.c | 2 +-
kernel/time/namespace.c | 2 +-
kernel/time/posix-cpu-timers.c | 4 +-
kernel/time/posix-stubs.c | 4 +-
kernel/time/posix-timers.c | 25 +-
kernel/time/tick-sched.c | 14 +-
kernel/time/timekeeping.c | 8 +-
kernel/trace/Kconfig | 1 +
kernel/trace/ring_buffer.c | 2 +
kernel/ucount.c | 21 +-
kernel/user_namespace.c | 5 +-
lib/842/842_decompress.c | 7 +-
lib/buildid.c | 4 +
lib/cmdline.c | 13 +-
lib/decompress_bunzip2.c | 6 +-
lib/fault-inject.c | 7 +-
lib/iov_iter.c | 4 +
lib/kobject_uevent.c | 2 +-
lib/plist.c | 7 +
lib/raid/raid6/x86/avx2.c | 6 +
lib/raid/raid6/x86/avx512.c | 6 +
lib/raid/raid6/x86/recov_avx2.c | 2 +
lib/raid/raid6/x86/recov_avx512.c | 2 +
lib/raid/xor/x86/xor-avx.c | 1 +
lib/stackdepot.c | 2 +-
lib/tests/cmdline_kunit.c | 39 +
mm/alloc_tag.c | 2 +-
mm/damon/core.c | 118 ++-
mm/damon/paddr.c | 8 +-
mm/damon/sysfs-schemes.c | 6 +-
mm/damon/sysfs.c | 11 +-
mm/damon/tests/core-kunit.h | 381 +++++++-
mm/damon/vaddr.c | 10 +-
mm/execmem.c | 4 +-
mm/huge_memory.c | 23 +-
mm/hugetlb.c | 151 +++-
mm/hugetlb_cgroup.c | 33 +
mm/ksm.c | 5 +-
mm/list_lru.c | 7 +-
mm/madvise.c | 22 +-
mm/memcontrol-v1.h | 5 +-
mm/memcontrol.c | 181 ++--
mm/memfd.c | 31 +-
mm/memory.c | 24 +-
mm/mempolicy.c | 25 +-
mm/mlock.c | 2 +-
mm/mremap.c | 33 +-
mm/nommu.c | 6 +-
mm/page_alloc.c | 83 +-
mm/page_alloc.h | 2 +
mm/page_counter.c | 21 +-
mm/page_isolation.c | 40 +-
mm/page_table_check.c | 4 +-
mm/page_vma_mapped.c | 28 +-
mm/percpu.c | 5 +-
mm/shmem.c | 17 +-
mm/swap.h | 6 +-
mm/swap_state.c | 29 +-
mm/truncate.c | 3 +-
mm/userfaultfd.c | 6 +-
mm/vma.c | 16 +-
mm/vmscan.c | 21 +-
mm/workingset.c | 5 +-
mm/zswap.c | 5 +-
net/bluetooth/6lowpan.c | 1 +
net/bluetooth/hci_debugfs.c | 9 +
net/bluetooth/l2cap_core.c | 41 +-
net/bluetooth/l2cap_sock.c | 4 +
net/bluetooth/selftest.c | 1 +
net/bluetooth/smp.c | 1 +
net/ceph/mon_client.c | 3 +
net/ceph/osd_client.c | 13 +-
net/ceph/osdmap.c | 18 +-
net/core/dev.c | 8 +
net/core/gro.c | 4 +
net/core/net_namespace.c | 4 +-
net/core/skbuff.c | 13 +-
net/ipv4/inet_connection_sock.c | 10 +-
net/ipv4/inet_fragment.c | 5 +
net/ipv4/inet_hashtables.c | 5 +-
net/ipv4/ip_fragment.c | 3 +-
net/ipv4/ip_gre.c | 1 +
net/ipv4/ipmr.c | 22 +-
net/ipv4/netfilter/nf_reject_ipv4.c | 5 +
net/ipv4/route.c | 4 +-
net/ipv4/syncookies.c | 2 +
net/ipv4/sysctl_net_ipv4.c | 2 +
net/ipv4/tcp_cong.c | 4 +-
net/ipv4/tcp_input.c | 4 +-
net/ipv4/tcp_output.c | 2 +-
net/ipv6/addrconf.c | 46 +-
net/ipv6/inet6_hashtables.c | 4 +-
net/ipv6/ip6_gre.c | 1 +
net/ipv6/ip6mr.c | 5 +-
net/ipv6/netfilter/nf_reject_ipv6.c | 5 +
net/ipv6/reassembly.c | 4 +-
net/ipv6/route.c | 2 +-
net/l2tp/l2tp_core.c | 51 +-
net/l2tp/l2tp_core.h | 6 +-
net/l2tp/l2tp_debugfs.c | 4 +-
net/l2tp/l2tp_netlink.c | 11 +-
net/l2tp/l2tp_ppp.c | 8 +-
net/mac80211/tx.c | 52 +-
net/mptcp/protocol.c | 40 +-
net/mptcp/protocol.h | 10 +-
net/mptcp/subflow.c | 6 +-
net/mptcp/token.c | 68 +-
net/mptcp/token_test.c | 4 +-
net/netfilter/nf_conntrack_netlink.c | 8 +-
net/packet/af_packet.c | 12 +-
net/rds/ib_cm.c | 6 +-
net/rds/ib_recv.c | 13 +-
net/rds/recv.c | 6 +-
net/sctp/socket.c | 26 +-
net/smc/smc_tx.c | 7 +
net/sunrpc/xprtrdma/rpc_rdma.c | 27 +-
net/sunrpc/xprtrdma/svc_rdma_transport.c | 3 +-
net/sunrpc/xprtrdma/verbs.c | 9 +-
net/tipc/group.c | 19 +-
net/tipc/socket.c | 12 +-
net/unix/sysctl_net_unix.c | 4 +-
net/xdp/xsk_buff_pool.c | 2 +
rust/bindgen_parameters | 6 +
rust/kernel/dma.rs | 21 +-
rust/kernel/irq/request.rs | 28 +-
rust/kernel/time/hrtimer.rs | 6 +-
scripts/Makefile.autofdo | 2 +-
security/apparmor/af_unix.c | 20 +-
security/apparmor/apparmorfs.c | 15 +-
security/apparmor/file.c | 59 +-
security/apparmor/include/label.h | 6 +-
security/apparmor/include/policy.h | 20 +
security/apparmor/label.c | 1 -
security/apparmor/match.c | 3 +-
security/apparmor/policy.c | 19 +
security/apparmor/policy_unpack.c | 13 +-
sound/core/compress_offload.c | 32 +-
sound/core/init.c | 12 +-
sound/core/seq/oss/seq_oss_device.h | 1 +
sound/core/seq/oss/seq_oss_event.c | 3 +
sound/core/seq/oss/seq_oss_init.c | 2 +
sound/core/timer.c | 1 +
sound/core/timer_compat.c | 1 +
sound/core/ump_convert.c | 2 +-
sound/drivers/aloop.c | 31 +-
sound/drivers/mpu401/mpu401_uart.c | 8 +-
sound/drivers/mtpav.c | 2 +-
sound/hda/codecs/hdmi/eld.c | 6 +-
sound/hda/codecs/hdmi/hdmi.c | 3 +-
sound/hda/codecs/realtek/alc269.c | 138 +--
sound/hda/codecs/side-codecs/cs35l41_hda.c | 12 +-
sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 19 +-
sound/hda/codecs/via.c | 1 +
sound/hda/common/codec.c | 6 +
sound/hda/common/sysfs.c | 4 +
sound/mips/sgio2audio.c | 13 +-
sound/oss/dmasound/dmasound_q40.c | 65 +-
sound/pci/cs46xx/dsp_spos.c | 2 +-
sound/soc/amd/acp-config.c | 7 +
sound/soc/codecs/arizona-jack.c | 1 +
sound/soc/codecs/hdac_hda.c | 16 +
sound/soc/codecs/lpass-wsa-macro.c | 42 +-
sound/soc/codecs/pcm6240.c | 2 -
sound/soc/codecs/rt5682s.c | 4 +-
sound/soc/codecs/rt712-sdca-dmic.c | 4 +-
sound/soc/codecs/tlv320aic32x4-clk.c | 8 +-
sound/soc/codecs/wcd9335.c | 25 +-
sound/soc/codecs/wm8994.c | 3 +
sound/soc/codecs/wsa883x.c | 13 +-
sound/soc/codecs/wsa884x.c | 11 +-
sound/soc/fsl/fsl_xcvr.c | 28 +-
sound/soc/intel/atom/sst/sst_acpi.c | 14 +-
sound/soc/qcom/qdsp6/q6afe.c | 10 +-
sound/soc/qcom/qdsp6/q6apm-dai.c | 12 +-
sound/soc/qcom/qdsp6/q6apm.c | 50 +-
sound/soc/qcom/qdsp6/q6asm-dai.c | 7 +-
sound/soc/qcom/qdsp6/topology.c | 31 +-
sound/soc/sdca/sdca_class.c | 9 +-
sound/soc/sdw_utils/soc_sdw_rt711.c | 1 +
sound/soc/stm/stm32_i2s.c | 23 +-
sound/soc/ti/davinci-mcasp.c | 1 +
sound/synth/emux/emux.c | 10 +-
sound/synth/emux/soundfont.c | 9 +
sound/usb/line6/capture.c | 25 +-
sound/usb/line6/capture.h | 2 +-
sound/usb/line6/playback.c | 31 +-
sound/usb/misc/ua101.c | 29 +-
sound/usb/pcm.c | 20 +-
sound/usb/quirks-table.h | 4 +-
sound/usb/quirks.c | 4 +
tools/dma/Makefile | 6 +
tools/perf/arch/loongarch/util/header.c | 2 +-
tools/perf/util/machine.c | 2 +-
tools/perf/util/powerpc-vpadtl.c | 2 +-
tools/perf/util/python.c | 2 +
tools/testing/selftests/cgroup/test_cpuset_prs.sh | 3 +
tools/testing/selftests/core/unshare_test.c | 19 +-
.../selftests/filesystems/idmapped_tmpfile.c | 7 +
tools/testing/selftests/iommu/iommufd.c | 10 +-
tools/testing/selftests/landlock/audit_test.c | 2 +-
tools/testing/selftests/landlock/net_test.c | 4 +-
tools/testing/selftests/landlock/ptrace_test.c | 2 +-
tools/testing/selftests/seccomp/seccomp_bpf.c | 179 ++++
tools/testing/vma/include/stubs.h | 5 +
1105 files changed, 14314 insertions(+), 6415 deletions(-)
^ permalink raw reply [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0001/1257] drm/xe: Implement Wa_22016122933
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0002/1257] media: cx88: Specify rc type at rc_allocate_type() Greg Kroah-Hartman
` (997 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniele Ceraolo Spurio,
Tales A . Mendonça, Navon John Lukose, Matthew Brost,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tales A. Mendonça <talesam@gmail.com>
[ Upstream commit d5b0bf3f37f152583a884c696cf6caa152aa7ed5 ]
On platforms with a standalone media GT and media version 13.00
(MTL/ARL), memory shared between the CPU and the media GT's GuC must
not be mapped cached on the CPU side: the CPU can otherwise read stale
cache lines for data the GuC has already written.
i915 implements this as Wa_22016122933 (see
intel_gt_needs_wa_22016122933(), used by intel_guc_allocate_vma() and
intel_gt_coherent_map_type()); xe never inherited it.
The visible symptom on ARL is TLB invalidation acks stalling for a
near-constant ~2.3s: the GuC writes the G2H ack in time, but the CPU
keeps reading a stale (empty) view of the G2H CTB until the line is
naturally evicted, so the fence timeout at 2.25s fires first. GuC log
decode confirmed all invalidations were handled promptly by the
firmware, and only the media GT was affected. See Link for the full
investigation (three machines affected: 7d51, 7dd1, Arc Pro 130T).
Making the mapping coherent instead of uncached does not help: with a
GGTT PAT entry repurposed to WB|COH_2WAY the driver comes up and the
media GT GuC runs, but the stalls remain (request-to-ack 2290ms).
Uncached really is required here. Note that 2-way coherency is not
normally reachable from a GGTT PTE (only 2 PAT bits), so that
experiment needed a modified PAT table and may not reflect a supported
configuration.
Add the OOB workaround scoped like i915 (media version 13.00, media GT
only - MEDIA_VERSION() OOB rules only match the media GT on standalone
media platforms) and apply XE_BO_FLAG_NEEDS_UC to the GuC-shared
allocations the CPU reads from: the CTBs, the GuC log, ADS, the SLPC
shared data and the engine activity buffers. hwconfig and the G2G
buffer are allocated on the primary GT only, where the workaround does
not apply.
Note that XE_BO_FLAG_NEEDS_UC drives both the CPU mapping (uncached)
and the GGTT cache mode (XE_CACHE_NONE instead of XE_CACHE_WB), which is
stricter than i915: i915 documents the workaround as WC on the CPU side
and UC on the GPU side. A CPU-WC variant with the GGTT side kept at
XE_CACHE_NONE was measured to be equally effective, but expressing it
would require either a new BO flag or decoupling the GGTT cache-mode
selection from XE_BO_FLAG_NEEDS_UC - simply swapping in
XE_BO_FLAG_FORCE_WC silently relaxes the GPU side back to WB and the
stalls return. The stricter mapping is kept here since it is the tested
configuration and no throughput difference between the two was
measurable; the extra plumbing can be added later if parity with i915 is
preferred.
Scope is limited to the GuC-shared allocations, which is where the
failures were observed. i915 additionally covers media-GT LRC/ring
state; extending xe to match can be done as a follow-up if wanted.
Validation on two ARL machines (7d51 and 7dd1): before, 20-60 TLB
invalidation ack stalls per day, every day, for weeks, on every kernel
and on two GuC firmware versions (70.53.0 and 70.72.1). After: zero
stalls in six weeks of combined runtime, over 10M TLB invalidations
processed under the same workloads, across kernels 7.1.6, 7.1.8 and
7.2. The 7dd1 machine, which could not survive a day of media
workloads on xe without a platform freeze, has been running xe full
time since 11 August, including days with heavy video transcoding,
with zero stalls and zero freezes.
The coherency experiment, the CPU-WC measurements and the engine
activity coverage gap were found by Navon John Lukose while A/B
testing v2 on an ARL 7d51.
Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8678
Suggested-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Signed-off-by: Tales A. Mendonça <talesam@gmail.com>
Tested-by: Navon John Lukose <navonjohnlukose@gmail.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260922144634.55130-4-talesam@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_guc.c | 16 ++++++++++++++++
drivers/gpu/drm/xe/xe_guc.h | 2 ++
drivers/gpu/drm/xe/xe_guc_ads.c | 3 ++-
drivers/gpu/drm/xe/xe_guc_ct.c | 6 ++++--
drivers/gpu/drm/xe/xe_guc_engine_activity.c | 6 ++++--
drivers/gpu/drm/xe/xe_guc_log.c | 7 +++++--
drivers/gpu/drm/xe/xe_guc_pc.c | 3 ++-
drivers/gpu/drm/xe/xe_wa_oob.rules | 1 +
8 files changed, 36 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c
index 4286bd05c6861..c988a2a3b7bdb 100644
--- a/drivers/gpu/drm/xe/xe_guc.c
+++ b/drivers/gpu/drm/xe/xe_guc.c
@@ -1468,6 +1468,22 @@ int xe_guc_suspend(struct xe_guc *guc)
return 0;
}
+/**
+ * xe_guc_bo_wa_flags - Extra BO flags for memory shared with the GuC
+ * @gt: the &xe_gt whose GuC the buffer will be shared with
+ *
+ * Wa_22016122933: on the standalone media GT, memory shared between the
+ * CPU and the GuC must not be mapped cached on the CPU side, otherwise
+ * the CPU can read stale data written by the GuC (e.g. G2H CTB writes)
+ * for multiple seconds.
+ *
+ * Return: additional XE_BO_FLAG_* to use when allocating GuC-shared memory
+ */
+u32 xe_guc_bo_wa_flags(struct xe_gt *gt)
+{
+ return XE_GT_WA(gt, 22016122933) ? XE_BO_FLAG_NEEDS_UC : 0;
+}
+
void xe_guc_notify(struct xe_guc *guc)
{
struct xe_gt *gt = guc_to_gt(guc);
diff --git a/drivers/gpu/drm/xe/xe_guc.h b/drivers/gpu/drm/xe/xe_guc.h
index 61e3ee19a59bf..c4eca40d69cfc 100644
--- a/drivers/gpu/drm/xe/xe_guc.h
+++ b/drivers/gpu/drm/xe/xe_guc.h
@@ -30,6 +30,7 @@
xe_guc_fw_version_at_least((guc), MAKE_GUC_VER_ARGS(ver))
struct drm_printer;
+struct xe_gt;
void xe_guc_comm_init_early(struct xe_guc *guc);
int xe_guc_init_noalloc(struct xe_guc *guc);
@@ -45,6 +46,7 @@ void xe_guc_runtime_suspend(struct xe_guc *guc);
void xe_guc_runtime_resume(struct xe_guc *guc);
int xe_guc_suspend(struct xe_guc *guc);
int xe_guc_softreset(struct xe_guc *guc);
+u32 xe_guc_bo_wa_flags(struct xe_gt *gt);
void xe_guc_notify(struct xe_guc *guc);
int xe_guc_auth_huc(struct xe_guc *guc, u32 rsa_addr);
int xe_guc_mmio_send(struct xe_guc *guc, const u32 *request, u32 len);
diff --git a/drivers/gpu/drm/xe/xe_guc_ads.c b/drivers/gpu/drm/xe/xe_guc_ads.c
index 58a3f6293ce46..9ceb662ca40e4 100644
--- a/drivers/gpu/drm/xe/xe_guc_ads.c
+++ b/drivers/gpu/drm/xe/xe_guc_ads.c
@@ -435,7 +435,8 @@ int xe_guc_ads_init(struct xe_guc_ads *ads)
XE_BO_FLAG_SYSTEM |
XE_BO_FLAG_GGTT |
XE_BO_FLAG_GGTT_INVALIDATE |
- XE_BO_FLAG_PINNED_NORESTORE);
+ XE_BO_FLAG_PINNED_NORESTORE |
+ xe_guc_bo_wa_flags(gt));
if (IS_ERR(bo))
return PTR_ERR(bo);
diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c
index fe70c0fd85c52..1ad96e4b4f893 100644
--- a/drivers/gpu/drm/xe/xe_guc_ct.c
+++ b/drivers/gpu/drm/xe/xe_guc_ct.c
@@ -376,7 +376,8 @@ int xe_guc_ct_init(struct xe_guc_ct *ct)
XE_BO_FLAG_SYSTEM |
XE_BO_FLAG_GGTT |
XE_BO_FLAG_GGTT_INVALIDATE |
- XE_BO_FLAG_PINNED_NORESTORE);
+ XE_BO_FLAG_PINNED_NORESTORE |
+ xe_guc_bo_wa_flags(gt));
if (IS_ERR(bo))
return PTR_ERR(bo);
@@ -386,7 +387,8 @@ int xe_guc_ct_init(struct xe_guc_ct *ct)
XE_BO_FLAG_SYSTEM |
XE_BO_FLAG_GGTT |
XE_BO_FLAG_GGTT_INVALIDATE |
- XE_BO_FLAG_PINNED_NORESTORE);
+ XE_BO_FLAG_PINNED_NORESTORE |
+ xe_guc_bo_wa_flags(gt));
if (IS_ERR(bo))
return PTR_ERR(bo);
diff --git a/drivers/gpu/drm/xe/xe_guc_engine_activity.c b/drivers/gpu/drm/xe/xe_guc_engine_activity.c
index a782be57caadb..729ce8ac140b6 100644
--- a/drivers/gpu/drm/xe/xe_guc_engine_activity.c
+++ b/drivers/gpu/drm/xe/xe_guc_engine_activity.c
@@ -97,7 +97,8 @@ static int allocate_engine_activity_buffers(struct xe_guc *guc,
metadata_bo = xe_bo_create_pin_map_novm(gt_to_xe(gt), tile, PAGE_ALIGN(metadata_size),
ttm_bo_type_kernel, XE_BO_FLAG_SYSTEM |
- XE_BO_FLAG_GGTT | XE_BO_FLAG_GGTT_INVALIDATE,
+ XE_BO_FLAG_GGTT | XE_BO_FLAG_GGTT_INVALIDATE |
+ xe_guc_bo_wa_flags(gt),
false);
if (IS_ERR(metadata_bo))
@@ -105,7 +106,8 @@ static int allocate_engine_activity_buffers(struct xe_guc *guc,
bo = xe_bo_create_pin_map_novm(gt_to_xe(gt), tile, PAGE_ALIGN(size),
ttm_bo_type_kernel, XE_BO_FLAG_VRAM_IF_DGFX(tile) |
- XE_BO_FLAG_GGTT | XE_BO_FLAG_GGTT_INVALIDATE, false);
+ XE_BO_FLAG_GGTT | XE_BO_FLAG_GGTT_INVALIDATE |
+ xe_guc_bo_wa_flags(gt), false);
if (IS_ERR(bo)) {
xe_bo_unpin_map_no_vm(metadata_bo);
diff --git a/drivers/gpu/drm/xe/xe_guc_log.c b/drivers/gpu/drm/xe/xe_guc_log.c
index 538d4df0f7aa7..7d006268ce916 100644
--- a/drivers/gpu/drm/xe/xe_guc_log.c
+++ b/drivers/gpu/drm/xe/xe_guc_log.c
@@ -17,6 +17,7 @@
#include "xe_force_wake.h"
#include "xe_gt_printk.h"
#include "xe_gt_types.h"
+#include "xe_guc.h"
#include "xe_map.h"
#include "xe_mmio.h"
#include "xe_module.h"
@@ -624,14 +625,16 @@ void xe_guc_log_print_lfd(struct xe_guc_log *log, struct drm_printer *p)
int xe_guc_log_init(struct xe_guc_log *log)
{
struct xe_device *xe = log_to_xe(log);
- struct xe_tile *tile = gt_to_tile(log_to_gt(log));
+ struct xe_gt *gt = log_to_gt(log);
+ struct xe_tile *tile = gt_to_tile(gt);
struct xe_bo *bo;
bo = xe_managed_bo_create_pin_map(xe, tile, GUC_LOG_SIZE,
XE_BO_FLAG_SYSTEM |
XE_BO_FLAG_GGTT |
XE_BO_FLAG_GGTT_INVALIDATE |
- XE_BO_FLAG_PINNED_NORESTORE);
+ XE_BO_FLAG_PINNED_NORESTORE |
+ xe_guc_bo_wa_flags(gt));
if (IS_ERR(bo))
return PTR_ERR(bo);
diff --git a/drivers/gpu/drm/xe/xe_guc_pc.c b/drivers/gpu/drm/xe/xe_guc_pc.c
index 7cf8f48585988..58e41b2319bc5 100644
--- a/drivers/gpu/drm/xe/xe_guc_pc.c
+++ b/drivers/gpu/drm/xe/xe_guc_pc.c
@@ -1378,7 +1378,8 @@ int xe_guc_pc_init(struct xe_guc_pc *pc)
XE_BO_FLAG_VRAM_IF_DGFX(tile) |
XE_BO_FLAG_GGTT |
XE_BO_FLAG_GGTT_INVALIDATE |
- XE_BO_FLAG_PINNED_NORESTORE);
+ XE_BO_FLAG_PINNED_NORESTORE |
+ xe_guc_bo_wa_flags(gt));
if (IS_ERR(bo))
return PTR_ERR(bo);
diff --git a/drivers/gpu/drm/xe/xe_wa_oob.rules b/drivers/gpu/drm/xe/xe_wa_oob.rules
index 3001155f8d09e..6662987effd73 100644
--- a/drivers/gpu/drm/xe/xe_wa_oob.rules
+++ b/drivers/gpu/drm/xe/xe_wa_oob.rules
@@ -14,6 +14,7 @@
16017236439 PLATFORM(PVC)
14019821291 MEDIA_VERSION_RANGE(1300, 2000)
14015076503 MEDIA_VERSION(1300)
+22016122933 MEDIA_VERSION(1300)
14018913170 GRAPHICS_VERSION_RANGE(1270, 1274)
MEDIA_VERSION(1300)
PLATFORM(DG2)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0002/1257] media: cx88: Specify rc type at rc_allocate_type()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0001/1257] drm/xe: Implement Wa_22016122933 Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0003/1257] media: saa7134: " Greg Kroah-Hartman
` (996 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit a127f5e9f9ea0470ee3bf83fab82441ae11af208 ]
Changing the type of the rc device after allocation is ugly and
this will also break in a future commit. Ensure that the allocation
happens with the correct type in the first place.
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx88/cx88-input.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/drivers/media/pci/cx88/cx88-input.c b/drivers/media/pci/cx88/cx88-input.c
index 5d9ce4f9af011..c96d289e5ab78 100644
--- a/drivers/media/pci/cx88/cx88-input.c
+++ b/drivers/media/pci/cx88/cx88-input.c
@@ -259,7 +259,7 @@ static void cx88_ir_close(struct rc_dev *rc)
int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
{
struct cx88_IR *ir;
- struct rc_dev *dev;
+ struct rc_dev *dev = NULL;
char *ir_codes = NULL;
u64 rc_proto = RC_PROTO_BIT_OTHER;
int err = -ENOMEM;
@@ -268,11 +268,8 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
*/
ir = kzalloc_obj(*ir);
- dev = rc_allocate_device(RC_DRIVER_IR_RAW);
- if (!ir || !dev)
- goto err_out_free;
-
- ir->dev = dev;
+ if (!ir)
+ return -ENOMEM;
/* detect & configure */
switch (core->boardnr) {
@@ -439,6 +436,13 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
goto err_out_free;
}
+ dev = rc_allocate_device(ir->sampling ?
+ RC_DRIVER_IR_RAW : RC_DRIVER_SCANCODE);
+ if (!dev)
+ goto err_out_free;
+
+ ir->dev = dev;
+
/*
* The usage of mask_keycode were very convenient, due to several
* reasons. Among others, the scancode tables were using the scancode
@@ -477,12 +481,10 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
dev->close = cx88_ir_close;
dev->scancode_mask = hardware_mask;
- if (ir->sampling) {
+ if (ir->sampling)
dev->timeout = MS_TO_US(10); /* 10 ms */
- } else {
- dev->driver_type = RC_DRIVER_SCANCODE;
+ else
dev->allowed_protocols = rc_proto;
- }
ir->core = core;
core->ir = ir;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0003/1257] media: saa7134: Specify rc type at rc_allocate_type()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0001/1257] drm/xe: Implement Wa_22016122933 Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0002/1257] media: cx88: Specify rc type at rc_allocate_type() Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0004/1257] mptcp: fix MP_CAPABLE token migration when cloning reqsk Greg Kroah-Hartman
` (995 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 33154da9f78041edd93f0895a7d697c67994d75b ]
Changing the type of the rc device after allocation is ugly and
this will also break in a future commit. Ensure that the allocation
happens with the correct type in the first place.
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/saa7134/saa7134-input.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/media/pci/saa7134/saa7134-input.c b/drivers/media/pci/saa7134/saa7134-input.c
index 7f6680de31564..b2a2372d149a3 100644
--- a/drivers/media/pci/saa7134/saa7134-input.c
+++ b/drivers/media/pci/saa7134/saa7134-input.c
@@ -769,7 +769,8 @@ int saa7134_input_init1(struct saa7134_dev *dev)
}
ir = kzalloc_obj(*ir);
- rc = rc_allocate_device(RC_DRIVER_SCANCODE);
+ rc = rc_allocate_device(raw_decode ?
+ RC_DRIVER_IR_RAW : RC_DRIVER_SCANCODE);
if (!ir || !rc) {
err = -ENOMEM;
goto err_out_free;
@@ -792,10 +793,8 @@ int saa7134_input_init1(struct saa7134_dev *dev)
rc->priv = dev;
rc->open = saa7134_ir_open;
rc->close = saa7134_ir_close;
- if (raw_decode) {
- rc->driver_type = RC_DRIVER_IR_RAW;
+ if (raw_decode)
rc->allowed_protocols = RC_PROTO_BIT_ALL_IR_DECODER;
- }
rc->device_name = saa7134_boards[dev->board].name;
rc->input_phys = ir->phys;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0004/1257] mptcp: fix MP_CAPABLE token migration when cloning reqsk
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0003/1257] media: saa7134: " Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0005/1257] x86/mm/pat: Use pr_warn() for early W^X warnings Greg Kroah-Hartman
` (994 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Sashiko, Ruide Cao, Ren Wei,
Matthieu Baerts (NGI0), Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruide Cao <caoruide123@gmail.com>
[ Upstream commit 2093bc7fa50056fef8620d2b82bcb2e9a0a5575d ]
TCP request migration clones pending request sockets with
inet_reqsk_clone(). For MPTCP MP_CAPABLE requests this byte-copies the
token_node hlist state into the clone even though the token table still
names the original request, and the following warning can be seen:
WARNING: net/mptcp/token.c:364 at mptcp_token_destroy_request+0x2b0/0x330, CPU#2: swapper/2/0
CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 7.2.0-rc5-00353-gc27e36054537 #10 PREEMPT(full)
RIP: 0010:mptcp_token_destroy_request (net/mptcp/token.c:364 (discriminator 1))
Call Trace:
<IRQ>
subflow_v4_req_destructor (net/mptcp/subflow.c:694)
__reqsk_free (net/ipv4/inet_connection_sock.c:906)
reqsk_timer_handler (include/net/request_sock.h:137 net/ipv4/inet_connection_sock.c:1147)
call_timer_fn (kernel/time/timer.c:1748)
Move token request ownership from the original request to the clone under
the token bucket lock. Make mptcp_token_accept() and
mptcp_token_destroy_request() re-check token_node under the same lock and
treat an already moved or removed request as a normal race instead of
warning. This also keeps token bucket chain_len accounting balanced.
If a passive MP_CAPABLE socket cannot claim the token, destroy the
provisional MPTCP socket and let the subflow fall back rather than
installing a socket with mismatched token ownership. Mark that path as a
passive handshake fallback so MPCapableFallbackACK records the downgrade.
If the speculative clone later loses the inet_ehash_insert() ownership
arbitration, the original request may find that its token was already moved
and fall back to plain TCP. The clone destructor then releases the token
reservation and keeps chain_len balanced. This trades an exceptionally
rare fallback for eliminating the warning and persistent accounting drift.
Fixes: c905dee62232 ("tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/86e2514b533bf4d55d4aa2fdbf1404022e8c9430.1776149210.git.caoruide123%40gmail.com
Signed-off-by: Ruide Cao <caoruide123@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-4-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/protocol.c | 31 +++++++++++++++----
net/mptcp/protocol.h | 4 ++-
net/mptcp/subflow.c | 6 +++-
net/mptcp/token.c | 68 +++++++++++++++++++++++++++++++++++++-----
net/mptcp/token_test.c | 4 +--
5 files changed, 97 insertions(+), 16 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index e89a69ab927c9..b902e24acd68b 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3706,6 +3706,24 @@ static void mptcp_copy_ip_options(struct sock *newsk, const struct sock *sk)
rcu_read_unlock();
}
+static void mptcp_sk_clone_destroy(struct sock *nsk)
+{
+ struct mptcp_sock *msk = mptcp_sk(nsk);
+
+ mptcp_release_sched(msk);
+ mptcp_set_state(nsk, TCP_CLOSE);
+ /* inet_csk_prepare_forced_close() clears TCP sock_ops state via
+ * tcp_sk(), but nsk is an MPTCP master socket; keep the inet-level
+ * destroy preparation here.
+ */
+ bh_unlock_sock(nsk);
+ sock_put(nsk);
+ sock_set_flag(nsk, SOCK_DEAD);
+ tcp_orphan_count_inc();
+ inet_sk(nsk)->inet_num = 0;
+ inet_csk_destroy_sock(nsk);
+}
+
struct sock *mptcp_sk_clone_init(const struct sock *sk,
const struct mptcp_options_received *mp_opt,
struct sock *ssk,
@@ -3765,11 +3783,6 @@ struct sock *mptcp_sk_clone_init(const struct sock *sk,
list_add(&subflow->node, &msk->conn_list);
sock_hold(ssk);
- /* new mpc subflow takes ownership of the newly
- * created mptcp socket
- */
- mptcp_token_accept(subflow_req, msk);
-
/* set msk addresses early to ensure mptcp_pm_get_local_id()
* uses the correct data
*/
@@ -3778,6 +3791,14 @@ struct sock *mptcp_sk_clone_init(const struct sock *sk,
mptcp_rcv_space_init(msk, ssk);
msk->rcvq_space.time = mptcp_stamp();
+ if (!mptcp_token_accept(subflow_req, msk)) {
+ list_del_init(&subflow->node);
+ WRITE_ONCE(msk->first, NULL);
+ sock_put(ssk);
+ mptcp_sk_clone_destroy(nsk);
+ return NULL;
+ }
+
if (mp_opt->suboptions & OPTION_MPTCP_MPC_ACK)
__mptcp_subflow_fully_established(msk, subflow, mp_opt);
bh_unlock_sock(nsk);
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 0384d6a023f9d..3c9ad99ee7ef0 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -1081,9 +1081,11 @@ static inline void mptcp_token_init_request(struct request_sock *req)
}
int mptcp_token_new_request(struct request_sock *req);
+void mptcp_token_move_request(struct request_sock *req,
+ struct request_sock *new_req);
void mptcp_token_destroy_request(struct request_sock *req);
int mptcp_token_new_connect(struct sock *ssk);
-void mptcp_token_accept(struct mptcp_subflow_request_sock *r,
+bool mptcp_token_accept(struct mptcp_subflow_request_sock *r,
struct mptcp_sock *msk);
bool mptcp_token_exists(u32 token);
struct mptcp_sock *mptcp_token_get_sock(struct net *net, u32 token);
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 3139a9ab2853a..2c72cb50fbf36 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -78,6 +78,8 @@ void mptcp_subflow_reqsk_clone(struct request_sock *req,
}
new_subflow_req->msk = msk;
+
+ mptcp_token_move_request(req, new_req);
}
static void subflow_generate_hmac(u64 key1, u64 key2, u32 nonce1, u32 nonce2,
@@ -922,8 +924,10 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
if (ctx->mp_capable) {
ctx->conn = mptcp_sk_clone_init(listener->conn, &mp_opt, child, req);
- if (!ctx->conn)
+ if (!ctx->conn) {
+ fallback = true;
goto fallback;
+ }
ctx->subflow_id = 1;
owner = mptcp_sk(ctx->conn);
diff --git a/net/mptcp/token.c b/net/mptcp/token.c
index f1a50f367add8..e0f2823f92efb 100644
--- a/net/mptcp/token.c
+++ b/net/mptcp/token.c
@@ -180,6 +180,43 @@ int mptcp_token_new_connect(struct sock *ssk)
return 0;
}
+/**
+ * mptcp_token_move_request - move request token ownership to a clone
+ * @req: original request socket
+ * @new_req: cloned request socket
+ *
+ * Move the token hash entry from the original request to its clone.
+ */
+void mptcp_token_move_request(struct request_sock *req,
+ struct request_sock *new_req)
+{
+ struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
+ struct mptcp_subflow_request_sock *new_subflow_req;
+ struct mptcp_subflow_request_sock *pos;
+ struct token_bucket *bucket;
+
+ new_subflow_req = mptcp_subflow_rsk(new_req);
+
+ if (hlist_nulls_unhashed_lockless(&subflow_req->token_node)) {
+ mptcp_token_init_request(new_req);
+ return;
+ }
+
+ bucket = token_bucket(subflow_req->token);
+ spin_lock_bh(&bucket->lock);
+ if (hlist_nulls_unhashed(&subflow_req->token_node)) {
+ mptcp_token_init_request(new_req);
+ } else {
+ pos = __token_lookup_req(bucket, subflow_req->token);
+ if (pos == subflow_req)
+ hlist_nulls_replace_init_rcu(&subflow_req->token_node,
+ &new_subflow_req->token_node);
+ else
+ mptcp_token_init_request(new_req);
+ }
+ spin_unlock_bh(&bucket->lock);
+}
+
/**
* mptcp_token_accept - replace a req sk with full sock in token hash
* @req: the request socket to be removed
@@ -187,24 +224,36 @@ int mptcp_token_new_connect(struct sock *ssk)
*
* Called when a SYN packet creates a new logical connection, i.e.
* is not a join request.
+ *
+ * Return: true on success.
*/
-void mptcp_token_accept(struct mptcp_subflow_request_sock *req,
+bool mptcp_token_accept(struct mptcp_subflow_request_sock *req,
struct mptcp_sock *msk)
{
struct mptcp_subflow_request_sock *pos;
struct sock *sk = (struct sock *)msk;
struct token_bucket *bucket;
+ bool ret = false;
- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
bucket = token_bucket(req->token);
spin_lock_bh(&bucket->lock);
+ if (hlist_nulls_unhashed(&req->token_node))
+ goto unlock;
- /* pedantic lookup check for the moved token */
pos = __token_lookup_req(bucket, req->token);
- if (!WARN_ON_ONCE(pos != req))
- hlist_nulls_del_init_rcu(&req->token_node);
+ if (pos != req)
+ goto unlock;
+
+ hlist_nulls_del_init_rcu(&req->token_node);
__sk_nulls_add_node_rcu((struct sock *)msk, &bucket->msk_chain);
+ ret = true;
+
+unlock:
spin_unlock_bh(&bucket->lock);
+ if (ret)
+ sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+
+ return ret;
}
bool mptcp_token_exists(u32 token)
@@ -355,16 +404,21 @@ void mptcp_token_destroy_request(struct request_sock *req)
struct mptcp_subflow_request_sock *pos;
struct token_bucket *bucket;
- if (hlist_nulls_unhashed(&subflow_req->token_node))
+ if (hlist_nulls_unhashed_lockless(&subflow_req->token_node))
return;
bucket = token_bucket(subflow_req->token);
spin_lock_bh(&bucket->lock);
+ if (hlist_nulls_unhashed(&subflow_req->token_node))
+ goto unlock;
+
pos = __token_lookup_req(bucket, subflow_req->token);
- if (!WARN_ON_ONCE(pos != subflow_req)) {
+ if (pos == subflow_req) {
hlist_nulls_del_init_rcu(&pos->token_node);
bucket->chain_len--;
}
+
+unlock:
spin_unlock_bh(&bucket->lock);
}
diff --git a/net/mptcp/token_test.c b/net/mptcp/token_test.c
index 4fc39fa2e262d..be9acce8a5673 100644
--- a/net/mptcp/token_test.c
+++ b/net/mptcp/token_test.c
@@ -99,7 +99,7 @@ static void mptcp_token_test_accept(struct kunit *test)
KUNIT_ASSERT_EQ(test, 0,
mptcp_token_new_request((struct request_sock *)req));
msk->token = req->token;
- mptcp_token_accept(req, msk);
+ KUNIT_EXPECT_TRUE(test, mptcp_token_accept(req, msk));
KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(&init_net, msk->token));
/* this is now a no-op */
@@ -122,7 +122,7 @@ static void mptcp_token_test_destroyed(struct kunit *test)
KUNIT_ASSERT_EQ(test, 0,
mptcp_token_new_request((struct request_sock *)req));
msk->token = req->token;
- mptcp_token_accept(req, msk);
+ KUNIT_EXPECT_TRUE(test, mptcp_token_accept(req, msk));
/* simulate race on removal */
refcount_set(&sk->sk_refcnt, 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0005/1257] x86/mm/pat: Use pr_warn() for early W^X warnings
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0004/1257] mptcp: fix MP_CAPABLE token migration when cloning reqsk Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0006/1257] inet: reject unhashed sockets during established lookups Greg Kroah-Hartman
` (993 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor,
Mike Rapoport (Microsoft), Dave Hansen, Ihor Solodrai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <rppt@kernel.org>
[ Upstream commit ea6fd393cb9e6811a748c7551de0dd3090f9dcde ]
Nathan Chancellor reports the following warning:
CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 100e00
from its_alloc() doing set_memory_x() during early retpoline setup.
The warning is not factually wrong but it is unproductive. First, the RWX
permission is temporary and fixed up by execmem_restore_rox(). Second,
at the time of the warning, all kernel text is mapped RWX. So there is not
even a transient actual security issue.
The right way to fix this up is to relax RWX detection during boot but
make a final verification pass over all kernel page tables before running
userspace. There is code to do that today (debug_checkwx()) but it
must be enabled explicitly in Kconfig.
For now, retain the warning even if it's unproductive, but make it
scream less loudly: use pr_warn_once() rather than WARN_ONCE().
Remove the warning once debug_checkwx() behavior becomes unconditional.
Closes: https://lore.kernel.org/all/20260905044253.GA3816371@ax162
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://patch.msgid.link/20260913-fixes-verify-rwx-v3-1-5e1d6a08bd02@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/mm/pat/set_memory.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index 226660973d515..c71f6774a2f32 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -719,6 +719,21 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
return new;
end = start + npg * PAGE_SIZE - 1;
+
+ /*
+ * If the kernel text is still RWX, gently complain, this could be a
+ * false positive.
+ * Once debug_checkwx() becomes mandatory for CONFIG_STRICT_KERNEL_RWX,
+ * the warning can be removed completely.
+ */
+ if (!kernel_set_to_readonly) {
+ pr_warn_once("CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
+ (unsigned long long)pgprot_val(old),
+ (unsigned long long)pgprot_val(new),
+ start, end, pfn);
+ return new;
+ }
+
WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
(unsigned long long)pgprot_val(old),
(unsigned long long)pgprot_val(new),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0006/1257] inet: reject unhashed sockets during established lookups
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0005/1257] x86/mm/pat: Use pr_warn() for early W^X warnings Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0007/1257] rust: irq: declare cfi_encoding for irqreturn Greg Kroah-Hartman
` (992 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Eric Dumazet,
Kuniyuki Iwashima, Paolo Abeni, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 4e2b3ef19e0e04adca38442f07dd6bc93c712bf1 ]
TCP established ehash lookups are lockless. The socket caches involved
use SLAB_TYPESAFE_BY_RCU, so memory can be reused before an RCU reader
that retained its old address has finished.
After a tuple match, __inet_lookup_established() and
__inet6_lookup_established() acquire a reference and repeat the tuple
check. They do not check whether the new object is hashed. If the
address is reused for a socket with the same tuple, the lookup can
acquire a reference to the new object and return it while its nulls node
is unhashed.
A PoC that drives reuse with a SYN cookie request socket reproduced the
crash. The new request socket is unhashed and has a NULL rsk_listener.
A lookup that had loaded the address of the old request socket acquired
the reference published by tcp_get_cookie_sock() and returned the new
object. tcp_v4_rcv() then read sk_state through the NULL listener.
The resulting crash was:
BUG: kernel NULL pointer dereference, address: 0000000000000012
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
...
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy)
...
RIP: 0010:tcp_v4_rcv+0x44e/0x1280
...
R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000
...
CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0
...
Call Trace:
<IRQ>
? raw_local_deliver+0xae/0x240
ip_protocol_deliver_rcu+0x2d/0x180
ip_local_deliver_finish+0x84/0x100
ip_sublist_rcv_finish+0x5f/0x70
ip_sublist_rcv+0x12a/0x1d0
ip_list_rcv+0xfd/0x130
__netif_receive_skb_list_core+0x223/0x250
netif_receive_skb_list_internal+0x1d2/0x2c0
? try_fill_recv+0x39/0x7b0
napi_complete_done+0x74/0x170
virtnet_poll+0x445/0x600
__napi_poll+0x27/0x1e0
net_rx_action+0x2fe/0x3b0
handle_softirqs+0xc2/0x2c0
__irq_exit_rcu+0x74/0xd0
common_interrupt+0x7f/0x90
</IRQ>
...
Kernel panic - not syncing: Fatal exception in interrupt
After taking a reference, check whether the nulls node is unhashed in
both IPv4 and IPv6 established lookups. If it is unhashed or the tuple
no longer matches, drop the reference and restart the lookup.
Lookups racing with the TIME_WAIT hashdance, or with a request being
replaced by its child, now restart and find the new socket instead of
returning the old one.
Request sockets that were never inserted into ehash can have a nonzero
refcount, and a stale lookup can hold a transient reference. Therefore,
when SYN cookie, Fast Open, and request migration paths fail after
setting a nonzero refcount, release the references held by those paths
with reqsk_put() instead of freeing the request directly.
Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20261029214219.1035176-2-imv4bel@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/inet_connection_sock.c | 10 +++++++---
net/ipv4/inet_hashtables.c | 5 +++--
net/ipv4/syncookies.c | 2 ++
net/ipv4/tcp_input.c | 4 +++-
net/ipv6/inet6_hashtables.c | 4 +++-
5 files changed, 18 insertions(+), 7 deletions(-)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index c6f8011200a0b..8e891c8141f85 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -1140,10 +1140,14 @@ static void reqsk_timer_handler(struct timer_list *t)
*/
if (nreq) {
__NET_INC_STATS(net, LINUX_MIB_TCPMIGRATEREQFAILURE);
+ /* The timer was not armed, drop its reference here. */
+ reqsk_put(nreq);
no_ownership:
reqsk_migrate_reset(nreq);
reqsk_queue_removed(queue, nreq);
- __reqsk_free(nreq);
+ /* Drop the temporary reference and the one reserved for ehash. */
+ reqsk_put(nreq);
+ reqsk_put(nreq);
}
drop:
@@ -1451,7 +1455,7 @@ struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child,
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMIGRATEREQFAILURE);
reqsk_migrate_reset(nreq);
- __reqsk_free(nreq);
+ reqsk_put(nreq);
} else if (inet_csk_reqsk_queue_add(sk, req, child)) {
return child;
}
@@ -1506,7 +1510,7 @@ void inet_csk_listen_stop(struct sock *sk)
__NET_INC_STATS(sock_net(nsk),
LINUX_MIB_TCPMIGRATEREQFAILURE);
reqsk_migrate_reset(nreq);
- __reqsk_free(nreq);
+ reqsk_put(nreq);
}
rcu_read_unlock();
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index ba0faa9ae2bb3..58d54965036a2 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -552,8 +552,9 @@ struct sock *__inet_lookup_established(const struct net *net,
if (likely(inet_match(net, sk, acookie, ports, dif, sdif))) {
if (unlikely(!refcount_inc_not_zero(&sk->sk_refcnt)))
goto out;
- if (unlikely(!inet_match(net, sk, acookie,
- ports, dif, sdif))) {
+ if (unlikely(hlist_nulls_unhashed_lockless(&sk->sk_nulls_node) ||
+ !inet_match(net, sk, acookie, ports, dif,
+ sdif))) {
sock_gen_put(sk);
goto begin;
}
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 73e1297681847..6440305615378 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -218,6 +218,8 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
bh_unlock_sock(child);
sock_put(child);
+ reqsk_put(req);
+ return NULL;
}
__reqsk_free(req);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 99baf14afdfd8..3583867487d7f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -7777,7 +7777,9 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
bh_unlock_sock(fastopen_sk);
sock_put(fastopen_sk);
- goto drop_and_free;
+ /* tcp_disconnect() already dropped one reqsk ref. */
+ reqsk_put(req);
+ goto drop;
}
READ_ONCE(sk->sk_data_ready)(sk);
bh_unlock_sock(fastopen_sk);
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index b111b51d69fc9..aa5fa1dd062f7 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -108,7 +108,9 @@ struct sock *__inet6_lookup_established(const struct net *net,
if (unlikely(!refcount_inc_not_zero(&sk->sk_refcnt)))
goto out;
- if (unlikely(!inet6_match(net, sk, saddr, daddr, ports, dif, sdif))) {
+ if (unlikely(hlist_nulls_unhashed_lockless(&sk->sk_nulls_node) ||
+ !inet6_match(net, sk, saddr, daddr, ports, dif,
+ sdif))) {
sock_gen_put(sk);
goto begin;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0007/1257] rust: irq: declare cfi_encoding for irqreturn
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0006/1257] inet: reject unhashed sockets during established lookups Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0008/1257] rust: hrtimer: declare cfi_encoding for hrtimer_restart Greg Kroah-Hartman
` (991 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sami Tolvanen, Alice Ryhl, Gary Guo,
Danilo Krummrich, Miguel Ojeda, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sami Tolvanen <samitolvanen@google.com>
[ Upstream commit 01f3e6b4b1c8c1748e59ba53631ab1f5d9ad0ea4 ]
The IRQ callbacks return c_uint. C calls them through irq_handler_t,
which returns enum irqreturn. kCFI encodes enum types by name even with
integer normalization, so the type ids never match and every call fails
the CFI check.
Generate irqreturn as a newtype with a cfi_encoding, as is done for
lru_status, and return bindings::irqreturn_t from the callbacks.
Fixes: 0851d34a8cc3 ("rust: irq: add support for non-threaded IRQs and handlers")
Fixes: 135d40523244 ("rust: irq: add support for threaded IRQs and handlers")
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261019-rust-cfi-fixes-v1-1-9503472ba738@google.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
[ sashal: Adjusted insertion context to preserve existing fwctl_rpc_scope CFI declarations. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/bindgen_parameters | 2 ++
rust/kernel/irq/request.rs | 28 +++++++++++++++++-----------
2 files changed, 19 insertions(+), 11 deletions(-)
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index 39aae62dca669..cbc0a302647e5 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -29,6 +29,8 @@
# enums that appear in indirect function calls should specify a cfi type
--newtype-enum fwctl_rpc_scope
--with-attribute-custom-enum=fwctl_rpc_scope='#[cfi_encoding="15fwctl_rpc_scope"]'
+--newtype-enum irqreturn
+--with-attribute-custom-enum=irqreturn='#[cfi_encoding="9irqreturn"]'
--newtype-enum lru_status
--with-attribute-custom-enum=lru_status='#[cfi_encoding="10lru_status"]'
diff --git a/rust/kernel/irq/request.rs b/rust/kernel/irq/request.rs
index c1c6525a676a7..1afa9fcaad1f6 100644
--- a/rust/kernel/irq/request.rs
+++ b/rust/kernel/irq/request.rs
@@ -25,10 +25,10 @@
#[repr(u32)]
pub enum IrqReturn {
/// The interrupt was not from this device or was not handled.
- None = bindings::irqreturn_IRQ_NONE,
+ None = bindings::irqreturn::IRQ_NONE.0,
/// The interrupt was handled by this device.
- Handled = bindings::irqreturn_IRQ_HANDLED,
+ Handled = bindings::irqreturn::IRQ_HANDLED.0,
}
/// Callbacks for an IRQ handler.
@@ -240,25 +240,28 @@ fn drop(self: Pin<&mut Self>) {
/// # Safety
///
/// This function should be only used as the callback in `request_irq`.
-unsafe extern "C" fn handle_irq_callback<T: Handler>(_irq: i32, ptr: *mut c_void) -> c_uint {
+unsafe extern "C" fn handle_irq_callback<T: Handler>(
+ _irq: i32,
+ ptr: *mut c_void,
+) -> bindings::irqreturn_t {
let ptr = ptr.cast_const().cast::<Registration<'_, T>>();
// SAFETY: `ptr` is a pointer to `Registration<'_, T>` set in `Registration::new()`.
let registration = unsafe { &*ptr };
- T::handle(®istration.handler) as c_uint
+ bindings::irqreturn_t(T::handle(®istration.handler) as c_uint)
}
/// The value that can be returned from [`ThreadedHandler::handle`].
#[repr(u32)]
pub enum ThreadedIrqReturn {
/// The interrupt was not from this device or was not handled.
- None = bindings::irqreturn_IRQ_NONE,
+ None = bindings::irqreturn::IRQ_NONE.0,
/// The interrupt was handled by this device.
- Handled = bindings::irqreturn_IRQ_HANDLED,
+ Handled = bindings::irqreturn::IRQ_HANDLED.0,
/// The handler wants the handler thread to wake up.
- WakeThread = bindings::irqreturn_IRQ_WAKE_THREAD,
+ WakeThread = bindings::irqreturn::IRQ_WAKE_THREAD.0,
}
/// Callbacks for a threaded IRQ handler.
@@ -461,23 +464,26 @@ fn drop(self: Pin<&mut Self>) {
unsafe extern "C" fn handle_threaded_irq_callback<T: ThreadedHandler>(
_irq: i32,
ptr: *mut c_void,
-) -> c_uint {
+) -> bindings::irqreturn_t {
let ptr = ptr.cast_const().cast::<ThreadedRegistration<'_, T>>();
// SAFETY: `ptr` is a pointer to `ThreadedRegistration<'_, T>` set in
// `ThreadedRegistration::new()`.
let registration = unsafe { &*ptr };
- T::handle(®istration.handler) as c_uint
+ bindings::irqreturn_t(T::handle(®istration.handler) as c_uint)
}
/// # Safety
///
/// This function should be only used as the callback in `request_threaded_irq`.
-unsafe extern "C" fn thread_fn_callback<T: ThreadedHandler>(_irq: i32, ptr: *mut c_void) -> c_uint {
+unsafe extern "C" fn thread_fn_callback<T: ThreadedHandler>(
+ _irq: i32,
+ ptr: *mut c_void,
+) -> bindings::irqreturn_t {
let ptr = ptr.cast_const().cast::<ThreadedRegistration<'_, T>>();
// SAFETY: `ptr` is a pointer to `ThreadedRegistration<'_, T>` set in
// `ThreadedRegistration::new()`.
let registration = unsafe { &*ptr };
- T::handle_threaded(®istration.handler) as c_uint
+ bindings::irqreturn_t(T::handle_threaded(®istration.handler) as c_uint)
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0008/1257] rust: hrtimer: declare cfi_encoding for hrtimer_restart
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0007/1257] rust: irq: declare cfi_encoding for irqreturn Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0009/1257] rust: dma: declare cfi_encoding for dma_data_direction Greg Kroah-Hartman
` (990 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sami Tolvanen, Alice Ryhl,
FUJITA Tomonori, Andreas Hindborg, Gary Guo, Danilo Krummrich,
Miguel Ojeda, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sami Tolvanen <samitolvanen@google.com>
commit 39fe6892fd52faed6325ff7f13a92da01ab35727 upstream.
The hrtimer callbacks return bindings::hrtimer_restart, which bindgen
generates as c_uint. C calls them through hrtimer->function, which
returns enum hrtimer_restart. kCFI encodes enum types by name even with
integer normalization, so the type ids never match and every call fails
the CFI check.
Generate hrtimer_restart as a newtype with a cfi_encoding, as is done
for lru_status, and adapt HrTimerRestart to the newtype.
Fixes: 8a8afe9349fb ("rust: hrtimer: introduce hrtimer support")
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Tested-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Acked-by: Andreas Hindborg <a.hindborg@kernel.org>
Reviewed-by: Gary Guo <gary@garyguo.net>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261019-rust-cfi-fixes-v1-2-9503472ba738@google.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
[ Adjusted insertion context. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/bindgen_parameters | 2 ++
rust/kernel/time/hrtimer.rs | 6 +++---
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index cbc0a302647e5..45f6eb56a1f73 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -29,6 +29,8 @@
# enums that appear in indirect function calls should specify a cfi type
--newtype-enum fwctl_rpc_scope
--with-attribute-custom-enum=fwctl_rpc_scope='#[cfi_encoding="15fwctl_rpc_scope"]'
+--newtype-enum hrtimer_restart
+--with-attribute-custom-enum=hrtimer_restart='#[cfi_encoding="15hrtimer_restart"]'
--newtype-enum irqreturn
--with-attribute-custom-enum=irqreturn='#[cfi_encoding="9irqreturn"]'
--newtype-enum lru_status
diff --git a/rust/kernel/time/hrtimer.rs b/rust/kernel/time/hrtimer.rs
index 2d7f1131a8131..07344ed5fbd58 100644
--- a/rust/kernel/time/hrtimer.rs
+++ b/rust/kernel/time/hrtimer.rs
@@ -834,14 +834,14 @@ unsafe fn start(this: *const Self, expires: <Self::TimerMode as HrTimerMode>::Ex
#[repr(u32)]
pub enum HrTimerRestart {
/// Timer should not be restarted.
- NoRestart = bindings::hrtimer_restart_HRTIMER_NORESTART,
+ NoRestart = bindings::hrtimer_restart::HRTIMER_NORESTART.0,
/// Timer should be restarted.
- Restart = bindings::hrtimer_restart_HRTIMER_RESTART,
+ Restart = bindings::hrtimer_restart::HRTIMER_RESTART.0,
}
impl HrTimerRestart {
fn into_c(self) -> bindings::hrtimer_restart {
- self as bindings::hrtimer_restart
+ bindings::hrtimer_restart(self as c_uint)
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0009/1257] rust: dma: declare cfi_encoding for dma_data_direction
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0008/1257] rust: hrtimer: declare cfi_encoding for hrtimer_restart Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0010/1257] media: rc: Replace open coded krealloc() for keymap Greg Kroah-Hartman
` (989 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sami Tolvanen, Alice Ryhl, Gary Guo,
Danilo Krummrich, Miguel Ojeda, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sami Tolvanen <samitolvanen@google.com>
commit 7d109178cd644268326cd31702ed46c7ac8bb300 upstream.
bindgen generates bindings::dma_data_direction as an integer by default,
while C callback tables such as dma_buf_ops declare the parameter as
enum dma_data_direction. kCFI encodes enum types by name even with
integer normalization, so the type ids would not match when C calls into
a Rust callback taking bindings::dma_data_direction.
Generate dma_data_direction as a newtype with a cfi_encoding, as is done
for lru_status, and convert DataDirection through the newtype's
constants.
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Fixes: c2437c43cfb1 ("rust: dma: implement DataDirection")
Link: https://patch.msgid.link/20261019-rust-cfi-fixes-v1-3-9503472ba738@google.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
[ Adjusted insertion context. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/bindgen_parameters | 2 ++
rust/kernel/dma.rs | 21 +++++++++++----------
2 files changed, 13 insertions(+), 10 deletions(-)
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index 45f6eb56a1f73..5bab3cf063360 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -29,6 +29,8 @@
# enums that appear in indirect function calls should specify a cfi type
--newtype-enum fwctl_rpc_scope
--with-attribute-custom-enum=fwctl_rpc_scope='#[cfi_encoding="15fwctl_rpc_scope"]'
+--newtype-enum dma_data_direction
+--with-attribute-custom-enum=dma_data_direction='#[cfi_encoding="18dma_data_direction"]'
--newtype-enum hrtimer_restart
--with-attribute-custom-enum=hrtimer_restart='#[cfi_encoding="15hrtimer_restart"]'
--newtype-enum irqreturn
diff --git a/rust/kernel/dma.rs b/rust/kernel/dma.rs
index 2ce09f8e90c69..2ec5fe7d56bc4 100644
--- a/rust/kernel/dma.rs
+++ b/rust/kernel/dma.rs
@@ -310,25 +310,25 @@ pub enum DataDirection {
///
/// This is used when the buffer can be both read from and written to by the device.
/// The cache for the corresponding memory region is both flushed and invalidated.
- Bidirectional = Self::const_cast(bindings::dma_data_direction_DMA_BIDIRECTIONAL),
+ Bidirectional = Self::const_cast(bindings::dma_data_direction::DMA_BIDIRECTIONAL),
/// The DMA mapping is for data transfer from memory to the device (write).
///
/// The CPU has prepared data in the buffer, and the device will read it.
/// The cache for the corresponding memory region is flushed before device access.
- ToDevice = Self::const_cast(bindings::dma_data_direction_DMA_TO_DEVICE),
+ ToDevice = Self::const_cast(bindings::dma_data_direction::DMA_TO_DEVICE),
/// The DMA mapping is for data transfer from the device to memory (read).
///
/// The device will write data into the buffer for the CPU to read.
/// The cache for the corresponding memory region is invalidated before CPU access.
- FromDevice = Self::const_cast(bindings::dma_data_direction_DMA_FROM_DEVICE),
+ FromDevice = Self::const_cast(bindings::dma_data_direction::DMA_FROM_DEVICE),
/// The DMA mapping is not for data transfer.
///
/// This is primarily for debugging purposes. With this direction, the DMA mapping API
/// will not perform any cache coherency operations.
- None = Self::const_cast(bindings::dma_data_direction_DMA_NONE),
+ None = Self::const_cast(bindings::dma_data_direction::DMA_NONE),
}
impl DataDirection {
@@ -340,7 +340,7 @@ const fn const_cast(val: bindings::dma_data_direction) -> u32 {
// CAST: The C standard allows compilers to choose different integer types for enums.
// To safely check the value, we cast it to a wide signed integer type (`i128`)
// which can hold any standard C integer enum type without truncation.
- let wide_val = val as i128;
+ let wide_val = val.0 as i128;
// Check if the value is outside the valid range for the target type `u32`.
// CAST: `u32::MAX` is cast to `i128` to match the type of `wide_val` for the comparison.
@@ -358,11 +358,12 @@ const fn const_cast(val: bindings::dma_data_direction) -> u32 {
impl From<DataDirection> for bindings::dma_data_direction {
/// Returns the raw representation of [`enum dma_data_direction`].
fn from(direction: DataDirection) -> Self {
- // CAST: `direction as u32` gets the underlying representation of our `#[repr(u32)]` enum.
- // The subsequent cast to `Self` (the bindgen type) assumes the C enum is compatible
- // with the enum variants of `DataDirection`, which is a valid assumption given our
- // compile-time checks.
- direction as u32 as Self
+ match direction {
+ DataDirection::Bidirectional => Self::DMA_BIDIRECTIONAL,
+ DataDirection::ToDevice => Self::DMA_TO_DEVICE,
+ DataDirection::FromDevice => Self::DMA_FROM_DEVICE,
+ DataDirection::None => Self::DMA_NONE,
+ }
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0010/1257] media: rc: Replace open coded krealloc() for keymap
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0009/1257] rust: dma: declare cfi_encoding for dma_data_direction Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0011/1257] media: rc: Add missing locking " Greg Kroah-Hartman
` (988 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit e4b4aa413cc2e48a261c8c513ced964a3390c0cf ]
Replace open coded krealloc() and remove superfluous member of struct
rc_map - we don't need to track both the size in bytes and entries.
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Stable-dep-of: ab9567336171 ("media: rc: Add missing locking for keymap")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/rc-main.c | 45 +++++++++++++++++++-------------------
include/media/rc-map.h | 2 --
2 files changed, 22 insertions(+), 25 deletions(-)
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 85c9be43b9127..81f3aafcae8f4 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -17,9 +17,8 @@
#include <linux/module.h>
#include "rc-core-priv.h"
-/* Sizes are in bytes, 256 bytes allows for 32 entries on x64 */
-#define IR_TAB_MIN_SIZE 256
-#define IR_TAB_MAX_SIZE 8192
+#define IR_TAB_MIN_ENTRIES 32
+#define IR_TAB_MAX_ENTRIES 1024
static const struct {
const char *name;
@@ -214,21 +213,23 @@ static int scancode_to_u64(const struct input_keymap_entry *ke, u64 *scancode)
static int ir_create_table(struct rc_dev *dev, struct rc_map *rc_map,
const char *name, u64 rc_proto, size_t size)
{
+ unsigned int alloc;
rc_map->name = kstrdup(name, GFP_KERNEL);
if (!rc_map->name)
return -ENOMEM;
+ alloc = roundup_pow_of_two(size);
rc_map->rc_proto = rc_proto;
- rc_map->alloc = roundup_pow_of_two(size * sizeof(struct rc_map_table));
- rc_map->size = rc_map->alloc / sizeof(struct rc_map_table);
- rc_map->scan = kmalloc(rc_map->alloc, GFP_KERNEL);
+ rc_map->len = 0;
+ rc_map->size = alloc;
+ rc_map->scan = kmalloc_objs(struct rc_map_table, alloc, GFP_KERNEL);
if (!rc_map->scan) {
kfree(rc_map->name);
rc_map->name = NULL;
return -ENOMEM;
}
- dev_dbg(&dev->dev, "Allocated space for %u keycode entries (%u bytes)\n",
- rc_map->size, rc_map->alloc);
+ dev_dbg(&dev->dev, "Allocated space for %u keycode entries (%zu bytes)\n",
+ alloc, alloc * sizeof(struct rc_map_table));
return 0;
}
@@ -262,38 +263,36 @@ static void ir_free_table(struct rc_map *rc_map)
static int ir_resize_table(struct rc_dev *dev, struct rc_map *rc_map,
gfp_t gfp_flags)
{
- unsigned int oldalloc = rc_map->alloc;
- unsigned int newalloc = oldalloc;
- struct rc_map_table *oldscan = rc_map->scan;
+ unsigned int newsize = rc_map->size;
struct rc_map_table *newscan;
if (rc_map->size == rc_map->len) {
/* All entries in use -> grow keytable */
- if (rc_map->alloc >= IR_TAB_MAX_SIZE)
+ if (newsize >= IR_TAB_MAX_ENTRIES)
return -ENOMEM;
- newalloc *= 2;
- dev_dbg(&dev->dev, "Growing table to %u bytes\n", newalloc);
+ newsize *= 2;
+
+ dev_dbg(&dev->dev, "Growing table to %u entries\n", newsize);
}
- if ((rc_map->len * 3 < rc_map->size) && (oldalloc > IR_TAB_MIN_SIZE)) {
+ if (rc_map->len * 3 < rc_map->size && rc_map->size > IR_TAB_MIN_ENTRIES) {
/* Less than 1/3 of entries in use -> shrink keytable */
- newalloc /= 2;
- dev_dbg(&dev->dev, "Shrinking table to %u bytes\n", newalloc);
+ newsize /= 2;
+ dev_dbg(&dev->dev, "Shrinking table to %u entries\n", newsize);
}
- if (newalloc == oldalloc)
+ if (newsize == rc_map->size)
return 0;
- newscan = kmalloc(newalloc, gfp_flags);
+ newscan = krealloc_array(rc_map->scan, newsize,
+ sizeof(struct rc_map_table), gfp_flags);
if (!newscan)
return -ENOMEM;
- memcpy(newscan, rc_map->scan, rc_map->len * sizeof(struct rc_map_table));
rc_map->scan = newscan;
- rc_map->alloc = newalloc;
- rc_map->size = rc_map->alloc / sizeof(struct rc_map_table);
- kfree(oldscan);
+ rc_map->size = newsize;
+
return 0;
}
diff --git a/include/media/rc-map.h b/include/media/rc-map.h
index d95ed3e96de28..f167c37179c8f 100644
--- a/include/media/rc-map.h
+++ b/include/media/rc-map.h
@@ -148,7 +148,6 @@ struct rc_map_table {
* @scan: pointer to struct &rc_map_table
* @size: Max number of entries
* @len: Number of entries that are in use
- * @alloc: size of \*scan, in bytes
* @rc_proto: type of the remote controller protocol, as defined at
* enum &rc_proto
* @name: name of the key map table
@@ -158,7 +157,6 @@ struct rc_map {
struct rc_map_table *scan;
unsigned int size;
unsigned int len;
- unsigned int alloc;
enum rc_proto rc_proto;
const char *name;
spinlock_t lock;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0011/1257] media: rc: Add missing locking for keymap
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0010/1257] media: rc: Replace open coded krealloc() for keymap Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0012/1257] alpha: honor force_successful_syscall_return() again Greg Kroah-Hartman
` (987 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit ab9567336171e46ce9e03ee126902b3fd7901baa ]
When the rc_map for an rc_dev gets updated, locking is required but is
missing in places. A concurrent scancode lookup and a call to
rc_{register,unregistered}_device() could result in a use-after-free;
this could happen if IR is decoded during those function calls.
Add lockdep assertions where locks are required.
ir_free_table() should only be called for non-TX devices else we will
use a spinlock without iniitializing it.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/rc-main.c | 86 +++++++++++++++++++++++++-------------
1 file changed, 57 insertions(+), 29 deletions(-)
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 81f3aafcae8f4..946521ace142e 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -104,7 +104,6 @@ static struct rc_map_list *seek_rc_map(const char *name)
struct rc_map *rc_map_get(const char *name)
{
-
struct rc_map_list *map;
map = seek_rc_map(name);
@@ -201,7 +200,7 @@ static int scancode_to_u64(const struct input_keymap_entry *ke, u64 *scancode)
* ir_create_table() - initializes a scancode table
* @dev: the rc_dev device
* @rc_map: the rc_map to initialize
- * @name: name to assign to the table
+ * @map_name: name to assign to the table
* @rc_proto: ir type to assign to the new table
* @size: initial size of the table
*
@@ -211,23 +210,31 @@ static int scancode_to_u64(const struct input_keymap_entry *ke, u64 *scancode)
* return: zero on success or a negative error code
*/
static int ir_create_table(struct rc_dev *dev, struct rc_map *rc_map,
- const char *name, u64 rc_proto, size_t size)
+ const char *map_name, u64 rc_proto, size_t size)
{
+ struct rc_map_table *scan;
unsigned int alloc;
- rc_map->name = kstrdup(name, GFP_KERNEL);
- if (!rc_map->name)
+ char *name;
+
+ name = kstrdup(map_name, GFP_KERNEL);
+ if (!name)
return -ENOMEM;
+
alloc = roundup_pow_of_two(size);
- rc_map->rc_proto = rc_proto;
- rc_map->len = 0;
- rc_map->size = alloc;
- rc_map->scan = kmalloc_objs(struct rc_map_table, alloc, GFP_KERNEL);
- if (!rc_map->scan) {
- kfree(rc_map->name);
- rc_map->name = NULL;
+ scan = kmalloc_objs(struct rc_map_table, alloc, GFP_KERNEL);
+ if (!scan) {
+ kfree(name);
return -ENOMEM;
}
+ scoped_guard(spinlock_irqsave, &rc_map->lock) {
+ rc_map->name = name;
+ rc_map->scan = scan;
+ rc_map->rc_proto = rc_proto;
+ rc_map->len = 0;
+ rc_map->size = alloc;
+ }
+
dev_dbg(&dev->dev, "Allocated space for %u keycode entries (%zu bytes)\n",
alloc, alloc * sizeof(struct rc_map_table));
return 0;
@@ -237,16 +244,26 @@ static int ir_create_table(struct rc_dev *dev, struct rc_map *rc_map,
* ir_free_table() - frees memory allocated by a scancode table
* @rc_map: the table whose mappings need to be freed
*
- * This routine will free memory alloctaed for key mappings used by given
+ * This routine will free memory allocated for key mappings used by given
* scancode table.
*/
static void ir_free_table(struct rc_map *rc_map)
{
- rc_map->size = 0;
- kfree(rc_map->name);
- rc_map->name = NULL;
- kfree(rc_map->scan);
- rc_map->scan = NULL;
+ struct rc_map_table *scan;
+ const char *name;
+
+ scoped_guard(spinlock_irqsave, &rc_map->lock) {
+ name = rc_map->name;
+ scan = rc_map->scan;
+
+ rc_map->size = 0;
+ rc_map->len = 0;
+ rc_map->name = NULL;
+ rc_map->scan = NULL;
+ }
+
+ kfree(name);
+ kfree(scan);
}
/**
@@ -266,6 +283,8 @@ static int ir_resize_table(struct rc_dev *dev, struct rc_map *rc_map,
unsigned int newsize = rc_map->size;
struct rc_map_table *newscan;
+ lockdep_assert_held(&rc_map->lock);
+
if (rc_map->size == rc_map->len) {
/* All entries in use -> grow keytable */
if (newsize >= IR_TAB_MAX_ENTRIES)
@@ -317,6 +336,8 @@ static unsigned int ir_update_mapping(struct rc_dev *dev,
int old_keycode = rc_map->scan[index].keycode;
int i;
+ lockdep_assert_held(&rc_map->lock);
+
/* Did the user wish to remove the mapping? */
if (new_keycode == KEY_RESERVED || new_keycode == KEY_UNKNOWN) {
dev_dbg(&dev->dev, "#%d: Deleting scan 0x%04llx\n",
@@ -372,6 +393,8 @@ static unsigned int ir_establish_scancode(struct rc_dev *dev,
{
unsigned int i;
+ lockdep_assert_held(&rc_map->lock);
+
/*
* Unfortunately, some hardware-based IR decoders don't provide
* all bits for the complete IR code. In general, they provide only
@@ -396,7 +419,7 @@ static unsigned int ir_establish_scancode(struct rc_dev *dev,
/* No previous mapping found, we might need to grow the table */
if (rc_map->size == rc_map->len) {
if (!resize || ir_resize_table(dev, rc_map, GFP_ATOMIC))
- return -1U;
+ return UINT_MAX;
}
/* i is the proper index to insert our new keycode */
@@ -478,16 +501,18 @@ static int ir_setkeytable(struct rc_dev *dev, const struct rc_map *from)
if (rc)
return rc;
- for (i = 0; i < from->size; i++) {
- index = ir_establish_scancode(dev, rc_map,
- from->scan[i].scancode, false);
- if (index >= rc_map->len) {
- rc = -ENOMEM;
- break;
- }
+ scoped_guard(spinlock_irqsave, &rc_map->lock) {
+ for (i = 0; i < from->size; i++) {
+ index = ir_establish_scancode(dev, rc_map,
+ from->scan[i].scancode, false);
+ if (index >= rc_map->len) {
+ rc = -ENOMEM;
+ break;
+ }
- ir_update_mapping(dev, rc_map, index,
- from->scan[i].keycode);
+ ir_update_mapping(dev, rc_map, index,
+ from->scan[i].keycode);
+ }
}
if (rc)
@@ -523,6 +548,8 @@ static unsigned int ir_lookup_by_scancode(const struct rc_map *rc_map,
{
struct rc_map_table *res;
+ lockdep_assert_held(&rc_map->lock);
+
res = bsearch(&scancode, rc_map->scan, rc_map->len,
sizeof(struct rc_map_table), rc_map_cmp);
if (!res)
@@ -1993,7 +2020,8 @@ int rc_register_device(struct rc_dev *dev)
scoped_guard(mutex, &dev->lock)
dev->registered = false;
out_free_table:
- ir_free_table(&dev->rc_map);
+ if (dev->driver_type != RC_DRIVER_IR_RAW_TX)
+ ir_free_table(&dev->rc_map);
out_raw:
ida_free(&rc_ida, minor);
return rc;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0012/1257] alpha: honor force_successful_syscall_return() again
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0011/1257] media: rc: Add missing locking " Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0013/1257] drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr Greg Kroah-Hartman
` (986 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Turner, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
This fix is for 7.1.y, 7.2.y and 7.3.y only. Mainline is not affected
since commit 83bd31c2840b ("alpha: enable GENERIC_ENTRY") in v7.4-rc1,
which replaced the saved-r0 check with a flag in thread_info. That
conversion is far too large for stable, so this patch fixes the old
entry code instead.
Syscalls that return data rather than a status, such as PTRACE_PEEKUSR,
PTRACE_PEEKTEXT/PEEKDATA, osf_sigprocmask and shmat, call
force_successful_syscall_return() so that a result with the top bit set
is not mistaken for an error. On alpha that clears the saved r0, and
$syscall_error and $strace_error used to check for this and take the
success path.
Commit 55b22075f784 ("alpha: add support for SECCOMP and
SECCOMP_FILTER") moved the restart syscall number to r2 and dropped both
checks, so any negative result now comes back to userspace as an
error with a3 set. PTRACE_PEEKUSR of a register holding -1 fails with
EPERM, which makes sandbox abort when it traces static binaries during
Gentoo package builds, and PTRACE_PEEKUSR of a register holding
0xffffffffffffe000 fails with errno 8192, which breaks unwinding of a
ptrace-stopped thread in elfutils (run-backtrace-native.sh).
Restore the checks on both exit paths. On the traced path the success
path also has to stop falling through into
SYSCALL_SKIP_RETURN_RESTART_GATE, which is meant for skipped syscalls
and would turn a forced-success result of -1 into ENOSYS.
Link: https://bugs.gentoo.org/985765
Fixes: 55b22075f784 ("alpha: add support for SECCOMP and SECCOMP_FILTER")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/entry.S | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/arch/alpha/kernel/entry.S b/arch/alpha/kernel/entry.S
index 9f2608de25446..fe88cd598492a 100644
--- a/arch/alpha/kernel/entry.S
+++ b/arch/alpha/kernel/entry.S
@@ -603,6 +603,14 @@ ret_to_kernel:
.align 3
$syscall_error:
+ /*
+ * force_successful_syscall_return() zeroes the saved r0 (the
+ * syscall number): the negative return value is data, not an
+ * error number.
+ */
+ ldq $18, 0($sp)
+ beq $18, $ret_success
+
/* Restart syscall nr comes from saved r2 (preserved even if r0 overwritten). */
ldq $18, 16($sp) /* old syscall nr for restart */
@@ -700,9 +708,11 @@ ret_from_straced:
$strace_success:
stq $31, 72($sp) /* a3=0 => no error */
stq $0, 0($sp) /* save return value */
+ br $strace_leave
$strace_skip_call:
SYSCALL_SKIP_RETURN_RESTART_GATE
+$strace_leave:
DO_SWITCH_STACK
jsr $26, syscall_trace_leave
UNDO_SWITCH_STACK
@@ -710,6 +720,10 @@ $strace_skip_call:
.align 3
$strace_error:
+ /* See $syscall_error. */
+ ldq $18, 0($sp)
+ beq $18, $strace_success
+
ldq $18, 16($sp) /* restart syscall nr */
ldq $19, 72($sp) /* .. and this a3 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0013/1257] drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0012/1257] alpha: honor force_successful_syscall_return() again Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0014/1257] drm/nouveau: reject zero-size notifier object allocation Greg Kroah-Hartman
` (985 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lyude Paul, Dave Airlie, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <lyude@redhat.com>
[ Upstream commit c7abe771e013848970421e5ca29c6b2f05c31965 ]
Previously, it looked as if we were able to fix suspend/resume on some
desktops by setting Gcoff based on whether or not we were entering runtime
PM. This was a mistake though - the only time suspend/resume would end up
actually working was if Gcoff = 0.
It seems like it's likely the main reason for this is the FBSR GcOff
argument actually controls GSP's behavior with regards to which buffers it
decides to save across suspend/resume. When GcOff = 1, RM reserved regions
are saved unless they are marked as LOST_ON_SUSPEND, and RM channel-context
and kernel-client buffers are also saved -including- when they are
LOST_ON_SUSPEND. This means with GcOff = 1, we end up having GSP save and
restore buffers that actually need to be reinitialized on resume - causing
the failures we're setting.
Thanks to John Hubbard from Nvidia for providing some background on what
these options do in the GSP firmware do!
Signed-off-by: Lyude Paul <lyude@redhat.com>
Fixes: 53dac0623853 ("drm/nouveau/gsp: add support for 570.144")
Cc: <stable@vger.kernel.org> # v6.16+
Reviewed-by: Dave Airlie <airlied@redhat.com>
Link: https://patch.msgid.link/20260814194542.781955-3-lyude@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c
index 469e7eed1d6f8..a93a39ef7c690 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c
@@ -135,7 +135,7 @@ r570_fbsr_init(struct nvkm_gsp *gsp, struct sg_table *sgt, u64 size)
ctrl->hClient = gsp->internal.client.object.handle;
ctrl->hSysMem = memlist.handle;
ctrl->sysmemAddrOfSuspendResumeData = gsp->sr.meta.addr;
- ctrl->bEnteringGcoffState = 1;
+ ctrl->bEnteringGcoffState = 0;
ret = nvkm_gsp_rm_ctrl_wr(&gsp->internal.device.subdevice, ctrl);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0014/1257] drm/nouveau: reject zero-size notifier object allocation
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0013/1257] drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0015/1257] drm/nouveau/svm: drain fault handler before freeing svmm Greg Kroah-Hartman
` (984 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Zhenhao Wan, Lyude Paul,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenhao Wan <whi4ed0g@gmail.com>
[ Upstream commit 38125d38d850bd2fdd5d7840c3bd52d9d208995b ]
nouveau_abi16_ioctl_notifierobj_alloc() passes the userspace-controlled
info->size to nvkm_mm_head() as both size_max and size_min without a lower
bound. A zero size satisfies the allocator's "e - s < size_min" gate
(size_min == 0 makes the unsigned comparison inert) and yields a
zero-length node, after which
args.limit = ntfy->node->offset + ntfy->node->length - 1;
underflows (offset 0, length 0 -> 0xffffffff) into an oversized ~4 GiB DMA
window. The dma object constructor only rejects start > limit, so the
validly ordered [base, base + 0xffffffff] range passes and is programmed
into the GPU DMA context. The ioctl is DRM_RENDER_ALLOW, so any render
node client can trigger this on pre-Fermi hardware.
Reject a zero-size request before allocating anything.
Fixes: ebb945a94bba ("drm/nouveau: port all engines to new engine module format")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260813-nouveau-abi16-notifierobj-zero-size-v1-1-20dee38077cb@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_abi16.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index b776030460f77..e876f154963d0 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -666,6 +666,10 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
if (unlikely(device->info.family >= NV_DEVICE_INFO_V0_FERMI))
return nouveau_abi16_put(abi16, -EINVAL);
+ /* zero size yields a zero-length node, underflowing args.limit */
+ if (unlikely(!info->size))
+ return nouveau_abi16_put(abi16, -EINVAL);
+
chan = nouveau_abi16_chan(abi16, info->channel);
if (!chan)
return nouveau_abi16_put(abi16, -ENOENT);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0015/1257] drm/nouveau/svm: drain fault handler before freeing svmm
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0014/1257] drm/nouveau: reject zero-size notifier object allocation Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0016/1257] drm/nouveau/pci: use config-space MSI rearm on MCP79/MCP7A (NVAC) Greg Kroah-Hartman
` (983 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Zhenhao Wan, Lyude Paul,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenhao Wan <whi4ed0g@gmail.com>
[ Upstream commit b46ddaf0823405f81e681eb26ec98508f3eb9a07 ]
The SVM fault handler nouveau_svm_fault() looks up each fault's
nouveau_svmm under svm->mutex, caches it in the fault array, then drops
svm->mutex and dereferences the svmm across blocking faults
(mmu_interval_notifier_insert(), hmm_range_fault()).
nouveau_svmm is not refcounted. On DRM file close nouveau_svmm_fini() ->
mmu_notifier_put() frees it asynchronously via call_srcu() without
waiting for the handler, and mmget_not_zero() pins the mm, not the svmm.
flush_work() on the fault buffer otherwise runs only at device removal
and suspend, never on close, so a fault handled concurrently with a close
can dereference a freed svmm.
The instance is already unlinked by nouveau_svmm_part() earlier in the
same close, so no new fault can resolve to it. Drain the handler in
nouveau_svmm_fini() before the free, guarding the flush with a NULL check
on drm->svm: on device teardown nouveau_svm_fini() runs first and frees
drm->svm (NULL) after blocking the notify and flushing the buffer, so the
handler is already drained; on per-client close drm->svm is alive and the
flush runs.
Fixes: eeaf06ac1a55 ("drm/nouveau/svm: initial support for shared virtual memory")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260814-nouveau-svm-svmm-uaf-v2-1-8e6590519f07@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_svm.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
index 58735446d7832..c519c28164fa0 100644
--- a/drivers/gpu/drm/nouveau/nouveau_svm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
@@ -304,6 +304,19 @@ nouveau_svmm_fini(struct nouveau_svmm **psvmm)
{
struct nouveau_svmm *svmm = *psvmm;
if (svmm) {
+ struct nouveau_svm *svm = svmm->vmm->cli->drm->svm;
+
+ /* The fault handler caches svmm pointers under svm->mutex and
+ * dereferences them after dropping it, across blocking faults.
+ * The instance is already unlinked (nouveau_svmm_part), so drain
+ * the handler before the free to release any in-flight reference.
+ *
+ * On device teardown nouveau_svm_fini() ran first and freed
+ * drm->svm (NULL) after draining the buffer; nothing to flush.
+ */
+ if (svm)
+ flush_work(&svm->buffer[0].work);
+
mutex_lock(&svmm->mutex);
svmm->vmm = NULL;
mutex_unlock(&svmm->mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0016/1257] drm/nouveau/pci: use config-space MSI rearm on MCP79/MCP7A (NVAC)
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0015/1257] drm/nouveau/svm: drain fault handler before freeing svmm Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0017/1257] drm/nouveau: disable the fence uevent work instead of just cancelling it Greg Kroah-Hartman
` (982 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fab Stz, Marek Czernohous,
Lyude Paul, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <marek@czernohous.de>
[ Upstream commit 354d47fb3f35461b7f942831c1b2a7105e92b57f ]
NVAC (MCP79/MCP7A) uses g94_pci_func, whose .msi_rearm is
nv40_pci_msi_rearm(): a re-arm write through the MMIO mirror of PCI
config space. On this IGP that path is unreliable; when a re-arm is
missed the interrupt line stays dead, command submission times out and
the GPU appears hung until reboot. On an Apple Mac mini (early 2009,
MCP79, boot0 0x0ac080b1) this showed as sporadic fifo timeouts and GPU
hangs under load unless MSI was disabled via config=NvMSI=0.
Give NVAC its own pci func that re-arms through real PCI config space
(nv46_pci_msi_rearm) instead. This follows existing precedent: nv46.c
documents the MMIO-mirror re-arm as broken on several related parts,
and commit 5112abc6a433 ("drm/nouveau/pci/g92: Fix rearm") fixed g92
the same way while moving the remaining chipsets, NVAC included, into
the newly added shared g94 table, where NVAC stayed on the MMIO path.
This change completes that fix for NVAC. The sibling IGP NVAA
(MCP77/MCP78) has MSI disabled entirely as "reported broken" in
nvkm_pci_new_(); NVAC works correctly once the re-arm goes through
config space, so disabling MSI is not necessary.
Only NVAC is switched: that is the hardware this has been validated
on. The other users of g94_pci_func (G94/G96/G98/GT2xx and the
MCP77/MCP89 IGPs) keep their current behavior; MCP77 and MCP89
plausibly want the same treatment but were not tested.
Tested on the Mac mini as a daily driver for two months with MSI
enabled and zero fifo timeouts. Independently confirmed stable on an
iMac9,1 (MCP79) running 6.12.90 with the v1 form of this change (the
same one-line functional switch, applied to that kernel's g94
implementation).
Fixes: 5112abc6a433 ("drm/nouveau/pci/g92: Fix rearm")
Cc: <stable@vger.kernel.org> # v6.16+
Tested-by: Fab Stz <fabstz-it@yahoo.fr>
Assisted-by: Claude:claude-opus-4-7
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178688574401.522643.12812428444459119913@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/nouveau/include/nvkm/subdev/pci.h | 1 +
.../gpu/drm/nouveau/nvkm/engine/device/base.c | 2 +-
.../gpu/drm/nouveau/nvkm/subdev/pci/Kbuild | 1 +
.../gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c | 35 +++++++++++++++++++
4 files changed, 38 insertions(+), 1 deletion(-)
create mode 100644 drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h
index 112b674ed9c8a..0172e0d200f81 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h
@@ -46,6 +46,7 @@ int nv4c_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct n
int g84_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
int g92_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
int g94_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
+int mcp79_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
int gf100_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
int gf106_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
int gk104_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index 96c8a5b299999..a2ed8c4fe52a0 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -1237,7 +1237,7 @@ nvac_chipset = {
.mc = { 0x00000001, g98_mc_new },
.mmu = { 0x00000001, mcp77_mmu_new },
.mxm = { 0x00000001, nv50_mxm_new },
- .pci = { 0x00000001, g94_pci_new },
+ .pci = { 0x00000001, mcp79_pci_new },
.therm = { 0x00000001, g84_therm_new },
.timer = { 0x00000001, nv41_timer_new },
.volt = { 0x00000001, nv40_volt_new },
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild
index a14ea0f7b1c87..90f03baeb22ac 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild
@@ -9,6 +9,7 @@ nvkm-y += nvkm/subdev/pci/nv4c.o
nvkm-y += nvkm/subdev/pci/g84.o
nvkm-y += nvkm/subdev/pci/g92.o
nvkm-y += nvkm/subdev/pci/g94.o
+nvkm-y += nvkm/subdev/pci/mcp79.o
nvkm-y += nvkm/subdev/pci/gf100.o
nvkm-y += nvkm/subdev/pci/gf106.o
nvkm-y += nvkm/subdev/pci/gk104.o
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c
new file mode 100644
index 0000000000000..e2ae242f1aa77
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: MIT
+/*
+ * Copyright 2026 Marek Czernohous
+ *
+ * MCP79/MCP7A (NVAC): like g94, but MSI re-arm goes through real PCI
+ * config space. The MMIO-mirror re-arm is unreliable on this IGP and a
+ * missed re-arm kills the interrupt line (see the nv46 comment; g92
+ * already re-arms through config space for the same reason).
+ */
+#include "priv.h"
+
+static const struct nvkm_pci_func
+mcp79_pci_func = {
+ .cfg = { .addr = 0x088000, .size = 0x1000 },
+
+ .init = g84_pci_init,
+ .msi_rearm = nv46_pci_msi_rearm,
+
+ .pcie.init = g84_pcie_init,
+ .pcie.set_link = g84_pcie_set_link,
+
+ .pcie.max_speed = g84_pcie_max_speed,
+ .pcie.cur_speed = g84_pcie_cur_speed,
+
+ .pcie.set_version = g84_pcie_set_version,
+ .pcie.version = g84_pcie_version,
+ .pcie.version_supported = g92_pcie_version_supported,
+};
+
+int
+mcp79_pci_new(struct nvkm_device *device, enum nvkm_subdev_type type, int inst,
+ struct nvkm_pci **ppci)
+{
+ return nvkm_pci_new_(&mcp79_pci_func, device, type, inst, ppci);
+}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0017/1257] drm/nouveau: disable the fence uevent work instead of just cancelling it
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0016/1257] drm/nouveau/pci: use config-space MSI rearm on MCP79/MCP7A (NVAC) Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0018/1257] drm/nouveau: cancel the DP IRQ work before freeing the connector Greg Kroah-Hartman
` (981 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Marek Czernohous,
Lyude Paul, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <marek@czernohous.de>
[ Upstream commit 827eb9328eaed831d7cc426ac2705038a40835b6 ]
nouveau_fence_context_del() drains the uevent work while the event that
feeds it is still armed:
cancel_work_sync(&fctx->uevent_work);
nouveau_fence_context_kill(fctx, 0);
nvif_event_dtor(&fctx->event);
nouveau_fence_wait_uevent_handler() queues the work unconditionally:
schedule_work(&fctx->uevent_work);
return NVIF_EVENT_KEEP;
so a non-stall interrupt arriving after cancel_work_sync() has returned
re-arms the work that was just drained. The window closes in two steps,
neither of which is the drain. The kill blocks the event when the last
fence holding a notify_ref is signalled, which reaches
atomic_xchg(&ntfy->allowed, 0) (nvkm/core/event.c:104), and
nvkm_event_ntfy() skips a ntfy that is not allowed (:183). That stops
further handlers from starting, but not one that is already inside
nvkm_event_ntfy(): the event is created with wait = false
(nouveau_fence.c:201), so nvkm_event_ntfy_block_() leaves it on the list
and never takes event->list_lock. Only nvif_event_dtor() waits that one
out: nvkm_event_ntfy_del() (:141) goes through nvkm_event_ntfy_remove(),
which takes write_lock_irq() on that same list_lock (:84).
Either way the re-arm happens after the drain, and the caller drops its
reference immediately afterwards, for example nv84_fence_context_del():
nouveau_fence_context_del(&fctx->base);
chan->fence = NULL;
nouveau_fence_context_free(&fctx->base);
That is a kref_put() on fctx->fence_ref, so the context outlives the
teardown only while emitted fences still hold a reference of their own.
That is no safety net: whenever none do, the count reaches zero right
there and nouveau_fence_context_put() kfree()s fctx while the work is
still queued. &fctx->uevent_work is embedded in that allocation, so the
workqueue already dereferences freed memory when it picks the item up,
and nouveau_fence_uevent_work() can then take fctx->lock on it. With
CONFIG_DEBUG_OBJECTS_WORK and CONFIG_DEBUG_OBJECTS_FREE, kfree() of a
still-queued work item is reported as the free of an active object.
On live memory the re-armed work has nothing left to do:
nouveau_fence_context_kill() empties fctx->pending and sets fctx->killed
under fctx->lock, nouveau_fence_emit() then returns -ENODEV rather than
queueing anything new, and nouveau_fence_update() only reaches
nvif_event_block() if it signalled something off that list. The defect
is the access to freed memory, not what the work would have found.
Only chips from G84 on can reach this at all: nouveau_fence_context_new()
returns before nvif_event_ctor() when priv->uevent is clear, and
nv84_fence_create() is the only place that sets it.
nv84_fence_context_del() is the context_del for all of those, because
nvc0_fence_create() and gv100_fence_create() build on nv84_fence_create()
and override only context_new.
Use disable_work_sync() instead. It drains the work exactly like
cancel_work_sync() does, and additionally increments the work item's
disable count, after which "any attempt to queue @work will fail and
return %false" (kernel/workqueue.c, disable_work()). The handler's
schedule_work() then has nothing to re-arm, and the teardown order stays
as it is.
Draining a second time after nvif_event_dtor() would close the window as
well, and without the newer API: once nvkm_event_ntfy_remove() has
returned, no handler can start or still be running, so nothing re-arms
the work past that point. disable_work_sync() is preferred here because
it needs one synchronisation point instead of two, it keeps the work
from being queued at all rather than cleaning up after it, and it is
what drm has settled on for this (drm/xe, drm/panthor, drm_pagemap).
Blocking the event rather than the work is not an option: fctx->event is
created with wait = false, so a handler already inside nvkm_event_ntfy()
can still queue the work.
Note for backports: disable_work_sync() arrived in v6.10 with
commit 86898fa6b8cd ("workqueue: Implement disable/enable for (delayed)
work items"), while the fix being corrected here reached 6.6.18 and
6.7.6. linux-6.6.y therefore carries this bug without the API, and this
patch would apply there and then fail to build. A 6.6.y backport wants
the second drain described above instead, as its own patch.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260812233022.159301F000E9@smtp.kernel.org/
Fixes: 39126abc5e20 ("nouveau: offload fence uevents work to workqueue")
Cc: <stable@vger.kernel.org> # 6.10.x
Assisted-by: Claude:claude-opus-5
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178688513268.513871.3468844663561639695@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
index edbe9e08ba0fd..11e95c37ce506 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -96,7 +96,7 @@ nouveau_fence_context_kill(struct nouveau_fence_chan *fctx, int error)
void
nouveau_fence_context_del(struct nouveau_fence_chan *fctx)
{
- cancel_work_sync(&fctx->uevent_work);
+ disable_work_sync(&fctx->uevent_work);
nouveau_fence_context_kill(fctx, 0);
nvif_event_dtor(&fctx->event);
fctx->dead = 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0018/1257] drm/nouveau: cancel the DP IRQ work before freeing the connector
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0017/1257] drm/nouveau: disable the fence uevent work instead of just cancelling it Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0019/1257] drm/nouveau: dont dereference outp before checking it in nouveau_dp_irq Greg Kroah-Hartman
` (980 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Marek Czernohous,
Lyude Paul, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <marek@czernohous.de>
[ Upstream commit f60849975a886d70883bcb6b3658c0fa83c6971f ]
nouveau_connector_destroy() tears the two nvif events down and then
frees the connector, but never cancels the work the IRQ event queues:
nvif_event_dtor(&nv_connector->irq);
nvif_event_dtor(&nv_connector->hpd);
kfree(nv_connector->edid);
...
kfree(connector);
nouveau_connector_irq() queues that work unconditionally:
schedule_work(&nv_connector->irq_work);
return NVIF_EVENT_KEEP;
A DP IRQ arriving just before nvif_event_dtor() therefore leaves
nv_connector->irq_work on the system queue past the kfree(). When it
runs, nouveau_dp_irq() derives both nv_connector and connector from the
work_struct and dereferences them, and goes on to take
outp->dp.hpd_irq_lock.
There is no cancel_work_sync() for irq_work anywhere in the driver, so
nothing else covers this. Add it after the event teardown, where no
further work can be queued, and before anything is freed.
Reported by the Sashiko review bot as a pre-existing issue, in its review
of an earlier nv04 FIFO series of mine, and confirmed against the source.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260812231330.705425-1-mczernohous@gmail.com?part=1
Fixes: 773eb04d14a1 ("drm/nouveau/disp: expose conn event class")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178682366002.3748010.4096452389040554615@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_connector.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 4cfc9c7c2ae0c..7c4f0a29b05bf 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -397,6 +397,7 @@ nouveau_connector_destroy(struct drm_connector *connector)
struct nouveau_connector *nv_connector = nouveau_connector(connector);
nvif_event_dtor(&nv_connector->irq);
nvif_event_dtor(&nv_connector->hpd);
+ cancel_work_sync(&nv_connector->irq_work);
kfree(nv_connector->edid);
drm_connector_unregister(connector);
drm_connector_cleanup(connector);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0019/1257] drm/nouveau: dont dereference outp before checking it in nouveau_dp_irq
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0018/1257] drm/nouveau: cancel the DP IRQ work before freeing the connector Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0020/1257] drm/amdgpu: recompute the dw estimate after allocating a new VM update job Greg Kroah-Hartman
` (979 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Czernohous, Lyude Paul,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <marek@czernohous.de>
[ Upstream commit 843bc34db94bff0612c8294861b156489958897b ]
nouveau_dp_irq() looks the encoder up and dereferences it in the same
breath, five lines before testing it:
struct nouveau_encoder *outp = find_encoder(connector, DCB_OUTPUT_DP);
struct nouveau_drm *drm = nouveau_drm(outp->base.base.dev);
...
if (!outp)
return;
find_encoder() walks the connector's possible encoders and returns NULL
when none of them matches the requested type, so the NULL test is not
decoration: it is the author saying this can happen. The initialiser
above it dereferences the same pointer regardless.
The NULL test predates the dereference. commit 773eb04d14a1
("drm/nouveau/disp: expose conn event class") turned nouveau_dp_irq()
into a work callback, and since the drm pointer was no longer passed in
as an argument it was recovered from the encoder in the declaration
block, which put the dereference above the existing test.
Move the drm lookup below the test. No functional change when outp is
non-NULL.
Fixes: 773eb04d14a1 ("drm/nouveau/disp: expose conn event class")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178682366004.3748010.14933649768375463967@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_dp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c b/drivers/gpu/drm/nouveau/nouveau_dp.c
index 55691ec44abaa..738802358d85c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dp.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
@@ -486,7 +486,7 @@ nouveau_dp_irq(struct work_struct *work)
container_of(work, typeof(*nv_connector), irq_work);
struct drm_connector *connector = &nv_connector->base;
struct nouveau_encoder *outp = find_encoder(connector, DCB_OUTPUT_DP);
- struct nouveau_drm *drm = nouveau_drm(outp->base.base.dev);
+ struct nouveau_drm *drm;
struct nv50_mstm *mstm;
u64 hpd = 0;
int ret;
@@ -494,6 +494,8 @@ nouveau_dp_irq(struct work_struct *work)
if (!outp)
return;
+ drm = nouveau_drm(outp->base.base.dev);
+
mstm = outp->dp.mstm;
NV_DEBUG(drm, "service %s\n", connector->name);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0020/1257] drm/amdgpu: recompute the dw estimate after allocating a new VM update job
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0019/1257] drm/nouveau: dont dereference outp before checking it in nouveau_dp_irq Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0021/1257] drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG Greg Kroah-Hartman
` (978 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, YuBiao Wang, Christian König,
Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: YuBiao Wang <YuBiao.Wang@amd.com>
[ Upstream commit a74c7832b11827907de560169c7d4ac94505fd87 ]
amdgpu_vm_sdma_update() keeps the number of free dwords of the current
job in a local variable. When the job runs out of room it is committed
and a new one is allocated, but that local variable is not refreshed and
still describes the job which was just submitted.
The stale value is then used to decide how many PTEs fit into the new
job. If it happens to be copy_pte_num_dw + 7, or one more than that, the
result is zero. copy_pte() encodes the transfer size as count * 8 - 1,
so a count of zero asks the engine for a 1GB copy starting inside the IB
pool. That runs off the end of the pool, faults on the first unmapped
GART page above it and hangs the ring.
Re-initialize the estimate from the newly allocated job, which is empty
and therefore has its full budget available.
Cc: stable@vger.kernel.org
Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c
index 50cc0779c340e..eb8cf0d9d9c59 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c
@@ -254,6 +254,11 @@ static int amdgpu_vm_sdma_update(struct amdgpu_vm_update_params *p,
AMDGPU_KERNEL_JOB_ID_VM_UPDATE);
if (r)
return r;
+
+ /* The estimate above describes the job which was just
+ * submitted, take the budget of the newly allocated one.
+ */
+ ndw = p->num_dw_left;
}
if (!p->pages_addr) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0021/1257] drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0020/1257] drm/amdgpu: recompute the dw estimate after allocating a new VM update job Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0022/1257] iio: adc: ti-ads1100: Fix incorrect reading when datarate changed in single mode Greg Kroah-Hartman
` (977 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harry Wentland, Alex Hung,
Robert Mader, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Wentland <harry.wentland@amd.com>
[ Upstream commit 2ffaa7c4050605cb27756f5336f778d1b21268b9 ]
The ROM early-return checks for PQ, Gamma 2.2, and HLG in
mod_color_calculate_degamma_params() do not consider the map_user_ramp
parameter. When map_user_ramp is true (indicating a subsampled surface
that requires post-scaler degamma via GAMCOR), the function still takes
the ROM path, programming PRE_DEGAM instead.
For subsampled formats the chroma channels must be upsampled by the
scaler before degamma is applied. PRE_DEGAM sits before the scaler in
the pipeline (CNVC domain), while GAMCOR sits after it (CM domain).
Using the ROM for subsampled surfaces means degamma is applied to
subsampled chroma before upsampling, producing incorrect results.
Fix by gating the dcn_arch ROM capability checks on !map_user_ramp,
forcing PQ/Gamma22/HLG through the GAMCOR LUT path when the surface
is subsampled.
Fixes: a8bf71649088 ("drm/amd/display: Internal refactoring to abstract color caps")
Cc: stable@vger.kernel.org
Assisted-by: Copilot:claude-opus-4.6
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Tested-by: Robert Mader <robert.mader@collabora.com>
Link: https://patch.msgid.link/20260814211816.1219597-11-harry.wentland@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
index 03d88e78165d5..5786ef5787ac6 100644
--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
@@ -1696,7 +1696,8 @@ bool mod_color_calculate_degamma_params(struct dc_color_caps *dc_caps,
return true;
if (dc_caps != NULL &&
- dc_caps->dpp.dcn_arch == 1) {
+ dc_caps->dpp.dcn_arch == 1 &&
+ !map_user_ramp) {
if (input_tf->tf == TRANSFER_FUNCTION_PQ &&
dc_caps->dpp.dgam_rom_caps.pq == 1)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0022/1257] iio: adc: ti-ads1100: Fix incorrect reading when datarate changed in single mode
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0021/1257] drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0023/1257] iio: light: ltr501: Power down chip if request irq fails Greg Kroah-Hartman
` (976 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Szczudlo, Andy Shevchenko,
Stable, Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Szczudlo <jakubszczudlo40@gmail.com>
[ Upstream commit 38dbf24dfbd0a73b89fa2871a7148429aef05531 ]
When device is suspended and it is in single mode then changing
datarate doesn't make it actually wait for new measurement, so to
be sure that read after change is correct, functions that changes
datarate and gain will wait for a new data.
Fixes: 541880542f2b ("iio: adc: Add TI ADS1100 and ADS1000")
Signed-off-by: Jakub Szczudlo <jakubszczudlo40@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ti-ads1100.c | 107 +++++++++++++++++++++++++++++++++--
1 file changed, 103 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/adc/ti-ads1100.c b/drivers/iio/adc/ti-ads1100.c
index 9fe8d54cce83c..03096d7e10914 100644
--- a/drivers/iio/adc/ti-ads1100.c
+++ b/drivers/iio/adc/ti-ads1100.c
@@ -15,10 +15,12 @@
#include <linux/module.h>
#include <linux/init.h>
#include <linux/i2c.h>
+#include <linux/iopoll.h>
#include <linux/mutex.h>
#include <linux/property.h>
#include <linux/pm_runtime.h>
#include <linux/regulator/consumer.h>
+#include <linux/time.h>
#include <linux/units.h>
#include <linux/iio/iio.h>
@@ -43,6 +45,9 @@
static const int ads1100_data_rate[] = { 128, 32, 16, 8 };
static const int ads1100_data_rate_bits[] = { 12, 14, 15, 16 };
+/* Timeout based on the minimum sample rate of 8 SPS (7500ms) */
+#define ADS1100_MAX_DRDY_TIMEOUT_US (7500 * USEC_PER_MSEC)
+
struct ads1100_data {
struct i2c_client *client;
struct regulator *reg_vdd;
@@ -123,10 +128,86 @@ static int ads1100_get_adc_result(struct ads1100_data *data, int chan, int *val)
return 0;
}
+static int ads1100_conversion_busy(struct ads1100_data *data)
+{
+ u8 buffer[3];
+ int ret;
+
+ ret = i2c_master_recv(data->client, (char *)&buffer, sizeof(buffer));
+ if (ret < 0) {
+ dev_err(&data->client->dev, "I2C read fail: %d\n", ret);
+ return ret;
+ }
+
+ return FIELD_GET(ADS1100_CFG_ST_BSY, buffer[2]);
+}
+
+static int ads1100_wait_single_conversion(struct ads1100_data *data)
+{
+ int data_rate_index = FIELD_GET(ADS1100_DR_MASK, data->config);
+ int data_rate_Hz = ads1100_data_rate[data_rate_index];
+ unsigned long poll_us = DIV_ROUND_CLOSEST(USEC_PER_SEC, data_rate_Hz) / 4;
+ int busy;
+ int ret;
+
+ ret = readx_poll_timeout(ads1100_conversion_busy, data,
+ busy, busy <= 0,
+ poll_us, ADS1100_MAX_DRDY_TIMEOUT_US);
+ if (busy < 0)
+ return busy;
+
+ return ret;
+}
+
+static int ads1100_start_single_conversion(struct ads1100_data *data)
+{
+ u8 config = data->config | ADS1100_CFG_SC;
+ int ret;
+
+ ret = i2c_master_send(data->client, &config, sizeof(config));
+ if (ret < 0) {
+ dev_err(&data->client->dev, "I2C write fail: %d\n", ret);
+ return ret;
+ }
+ /* Need to wait because of change from continuous to single mode */
+ ret = ads1100_wait_single_conversion(data);
+ if (ret)
+ return ret;
+
+ config |= ADS1100_CFG_ST_BSY;
+
+ ret = i2c_master_send(data->client, &config, sizeof(config));
+ if (ret < 0) {
+ dev_err(&data->client->dev, "I2C write fail: %d\n", ret);
+ return ret;
+ }
+
+ /* No need to cache it, it's status bit */
+ data->config = config & ~ADS1100_CFG_ST_BSY;
+
+ return 0;
+}
+
+static int ads1100_poll_data_ready(struct ads1100_data *data)
+{
+ int ret;
+
+ ret = ads1100_start_single_conversion(data);
+ if (ret)
+ return ret;
+
+ ret = ads1100_wait_single_conversion(data);
+ if (ret)
+ return ret;
+
+ return ads1100_set_config_bits(data, ADS1100_CFG_SC, ADS1100_CONTINUOUS);
+}
+
static int ads1100_set_scale(struct ads1100_data *data, int val, int val2)
{
int microvolts;
int gain;
+ int ret;
/* With Vdd between 2.7 and 5V, the scale is always below 1 */
if (val)
@@ -135,6 +216,11 @@ static int ads1100_set_scale(struct ads1100_data *data, int val, int val2)
if (!val2)
return -EINVAL;
+ PM_RUNTIME_ACQUIRE_IF_ENABLED_AUTOSUSPEND(&data->client->dev, pm);
+ ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
+ if (ret)
+ return ret;
+
microvolts = regulator_get_voltage(data->reg_vdd);
/*
* val2 is in 'micro' units, n = val2 / 1000000
@@ -149,22 +235,35 @@ static int ads1100_set_scale(struct ads1100_data *data, int val, int val2)
ads1100_set_config_bits(data, ADS1100_PGA_MASK, ffs(gain) - 1);
- return 0;
+ return ads1100_poll_data_ready(data);
}
static int ads1100_set_data_rate(struct ads1100_data *data, int chan, int rate)
{
unsigned int i;
unsigned int size;
+ int ret;
size = data->supports_data_rate ? ARRAY_SIZE(ads1100_data_rate) : 1;
for (i = 0; i < size; i++) {
if (ads1100_data_rate[i] == rate)
- return ads1100_set_config_bits(data, ADS1100_DR_MASK,
- FIELD_PREP(ADS1100_DR_MASK, i));
+ break;
}
- return -EINVAL;
+ if (i == size)
+ return -EINVAL;
+
+ PM_RUNTIME_ACQUIRE_IF_ENABLED_AUTOSUSPEND(&data->client->dev, pm);
+ ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
+ if (ret)
+ return ret;
+
+ ret = ads1100_set_config_bits(data, ADS1100_DR_MASK,
+ FIELD_PREP(ADS1100_DR_MASK, i));
+ if (ret)
+ return ret;
+
+ return ads1100_poll_data_ready(data);
}
static int ads1100_get_vdd_millivolts(struct ads1100_data *data)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0023/1257] iio: light: ltr501: Power down chip if request irq fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0022/1257] iio: adc: ti-ads1100: Fix incorrect reading when datarate changed in single mode Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0024/1257] cpufreq: airoha: fix probe failure with correct error check Greg Kroah-Hartman
` (975 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuppuswamy Sathyanarayanan,
Andy Shevchenko, Esben Haabendal, Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <esben@geanix.com>
[ Upstream commit 8a9bcd587d7d768e6c8e9fff88bb89645e412731 ]
In case devm_request_threaded_irq() failed, we were leaving the chip
powered instead of powering it down again. Power down the chip switching
ALS and PS modes to standby.
Fixes: 7ac702b3144b ("iio: ltr501: Add interrupt support")
Cc: stable@vger.kernel.org
Acked-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Esben Haabendal <esben@geanix.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/ltr501.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index fa0d16890c8bf..b36bd10a02624 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -1538,7 +1538,7 @@ static int ltr501_probe(struct i2c_client *client)
"ltr501_thresh_event",
indio_dev);
if (ret)
- return ret;
+ goto powerdown_on_error;
} else {
indio_dev->info = data->chip_info->info_no_irq;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0024/1257] cpufreq: airoha: fix probe failure with correct error check
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0023/1257] iio: light: ltr501: Power down chip if request irq fails Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0025/1257] media: streamzap: Add missing rc_unregister_device() Greg Kroah-Hartman
` (974 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Schwierzeck,
Christian Marangi, Zhongqiu Han, Viresh Kumar, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
[ Upstream commit 801ade22c4fc078ea9b11e1f3fe3aae8b8bef886 ]
dev_pm_domain_attach_list() returns the number of attached PM domains
on success (a positive count), or a negative error code on failure.
The driver checks "if (ret)" which treats a successful attachment of
one or more PM domains as an error, causing the probe to fail with
return code 1.
Fix by checking "if (ret < 0)" like all other users of this API.
Cc: stable@vger.kernel.org
Fixes: 84cf9e541ccc ("cpufreq: airoha: Add EN7581 CPUFreq SMCCC driver")
Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/airoha-cpufreq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/cpufreq/airoha-cpufreq.c b/drivers/cpufreq/airoha-cpufreq.c
index 3e7770860d13c..8283c528d0c14 100644
--- a/drivers/cpufreq/airoha-cpufreq.c
+++ b/drivers/cpufreq/airoha-cpufreq.c
@@ -64,7 +64,7 @@ static int airoha_cpufreq_probe(struct platform_device *pdev)
/* Attach PM for OPP */
ret = dev_pm_domain_attach_list(cpu_dev, &attach_data,
&priv->pd_list);
- if (ret)
+ if (ret < 0)
goto clear_opp_config;
cpufreq_dt = platform_device_register_simple("cpufreq-dt", -1, NULL, 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0025/1257] media: streamzap: Add missing rc_unregister_device()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0024/1257] cpufreq: airoha: fix probe failure with correct error check Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0026/1257] media: redrat3: Ensure we dont read beyond the end of the packet Greg Kroah-Hartman
` (973 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 3982d2eeb1bdf7a9c14e4ff69015cb456f11da51 ]
If usb_submit_urb() fails during probe, then the error path is missing a
call to rc_unregister_device(), which will leak various things like the
input device.
Fixes: 42844992664f ("media: rc: streamzap: Error handling in probe")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/streamzap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/rc/streamzap.c b/drivers/media/rc/streamzap.c
index 307985d74fe8a..41195ad82734f 100644
--- a/drivers/media/rc/streamzap.c
+++ b/drivers/media/rc/streamzap.c
@@ -365,6 +365,7 @@ static int streamzap_probe(struct usb_interface *intf,
return 0;
rc_submit_fail:
+ rc_unregister_device(sz->rdev);
rc_free_device(sz->rdev);
usb_set_intfdata(intf, NULL);
rc_dev_fail:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0026/1257] media: redrat3: Ensure we dont read beyond the end of the packet
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0025/1257] media: streamzap: Add missing rc_unregister_device() Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0027/1257] media: redrat3: Ensure all urbs are suspended Greg Kroah-Hartman
` (972 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit cd49f62f4161c7340d9c9f53b67757575900c0bc ]
The length and offset is provided by the usb device, so it should be
validated.
Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/redrat3.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 565c490b7051a..1200fb49d8879 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -358,8 +358,24 @@ static void redrat3_process_ir_data(struct redrat3_dev *rr3)
/* process each rr3 encoded byte into an int */
sig_size = be16_to_cpu(rr3->irdata.sig_size);
+
+ /*
+ * Note we are not checking if we are reading beyond the end of the
+ * packet which was sent, and reading stale data. If the device
+ * sends a packet which is short then we get garbage IR, but no
+ * out of bounds read.
+ */
+ if (sig_size > RR3_MAX_SIG_SIZE) {
+ dev_err(dev, "length %u is incorrect\n", sig_size);
+ return;
+ }
+
for (i = 0; i < sig_size; i++) {
offset = rr3->irdata.sigdata[i];
+ if (offset >= RR3_DRIVER_MAXLENS) {
+ dev_err(dev, "offset %u is incorrect\n", offset);
+ return;
+ }
val = get_unaligned_be16(&rr3->irdata.lens[offset]);
/* we should always get pulse/space/pulse/space samples */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0027/1257] media: redrat3: Ensure all urbs are suspended
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0026/1257] media: redrat3: Ensure we dont read beyond the end of the packet Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0028/1257] media: redrat3: Error path leaves device in transmitting state Greg Kroah-Hartman
` (971 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 1582f545273f2aa4eb4ee6f3a89b433f5c85c68f ]
Ensure that the learn urb is stopped before suspend.
Fixes: c49fcdde38cb ("[media] redrat3: enable carrier reports using wideband receiver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/redrat3.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 1200fb49d8879..fc514d9f868b1 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -1168,6 +1168,7 @@ static int redrat3_dev_suspend(struct usb_interface *intf, pm_message_t message)
usb_kill_urb(rr3->narrow_urb);
usb_kill_urb(rr3->wide_urb);
usb_kill_urb(rr3->flash_urb);
+ usb_kill_urb(rr3->learn_urb);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0028/1257] media: redrat3: Error path leaves device in transmitting state
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0027/1257] media: redrat3: Ensure all urbs are suspended Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0029/1257] media: sunxi-cir: Ensure no more interrupts can occur before free Greg Kroah-Hartman
` (970 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 8024d5e84531d828535365718278f1cf0ce67db0 ]
In the allocation failure error path, the transmitting boolean is not
cleared. If this error path is followed the transmitter cannot be
used again until the device is replugged or the module reloaded.
Fix the error path by moving the assignment statement.
Remove the check for the transmitting state in transmit, since rc-core
ensures there is never a reentrant call to the driver transmit function;
the transmit function is always called with dev->lock held.
The transmitting boolean is only used for interpretting firmware errors.
Fixes: fac59136bc22 ("[media] RedRat3: Return directly after a failed kcalloc() in redrat3_transmit_ir()")"
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/redrat3.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index fc514d9f868b1..3e82b5e66477e 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -773,17 +773,9 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf,
u8 curlencheck = 0;
unsigned i, sendbuf_len;
- if (rr3->transmitting) {
- dev_warn(dev, "%s: transmitter already in use\n", __func__);
- return -EAGAIN;
- }
-
if (count > RR3_MAX_SIG_SIZE - RR3_TX_TRAILER_LEN)
return -EINVAL;
- /* rr3 will disable rc detector on transmit */
- rr3->transmitting = true;
-
sample_lens = kzalloc_objs(*sample_lens, RR3_DRIVER_MAXLENS);
if (!sample_lens)
return -ENOMEM;
@@ -794,6 +786,9 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf,
goto out;
}
+ /* rr3 will disable rc detector on transmit */
+ rr3->transmitting = true;
+
for (i = 0; i < count; i++) {
cur_sample_len = redrat3_us_to_len(txbuf[i]);
if (cur_sample_len > 0xffff) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0029/1257] media: sunxi-cir: Ensure no more interrupts can occur before free
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0028/1257] media: redrat3: Error path leaves device in transmitting state Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0030/1257] media: meson-ir-tx: Ensure clock is disabled on unbind Greg Kroah-Hartman
` (969 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit f9b33ec404200c03dd490ec133b8f9bf599c5444 ]
Only call rc_free_device() once the hardware has been stopped.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/sunxi-cir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/rc/sunxi-cir.c b/drivers/media/rc/sunxi-cir.c
index 28e840a7e5b8c..af1ee08ffdbec 100644
--- a/drivers/media/rc/sunxi-cir.c
+++ b/drivers/media/rc/sunxi-cir.c
@@ -374,8 +374,8 @@ static void sunxi_ir_remove(struct platform_device *pdev)
struct sunxi_ir *ir = platform_get_drvdata(pdev);
rc_unregister_device(ir->rc);
- rc_free_device(ir->rc);
sunxi_ir_hw_exit(&pdev->dev);
+ rc_free_device(ir->rc);
}
static void sunxi_ir_shutdown(struct platform_device *pdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0030/1257] media: meson-ir-tx: Ensure clock is disabled on unbind
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0029/1257] media: sunxi-cir: Ensure no more interrupts can occur before free Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0031/1257] media: meson-ir-tx: Ensure rc_free_device() is called " Greg Kroah-Hartman
` (968 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Young, Martin Blumenstingl,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 1517326fcc9dfdb9acb24f42472366ac1b4b8237 ]
clk_prepare_enable() needs a call to clk_disable_unprepare() on
driver unbind. Make it devm managed.
Fixes: 49be1c78d575 ("media: rc: introduce Meson IR TX driver")
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/meson-ir-tx.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index fded2c256f2a6..6beb9e97453dd 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -288,11 +288,12 @@ static int meson_irtx_mod_clock_probe(struct meson_irtx *ir,
if (!np)
return -ENODEV;
- clock = devm_clk_get(ir->dev, "xtal");
- if (IS_ERR(clock) || clk_prepare_enable(clock))
+ *clk_nr = IRB_MOD_XTAL3_CLK;
+
+ clock = devm_clk_get_enabled(ir->dev, "xtal");
+ if (IS_ERR(clock))
return -ENODEV;
- *clk_nr = IRB_MOD_XTAL3_CLK;
ir->clk_rate = clk_get_rate(clock) / 3;
if (ir->clk_rate < IRB_MOD_1US_CLK_RATE) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0031/1257] media: meson-ir-tx: Ensure rc_free_device() is called on unbind
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0030/1257] media: meson-ir-tx: Ensure clock is disabled on unbind Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0032/1257] media: meson-ir-tx: Ensure probe error is propagated Greg Kroah-Hartman
` (967 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Young, Martin Blumenstingl,
Neil Armstrong, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 32999b8a9d5c4f497c9739e70ac4ee390cd650a7 ]
Make rc_dev devm managed.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/meson-ir-tx.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index 6beb9e97453dd..e8e3c1a303279 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -346,7 +346,7 @@ static int meson_irtx_probe(struct platform_device *pdev)
if (ret)
return dev_err_probe(dev, ret, "irq request failed\n");
- rc = rc_allocate_device(RC_DRIVER_IR_RAW_TX);
+ rc = devm_rc_allocate_device(dev, RC_DRIVER_IR_RAW_TX);
if (!rc)
return -ENOMEM;
@@ -359,10 +359,8 @@ static int meson_irtx_probe(struct platform_device *pdev)
rc->s_tx_duty_cycle = meson_irtx_set_duty_cycle;
ret = devm_rc_register_device(dev, rc);
- if (ret < 0) {
- rc_free_device(rc);
+ if (ret < 0)
return dev_err_probe(dev, ret, "rc_dev registration failed\n");
- }
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0032/1257] media: meson-ir-tx: Ensure probe error is propagated
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0031/1257] media: meson-ir-tx: Ensure rc_free_device() is called " Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0033/1257] media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled Greg Kroah-Hartman
` (966 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Young, Martin Blumenstingl,
Neil Armstrong, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 2eb8a4cba70f521a8217021e227cfa28ba17724b ]
devm_clk_get_enabled() may return -EPROBE_DEFER which needs to be
propagated else the probe will not be deferred, it will fail instead.
Fixes: 49be1c78d575 ("media: rc: introduce Meson IR TX driver")
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/meson-ir-tx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index e8e3c1a303279..1ab898069e67f 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -292,7 +292,7 @@ static int meson_irtx_mod_clock_probe(struct meson_irtx *ir,
clock = devm_clk_get_enabled(ir->dev, "xtal");
if (IS_ERR(clock))
- return -ENODEV;
+ return PTR_ERR(clock);
ir->clk_rate = clk_get_rate(clock) / 3;
@@ -325,7 +325,7 @@ static int meson_irtx_probe(struct platform_device *pdev)
irq = platform_get_irq(pdev, 0);
if (irq < 0)
- return -ENODEV;
+ return irq;
ir->dev = dev;
ir->carrier = MIRTX_DEFAULT_CARRIER;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0033/1257] media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0032/1257] media: meson-ir-tx: Ensure probe error is propagated Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0034/1257] media: imx-jpeg: finish the job on device_run() error paths Greg Kroah-Hartman
` (965 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit f7509d2567cf92eeccc31c363a2e2ae43188930c ]
Once the interrupt handler is enabled, priv->rdev can be used. Ensure
it is setup correctly so there is no race condition.
Fixes: a84fcdaa9058 ("[media] rc: Introduce hix5hd2 IR transmitter driver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/ir-hix5hd2.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/media/rc/ir-hix5hd2.c b/drivers/media/rc/ir-hix5hd2.c
index 1b061e4a3dcfa..aa3de4d57a585 100644
--- a/drivers/media/rc/ir-hix5hd2.c
+++ b/drivers/media/rc/ir-hix5hd2.c
@@ -316,6 +316,9 @@ static int hix5hd2_ir_probe(struct platform_device *pdev)
if (ret < 0)
goto clkerr;
+ priv->rdev = rdev;
+ priv->dev = dev;
+
if (devm_request_irq(dev, priv->irq, hix5hd2_ir_rx_interrupt,
0, pdev->name, priv) < 0) {
dev_err(dev, "IRQ %d register failed\n", priv->irq);
@@ -323,8 +326,6 @@ static int hix5hd2_ir_probe(struct platform_device *pdev)
goto regerr;
}
- priv->rdev = rdev;
- priv->dev = dev;
platform_set_drvdata(pdev, priv);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0034/1257] media: imx-jpeg: finish the job on device_run() error paths
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0033/1257] media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0035/1257] microblaze: Fix MB_MANAGER build with older binutils Greg Kroah-Hartman
` (964 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fan Wu, Ming Qian, Frank Li,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit 30b35fd2b999e1b8c26f8191d974d20c8848d2d6 ]
mxc_jpeg_device_run() returns early through a shared "end" label on several
error paths (no free slot, mxc_jpeg_alloc_slot_data() failure, or missing
buffers or queue data), and none of them calls v4l2_m2m_job_finish().
Since the delayed work is queued only after the hardware is started, those
paths neither finish the job directly nor queue timeout work that could
finish it later. The job is left with TRANS_RUNNING set, so the
wait_event() in v4l2_m2m_cancel_job() (reached from v4l2_m2m_ctx_release()
at close) waits indefinitely and the close hangs.
mxc_jpeg_alloc_slot_data() uses dma_alloc_coherent(), so the failure path
is reachable under memory pressure.
Return the src/dst buffers with VB2_BUF_STATE_ERROR and call
v4l2_m2m_job_finish() on those paths: paths that have buffers use a
"buf_finish" label; the no-buffer path uses "job_finish" directly. This
mirrors the existing jpeg_parse_error path.
This bug was found by static analysis.
Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/nxp/imx-jpeg/mxc-jpeg.c | 21 +++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
index ea2fad5dd646d..e170859354352 100644
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -1590,15 +1590,15 @@ static void mxc_jpeg_device_run(void *priv)
dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
if (!src_buf || !dst_buf) {
dev_err(dev, "Null src or dst buf\n");
- goto end;
+ goto job_finish;
}
q_data_cap = mxc_jpeg_get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
if (!q_data_cap)
- goto end;
+ goto buf_finish;
q_data_out = mxc_jpeg_get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT);
if (!q_data_out)
- goto end;
+ goto buf_finish;
src_buf->sequence = q_data_out->sequence++;
dst_buf->sequence = q_data_cap->sequence++;
@@ -1636,11 +1636,11 @@ static void mxc_jpeg_device_run(void *priv)
ctx->slot = mxc_get_free_slot(&jpeg->slot_data);
if (ctx->slot < 0) {
dev_err(dev, "No more free slots\n");
- goto end;
+ goto buf_finish;
}
if (!mxc_jpeg_alloc_slot_data(jpeg)) {
dev_err(dev, "Cannot allocate slot data\n");
- goto end;
+ goto buf_finish;
}
mxc_jpeg_enable_slot(reg, ctx->slot);
@@ -1660,8 +1660,17 @@ static void mxc_jpeg_device_run(void *priv)
mxc_jpeg_dec_mode_go(dev, reg);
}
schedule_delayed_work(&ctx->task_timer, msecs_to_jiffies(hw_timeout));
-end:
+
spin_unlock_irqrestore(&ctx->mxc_jpeg->hw_lock, flags);
+ return;
+buf_finish:
+ v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+ v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+ v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_ERROR);
+ v4l2_m2m_buf_done(dst_buf, VB2_BUF_STATE_ERROR);
+job_finish:
+ spin_unlock_irqrestore(&ctx->mxc_jpeg->hw_lock, flags);
+ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
}
static int mxc_jpeg_decoder_cmd(struct file *file, void *priv,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0035/1257] microblaze: Fix MB_MANAGER build with older binutils
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0034/1257] media: imx-jpeg: finish the job on device_run() error paths Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0036/1257] devtmpfs: restore mount option reconfiguration on get_tree Greg Kroah-Hartman
` (963 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Michal Simek,
Karl Mehltretter, Michal Simek, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 79c8aa4da3d5453dd956d2170d1c9c716311ea06 ]
Commit 88707ebe77e2 ("microblaze: Add custom break vector handler for mb
manager") added the suspend mnemonic to the MB Manager break handler.
GNU as only learned this mnemonic in binutils 2.42. Linux supports
binutils 2.30, where enabling CONFIG_MB_MANAGER fails:
arch/microblaze/kernel/entry.S:946: Error: unknown opcode "suspend"
The suspend mnemonic is an alias for mbar 24, and both encode as
0xbb020004. Use the underlying instruction, which GNU as 2.30 already
supports.
Fixes: 88707ebe77e2 ("microblaze: Add custom break vector handler for mb manager")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310310151.UhB396Qs-lkp@intel.com/
Suggested-by: Michal Simek <monstr@monstr.eu>
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260813024026.5402-1-kmehltretter@gmail.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/microblaze/kernel/entry.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index 582d7256d8154..ad44341a5dbc7 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -943,7 +943,7 @@ ret_from_break:
mbar 1
mbar 2
bri 4
- suspend
+ mbar 24 /* suspend */
nop
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0036/1257] devtmpfs: restore mount option reconfiguration on get_tree
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0035/1257] microblaze: Fix MB_MANAGER build with older binutils Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0037/1257] udf: Make sure theres enough space for LVID implementation use field Greg Kroah-Hartman
` (962 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Liebold, Al Viro, Eric Sandeen,
Christian Brauner (Amutable), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <sandeen@redhat.com>
[ Upstream commit 1c7df6fa838a46f0d5090ef134f67511f0592f33 ]
commit cb0e0a8bf4e1 ("devtmpfs: replace ->mount with ->get_tree in
public instance") converted the public devtmpfs instance to the new
mount API but broke the ability to reconfigure the shared superblock
options via subsequent mount() calls, as had been fixed once in
a6097180d884 ("devtmpfs regression fix: reconfigure on each mount")
This makes boot-time defaults permanent.
Fix this using an approach suggested by Al Viro: at init_fs_context
time, create a reconfigure-mode context via fs_context_for_reconfigure()
and save it in fc->fs_private. The devtmpfs parse ops can then use
this context to parse options appropriately for the underlying filesystem.
This also removes the devtmpfs_configure_context() one-time ops-copying
approach and the global mutable ops table it required.
Fixes: cb0e0a8bf4e1 ("devtmpfs: replace ->mount with ->get_tree in public instance")
Reported-by: Simon Liebold <simonlie@amazon.de>
Cc: stable@vger.kernel.org
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Link: https://patch.msgid.link/b1bd3b15-78ea-4487-b6a8-aad0b05dd3bb@redhat.com
Tested-by: Simon Liebold <simonlie@amazon.de>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/devtmpfs.c | 108 ++++++++++++++++++++++++----------------
1 file changed, 64 insertions(+), 44 deletions(-)
diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
index aef0fcc6aba1e..11c70888f38be 100644
--- a/drivers/base/devtmpfs.c
+++ b/drivers/base/devtmpfs.c
@@ -72,39 +72,90 @@ static struct file_system_type internal_fs_type = {
.kill_sb = kill_anon_super,
};
-/* Simply take a ref on the existing mount */
+struct devtmpfs_context {
+ struct fs_context *fc;
+};
+
+static void devtmpfs_free(struct fs_context *fc)
+{
+ struct devtmpfs_context *ctx = fc->fs_private;
+
+ if (ctx) {
+ put_fs_context(ctx->fc);
+ kfree(ctx);
+ }
+}
+
+static int devtmpfs_parse_param(struct fs_context *fc, struct fs_parameter *param)
+{
+ struct devtmpfs_context *ctx = fc->fs_private;
+
+ return ctx->fc->ops->parse_param(ctx->fc, param);
+}
+
+static int devtmpfs_parse_monolithic(struct fs_context *fc, void *data)
+{
+ struct devtmpfs_context *ctx = fc->fs_private;
+
+ if (ctx->fc->ops->parse_monolithic)
+ return ctx->fc->ops->parse_monolithic(ctx->fc, data);
+ return generic_parse_monolithic(ctx->fc, data);
+}
+
static int devtmpfs_get_tree(struct fs_context *fc)
{
+ struct devtmpfs_context *ctx = fc->fs_private;
struct super_block *sb = mnt->mnt_sb;
+ int err;
atomic_inc(&sb->s_active);
down_write(&sb->s_umount);
+
+ if (ctx->fc->ops->reconfigure) {
+ err = ctx->fc->ops->reconfigure(ctx->fc);
+ if (err) {
+ deactivate_locked_super(sb);
+ return err;
+ }
+ }
+
fc->root = dget(sb->s_root);
return 0;
}
-/* Ops are filled in during init depending on underlying shmem or ramfs type */
-static struct fs_context_operations devtmpfs_context_ops = {};
+static const struct fs_context_operations devtmpfs_context_ops = {
+ .free = devtmpfs_free,
+ .parse_param = devtmpfs_parse_param,
+ .parse_monolithic = devtmpfs_parse_monolithic,
+ .get_tree = devtmpfs_get_tree,
+};
-/* Call the underlying initialization and set to our ops */
static int devtmpfs_init_fs_context(struct fs_context *fc)
{
- int ret;
-#ifdef CONFIG_TMPFS
- ret = shmem_init_fs_context(fc);
-#else
- ret = ramfs_init_fs_context(fc);
-#endif
- if (ret < 0)
- return ret;
+ struct devtmpfs_context *ctx;
+ int err;
+
+ ctx = kzalloc_obj(struct devtmpfs_context);
+ if (!ctx)
+ return -ENOMEM;
+
+ /* Each mount will reconfigure the shared superblock w/ new options */
+ ctx->fc = fs_context_for_reconfigure(mnt->mnt_root,
+ mnt->mnt_sb->s_flags, MS_RMT_MASK);
+ if (IS_ERR(ctx->fc)) {
+ err = PTR_ERR(ctx->fc);
+ kfree(ctx);
+ return err;
+ }
+ fc->fs_private = ctx;
fc->ops = &devtmpfs_context_ops;
return 0;
}
static struct file_system_type dev_fs_type = {
- .name = "devtmpfs",
+ .name = "devtmpfs",
.init_fs_context = devtmpfs_init_fs_context,
};
@@ -442,31 +493,6 @@ static int __ref devtmpfsd(void *p)
return 0;
}
-/*
- * Get the underlying (shmem/ramfs) context ops to build ours
- */
-static int devtmpfs_configure_context(void)
-{
- struct fs_context *fc;
-
- fc = fs_context_for_reconfigure(mnt->mnt_root, mnt->mnt_sb->s_flags,
- MS_RMT_MASK);
- if (IS_ERR(fc))
- return PTR_ERR(fc);
-
- /* Set up devtmpfs_context_ops based on underlying type */
- devtmpfs_context_ops.free = fc->ops->free;
- devtmpfs_context_ops.dup = fc->ops->dup;
- devtmpfs_context_ops.parse_param = fc->ops->parse_param;
- devtmpfs_context_ops.parse_monolithic = fc->ops->parse_monolithic;
- devtmpfs_context_ops.get_tree = &devtmpfs_get_tree;
- devtmpfs_context_ops.reconfigure = fc->ops->reconfigure;
-
- put_fs_context(fc);
-
- return 0;
-}
-
/*
* Create devtmpfs instance, driver-core devices will add their device
* nodes here.
@@ -482,12 +508,6 @@ int __init devtmpfs_init(void)
return PTR_ERR(mnt);
}
- err = devtmpfs_configure_context();
- if (err) {
- pr_err("unable to configure devtmpfs type %d\n", err);
- return err;
- }
-
err = register_filesystem(&dev_fs_type);
if (err) {
pr_err("unable to register devtmpfs type %d\n", err);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0037/1257] udf: Make sure theres enough space for LVID implementation use field
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0036/1257] devtmpfs: restore mount option reconfiguration on get_tree Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0038/1257] aio: prevent eventfd/epoll recursion on poll Greg Kroah-Hartman
` (961 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yunpeng Tian, Gongming Wang,
Mingda Zhang, Qinrun Dai, Jan Kara, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
[ Upstream commit a61fb39759d719a4f4966742b4d28387e33d81c4 ]
udf_lvid_valid() verifies that the LVID has enough space for all the
tables and the reported length of ImplementationUse field. However it
doesn't make sure the reported length is large enough to contain
logicalVolIntegrityDescImpUse structure which OSTA specification
requires. This can thus lead to accesses beyond the end of LVID buffer
for suitably corrupted UDF filesystem. Add the length check.
Reported-by: Yunpeng Tian <shionthanatos@gmail.com>
Reported-by: Gongming Wang <gmwgg05@gmail.com>
Reported-by: Mingda Zhang <npczmd@qq.com>
Reported-by: Qinrun Dai <jupmouse@gmail.com>
Cc: stable@vger.kernel.org
Fixes: 781d2a9a2fc7 ("udf: Check LVID earlier")
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/super.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 2ba5973ef4dd4..5351755aca3ec 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1617,7 +1617,10 @@ static bool udf_lvid_valid(struct super_block *sb,
parts = le32_to_cpu(lvid->numOfPartitions);
impuselen = le32_to_cpu(lvid->lengthOfImpUse);
- if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize ||
+ if (sizeof(struct logicalVolIntegrityDescImpUse) > impuselen ||
+ impuselen >= sb->s_blocksize)
+ return false;
+ if (parts >= sb->s_blocksize ||
sizeof(struct logicalVolIntegrityDesc) + impuselen +
2 * parts * sizeof(u32) > sb->s_blocksize)
return false;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0038/1257] aio: prevent eventfd/epoll recursion on poll
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0037/1257] udf: Make sure theres enough space for LVID implementation use field Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0039/1257] ipc/mqueue: release notification resources during inode eviction Greg Kroah-Hartman
` (960 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daehyeon Ko,
Christian Brauner (Amutable), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit 398e3fa789aa5ffddc8689d8cbc7b31e1824130c ]
aio_poll_wake() can complete a keyed poll request inline while the
provider waitqueue lock is held. If the polled file is an epoll instance
and the AIO result eventfd is watched by that same instance, signaling the
result can feed back into epoll and try to take the provider waitqueue lock
again.
For example, a timerfd wake can follow this path:
timerfd -> ep_poll_callback -> aio_poll_wake -> aio_complete
-> eventfd_signal -> ep_poll_callback -> ep_poll_safewake
The second ep_poll_safewake() recursively acquires ep->poll_wait.lock.
eventfd_signal_allowed() does not prevent this because the wake chain did
not begin in eventfd, so the task's eventfd recursion bit is still clear
when aio_poll_wake() decides to complete inline.
An unprivileged process can construct this graph and make a CPU spin on the
recursive lock. DEBUG_SPINLOCK reports "BUG: spinlock recursion", and
lockdep reports the same epoll waitqueue lock as both held and requested.
Always defer eventfd-backed poll completions through the existing
aio_poll_put_work() path. At this point the request has already been
detached from the waitqueue and active request list, so the work item can
publish the completion after the provider callback releases its lock.
Poll completions without a result eventfd remain inline.
Fixes: e8693bcfa0b4 ("aio: allow direct aio poll comletions for keyed wakeups")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20260813133843.2933127-1-4ncienth@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/aio.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/aio.c b/fs/aio.c
index d78acc69f4870..92241a24d9e28 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1869,7 +1869,12 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
list_del_init(&req->wait.entry);
list_del(&iocb->ki_list);
iocb->ki_res.res = mangle_poll(mask);
- if (iocb->ki_eventfd && !eventfd_signal_allowed()) {
+ /*
+ * We hold an arbitrary provider waitqueue lock here. Signaling a
+ * result eventfd can feed back through epoll and try to take the same
+ * lock again. Defer all eventfd-backed poll completions.
+ */
+ if (iocb->ki_eventfd) {
iocb = NULL;
INIT_WORK(&req->work, aio_poll_put_work);
schedule_work(&req->work);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0039/1257] ipc/mqueue: release notification resources during inode eviction
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0038/1257] aio: prevent eventfd/epoll recursion on poll Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0040/1257] kho: do not reserve scratch memory in the kdump kernel Greg Kroah-Hartman
` (959 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daehyeon Ko,
Christian Brauner (Amutable), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit eb85469f0dd69ca145d63117450e14c31f67f698 ]
mqueue_flush_file() removes an mq_notify() registration only when the
closing task belongs to the thread group stored in notify_owner.
A task in a separate thread group created with CLONE_FILES can register
SIGEV_THREAD notification and exit without closing the shared file table.
If another thread group then unlinks and last-closes the queue, ->flush()
skips the registration and inode eviction loses the only pointers to its
resources.
The orphaned registration permanently retains the notification skb, its
netlink socket, a pid reference and a user namespace reference. An
unprivileged process can repeat the sequence with new queues and sockets.
No inode users remain during eviction. Remove any stale registration there
after dropping info->lock, since netlink_sendskb() may release the final
socket reference.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20260824042359.925145-1-4ncienth@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
ipc/mqueue.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index d1dd36a651b0d..d1a1965c98118 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -528,6 +528,13 @@ static void mqueue_evict_inode(struct inode *inode)
list_add_tail(&msg->m_list, &tmp_msg);
kfree(info->node_cache);
spin_unlock(&info->lock);
+ /*
+ * A shared file table can let the notification owner exit without
+ * running ->flush(). No users of the inode remain during eviction, so
+ * tear down any stale notification after dropping info->lock because
+ * netlink_sendskb() may release the final socket reference.
+ */
+ remove_notification(info);
list_for_each_entry_safe(msg, nmsg, &tmp_msg, m_list) {
list_del(&msg->m_list);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0040/1257] kho: do not reserve scratch memory in the kdump kernel
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0039/1257] ipc/mqueue: release notification resources during inode eviction Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0041/1257] remoteproc: elf_loader: Bound the section header table Greg Kroah-Hartman
` (958 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxi Saparov,
Mike Rapoport (Microsoft), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxi Saparov <masaparov@coreweave.com>
[ Upstream commit 48be325089e15077411785d0c41ddb9071a61081 ]
If a kernel with CONFIG_KEXEC_HANDOVER_ENABLE_DEFAULT=y (or kho=on)
does not receive a handover FDT, it reserves KHO scratch memory in
kho_reserve_scratch().
The kdump kernel always takes this path. Since commit a6715d7ec472
("kho: skip KHO for crash kernel"), the kernel does not add KHO
metadata to the crash kimage. As a result, the kdump kernel never
receives a handover FDT and always reserves scratch memory.
The kdump kernel boots in the small crashkernel= memory reservation.
On our x86 hosts, the kernel and initramfs make approximately 176 MB
of early reservations. The scratch areas then use approximately
650 MB more of the crashkernel memory. When a large early allocation
fails, the kdump kernel panics:
bio: can't create integrity buf pool
A kdump kernel has nothing to hand over: its only task is to dump the
memory of the old kernel and reboot. Fix is to disable KHO at the top of
kho_memory_init() so that the kdump kernel does not reserve scratch
memory.
Fixes: 3dc92c311498 ("kexec: add Kexec HandOver (KHO) generation helpers")
Cc: stable@vger.kernel.org
Signed-off-by: Maxi Saparov <masaparov@coreweave.com>
Link: https://patch.msgid.link/20260811161857.3096-1-maxi.saparov@gmail.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/liveupdate/kexec_handover.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c
index 7c4d86daf86d5..3c87c2a3d6f09 100644
--- a/kernel/liveupdate/kexec_handover.c
+++ b/kernel/liveupdate/kexec_handover.c
@@ -12,6 +12,7 @@
#include <linux/cleanup.h>
#include <linux/cma.h>
+#include <linux/crash_dump.h>
#include <linux/kmemleak.h>
#include <linux/count_zeros.h>
#include <linux/kasan.h>
@@ -1939,6 +1940,12 @@ void __init kho_memory_init_early(void)
void __init kho_memory_init(void)
{
+ if (is_kdump_kernel()) {
+ kho_enable = false;
+ pr_info("disabled in the kdump kernel\n");
+ return;
+ }
+
if (kho_in.scratch_phys)
kho_mem_retrieve();
else
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0041/1257] remoteproc: elf_loader: Bound the section header table
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0040/1257] kho: do not reserve scratch memory in the kdump kernel Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0042/1257] soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison Greg Kroah-Hartman
` (957 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, HyeongJun An, Mathieu Poirier,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit b32177ead5f8925aa66ceed2bd533a85196f4f0c ]
The rproc_elf_sanity_check() only checks the image is big enough to hold
one section header. But find_table() walks e_shnum of them, and first
dereferences the header at e_shstrndx to locate the section name table.
Both fields are u16 and both come from the image, so an e_shstrndx of
65535 reads about 4 MB past the buffer.
The commit 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read
past the ELF header") added the same check to the MDT loader, and says
the header "is sanitized beforehand" under remoteproc. That is what this
patch makes true.
Check e_shoff against the image size first, so the two bounds can use
size_add() without an e_shoff above SIZE_MAX wrapping on 32-bit. The
bounds are separate because e_shnum may be zero while find_table() still
reads the e_shstrndx header.
Fixes: 400e64df6b23 ("remoteproc: add framework for controlling remote processors")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://lore.kernel.org/r/20260724025322.2341205-1-sammiee5311@gmail.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/remoteproc_elf_loader.c | 23 ++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
diff --git a/drivers/remoteproc/remoteproc_elf_loader.c b/drivers/remoteproc/remoteproc_elf_loader.c
index 94177e4160473..da3cddbe7d4cb 100644
--- a/drivers/remoteproc/remoteproc_elf_loader.c
+++ b/drivers/remoteproc/remoteproc_elf_loader.c
@@ -46,8 +46,9 @@ int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw)
struct elf32_hdr *ehdr;
u32 elf_shdr_get_size;
u64 phoff, shoff;
+ size_t shend;
char class;
- u16 phnum;
+ u16 phnum, shnum, shstrndx;
if (!fw) {
dev_err(dev, "failed to load %s\n", name);
@@ -90,9 +91,27 @@ int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw)
phoff = elf_hdr_get_e_phoff(class, fw->data);
shoff = elf_hdr_get_e_shoff(class, fw->data);
phnum = elf_hdr_get_e_phnum(class, fw->data);
+ shnum = elf_hdr_get_e_shnum(class, fw->data);
+ shstrndx = elf_hdr_get_e_shstrndx(class, fw->data);
elf_shdr_get_size = elf_size_of_shdr(class);
- if (fw->size < shoff + elf_shdr_get_size) {
+ /* keeps shoff in size_t range for the two bounds below */
+ if (shoff > fw->size) {
+ dev_err(dev, "Section header table is out of bounds\n");
+ return -EINVAL;
+ }
+
+ if (shnum) {
+ shend = size_add(size_mul(elf_shdr_get_size, shnum), shoff);
+ if (shend > fw->size) {
+ dev_err(dev, "Section headers are out of bounds\n");
+ return -EINVAL;
+ }
+ }
+
+ /* find_table() reads the header at shstrndx even with no sections */
+ shend = size_add(size_mul(elf_shdr_get_size, (size_t)shstrndx + 1), shoff);
+ if (shend > fw->size) {
dev_err(dev, "Image is too small\n");
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0042/1257] soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0041/1257] remoteproc: elf_loader: Bound the section header table Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0043/1257] soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around Greg Kroah-Hartman
` (956 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Viken Dadhaniya,
Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
[ Upstream commit 0231382f070df26a8b267f9e68c5440928b87c89 ]
serial_protocol is declared as __le16 in struct se_fw_hdr, but was
decoded with le32_to_cpu(). On big-endian systems the extra byte swap
causes the field to always compare unequal to the protocol argument,
so no firmware segment is ever selected.
Use le16_to_cpu() to match the field width.
Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-1-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/qcom-geni-se.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index 873bfbd6b2b7b..1d6e6611441d6 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -1298,7 +1298,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1)
continue;
- if (le32_to_cpu(sefw->serial_protocol) != protocol)
+ if (le16_to_cpu(sefw->serial_protocol) != protocol)
continue;
if (fw_size % 2 != 0) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0043/1257] soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0042/1257] soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison Greg Kroah-Hartman
@ 2026-11-07 13:38 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0044/1257] soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller Greg Kroah-Hartman
` (955 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Viken Dadhaniya,
Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
[ Upstream commit e976c865bf31b562ab3908f0f1e2160da77fa156 ]
fw_size is read from the 16-bit fw_size_in_items field and incremented
when the count is odd. If fw_size_in_items == 0xffff the increment
wraps to 0 as a u16, making the bounds check below pass for a firmware
segment whose actual size was not validated. Widen fw_size to u32 so
the increment never wraps.
Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-2-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/qcom-geni-se.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index 1d6e6611441d6..54c0a66d6dd6f 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -1248,7 +1248,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
struct se_fw_hdr *sefw;
u32 fw_end, cfg_idx_end, cfg_val_end;
u32 prog_ram_depth;
- u16 fw_size;
+ u32 fw_size;
int i;
if (!fw || fw->size < sizeof(struct elf32_hdr))
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0044/1257] soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-11-07 13:38 ` [PATCH 7.3 0043/1257] soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0045/1257] soc: qcom: geni-se: Fix write to read-only firmware buffer Greg Kroah-Hartman
` (954 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Viken Dadhaniya,
Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
[ Upstream commit d1750c530e9b9b75c8d1b29d3c76e052a049f51f ]
fw_end was computed from the raw fw_size_in_items, before the odd-word
round-up. A segment with an odd word count could pass the bounds check
at the unrounded value but then be copied one word past the validated
limit. Move fw_end (and the cfg_{idx,val}_end) calculations to after
the round-up so they always reflect the true copy extent.
The caller geni_load_se_fw() re-read hdr->fw_size_in_items for the
memcpy_toio() length, bypassing the validated and rounded value
established by geni_find_protocol_fw(). Add a fw_size_out output
parameter and use it in the caller.
Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-3-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/qcom-geni-se.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index 54c0a66d6dd6f..11ca8223fbcd6 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -1230,6 +1230,8 @@ EXPORT_SYMBOL_GPL(geni_se_resources_init);
* @se: Pointer to the serial engine structure.
* @fw: Pointer to the firmware image.
* @protocol: Expected serial engine protocol type.
+ * @fw_size_out: Non-NULL output parameter; receives the rounded, validated
+ * firmware word count on success.
*
* Identifies the appropriate firmware image or configuration required for a
* specific communication protocol instance running on a Qualcomm GENI
@@ -1239,7 +1241,8 @@ EXPORT_SYMBOL_GPL(geni_se_resources_init);
* Return: pointer to a valid 'struct se_fw_hdr' if found, or NULL otherwise.
*/
static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw,
- enum geni_se_protocol_type protocol)
+ enum geni_se_protocol_type protocol,
+ u32 *fw_size_out)
{
struct device *dev = se->dev;
const struct elf32_hdr *ehdr;
@@ -1289,11 +1292,6 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
sefw = (struct se_fw_hdr *)(fw->data + phdr->p_offset);
fw_size = le16_to_cpu(sefw->fw_size_in_items);
- fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32);
- cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) +
- le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u8);
- cfg_val_end = le16_to_cpu(sefw->cfg_val_offset) +
- le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u32);
if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1)
continue;
@@ -1306,6 +1304,12 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
sefw->fw_size_in_items = cpu_to_le16(fw_size);
}
+ fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32);
+ cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) +
+ le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u8);
+ cfg_val_end = le16_to_cpu(sefw->cfg_val_offset) +
+ le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u32);
+
prog_ram_depth = FIELD_GET(PROG_RAM_DEPTH_MSK,
readl_relaxed(se->base + SE_HW_PARAM_2));
if (fw_size >= prog_ram_depth) {
@@ -1320,6 +1324,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
continue;
}
+ *fw_size_out = fw_size;
return sefw;
}
@@ -1430,11 +1435,11 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw,
{
const u32 *fw_data, *cfg_val_arr;
const u8 *cfg_idx_arr;
- u32 i, reg_value;
+ u32 i, reg_value, fw_size_in_items;
int ret;
struct se_fw_hdr *hdr;
- hdr = geni_find_protocol_fw(se, fw, protocol);
+ hdr = geni_find_protocol_fw(se, fw, protocol, &fw_size_in_items);
if (!hdr)
return -EINVAL;
@@ -1511,7 +1516,7 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw,
/* Program RAM address space. */
memcpy_toio(se->base + SE_GENI_CFG_RAMN, fw_data,
- le16_to_cpu(hdr->fw_size_in_items) * sizeof(u32));
+ fw_size_in_items * sizeof(u32));
/* Put default values on GENI's output pads. */
writel_relaxed(0x1, se->base + GENI_FORCE_DEFAULT_REG);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0045/1257] soc: qcom: geni-se: Fix write to read-only firmware buffer
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0044/1257] soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0046/1257] soc: qcom: pmic_glink: Fix device access from worker during suspend Greg Kroah-Hartman
` (953 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Viken Dadhaniya,
Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
[ Upstream commit 28b9c15f1829fff7b26db0dbbbde1c6b466cb156 ]
geni_find_protocol_fw() casts fw->data to a non-const struct se_fw_hdr
pointer and writes back the rounded-up fw_size value:
sefw->fw_size_in_items = cpu_to_le16(fw_size);
The firmware subsystem maps the firmware blob read-only. Writing through
the cast pointer causes a level-3 permission fault on AArch64 and
crashes the kernel during driver probe.
The write-back is no longer necessary: geni_find_protocol_fw() now
propagates the rounded size to the caller via fw_size_out. Remove the
write-back and make sefw (and the hdr pointer in the caller)
const-correct.
Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-4-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/qcom-geni-se.c | 22 ++++++++++------------
1 file changed, 10 insertions(+), 12 deletions(-)
diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index 11ca8223fbcd6..6ac2bdc16984c 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -1238,17 +1238,17 @@ EXPORT_SYMBOL_GPL(geni_se_resources_init);
* controller. Validates the firmware size against the hardware PROG_RAM_DEPTH
* read from SE_HW_PARAM_2.
*
- * Return: pointer to a valid 'struct se_fw_hdr' if found, or NULL otherwise.
+ * Return: pointer to a valid 'const struct se_fw_hdr' if found, or NULL otherwise.
*/
-static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw,
- enum geni_se_protocol_type protocol,
- u32 *fw_size_out)
+static const struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw,
+ enum geni_se_protocol_type protocol,
+ u32 *fw_size_out)
{
struct device *dev = se->dev;
const struct elf32_hdr *ehdr;
const struct elf32_phdr *phdrs;
const struct elf32_phdr *phdr;
- struct se_fw_hdr *sefw;
+ const struct se_fw_hdr *sefw;
u32 fw_end, cfg_idx_end, cfg_val_end;
u32 prog_ram_depth;
u32 fw_size;
@@ -1290,7 +1290,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
if (phdr->p_filesz < sizeof(struct se_fw_hdr))
continue;
- sefw = (struct se_fw_hdr *)(fw->data + phdr->p_offset);
+ sefw = (const struct se_fw_hdr *)(fw->data + phdr->p_offset);
fw_size = le16_to_cpu(sefw->fw_size_in_items);
if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1)
@@ -1299,10 +1299,8 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
if (le16_to_cpu(sefw->serial_protocol) != protocol)
continue;
- if (fw_size % 2 != 0) {
+ if (fw_size % 2 != 0)
fw_size++;
- sefw->fw_size_in_items = cpu_to_le16(fw_size);
- }
fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32);
cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) +
@@ -1437,15 +1435,15 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw,
const u8 *cfg_idx_arr;
u32 i, reg_value, fw_size_in_items;
int ret;
- struct se_fw_hdr *hdr;
+ const struct se_fw_hdr *hdr;
hdr = geni_find_protocol_fw(se, fw, protocol, &fw_size_in_items);
if (!hdr)
return -EINVAL;
- fw_data = (const u32 *)((u8 *)hdr + le16_to_cpu(hdr->fw_offset));
+ fw_data = (const u32 *)((const u8 *)hdr + le16_to_cpu(hdr->fw_offset));
cfg_idx_arr = (const u8 *)hdr + le16_to_cpu(hdr->cfg_idx_offset);
- cfg_val_arr = (const u32 *)((u8 *)hdr + le16_to_cpu(hdr->cfg_val_offset));
+ cfg_val_arr = (const u32 *)((const u8 *)hdr + le16_to_cpu(hdr->cfg_val_offset));
ret = geni_icc_set_bw(se);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0046/1257] soc: qcom: pmic_glink: Fix device access from worker during suspend
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0045/1257] soc: qcom: geni-se: Fix write to read-only firmware buffer Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0047/1257] PCI: qcom: Only check bridge nodes for PERST# GPIOs Greg Kroah-Hartman
` (952 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Caleb Connolly,
Bjorn Andersson, Abel Vesa, Abel Vesa, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <abel.vesa@linaro.org>
[ Upstream commit 7d0767c5cd878707fd6711023731549c83563840 ]
For historical reasons, the GLINK smem interrupt is registered with
IRRQF_NO_SUSPEND flag set, which is the underlying problem here, since the
incoming messages can be delivered during late suspend and early
resume.
In this specific case, the pmic_glink_altmode_worker() currently gets
scheduled on the system_wq which can be scheduled to run while devices
are still suspended. This proves to be a problem when a Type-C retimer,
switch or mux that is controlled over a bus like I2C, because the I2C
controller is suspended.
This has been proven to be the case on the X Elite boards where such
retimers (ParadeTech PS8830) are used in order to handle Type-C
orientation and altmode configuration. The following warning is thrown:
[ 35.134876] i2c i2c-4: Transfer while suspended
[ 35.143865] WARNING: CPU: 0 PID: 99 at drivers/i2c/i2c-core.h:56 __i2c_transfer+0xb4/0x57c [i2c_core]
[ 35.352879] Workqueue: events pmic_glink_altmode_worker [pmic_glink_altmode]
[ 35.360179] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 35.455242] Call trace:
[ 35.457826] __i2c_transfer+0xb4/0x57c [i2c_core] (P)
[ 35.463086] i2c_transfer+0x98/0xf0 [i2c_core]
[ 35.467713] i2c_transfer_buffer_flags+0x54/0x88 [i2c_core]
[ 35.473502] regmap_i2c_write+0x20/0x48 [regmap_i2c]
[ 35.478659] _regmap_raw_write_impl+0x780/0x944
[ 35.483401] _regmap_bus_raw_write+0x60/0x7c
[ 35.487848] _regmap_write+0x134/0x184
[ 35.491773] regmap_write+0x54/0x78
[ 35.495418] ps883x_set+0x58/0xec [ps883x]
[ 35.499688] ps883x_sw_set+0x60/0x84 [ps883x]
[ 35.504223] typec_switch_set+0x48/0x74 [typec]
[ 35.508952] pmic_glink_altmode_worker+0x44/0x1fc [pmic_glink_altmode]
[ 35.515712] process_scheduled_works+0x1a0/0x2d0
[ 35.520525] worker_thread+0x2a8/0x3c8
[ 35.524449] kthread+0xfc/0x184
[ 35.527749] ret_from_fork+0x10/0x20
The proper solution here should be to not deliver these kind of messages
during system suspend at all, or at least make it configurable per glink
client. But simply dropping the IRQF_NO_SUSPEND flag entirely will break
other clients. The final shape of the rework of the pmic glink driver in
order to fulfill both the filtering of the messages that need to be able
to wake-up the system and the queueing of these messages until the system
has properly resumed is still being discussed and it is planned as a
future effort.
Meanwhile, the stop-gap fix here is to schedule the pmic glink altmode
worker on the system_freezable_wq instead of the system_wq. This will
result in the altmode worker not being scheduled to run until the
devices are resumed first, which will give the controllers like I2C a
chance to resume before the transfer is requested.
Reported-by: Johan Hovold <johan+linaro@kernel.org>
Closes: https://lore.kernel.org/lkml/Z1CCVjEZMQ6hJ-wK@hovoldconsulting.com/
Fixes: 080b4e24852b ("soc: qcom: pmic_glink: Introduce altmode support")
Cc: stable@vger.kernel.org # 6.3
Reviewed-by: Caleb Connolly <caleb.connolly@linaro.org>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260819-b4-soc-qcom-pmic-glink-fix-device-access-on-worker-while-suspended-v3-1-169b00e0d9d4@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/pmic_glink_altmode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/qcom/pmic_glink_altmode.c b/drivers/soc/qcom/pmic_glink_altmode.c
index 13c434f8d03a6..465e5d2316a04 100644
--- a/drivers/soc/qcom/pmic_glink_altmode.c
+++ b/drivers/soc/qcom/pmic_glink_altmode.c
@@ -451,7 +451,7 @@ static void pmic_glink_altmode_sc8180xp_notify(struct pmic_glink_altmode *altmod
alt_port->mode = mode;
alt_port->hpd_state = hpd_state;
alt_port->hpd_irq = hpd_irq;
- schedule_work(&alt_port->work);
+ queue_work(system_freezable_wq, &alt_port->work);
}
#define SC8280XP_DPAM_MASK 0x3f
@@ -502,7 +502,7 @@ static void pmic_glink_altmode_sc8280xp_notify(struct pmic_glink_altmode *altmod
alt_port->tbt_data = *tbt;
}
- schedule_work(&alt_port->work);
+ queue_work(system_freezable_wq, &alt_port->work);
}
static void pmic_glink_altmode_callback(const void *data, size_t len, void *priv)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0047/1257] PCI: qcom: Only check bridge nodes for PERST# GPIOs
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0046/1257] soc: qcom: pmic_glink: Fix device access from worker during suspend Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0048/1257] udf: validate the device specification EA before using it Greg Kroah-Hartman
` (951 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christopher Obbard,
Manivannan Sadhasivam, Krishna Chaitanya Chundru, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Obbard <chris.obbard@oss.qualcomm.com>
[ Upstream commit 1b3b0bc2b3672e928e06997444528f8797579eb2 ]
qcom_pcie_parse_perst() walks the PCIe hierarchy described in the device
tree below its Root Port and collects the PERST# GPIOs from each bridge
node so all PERST# lines can be driven in unison during controller
bring-up, reset and power sequencing.
However, the recursive device tree walk currently visits every available
child node without checking that it is a PCI bridge. This allows the walk
to leave the PCI hierarchy and collect reset lines from children of PCI
Endpoint nodes, where those reset lines belong to other drivers.
This is reproducible on the Qualcomm RB3Gen2, where a Renesas uPD720201
USB host controller sits behind a PCIe switch downstream port. A Genesys
GL3590 USB hub connected to that controller is described as a child of
the PCI endpoint:
pcie@2,0 {
device_type = "pci";
usb-controller@0,0 {
compatible = "pci1912,0014";
hub@1 {
compatible = "usb5e3,610";
reset-gpios = <&tlmm 162 GPIO_ACTIVE_HIGH>;
};
};
};
The USB controller is a PCI Endpoint, and not a bridge, but the PERST#
walk descends through it and incorrectly claims the hub's reset GPIO:
$ gpioinfo
line 162: unnamed output consumer=PERST#
As a result, the onboard-usb-dev driver cannot acquire its reset GPIO
during probe:
onboard-usb-dev 1c08000.pcie:...:usb-controller@0,0:hub@1: \
error -EBUSY: failed to get reset GPIO
onboard-usb-dev 1c08000.pcie:...:usb-controller@0,0:hub@1: \
probe with driver onboard-usb-dev failed with error -16
The GPIO is also added to the root port's PERST# list and is asserted
and deasserted as part of PCIe reset sequencing. On the RB3Gen2 this
causes the USB hub to repeatedly re-enumerate:
[ 116.479598] hub 2-1:1.0: USB hub found
[ 116.488601] hub 2-1:1.0: USB hub found
[ 116.496971] hub 2-1:1.0: USB hub found
...
This disrupts the hub and devices connected to it.
Restrict the recursive walk to children with device_type "pci", so
PERST# GPIOs are collected only from PCI bridge nodes and the walk
does not descend through endpoints.
qocm_pcie_parse_ports() has made the same distinction since
commit 45df22935bdc ("PCI: qcom: Restrict port parsing only to PCIe
bridge child nodes"), but the PERST# walk added later did not carry over
that check.
This bug is distinct from commit 3edb3a038d42 ("PCI: qcom: Skip PERST#
GPIOs provided by downstream PCIe devices"), which filters PERST# GPIOs
based on their provider. Here the GPIO is provided by the SoC TLMM; the
bug is that reset-gpios is consumed from a non-bridge node at all.
Fixes: 2fd60a2edb83 ("PCI: qcom: Parse PERST# from all PCIe bridge nodes")
Signed-off-by: Christopher Obbard <chris.obbard@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260829-wip-obbardc-drivers-pcie-qcom-rb3gen2-usb-fix-v1-1-337821131a99@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index b58a607b713f5..89a476c370988 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -1953,7 +1953,7 @@ static bool qcom_pcie_is_child_node(struct device *dev,
return false;
}
-/* Parse PERST# from all nodes in depth first manner starting from @np */
+/* Collect PERST# GPIOs from PCI bridge nodes depth-first, starting at @np */
static int qcom_pcie_parse_perst(struct qcom_pcie *pcie,
struct qcom_pcie_port *port,
struct device_node *np)
@@ -2019,6 +2019,9 @@ static int qcom_pcie_parse_perst(struct qcom_pcie *pcie,
parse_child_node:
for_each_available_child_of_node_scoped(np, child) {
+ if (!of_node_is_type(child, "pci"))
+ continue;
+
ret = qcom_pcie_parse_perst(pcie, port, child);
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0048/1257] udf: validate the device specification EA before using it
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0047/1257] PCI: qcom: Only check bridge nodes for PERST# GPIOs Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0049/1257] microblaze: reserve the ABI argument-home area in the signal frame Greg Kroah-Hartman
` (950 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yunpeng Tian, Gongming Wang,
Mingda Zhang, Qinrun Dai, Jan Kara, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunpeng Tian <shionthanatos@gmail.com>
[ Upstream commit 9a2390959685ac35a58c80c8016120849a2babf6 ]
udf_get_extendedattr() bounds an extended attribute only against
struct genericFormat, which is 12 bytes. A type-12 device
specification is struct deviceSpec, which is 24 bytes plus a flexible
impUse array. Thus a corrupted filesystem can contain extended attribute
that is accepted by udf_get_extendedattr() but udf_write_inode() or
udf_read_inode() may access beyond the end of provided buffer.
Provide a udf_device_spec_valid() check to validate correctness of
extended attribute that is a deviceSpec. While here, check the result of
udf_add_extendedattr() before dereferencing it as it can return NULL in
case of error.
[JK: Removed duplicated validity checks]
Reported-by: Yunpeng Tian <shionthanatos@gmail.com>
Reported-by: Gongming Wang <gmwgg05@gmail.com>
Reported-by: Mingda Zhang <npczmd@qq.com>
Reported-by: Qinrun Dai <jupmouse@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Yunpeng Tian <shionthanatos@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/inode.c | 43 ++++++++++++++++++++++++++++++++++++++-----
1 file changed, 38 insertions(+), 5 deletions(-)
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 2f04c4f0e1b85..49673b555c624 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1336,6 +1336,26 @@ int udf_setsize(struct inode *inode, loff_t newsize)
return err;
}
+/*
+ * Verify validity of struct deviceSpec on disk. udf_get_extendedattr() has
+ * already verified the generic header and made sure attribute fits in the
+ * inode so we just have to make sure attribute space is large enough for
+ * deviceSpec struct and required impUse information.
+ */
+static bool udf_device_spec_valid(struct deviceSpec *dsea)
+{
+ u32 attr_length, imp_use_length;
+
+ attr_length = le32_to_cpu(dsea->attrLength);
+ imp_use_length = le32_to_cpu(dsea->impUseLength);
+ if (attr_length < sizeof(struct deviceSpec) ||
+ imp_use_length < sizeof(struct regid) ||
+ imp_use_length > attr_length - sizeof(struct deviceSpec))
+ return false;
+
+ return true;
+}
+
/*
* Maximum length of linked list formed by ICB hierarchy. The chosen number is
* arbitrary - just that we hopefully don't limit any real use of rewritten
@@ -1654,13 +1674,12 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) {
struct deviceSpec *dsea =
(struct deviceSpec *)udf_get_extendedattr(inode, 12, 1);
- if (dsea) {
- init_special_inode(inode, inode->i_mode,
+
+ if (!dsea || !udf_device_spec_valid(dsea))
+ goto out;
+ init_special_inode(inode, inode->i_mode,
MKDEV(le32_to_cpu(dsea->majorDeviceIdent),
le32_to_cpu(dsea->minorDeviceIdent)));
- /* Developer ID ??? */
- } else
- goto out;
}
ret = 0;
out:
@@ -1757,6 +1776,7 @@ int udf_write_inode(struct inode *inode, struct writeback_control *wbc)
struct udf_sb_info *sbi = UDF_SB(inode->i_sb);
unsigned char blocksize_bits = inode->i_sb->s_blocksize_bits;
struct udf_inode_info *iinfo = UDF_I(inode);
+ int err;
bh = sb_getblk(inode->i_sb,
udf_get_lb_pblock(inode->i_sb, &iinfo->i_location, 0));
@@ -1821,6 +1841,10 @@ int udf_write_inode(struct inode *inode, struct writeback_control *wbc)
udf_add_extendedattr(inode,
sizeof(struct deviceSpec) +
sizeof(struct regid), 12, 0x3);
+ if (!dsea) {
+ err = -ENOSPC;
+ goto out_unlock;
+ }
dsea->attrType = cpu_to_le32(12);
dsea->attrSubtype = 1;
dsea->attrLength = cpu_to_le32(
@@ -1828,6 +1852,10 @@ int udf_write_inode(struct inode *inode, struct writeback_control *wbc)
sizeof(struct regid));
dsea->impUseLength = cpu_to_le32(sizeof(struct regid));
}
+ if (!udf_device_spec_valid(dsea)) {
+ err = -EFSCORRUPTED;
+ goto out_unlock;
+ }
eid = (struct regid *)dsea->impUse;
memset(eid, 0, sizeof(*eid));
strcpy(eid->ident, UDF_ID_DEVELOPER);
@@ -1962,6 +1990,11 @@ int udf_write_inode(struct inode *inode, struct writeback_control *wbc)
set_inode_metadata_writeback(inode);
return 0;
+
+out_unlock:
+ unlock_buffer(bh);
+ brelse(bh);
+ return err;
}
struct inode *__udf_iget(struct super_block *sb, struct kernel_lb_addr *ino,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0049/1257] microblaze: reserve the ABI argument-home area in the signal frame
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0048/1257] udf: validate the device specification EA before using it Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0050/1257] microblaze: dont clobber r3/r4 restored by rt_sigreturn Greg Kroah-Hartman
` (949 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ramin Moussavi, Waldemar Brodkorb,
Michal Simek, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramin Moussavi <ramin.moussavi@yacoub.de>
[ Upstream commit c5947d28c20955de897eeb98430f96db0494f7d7 ]
The MicroBlaze procedure call standard reserves [r1+0] for the return
address and lets a callee store its incoming register arguments r5..r10
into the caller-provided home slots at [r1+4]..[r1+24]. When the kernel
enters a signal handler it sets r1 to point at struct rt_sigframe, whose
leading member is the siginfo prepared for the handler. A handler that
homes its arguments - which an unoptimised (-O0) build always does -
therefore overwrites the first 24 bytes of that siginfo, so an
SA_SIGINFO handler reads corrupted values. The stores stay within
siginfo (128 bytes) and do not reach the ucontext behind it.
Reserve the home area by making a seven-word gap -- the return-address
slot plus the six argument slots, 28 bytes -- the first member of struct
rt_sigframe, so the handler's argument stores land in scratch space
instead of clobbering siginfo.
Tested on qemu-system-microblazeel (petalogix-s3adsp1800) with the
uClibc-ng NPTL test suite: tst-timer4, tst-timer5, tst-mqueue5 and
tst-signal6 pass; before this change they failed because the handler
clobbered the signal frame.
Fixes: 2148daa9c45f ("microblaze_v8: Signal support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-3-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/microblaze/kernel/signal.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/microblaze/kernel/signal.c b/arch/microblaze/kernel/signal.c
index c78a0ff480660..4956014a99379 100644
--- a/arch/microblaze/kernel/signal.c
+++ b/arch/microblaze/kernel/signal.c
@@ -49,6 +49,14 @@ struct sigframe {
};
struct rt_sigframe {
+ /*
+ * Home area for the handler's register arguments: the MicroBlaze
+ * ABI reserves [r1+0] for the return address and lets the callee
+ * store r5..r10 at [r1+4]..[r1+24], and r1 points at this frame
+ * when the handler is entered. Without the gap those stores
+ * corrupt frame->info.
+ */
+ unsigned long abi_gap[7];
struct siginfo info;
struct ucontext uc;
unsigned long tramp[2]; /* signal trampoline */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0050/1257] microblaze: dont clobber r3/r4 restored by rt_sigreturn
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0049/1257] microblaze: reserve the ABI argument-home area in the signal frame Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0051/1257] microblaze: restore the ABI argument home area below pt_regs (PTO) Greg Kroah-Hartman
` (948 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ramin Moussavi, Waldemar Brodkorb,
Michal Simek, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramin Moussavi <ramin.moussavi@yacoub.de>
[ Upstream commit da6829138a39fa3b9ec318ca54ff89af9d94d350 ]
ret_from_trap begins by storing the system call return values r3 and r4
back into the saved user pt_regs. That is right for an ordinary system
call, but sys_rt_sigreturn() returns through the same path and has to be
transparent: restore_sigcontext() has just filled pt_regs from the signal
frame, and every register must reach userspace exactly as saved. The two
stores overwrite the restored r3/r4 with whatever the C function left in
those registers.
Only r4 is actually lost, and that follows from how sigreturn is written
everywhere rather than from chance. Architectures have sys_rt_sigreturn()
return the restored return-value register precisely so that this writeback
stores the restored value -- arm returns regs->ARM_r0, riscv and csky
regs->a0, arc regs->r0 -- and microblaze does the same through
*rval_p = regs->r3 in restore_sigcontext(). But the entry macros treat r3
and r4 as a pair, so ret_from_trap writes back two registers while a C
function has only one return value; nothing carries the restored r4.
Commit 791d0a169b91 ("microblaze: Fix sys_rt_sigreturn_wrapper") introduced
this in v2.6.37. The old wrapper saved r3/r4 before the call and reloaded
them from pt_regs afterwards; switching brlid to brid removed the only
point where they were reloaded, and the stores have been overwriting them
ever since.
Fix it the way the sibling paths already behave: ret_from_irq and
ret_from_exc restore the full register set and do not perform these stores
at all. Label the instruction after the stores ret_from_trap_no_rval and
enter there, biasing r15 by -8 so that the ABI return "rtsd r15, 8" lands
on it; naming the entry rather than computing ret_from_trap + 8 keeps it
correct if the number of stores ever changes. Restoring the old
save/reload would work too, but costs four memory accesses and a branch to
undo damage that is better not done.
Any value the compiler keeps in r4 across a signal is lost. The tightest
windows are the lwx/swx compare-and-swap retry loops gcc emits for atomics:
in uClibc-ng's libc.so alone, 50 of 364 such loops hold the address in r4.
This is not specific to one libc -- musl passes the address as "r"(p), and
glibc has no microblaze atomic-machine.h and so uses gcc's __atomic
builtins, which expand the same way. Triggering it needs threads plus a
signal storm, which is why it survived 15 years.
Reproduced on qemu-system-microblazeel (petalogix-s3adsp1800) by running
the uClibc-ng NPTL test tst-eintr1 40 times against an unchanged userspace:
on v7.2 built with gcc 16.2.0, 23 of 40 iterations died with SIGSEGV
without this patch and 0 of 40 with it; on v7.0 built with gcc 12.5.0 the
same comparison gave 6 of 40 against 0 of 40. The register dump of a
failing iteration shows the signature: a zero r4 and a fault at address 0,
while r3 came back intact.
Fixes: 791d0a169b91 ("microblaze: Fix sys_rt_sigreturn_wrapper")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-4-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/microblaze/kernel/entry.S | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index ad44341a5dbc7..efa4ab056fb5f 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -434,7 +434,13 @@ C_ENTRY(_user_exception):
C_ENTRY(ret_from_trap):
swi r3, r1, PT_R3
swi r4, r1, PT_R4
-
+/*
+ * Entry point for returns that must not store r3/r4 back into pt_regs,
+ * i.e. rt_sigreturn, which has already restored them from the signal
+ * context. Reached as "rtsd r15, 8" with r15 set to this label minus 8,
+ * so it stays correct if the number of stores above ever changes.
+ */
+ret_from_trap_no_rval:
lwi r11, r1, PT_MODE;
/* See if returning to kernel mode, if so, skip resched &c. */
bnei r11, 2f;
@@ -518,6 +524,15 @@ C_ENTRY(ret_from_kernel_thread):
C_ENTRY(sys_rt_sigreturn_wrapper):
addik r30, r0, 0 /* no restarts */
+ /*
+ * rt_sigreturn restores the full register set from the signal
+ * context, so it must skip the r3/r4 syscall-return stores at the
+ * head of ret_from_trap which would otherwise overwrite the
+ * just-restored r3/r4. Every C function returns with "rtsd r15, 8"
+ * -- the ABI return, where the 8 skips the caller's branch and its
+ * delay slot -- so bias r15 by -8 to land on ret_from_trap_no_rval.
+ */
+ addik r15, r0, ret_from_trap_no_rval - 8
brid sys_rt_sigreturn /* Do real work */
addik r5, r1, 0; /* add user context as 1st arg */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0051/1257] microblaze: restore the ABI argument home area below pt_regs (PTO)
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0050/1257] microblaze: dont clobber r3/r4 restored by rt_sigreturn Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0052/1257] microblaze: preserve the MSR carry flags across signals Greg Kroah-Hartman
` (947 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ramin Moussavi, Waldemar Brodkorb,
Michal Simek, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramin Moussavi <ramin.moussavi@yacoub.de>
[ Upstream commit c35d40a3efd2e575ef51a761e983f2bf7113be6c ]
The MicroBlaze ABI has the caller reserve stack space for the arguments
it passes in registers: REG_PARM_STACK_SPACE is 24 and
OUTGOING_REG_PARM_STACK_SPACE is 1 in the gcc backend, so a callee may
write to [caller_sp + 4, caller_sp + 28). The kernel calls C functions
from entry.S with r1 pointing at pt_regs, handing the callee license to
spill its incoming arguments over the saved registers -- the syscall
dispatch is the worst case, where the first argument slot is PT_R1, the
saved user stack pointer.
This was latent until GCC 15: since 3b9b8d6cfdf5 ("ira: Scale
save/restore costs of callee save registers with block frequency") the
allocator prefers spilling incoming arguments over copying them into
callee-saved registers, and a kernel built with gcc >= 15 (without the
TARGET_CALLEE_SAVE_COST workaround some distributions carry) corrupts
PT_R1 on the first syscall: init takes SIGSEGV and the kernel panics.
The kernel had exactly this reservation until 2011:
commit 6e83557c38b4 ("microblaze: Remove r0_ram pointer and PTO alignment")
removed STATE_SAVE_ARG_SPACE and with it the PTO offset, as part of
cleaning up what was thought to be copied-from-v850 leftovers. Restore
it: the frame is STATE_SAVE_SIZE = PT_SIZE + PTO, r1 stays at the frame
base through every asm-to-C call, and the saved registers are reached
at r1 + PTO + PT_*. PTO is 28 rather than the historic 24, which was
one word short: FIRST_PARM_OFFSET is 4 and REG_PARM_STACK_SPACE is 24,
so the area spans [sp+4, sp+28) and needs 28 bytes. With 24 the last
argument slot overlapped pt_regs' r0 -- harmless only because r0 is the
constant-zero register. STACK_BOUNDARY is 32 bits, so 28 needs no
further rounding.
Two places deliberately keep their mainline addressing.
hw_exception_handler.S needs no offset change: its real-mode handler
saves into the standalone pt_pool_space buffer rather than a stack
frame, and _unaligned_data_exception works through a pointer to pt_regs
in r7, where plain PT_* offsets are already right. And the user-SP
reload after popping the frame keeps PT_R1 - PT_SIZE because PTO
cancels there: (PTO + PT_R1) - (PT_SIZE + PTO) = PT_R1 - PT_SIZE. Both
are exactly as the pre-2011 code had them.
The instruction count is unchanged -- the same instructions with
different immediates, no per-call reservation and no trampolines. The
cost is 28 bytes more kernel stack per saved frame.
Fixes: 6e83557c38b4 ("microblaze: Remove r0_ram pointer and PTO alignment")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-5-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/microblaze/include/asm/entry.h | 13 +
arch/microblaze/include/asm/processor.h | 2 +-
arch/microblaze/kernel/entry.S | 329 +++++++++---------
arch/microblaze/kernel/hw_exception_handler.S | 5 +
arch/microblaze/kernel/process.c | 5 +-
5 files changed, 189 insertions(+), 165 deletions(-)
diff --git a/arch/microblaze/include/asm/entry.h b/arch/microblaze/include/asm/entry.h
index 9efadf12397ca..05acf4d7bc4b1 100644
--- a/arch/microblaze/include/asm/entry.h
+++ b/arch/microblaze/include/asm/entry.h
@@ -21,6 +21,19 @@
#define PER_CPU(var) var
+/*
+ * The MicroBlaze ABI has the caller reserve an argument home area:
+ * REG_PARM_STACK_SPACE is 24 and OUTGOING_REG_PARM_STACK_SPACE is 1, so a
+ * callee may write to [caller_sp + 4, caller_sp + 28). The kernel calls C
+ * with r1 at the frame base, so reserve that area below pt_regs and reach
+ * the saved registers through PTO. This restores what 6e83557c38b4
+ * ("microblaze: Remove r0_ram pointer and PTO alignment") removed; the old
+ * value of 24 was one word short and left the last argument slot
+ * overlapping pt_regs' r0.
+ */
+#define PTO 28
+#define STATE_SAVE_SIZE (PT_SIZE + PTO)
+
# ifndef __ASSEMBLER__
DECLARE_PER_CPU(unsigned int, KSP); /* Saved kernel stack pointer */
DECLARE_PER_CPU(unsigned int, KM); /* Kernel/user mode */
diff --git a/arch/microblaze/include/asm/processor.h b/arch/microblaze/include/asm/processor.h
index d59bdfffca7cc..595c24db27283 100644
--- a/arch/microblaze/include/asm/processor.h
+++ b/arch/microblaze/include/asm/processor.h
@@ -73,7 +73,7 @@ unsigned long __get_wchan(struct task_struct *p);
# define task_regs(task) ((struct pt_regs *)task_tos(task) - 1)
# define task_pt_regs_plus_args(tsk) \
- ((void *)task_pt_regs(tsk))
+ (((void *)task_pt_regs(tsk)) - PTO)
# define task_sp(task) (task_regs(task)->r1)
# define task_pc(task) (task_regs(task)->pc)
diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index efa4ab056fb5f..ebc8bcb98c522 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -177,78 +177,78 @@ syscall_debug_table:
1:
#define SAVE_REGS \
- swi r2, r1, PT_R2; /* Save SDA */ \
- swi r3, r1, PT_R3; \
- swi r4, r1, PT_R4; \
- swi r5, r1, PT_R5; \
- swi r6, r1, PT_R6; \
- swi r7, r1, PT_R7; \
- swi r8, r1, PT_R8; \
- swi r9, r1, PT_R9; \
- swi r10, r1, PT_R10; \
- swi r11, r1, PT_R11; /* save clobbered regs after rval */\
- swi r12, r1, PT_R12; \
- swi r13, r1, PT_R13; /* Save SDA2 */ \
- swi r14, r1, PT_PC; /* PC, before IRQ/trap */ \
- swi r15, r1, PT_R15; /* Save LP */ \
- swi r16, r1, PT_R16; \
- swi r17, r1, PT_R17; \
- swi r18, r1, PT_R18; /* Save asm scratch reg */ \
- swi r19, r1, PT_R19; \
- swi r20, r1, PT_R20; \
- swi r21, r1, PT_R21; \
- swi r22, r1, PT_R22; \
- swi r23, r1, PT_R23; \
- swi r24, r1, PT_R24; \
- swi r25, r1, PT_R25; \
- swi r26, r1, PT_R26; \
- swi r27, r1, PT_R27; \
- swi r28, r1, PT_R28; \
- swi r29, r1, PT_R29; \
- swi r30, r1, PT_R30; \
- swi r31, r1, PT_R31; /* Save current task reg */ \
+ swi r2, r1, PTO+PT_R2; /* Save SDA */ \
+ swi r3, r1, PTO+PT_R3; \
+ swi r4, r1, PTO+PT_R4; \
+ swi r5, r1, PTO+PT_R5; \
+ swi r6, r1, PTO+PT_R6; \
+ swi r7, r1, PTO+PT_R7; \
+ swi r8, r1, PTO+PT_R8; \
+ swi r9, r1, PTO+PT_R9; \
+ swi r10, r1, PTO+PT_R10; \
+ swi r11, r1, PTO+PT_R11; /* save clobbered regs after rval */\
+ swi r12, r1, PTO+PT_R12; \
+ swi r13, r1, PTO+PT_R13; /* Save SDA2 */ \
+ swi r14, r1, PTO+PT_PC; /* PC, before IRQ/trap */ \
+ swi r15, r1, PTO+PT_R15; /* Save LP */ \
+ swi r16, r1, PTO+PT_R16; \
+ swi r17, r1, PTO+PT_R17; \
+ swi r18, r1, PTO+PT_R18; /* Save asm scratch reg */ \
+ swi r19, r1, PTO+PT_R19; \
+ swi r20, r1, PTO+PT_R20; \
+ swi r21, r1, PTO+PT_R21; \
+ swi r22, r1, PTO+PT_R22; \
+ swi r23, r1, PTO+PT_R23; \
+ swi r24, r1, PTO+PT_R24; \
+ swi r25, r1, PTO+PT_R25; \
+ swi r26, r1, PTO+PT_R26; \
+ swi r27, r1, PTO+PT_R27; \
+ swi r28, r1, PTO+PT_R28; \
+ swi r29, r1, PTO+PT_R29; \
+ swi r30, r1, PTO+PT_R30; \
+ swi r31, r1, PTO+PT_R31; /* Save current task reg */ \
mfs r11, rmsr; /* save MSR */ \
- swi r11, r1, PT_MSR;
+ swi r11, r1, PTO+PT_MSR;
#define RESTORE_REGS_GP \
- lwi r2, r1, PT_R2; /* restore SDA */ \
- lwi r3, r1, PT_R3; \
- lwi r4, r1, PT_R4; \
- lwi r5, r1, PT_R5; \
- lwi r6, r1, PT_R6; \
- lwi r7, r1, PT_R7; \
- lwi r8, r1, PT_R8; \
- lwi r9, r1, PT_R9; \
- lwi r10, r1, PT_R10; \
- lwi r11, r1, PT_R11; /* restore clobbered regs after rval */\
- lwi r12, r1, PT_R12; \
- lwi r13, r1, PT_R13; /* restore SDA2 */ \
- lwi r14, r1, PT_PC; /* RESTORE_LINK PC, before IRQ/trap */\
- lwi r15, r1, PT_R15; /* restore LP */ \
- lwi r16, r1, PT_R16; \
- lwi r17, r1, PT_R17; \
- lwi r18, r1, PT_R18; /* restore asm scratch reg */ \
- lwi r19, r1, PT_R19; \
- lwi r20, r1, PT_R20; \
- lwi r21, r1, PT_R21; \
- lwi r22, r1, PT_R22; \
- lwi r23, r1, PT_R23; \
- lwi r24, r1, PT_R24; \
- lwi r25, r1, PT_R25; \
- lwi r26, r1, PT_R26; \
- lwi r27, r1, PT_R27; \
- lwi r28, r1, PT_R28; \
- lwi r29, r1, PT_R29; \
- lwi r30, r1, PT_R30; \
- lwi r31, r1, PT_R31; /* Restore cur task reg */
+ lwi r2, r1, PTO+PT_R2; /* restore SDA */ \
+ lwi r3, r1, PTO+PT_R3; \
+ lwi r4, r1, PTO+PT_R4; \
+ lwi r5, r1, PTO+PT_R5; \
+ lwi r6, r1, PTO+PT_R6; \
+ lwi r7, r1, PTO+PT_R7; \
+ lwi r8, r1, PTO+PT_R8; \
+ lwi r9, r1, PTO+PT_R9; \
+ lwi r10, r1, PTO+PT_R10; \
+ lwi r11, r1, PTO+PT_R11; /* restore clobbered regs after rval */\
+ lwi r12, r1, PTO+PT_R12; \
+ lwi r13, r1, PTO+PT_R13; /* restore SDA2 */ \
+ lwi r14, r1, PTO+PT_PC; /* RESTORE_LINK PC, before IRQ/trap */\
+ lwi r15, r1, PTO+PT_R15; /* restore LP */ \
+ lwi r16, r1, PTO+PT_R16; \
+ lwi r17, r1, PTO+PT_R17; \
+ lwi r18, r1, PTO+PT_R18; /* restore asm scratch reg */ \
+ lwi r19, r1, PTO+PT_R19; \
+ lwi r20, r1, PTO+PT_R20; \
+ lwi r21, r1, PTO+PT_R21; \
+ lwi r22, r1, PTO+PT_R22; \
+ lwi r23, r1, PTO+PT_R23; \
+ lwi r24, r1, PTO+PT_R24; \
+ lwi r25, r1, PTO+PT_R25; \
+ lwi r26, r1, PTO+PT_R26; \
+ lwi r27, r1, PTO+PT_R27; \
+ lwi r28, r1, PTO+PT_R28; \
+ lwi r29, r1, PTO+PT_R29; \
+ lwi r30, r1, PTO+PT_R30; \
+ lwi r31, r1, PTO+PT_R31; /* Restore cur task reg */
#define RESTORE_REGS \
- lwi r11, r1, PT_MSR; \
+ lwi r11, r1, PTO+PT_MSR; \
mts rmsr , r11; \
RESTORE_REGS_GP
#define RESTORE_REGS_RTBD \
- lwi r11, r1, PT_MSR; \
+ lwi r11, r1, PTO+PT_MSR; \
andni r11, r11, MSR_EIP; /* clear EIP */ \
ori r11, r11, MSR_EE | MSR_BIP; /* set EE and BIP */ \
mts rmsr , r11; \
@@ -265,11 +265,11 @@ syscall_debug_table:
lwi r1, r0, TOPHYS(PER_CPU(ENTRY_SP)); \
/* FIXME: I can add these two lines to one */ \
/* tophys(r1,r1); */ \
- /* addik r1, r1, -PT_SIZE; */ \
- addik r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - PT_SIZE; \
+ /* addik r1, r1, -STATE_SAVE_SIZE; */ \
+ addik r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - STATE_SAVE_SIZE; \
SAVE_REGS \
brid 2f; \
- swi r1, r1, PT_MODE; \
+ swi r1, r1, PTO+PT_MODE; \
1: /* User-mode state save. */ \
lwi r1, r0, TOPHYS(PER_CPU(CURRENT_SAVE)); /* get saved current */\
tophys(r1,r1); \
@@ -277,12 +277,13 @@ syscall_debug_table:
/* MS these three instructions can be added to one */ \
/* addik r1, r1, THREAD_SIZE; */ \
/* tophys(r1,r1); */ \
- /* addik r1, r1, -PT_SIZE; */ \
- addik r1, r1, THREAD_SIZE + CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - PT_SIZE; \
+ /* addik r1, r1, -STATE_SAVE_SIZE; */ \
+ addik r1, r1, THREAD_SIZE + CONFIG_KERNEL_BASE_ADDR \
+ - CONFIG_KERNEL_START - STATE_SAVE_SIZE; \
SAVE_REGS \
lwi r11, r0, TOPHYS(PER_CPU(ENTRY_SP)); \
- swi r11, r1, PT_R1; /* Store user SP. */ \
- swi r0, r1, PT_MODE; /* Was in user-mode. */ \
+ swi r11, r1, PTO+PT_R1; /* Store user SP. */ \
+ swi r0, r1, PTO+PT_MODE; /* Was in user-mode. */ \
/* MS: I am clearing UMS even in case when I come from kernel space */ \
clear_ums; \
2: lwi CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
@@ -292,7 +293,7 @@ syscall_debug_table:
.extern cpuinfo
C_ENTRY(mb_flush_dcache):
- addik r1, r1, -PT_SIZE
+ addik r1, r1, -STATE_SAVE_SIZE
SAVE_REGS
addik r3, r0, cpuinfo
@@ -305,12 +306,12 @@ C_ENTRY(mb_flush_dcache):
addk r9, r9, r8
RESTORE_REGS
- addik r1, r1, PT_SIZE
+ addik r1, r1, STATE_SAVE_SIZE
rtsd r15, 8
nop
C_ENTRY(mb_invalidate_icache):
- addik r1, r1, -PT_SIZE
+ addik r1, r1, -STATE_SAVE_SIZE
SAVE_REGS
addik r3, r0, cpuinfo
@@ -323,7 +324,7 @@ C_ENTRY(mb_invalidate_icache):
addk r9, r9, r8
RESTORE_REGS
- addik r1, r1, PT_SIZE
+ addik r1, r1, STATE_SAVE_SIZE
rtsd r15, 8
nop
@@ -350,18 +351,18 @@ C_ENTRY(_user_exception):
addik r1, r1, THREAD_SIZE;
tophys(r1,r1);
- addik r1, r1, -PT_SIZE; /* Make room on the stack. */
+ addik r1, r1, -STATE_SAVE_SIZE; /* Make room on the stack. */
SAVE_REGS
- swi r0, r1, PT_R3
- swi r0, r1, PT_R4
+ swi r0, r1, PTO+PT_R3
+ swi r0, r1, PTO+PT_R4
- swi r0, r1, PT_MODE; /* Was in user-mode. */
+ swi r0, r1, PTO+PT_MODE; /* Was in user-mode. */
lwi r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
- swi r11, r1, PT_R1; /* Store user SP. */
+ swi r11, r1, PTO+PT_R1; /* Store user SP. */
clear_ums;
2: lwi CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
/* Save away the syscall number. */
- swi r12, r1, PT_R0;
+ swi r12, r1, PTO+PT_R0;
tovirt(r1,r1)
/* where the trap should return need -8 to adjust for rtsd r15, 8*/
@@ -380,18 +381,18 @@ C_ENTRY(_user_exception):
beqi r11, 4f
addik r3, r0, -ENOSYS
- swi r3, r1, PT_R3
+ swi r3, r1, PTO+PT_R3
brlid r15, do_syscall_trace_enter
- addik r5, r1, PT_R0
+ addik r5, r1, PTO+PT_R0
# do_syscall_trace_enter returns the new syscall nr.
addk r12, r0, r3
- lwi r5, r1, PT_R5;
- lwi r6, r1, PT_R6;
- lwi r7, r1, PT_R7;
- lwi r8, r1, PT_R8;
- lwi r9, r1, PT_R9;
- lwi r10, r1, PT_R10;
+ lwi r5, r1, PTO+PT_R5;
+ lwi r6, r1, PTO+PT_R6;
+ lwi r7, r1, PTO+PT_R7;
+ lwi r8, r1, PTO+PT_R8;
+ lwi r9, r1, PTO+PT_R9;
+ lwi r10, r1, PTO+PT_R10;
4:
/* Jump to the appropriate function for the system call number in r12
* (r12 is not preserved), or return an error if r12 is not valid.
@@ -432,8 +433,8 @@ C_ENTRY(_user_exception):
/* Entry point used to return from a syscall/trap */
/* We re-enable BIP bit before state restore */
C_ENTRY(ret_from_trap):
- swi r3, r1, PT_R3
- swi r4, r1, PT_R4
+ swi r3, r1, PTO+PT_R3
+ swi r4, r1, PTO+PT_R4
/*
* Entry point for returns that must not store r3/r4 back into pt_regs,
* i.e. rt_sigreturn, which has already restored them from the signal
@@ -441,7 +442,7 @@ C_ENTRY(ret_from_trap):
* so it stays correct if the number of stores above ever changes.
*/
ret_from_trap_no_rval:
- lwi r11, r1, PT_MODE;
+ lwi r11, r1, PTO+PT_MODE;
/* See if returning to kernel mode, if so, skip resched &c. */
bnei r11, 2f;
/* We're returning to user mode, so check for various conditions that
@@ -453,7 +454,7 @@ ret_from_trap_no_rval:
beqi r11, 1f
brlid r15, do_syscall_trace_leave
- addik r5, r1, PT_R0
+ addik r5, r1, PTO+PT_R0
1:
/* We're returning to user mode, so check for various conditions that
* trigger rescheduling. */
@@ -472,7 +473,7 @@ ret_from_trap_no_rval:
andi r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
beqi r11, 4f; /* Signals to handle, handle them */
- addik r5, r1, 0; /* Arg 1: struct pt_regs *regs */
+ addik r5, r1, PTO; /* Arg 1: struct pt_regs *regs */
bralid r15, do_notify_resume; /* Handle any signals */
add r6, r30, r0; /* Arg 2: int in_syscall */
add r30, r0, r0 /* no more restarts */
@@ -484,7 +485,11 @@ ret_from_trap_no_rval:
VM_OFF;
tophys(r1,r1);
RESTORE_REGS_RTBD;
- addik r1, r1, PT_SIZE /* Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* Clean up stack space. */
+ /*
+ * Deliberately PT_SIZE, not STATE_SAVE_SIZE: r1 is back at the stack
+ * top, so PTO cancels and the saved SP sits at PT_R1 - PT_SIZE.
+ */
lwi r1, r1, PT_R1 - PT_SIZE;/* Restore user stack pointer. */
bri 6f;
@@ -493,7 +498,7 @@ ret_from_trap_no_rval:
VM_OFF;
tophys(r1,r1);
RESTORE_REGS_RTBD;
- addik r1, r1, PT_SIZE /* Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* Clean up stack space. */
tovirt(r1,r1);
6:
TRAP_return: /* Make global symbol for debugging */
@@ -534,7 +539,7 @@ C_ENTRY(sys_rt_sigreturn_wrapper):
*/
addik r15, r0, ret_from_trap_no_rval - 8
brid sys_rt_sigreturn /* Do real work */
- addik r5, r1, 0; /* add user context as 1st arg */
+ addik r5, r1, PTO; /* add user context as 1st arg */
/*
* HW EXCEPTION rutine start
@@ -545,7 +550,7 @@ C_ENTRY(full_exception_trap):
addik r17, r17, -4
SAVE_STATE /* Save registers */
/* PC, before IRQ/trap - this is one instruction above */
- swi r17, r1, PT_PC;
+ swi r17, r1, PTO+PT_PC;
tovirt(r1,r1)
/* FIXME this can be store directly in PT_ESR reg.
* I tested it but there is a fault */
@@ -555,7 +560,7 @@ C_ENTRY(full_exception_trap):
mfs r7, rfsr; /* save FSR */
mts rfsr, r0; /* Clear sticky fsr */
rted r0, full_exception
- addik r5, r1, 0 /* parameter struct pt_regs * regs */
+ addik r5, r1, PTO /* parameter struct pt_regs * regs */
/*
* Unaligned data trap.
@@ -581,14 +586,14 @@ C_ENTRY(unaligned_data_trap):
lwi r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
SAVE_STATE /* Save registers.*/
/* PC, before IRQ/trap - this is one instruction above */
- swi r17, r1, PT_PC;
+ swi r17, r1, PTO+PT_PC;
tovirt(r1,r1)
/* where the trap should return need -8 to adjust for rtsd r15, 8 */
addik r15, r0, ret_from_exc-8
mfs r3, resr /* ESR */
mfs r4, rear /* EAR */
rtbd r0, _unaligned_data_exception
- addik r7, r1, 0 /* parameter struct pt_regs * regs */
+ addik r7, r1, PTO /* parameter struct pt_regs * regs */
/*
* Page fault traps.
@@ -611,30 +616,30 @@ C_ENTRY(unaligned_data_trap):
C_ENTRY(page_fault_data_trap):
SAVE_STATE /* Save registers.*/
/* PC, before IRQ/trap - this is one instruction above */
- swi r17, r1, PT_PC;
+ swi r17, r1, PTO+PT_PC;
tovirt(r1,r1)
/* where the trap should return need -8 to adjust for rtsd r15, 8 */
addik r15, r0, ret_from_exc-8
mfs r6, rear /* parameter unsigned long address */
mfs r7, resr /* parameter unsigned long error_code */
rted r0, do_page_fault
- addik r5, r1, 0 /* parameter struct pt_regs * regs */
+ addik r5, r1, PTO /* parameter struct pt_regs * regs */
C_ENTRY(page_fault_instr_trap):
SAVE_STATE /* Save registers.*/
/* PC, before IRQ/trap - this is one instruction above */
- swi r17, r1, PT_PC;
+ swi r17, r1, PTO+PT_PC;
tovirt(r1,r1)
/* where the trap should return need -8 to adjust for rtsd r15, 8 */
addik r15, r0, ret_from_exc-8
mfs r6, rear /* parameter unsigned long address */
ori r7, r0, 0 /* parameter unsigned long error_code */
rted r0, do_page_fault
- addik r5, r1, 0 /* parameter struct pt_regs * regs */
+ addik r5, r1, PTO /* parameter struct pt_regs * regs */
/* Entry point used to return from an exception. */
C_ENTRY(ret_from_exc):
- lwi r11, r1, PT_MODE;
+ lwi r11, r1, PTO+PT_MODE;
bnei r11, 2f; /* See if returning to kernel mode, */
/* ... if so, skip resched &c. */
@@ -666,7 +671,7 @@ C_ENTRY(ret_from_exc):
* complete register state. Here we save anything not saved by
* the normal entry sequence, so that it may be safely restored
* (in a possibly modified form) after do_notify_resume returns. */
- addik r5, r1, 0; /* Arg 1: struct pt_regs *regs */
+ addik r5, r1, PTO; /* Arg 1: struct pt_regs *regs */
bralid r15, do_notify_resume; /* Handle any signals */
addi r6, r0, 0; /* Arg 2: int in_syscall */
bri 1b
@@ -678,7 +683,7 @@ C_ENTRY(ret_from_exc):
tophys(r1,r1);
RESTORE_REGS_RTBD;
- addik r1, r1, PT_SIZE /* Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* Clean up stack space. */
lwi r1, r1, PT_R1 - PT_SIZE; /* Restore user stack pointer. */
bri 6f;
@@ -687,7 +692,7 @@ C_ENTRY(ret_from_exc):
VM_OFF;
tophys(r1,r1);
RESTORE_REGS_RTBD;
- addik r1, r1, PT_SIZE /* Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* Clean up stack space. */
tovirt(r1,r1);
6:
@@ -720,10 +725,10 @@ C_ENTRY(_interrupt):
tophys(r1,r1); /* MS: I have in r1 physical address where stack is */
/* save registers */
/* MS: Make room on the stack -> activation record */
- addik r1, r1, -PT_SIZE;
+ addik r1, r1, -STATE_SAVE_SIZE;
SAVE_REGS
brid 2f;
- swi r1, r1, PT_MODE; /* 0 - user mode, 1 - kernel mode */
+ swi r1, r1, PTO+PT_MODE; /* 0 - user mode, 1 - kernel mode */
1:
/* User-mode state save. */
/* MS: get the saved current */
@@ -733,23 +738,23 @@ C_ENTRY(_interrupt):
addik r1, r1, THREAD_SIZE;
tophys(r1,r1);
/* save registers */
- addik r1, r1, -PT_SIZE;
+ addik r1, r1, -STATE_SAVE_SIZE;
SAVE_REGS
/* calculate mode */
- swi r0, r1, PT_MODE;
+ swi r0, r1, PTO+PT_MODE;
lwi r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
- swi r11, r1, PT_R1;
+ swi r11, r1, PTO+PT_R1;
clear_ums;
2:
lwi CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
tovirt(r1,r1)
addik r15, r0, irq_call;
irq_call:rtbd r0, do_IRQ;
- addik r5, r1, 0;
+ addik r5, r1, PTO;
/* MS: we are in virtual mode */
ret_from_irq:
- lwi r11, r1, PT_MODE;
+ lwi r11, r1, PTO+PT_MODE;
bnei r11, 2f;
1:
@@ -765,7 +770,7 @@ ret_from_irq:
5: andi r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
beqid r11, no_intr_resched
/* Handle a signal return; Pending signals should be in r18. */
- addik r5, r1, 0; /* Arg 1: struct pt_regs *regs */
+ addik r5, r1, PTO; /* Arg 1: struct pt_regs *regs */
bralid r15, do_notify_resume; /* Handle any signals */
addi r6, r0, 0; /* Arg 2: int in_syscall */
bri 1b
@@ -778,7 +783,7 @@ no_intr_resched:
VM_OFF;
tophys(r1,r1);
RESTORE_REGS
- addik r1, r1, PT_SIZE /* MS: Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* MS: Clean up stack space. */
lwi r1, r1, PT_R1 - PT_SIZE;
bri 6f;
/* MS: Return to kernel state. */
@@ -801,7 +806,7 @@ restore:
VM_OFF /* MS: turn off MMU */
tophys(r1,r1)
RESTORE_REGS
- addik r1, r1, PT_SIZE /* MS: Clean up stack space. */
+ addik r1, r1, STATE_SAVE_SIZE /* MS: Clean up stack space. */
tovirt(r1,r1);
6:
IRQ_return: /* MS: Make global symbol for debugging */
@@ -820,29 +825,29 @@ C_ENTRY(_xtmr_manager_reset):
lwi r1, r0, xmb_manager_stackpointer
/* Restore MSR */
- lwi r2, r1, PT_MSR
+ lwi r2, r1, PTO+PT_MSR
mts rmsr, r2
bri 4
/* restore Special purpose registers */
- lwi r2, r1, PT_PID
+ lwi r2, r1, PTO+PT_PID
mts rpid, r2
- lwi r2, r1, PT_TLBI
+ lwi r2, r1, PTO+PT_TLBI
mts rtlbx, r2
- lwi r2, r1, PT_ZPR
+ lwi r2, r1, PTO+PT_ZPR
mts rzpr, r2
#if CONFIG_XILINX_MICROBLAZE0_USE_FPU
- lwi r2, r1, PT_FSR
+ lwi r2, r1, PTO+PT_FSR
mts rfsr, r2
#endif
/* restore all the tlb's */
addik r3, r0, TOPHYS(tlb_skip)
- addik r6, r0, PT_TLBL0
- addik r7, r0, PT_TLBH0
+ addik r6, r0, PTO+PT_TLBL0
+ addik r7, r0, PTO+PT_TLBH0
restore_tlb:
add r6, r6, r1
add r7, r7, r1
@@ -868,9 +873,9 @@ ret_from_reset:
VM_OFF
/* MS: Restore all regs */
RESTORE_REGS
- lwi r14, r1, PT_R14
- lwi r16, r1, PT_PC
- addik r1, r1, PT_SIZE + 36
+ lwi r14, r1, PTO+PT_R14
+ lwi r16, r1, PTO+PT_PC
+ addik r1, r1, STATE_SAVE_SIZE + 36
rtbd r16, 0
nop
@@ -885,11 +890,11 @@ C_ENTRY(_xmb_manager_break):
* Reserve memory in the stack for context store/restore
* (which includes memory for storing tlbs (max two tlbs))
*/
- addik r1, r1, -PT_SIZE - 36
+ addik r1, r1, -STATE_SAVE_SIZE - 36
swi r1, r0, xmb_manager_stackpointer
SAVE_REGS
- swi r14, r1, PT_R14 /* rewrite saved R14 value */
- swi r16, r1, PT_PC; /* PC and r16 are the same */
+ swi r14, r1, PTO+PT_R14 /* rewrite saved R14 value */
+ swi r16, r1, PTO+PT_PC; /* PC and r16 are the same */
lwi r6, r0, TOPHYS(xmb_manager_baseaddr)
lwi r7, r0, TOPHYS(xmb_manager_crval)
@@ -903,25 +908,25 @@ C_ENTRY(_xmb_manager_break):
/* Save the special purpose registers */
mfs r2, rpid
- swi r2, r1, PT_PID
+ swi r2, r1, PTO+PT_PID
mfs r2, rtlbx
- swi r2, r1, PT_TLBI
+ swi r2, r1, PTO+PT_TLBI
mfs r2, rzpr
- swi r2, r1, PT_ZPR
+ swi r2, r1, PTO+PT_ZPR
#if CONFIG_XILINX_MICROBLAZE0_USE_FPU
mfs r2, rfsr
- swi r2, r1, PT_FSR
+ swi r2, r1, PTO+PT_FSR
#endif
mfs r2, rmsr
- swi r2, r1, PT_MSR
+ swi r2, r1, PTO+PT_MSR
/* Save all the tlb's */
addik r3, r0, TOPHYS(tlb_skip)
- addik r6, r0, PT_TLBL0
- addik r7, r0, PT_TLBH0
+ addik r6, r0, PTO+PT_TLBL0
+ addik r7, r0, PTO+PT_TLBH0
save_tlb:
add r6, r6, r1
add r7, r7, r1
@@ -978,28 +983,28 @@ C_ENTRY(_debug_exception):
lwi r1, r0, TOPHYS(PER_CPU(ENTRY_SP)); /* Reload kernel stack-ptr*/
/* BIP bit is set on entry, no interrupts can occur */
- addik r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - PT_SIZE;
+ addik r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - STATE_SAVE_SIZE;
SAVE_REGS;
/* save all regs to pt_reg structure */
- swi r0, r1, PT_R0; /* R0 must be saved too */
- swi r14, r1, PT_R14 /* rewrite saved R14 value */
- swi r16, r1, PT_PC; /* PC and r16 are the same */
+ swi r0, r1, PTO+PT_R0; /* R0 must be saved too */
+ swi r14, r1, PTO+PT_R14 /* rewrite saved R14 value */
+ swi r16, r1, PTO+PT_PC; /* PC and r16 are the same */
/* save special purpose registers to pt_regs */
mfs r11, rear;
- swi r11, r1, PT_EAR;
+ swi r11, r1, PTO+PT_EAR;
mfs r11, resr;
- swi r11, r1, PT_ESR;
+ swi r11, r1, PTO+PT_ESR;
mfs r11, rfsr;
- swi r11, r1, PT_FSR;
+ swi r11, r1, PTO+PT_FSR;
/* stack pointer is in physical address at it is decrease
- * by PT_SIZE but we need to get correct R1 value */
- addik r11, r1, CONFIG_KERNEL_START - CONFIG_KERNEL_BASE_ADDR + PT_SIZE;
- swi r11, r1, PT_R1
+ * by STATE_SAVE_SIZE but we need to get correct R1 value */
+ addik r11, r1, CONFIG_KERNEL_START - CONFIG_KERNEL_BASE_ADDR + STATE_SAVE_SIZE;
+ swi r11, r1, PTO+PT_R1
/* MS: r31 - current pointer isn't changed */
tovirt(r1,r1)
#ifdef CONFIG_KGDB
- addi r5, r1, 0 /* pass pt_reg address as the first arg */
+ addi r5, r1, PTO /* pass pt_reg address as the first arg */
addik r15, r0, dbtrap_call; /* return address */
rtbd r0, microblaze_kgdb_break
nop;
@@ -1015,16 +1020,16 @@ C_ENTRY(_debug_exception):
addik r1, r1, THREAD_SIZE; /* calculate kernel stack pointer */
tophys(r1,r1);
- addik r1, r1, -PT_SIZE; /* Make room on the stack. */
+ addik r1, r1, -STATE_SAVE_SIZE; /* Make room on the stack. */
SAVE_REGS;
- swi r16, r1, PT_PC; /* Save LP */
- swi r0, r1, PT_MODE; /* Was in user-mode. */
+ swi r16, r1, PTO+PT_PC; /* Save LP */
+ swi r0, r1, PTO+PT_MODE; /* Was in user-mode. */
lwi r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
- swi r11, r1, PT_R1; /* Store user SP. */
+ swi r11, r1, PTO+PT_R1; /* Store user SP. */
lwi CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
tovirt(r1,r1)
set_vms;
- addik r5, r1, 0;
+ addik r5, r1, PTO;
addik r15, r0, dbtrap_call;
dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
rtbd r0, sw_exception
@@ -1032,7 +1037,7 @@ dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
/* MS: The first instruction for the second part of the gdb/kgdb */
set_bip; /* Ints masked for state restore */
- lwi r11, r1, PT_MODE;
+ lwi r11, r1, PTO+PT_MODE;
bnei r11, 2f;
/* MS: Return to user space - gdb */
1:
@@ -1051,7 +1056,7 @@ dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
5: andi r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
beqi r11, 4f; /* Signals to handle, handle them */
- addik r5, r1, 0; /* Arg 1: struct pt_regs *regs */
+ addik r5, r1, PTO; /* Arg 1: struct pt_regs *regs */
bralid r15, do_notify_resume; /* Handle any signals */
addi r6, r0, 0; /* Arg 2: int in_syscall */
bri 1b
@@ -1062,7 +1067,7 @@ dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
tophys(r1,r1);
/* MS: Restore all regs */
RESTORE_REGS_RTBD
- addik r1, r1, PT_SIZE /* Clean up stack space */
+ addik r1, r1, STATE_SAVE_SIZE /* Clean up stack space */
lwi r1, r1, PT_R1 - PT_SIZE; /* Restore user stack pointer */
DBTRAP_return_user: /* MS: Make global symbol for debugging */
rtbd r16, 0; /* MS: Instructions to return from a debug trap */
@@ -1073,9 +1078,9 @@ DBTRAP_return_user: /* MS: Make global symbol for debugging */
tophys(r1,r1);
/* MS: Restore all regs */
RESTORE_REGS_RTBD
- lwi r14, r1, PT_R14;
- lwi r16, r1, PT_PC;
- addik r1, r1, PT_SIZE; /* MS: Clean up stack space */
+ lwi r14, r1, PTO+PT_R14;
+ lwi r16, r1, PTO+PT_PC;
+ addik r1, r1, STATE_SAVE_SIZE; /* MS: Clean up stack space */
tovirt(r1,r1);
DBTRAP_return_kernel: /* MS: Make global symbol for debugging */
rtbd r16, 0; /* MS: Instructions to return from a debug trap */
@@ -1173,7 +1178,7 @@ ENTRY(_switch_to)
.ent xmb_inject_err
.type xmb_inject_err, @function
xmb_inject_err:
- addik r1, r1, -PT_SIZE
+ addik r1, r1, -STATE_SAVE_SIZE
SAVE_REGS
/* Switch to real mode */
@@ -1197,7 +1202,7 @@ xmb_inject_err:
nop;
1:
RESTORE_REGS
- addik r1, r1, PT_SIZE
+ addik r1, r1, STATE_SAVE_SIZE
rtsd r15, 8;
nop;
.end xmb_inject_err
diff --git a/arch/microblaze/kernel/hw_exception_handler.S b/arch/microblaze/kernel/hw_exception_handler.S
index 07ea23965f817..4693916be5267 100644
--- a/arch/microblaze/kernel/hw_exception_handler.S
+++ b/arch/microblaze/kernel/hw_exception_handler.S
@@ -313,6 +313,11 @@ _MB_HW_ExceptionVectorTable:
.align 4
.ent _hw_exception_handler
_hw_exception_handler:
+ /*
+ * This handler saves into the static pt_pool_space buffer, not into a
+ * stack frame, so the plain PT_* offsets are right here -- do not add
+ * the PTO of entry.S's frames.
+ */
swi r1, r0, TOPHYS(pt_pool_space + PT_R1); /* GET_SP */
/* Save date to kernel memory. Here is the problem
* when you came from user space */
diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
index 6cbf642d7b801..090e1697ea7ae 100644
--- a/arch/microblaze/kernel/process.c
+++ b/arch/microblaze/kernel/process.c
@@ -19,6 +19,7 @@
#include <linux/bitops.h>
#include <linux/ptrace.h>
#include <asm/cacheflush.h>
+#include <asm/entry.h>
void show_regs(struct pt_regs *regs)
{
@@ -65,7 +66,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
* the registers. That's OK for a brand new thread.*/
memset(childregs, 0, sizeof(struct pt_regs));
memset(&ti->cpu_context, 0, sizeof(struct cpu_context));
- ti->cpu_context.r1 = (unsigned long)childregs;
+ ti->cpu_context.r1 = (unsigned long)childregs - PTO;
ti->cpu_context.r20 = (unsigned long)args->fn;
ti->cpu_context.r19 = (unsigned long)args->fn_arg;
childregs->pt_mode = 1;
@@ -79,7 +80,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
childregs->r1 = usp;
memset(&ti->cpu_context, 0, sizeof(struct cpu_context));
- ti->cpu_context.r1 = (unsigned long)childregs;
+ ti->cpu_context.r1 = (unsigned long)childregs - PTO;
childregs->msr |= MSR_UMS;
/* we should consider the fact that childregs is a copy of the parent
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0052/1257] microblaze: preserve the MSR carry flags across signals
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0051/1257] microblaze: restore the ABI argument home area below pt_regs (PTO) Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0053/1257] PCI: aspeed: Fix clk and PHY leak in aspeed_pcie_port_init() error paths Greg Kroah-Hartman
` (946 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sam Price, Ramin Moussavi,
Waldemar Brodkorb, Michal Simek, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Price <thesamprice@gmail.com>
[ Upstream commit ca35dd21a5f8343f47a23e4e5b3f0ffccf76a4ae ]
setup_sigcontext() and restore_sigcontext() copy r0-r31, pc, ear, esr and
fsr to and from the signal frame but never touch MSR. The interrupted
MSR is therefore dropped from the signal context entirely: the handler's
ucontext does not expose it, a handler cannot adjust the resumed
arithmetic flags through uc_mcontext.regs.msr, and -- because
restore_sigcontext() leaves regs->msr as whatever the rt_sigreturn trap
left in it -- the interrupted context resumes with the carry produced by
the syscall entry path (_user_exception does "addi r14, r14, 4", which
writes carry), not with its own.
Other architectures round-trip the user-visible flags through the signal
frame (arm's cpsr, csky's carry, x86's eflags), so a handler can both read
and adjust the resumed flags; purely privileged status registers such as
riscv's sstatus are left out. MicroBlaze should do the same for the
user-writable bits.
Concretely, MSR[C] (carry) is lost across signal delivery. Code that
keeps a live carry across a point where a signal can be delivered -- for
example an lwx/swx compare-and-swap retry loop, between the swx and the
carry test -- resumes with the handler's carry and mis-evaluates the
result; the same failure class as the rt_sigreturn r3/r4 clobber, reached
through a different register. Demonstrated under qemu-system-microblazeel
(machine petalogix-s3adsp1800): a handler that sets MSR_C in
uc_mcontext.regs.msr has no effect before this change (0 of 132 in-window
signals propagated) and takes effect after (130 of 132).
Save MSR in setup_sigcontext() so the handler's ucontext exposes it. The
signal frame is user-writable, so restore_sigcontext() must not restore it
verbatim: MicroBlaze packs the user-writable carry (MSR_C, MSR_CC) and the
privileged control bits (MSR_UM, MSR_VM, MSR_IE, MSR_EE, ...) into the one
register, and a verbatim restore would let userspace alter privileged
return state -- rtbd derives the resumed mode from MSR_UMS/MSR_VMS.
Restore only MSR_C | MSR_CC from the frame and keep the rest from the
current regs->msr. This mirrors x86's
restore_sigcontext(), which masks the restored EFLAGS to FIX_EFLAGS for
the same reason; arches whose status register is purely privileged (e.g.
riscv sstatus) simply do not restore it at all.
Comment on the exposed MSR reworded: it is not read-only,
restore_sigcontext() applies MSR_C|MSR_CC from the frame. Author's
Signed-off-by kept; he agreed to comment and changelog cleanups.
Fixes: 2148daa9c45f ("microblaze_v8: Signal support")
Cc: stable@vger.kernel.org
Signed-off-by: Sam Price <thesamprice@gmail.com>
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-6-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/microblaze/kernel/signal.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/arch/microblaze/kernel/signal.c b/arch/microblaze/kernel/signal.c
index 4956014a99379..6bbc16f98d5eb 100644
--- a/arch/microblaze/kernel/signal.c
+++ b/arch/microblaze/kernel/signal.c
@@ -33,6 +33,7 @@
#include <linux/linkage.h>
#include <linux/resume_user_mode.h>
#include <asm/entry.h>
+#include <asm/registers.h>
#include <asm/ucontext.h>
#include <linux/uaccess.h>
#include <linux/syscalls.h>
@@ -81,6 +82,22 @@ static int restore_sigcontext(struct pt_regs *regs,
COPY(pc); COPY(ear); COPY(esr); COPY(fsr);
#undef COPY
+ /*
+ * The frame is user-writable, so restore only the user-writable
+ * status flags (carry) and keep the kernel-controlled MSR bits
+ * (UMS/VMS/IE/EE/...) from regs->msr: rtbd derives the resumed mode
+ * from UMS/VMS, so a verbatim restore would hand userspace the
+ * privileged return state. Same idea as x86 masking the restored
+ * EFLAGS to FIX_EFLAGS.
+ */
+ {
+ unsigned long msr;
+
+ err |= __get_user(msr, &sc->regs.msr);
+ regs->msr = (regs->msr & ~(MSR_C | MSR_CC)) |
+ (msr & (MSR_C | MSR_CC));
+ }
+
*rval_p = regs->r3;
return err;
@@ -140,6 +157,7 @@ setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
COPY(r26); COPY(r27); COPY(r28); COPY(r29);
COPY(r30); COPY(r31);
COPY(pc); COPY(ear); COPY(esr); COPY(fsr);
+ COPY(msr); /* restore_sigcontext() accepts only carry state */
#undef COPY
err |= __put_user(mask, &sc->oldmask);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0053/1257] PCI: aspeed: Fix clk and PHY leak in aspeed_pcie_port_init() error paths
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0052/1257] microblaze: preserve the MSR carry flags across signals Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0054/1257] memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset Greg Kroah-Hartman
` (945 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liu Zhenlong, Manivannan Sadhasivam,
Bjorn Helgaas, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Zhenlong <dragonliu2018@gmail.com>
[ Upstream commit a54ac2eb6eca8baa86b89494b8a0d9439a0f72ee ]
aspeed_pcie_port_init() calls clk_prepare_enable() to enable the port
clock, but if phy_init() or phy_set_mode_ext() fails afterwards, the
function returns without calling clk_disable_unprepare(), leaking the
clock reference on every probe failure. Additionally, when
phy_set_mode_ext() fails, phy_init() has already succeeded, so
phy_exit() is also missing, leaking the PHY reference.
Add the matching clk_disable_unprepare() to both error paths, and
phy_exit() to the phy_set_mode_ext() failure path, mirroring the
cleanup pattern in pci-aardvark.
Compile-tested with gcc on arm64 defconfig using COMPILE_TEST.
Fixes: 9aa0cb68fcc1 ("PCI: aspeed: Add ASPEED PCIe RC driver")
Signed-off-by: Liu Zhenlong <dragonliu2018@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260816171633.15025-1-dragonliu2018@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-aspeed.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/controller/pcie-aspeed.c b/drivers/pci/controller/pcie-aspeed.c
index 74b03a55643fa..ecb7562f84c01 100644
--- a/drivers/pci/controller/pcie-aspeed.c
+++ b/drivers/pci/controller/pcie-aspeed.c
@@ -761,16 +761,21 @@ static int aspeed_pcie_port_init(struct aspeed_pcie_port *port)
port->slot);
ret = phy_init(port->phy);
- if (ret)
+ if (ret) {
+ clk_disable_unprepare(port->clk);
return dev_err_probe(dev, ret,
"failed to init phy pcie for slot (%d)\n",
port->slot);
+ }
ret = phy_set_mode_ext(port->phy, PHY_MODE_PCIE, PHY_MODE_PCIE_RC);
- if (ret)
+ if (ret) {
+ phy_exit(port->phy);
+ clk_disable_unprepare(port->clk);
return dev_err_probe(dev, ret,
"failed to set phy mode for slot (%d)\n",
port->slot);
+ }
reset_control_deassert(port->perst);
msleep(PCIE_RESET_CONFIG_WAIT_MS);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0054/1257] memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0053/1257] PCI: aspeed: Fix clk and PHY leak in aspeed_pcie_port_init() error paths Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0055/1257] memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT Greg Kroah-Hartman
` (944 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Chen, Danesh Petigara,
Florian Fainelli, Krzysztof Kozlowski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <justin.chen@broadcom.com>
[ Upstream commit 7c0b82d087908765c6c7daeb06943e21b78d523e ]
On API v1/v2 boards, the DCPU coprocessor can steer kernel readl_relaxed()
and writel_relaxed() to any address within 256 MB of the ioremapped DPFE
dmem or regs base. The DCPU firmware provides a 28-bit offset which the
driver adds to the ioremap base without any bounds checking in
get_msg_ptr().
This allows a compromised DCPU firmware to trick the host kernel into
reading or writing arbitrary memory-mapped I/O registers in vmalloc
space. When combined with a root-writable sysfs file like dpfe_refresh,
it provides an arbitrary MMIO write primitive. Similarly, world-readable
sysfs files can be used to leak other devices' register contents.
Fix this by recording the resource_size() of the dmem and regs ioremaps
at probe time, and rejecting any offset that, along with the largest
field accessed (DRAM_VENDOR_ERROR + sizeof(u32)), exceeds the recorded
mapping size.
Fixes: fee5f1ef6cf7 ("memory: brcmstb: dpfe: support new way of passing data from the DCPU")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Assisted-by: Gemini:gemini-3.1-pro-preview cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260826201500.3000125-2-danesh.petigara@broadcom.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/brcmstb_dpfe.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
index 08d9e05b1b338..66343205f585b 100644
--- a/drivers/memory/brcmstb_dpfe.c
+++ b/drivers/memory/brcmstb_dpfe.c
@@ -182,6 +182,8 @@ struct brcmstb_dpfe_priv {
void __iomem *regs;
void __iomem *dmem;
void __iomem *imem;
+ resource_size_t regs_size;
+ resource_size_t dmem_size;
struct device *dev;
const struct dpfe_api *dpfe_api;
struct mutex lock;
@@ -401,9 +403,14 @@ static void __iomem *get_msg_ptr(struct brcmstb_dpfe_priv *priv, u32 response,
*/
switch (msg_type) {
case 1:
+ if (DCPU_MSG_RAM_START + offset + DRAM_VENDOR_ERROR +
+ sizeof(u32) > priv->regs_size)
+ goto bad_offset;
ptr = priv->regs + DCPU_MSG_RAM_START + offset;
break;
case 0:
+ if (offset + DRAM_VENDOR_ERROR + sizeof(u32) > priv->dmem_size)
+ goto bad_offset;
ptr = priv->dmem + offset;
break;
default:
@@ -415,6 +422,12 @@ static void __iomem *get_msg_ptr(struct brcmstb_dpfe_priv *priv, u32 response,
}
return ptr;
+
+bad_offset:
+ dev_err(priv->dev, "DCPU returned out-of-range offset %#x\n", offset);
+ if (buf && size)
+ *size = sprintf(buf, "ERROR: DCPU offset out of range\n");
+ return NULL;
}
static void __finalize_command(struct brcmstb_dpfe_priv *priv)
@@ -858,6 +871,7 @@ static int brcmstb_dpfe_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
struct brcmstb_dpfe_priv *priv;
+ struct resource *res;
int ret;
priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -869,17 +883,21 @@ static int brcmstb_dpfe_probe(struct platform_device *pdev)
mutex_init(&priv->lock);
platform_set_drvdata(pdev, priv);
- priv->regs = devm_platform_ioremap_resource_byname(pdev, "dpfe-cpu");
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dpfe-cpu");
+ priv->regs = devm_ioremap_resource(dev, res);
if (IS_ERR(priv->regs)) {
dev_err(dev, "couldn't map DCPU registers\n");
return -ENODEV;
}
+ priv->regs_size = resource_size(res);
- priv->dmem = devm_platform_ioremap_resource_byname(pdev, "dpfe-dmem");
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dpfe-dmem");
+ priv->dmem = devm_ioremap_resource(dev, res);
if (IS_ERR(priv->dmem)) {
dev_err(dev, "Couldn't map DCPU data memory\n");
return -ENOENT;
}
+ priv->dmem_size = resource_size(res);
priv->imem = devm_platform_ioremap_resource_byname(pdev, "dpfe-imem");
if (IS_ERR(priv->imem)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0055/1257] memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0054/1257] memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0056/1257] memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile Greg Kroah-Hartman
` (943 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Chen, Danesh Petigara,
Florian Fainelli, Krzysztof Kozlowski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <justin.chen@broadcom.com>
[ Upstream commit 6b07f8c06caca015a0db69e3f323b5186469bc66 ]
A compromised or buggy DCPU coprocessor can make any user who reads
world-readable /sys/devices/.../dpfe_info|dpfe_dram trigger a kernel
stack out-of-bounds read of arbitrary extent. This bounds checks
chksum_idx against MSG_FIELD_MAX after reading the response from DCPU
message RAM.
Fixes: 5d06f53d9509 ("memory: brcmstb: dpfe: Compute checksum at __send_command() time")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Assisted-by: Gemini:gemini-3.1-pro-preview cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260826201500.3000125-3-danesh.petigara@broadcom.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/brcmstb_dpfe.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
index 66343205f585b..7b02c36c7fca7 100644
--- a/drivers/memory/brcmstb_dpfe.c
+++ b/drivers/memory/brcmstb_dpfe.c
@@ -503,6 +503,8 @@ static int __send_command(struct brcmstb_dpfe_priv *priv, unsigned int cmd,
for (i = 0; i < MSG_FIELD_MAX; i++)
result[i] = readl_relaxed(regs + DCPU_MSG_RAM(i));
chksum_idx = result[MSG_ARG_COUNT] + MSG_ARG_COUNT + 1;
+ if (chksum_idx >= MSG_FIELD_MAX)
+ ret = -EINVAL;
}
/* Tell DCPU we are done */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0056/1257] memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0055/1257] memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0057/1257] wifi: rtw88: fix out-of-bounds CAM write when key table is full Greg Kroah-Hartman
` (942 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Krzysztof Kozlowski,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 3db1fb5e1bb4c9eefc554f985f6f3316fa1292e5 ]
Add XSPI_CDD1BUF0 to the xSPI regmap volatile register table.
XSPI_CDD1BUF0 is a data buffer register used during manual transfers and,
like XSPI_CDD0BUF0, its contents are transient and should not be cached
by regmap. Mark it as volatile so reads always access the hardware
register.
Fixes: 687cac9559d8 ("memory: renesas-rpc-if: Add RZ/G3E xSPI support")
Cc: stable@vger.kernel.org
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://patch.msgid.link/20260727103449.3188105-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/renesas-rpc-if.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/memory/renesas-rpc-if.c b/drivers/memory/renesas-rpc-if.c
index 3755956ae9065..104c28532c202 100644
--- a/drivers/memory/renesas-rpc-if.c
+++ b/drivers/memory/renesas-rpc-if.c
@@ -34,6 +34,7 @@ static const struct regmap_access_table rpcif_volatile_table = {
static const struct regmap_range xspi_volatile_ranges[] = {
regmap_reg_range(XSPI_CDD0BUF0, XSPI_CDD0BUF0),
+ regmap_reg_range(XSPI_CDD1BUF0, XSPI_CDD1BUF0),
};
static const struct regmap_access_table xspi_volatile_table = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0057/1257] wifi: rtw88: fix out-of-bounds CAM write when key table is full
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0056/1257] memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0058/1257] wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields Greg Kroah-Hartman
` (941 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches,
イムティヤズ, Ping-Ke Shih,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: イムティヤズ <reza1234khan1234@gmail.com>
[ Upstream commit 10d58823cb44681466c022054030b8e68d94ce2f ]
In rtw_ops_set_key(), when the CAM table is full,
rtw_sec_get_free_cam() returns RTW_MAX_SEC_CAM_NUM (32) because
find_next_zero_bit()/find_first_zero_bit() return the bitmap size
when no free slot exists. The bounds check compares the returned
index with ">" against total_cam_num (32), so the invalid index 32
passes the check.
rtw_sec_write_cam() then indexes cam_table[32], an array declared
with RTW_MAX_SEC_CAM_NUM (32) entries, causing an out-of-bounds
write that corrupts the cam_map allocation bitmap. The write also
sets bit 32 of cam_map, which overruns the bitmap as well.
Fix the off-by-one by rejecting indices >= total_cam_num.
Tested on: RTL8821CE (PCIe) on kernel
7.2.0-rc6-rtw88test-00059-g0d8395707651. The patched module loaded
and associated to a WPA2 network; ping traffic passed with 0% packet
loss. Reassociation and disconnect/reconnect cycles completed
without errors, and the CAM table (debugfs dump_cam) showed valid
key entries. The CAM-full boundary (28+ pairwise keys) requires an
access point with 28+ clients and is not reachable in a
single-client setup, so that path was verified by code inspection.
Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
Cc: stable@vger.kernel.org
Tested-by: イムティヤズ <reza1234khan1234@gmail.com>
Signed-off-by: イムティヤズ <reza1234khan1234@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260805210941.75136-1-reza1234khan1234@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/mac80211.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c
index b01b98d24b0a5..0b622d7663b66 100644
--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
@@ -603,7 +603,7 @@ static int rtw_ops_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
hw_key_idx = key->keyidx;
}
- if (hw_key_idx > sec->total_cam_num) {
+ if (hw_key_idx >= sec->total_cam_num) {
ret = -ENOSPC;
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0058/1257] wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0057/1257] wifi: rtw88: fix out-of-bounds CAM write when key table is full Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0059/1257] wifi: rtw89: cap firmware section_num before parsing Greg Kroah-Hartman
` (940 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yi Cong, Ping-Ke Shih, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Cong <yicong@kylinos.cn>
[ Upstream commit 7e080e17ca38b72f6cf01e3bc750c243573e69a7 ]
The .ch and .bw backup fields are swapped; .ch should store the channel
and .bw the bandwidth, matching all other chips.
Fixes: 0194a95cbe721a ("wifi: rtw89: 8851b: rfk: add DPK")
Cc: stable@vger.kernel.org
Signed-off-by: Yi Cong <yicong@kylinos.cn>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260807081006.240450-1-cong.yi@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
index c63f0e6364dad..71342461f2b30 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
@@ -1895,8 +1895,8 @@ static void _dpk_information(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy,
u8 kidx = dpk->cur_idx[path];
dpk->bp[path][kidx].band = chan->band_type;
- dpk->bp[path][kidx].ch = chan->band_width;
- dpk->bp[path][kidx].bw = chan->channel;
+ dpk->bp[path][kidx].ch = chan->channel;
+ dpk->bp[path][kidx].bw = chan->band_width;
rtw89_debug(rtwdev, RTW89_DBG_RFK,
"[DPK] S%d[%d] (PHY%d): TSSI %s/ DBCC %s/ %s/ CH%d/ %s\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0059/1257] wifi: rtw89: cap firmware section_num before parsing
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0058/1257] wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0060/1257] platform/x86: int3472: Fix uninitialised variable warning Greg Kroah-Hartman
` (939 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ping-Ke Shih, Laxman Acharya Padhya,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
[ Upstream commit 273b0a8be083df6d0319ce62caa870e927f94a31 ]
rtw89_fw_bin_info.section_info has FWDL_SECTION_MAX_NUM (10) entries.
The v0/v1 header parsers take section_num from an 8-bit firmware field
(0..255) and write info->section_info[i] with no cap.
rtw89_fw_download_suit() keeps that object on the stack, so a crafted
firmware blob overflows the stack.
Reject a truncated header and a section table that does not fit in the
firmware image before reading fw_hdr->sections[i].
Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver")
Cc: stable@vger.kernel.org
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260825174438.63168-1-acharyalaxman8848@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/fw.c | 32 +++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 0099c5c03e7a6..b2991bc93f852 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -156,8 +156,24 @@ static int rtw89_fw_hdr_parser_v0(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
if (!info)
return -EINVAL;
+ if (len < sizeof(*fw_hdr)) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_W6_SEC_NUM);
+ if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
+ rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
+ info->section_num);
+ return -EINVAL;
+ }
+
base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
+ if (base_hdr_len > len) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_W7_DYN_HDR);
info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_W7_IDMEM_SHARE_MODE);
@@ -455,9 +471,25 @@ static int rtw89_fw_hdr_parser_v1(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
int ret;
u32 i;
+ if (len < sizeof(*fw_hdr)) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_SEC_NUM);
+ if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
+ rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
+ info->section_num);
+ return -EINVAL;
+ }
+
info->dsp_checksum = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_DSP_CHKSUM);
base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
+ if (base_hdr_len > len) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_DYN_HDR);
info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_IDMEM_SHARE_MODE);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0060/1257] platform/x86: int3472: Fix uninitialised variable warning
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0059/1257] wifi: rtw89: cap firmware section_num before parsing Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0061/1257] platform/x86: int3472: Increase handshake GPIO delay to 200 ms Greg Kroah-Hartman
` (938 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Ricardo Ribalda,
Rafael J. Wysocki (Intel), Daniel Scally, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 70e6384fe0f4cf9768944f81924f6c1478b0ce43 ]
Fix a compiler warning about an uninitialised err_msg variable by printing
the error where it is handled:
drivers/platform/x86/intel/int3472/discrete.c:440:24: warning: ‘err_msg’ may be used uninitialized [-Wmaybe-uninitialized]
440 | return dev_err_probe(int3472->dev, ret, err_msg);
Fixes: 5de691bffe57 ("platform/x86: Add intel_skl_int3472 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/int3472/discrete.c | 25 +++++++++++--------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c
index 6c729fcfce5db..9cd4f78875abf 100644
--- a/drivers/platform/x86/intel/int3472/discrete.c
+++ b/drivers/platform/x86/intel/int3472/discrete.c
@@ -329,7 +329,6 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
unsigned long gpio_flags;
union acpi_object *obj;
struct gpio_desc *gpio;
- const char *err_msg;
const char *con_id;
int ret;
@@ -375,7 +374,8 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
case INT3472_GPIO_TYPE_HOTPLUG_DETECT:
ret = skl_int3472_map_gpio_to_sensor(int3472, agpio, con_id, gpio_flags);
if (ret)
- err_msg = "Failed to map GPIO pin to sensor\n";
+ dev_err_probe(int3472->dev, ret,
+ "Failed to map GPIO pin to sensor\n");
break;
case INT3472_GPIO_TYPE_CLK_ENABLE:
@@ -387,7 +387,7 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
gpio = skl_int3472_gpiod_get_from_temp_lookup(int3472, agpio, con_id, gpio_flags);
if (IS_ERR(gpio)) {
ret = PTR_ERR(gpio);
- err_msg = "Failed to get GPIO\n";
+ dev_err_probe(int3472->dev, ret, "Failed to get GPIO\n");
break;
}
@@ -395,14 +395,16 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
case INT3472_GPIO_TYPE_CLK_ENABLE:
ret = skl_int3472_register_gpio_clock(int3472, gpio);
if (ret)
- err_msg = "Failed to register clock\n";
+ dev_err_probe(int3472->dev, ret,
+ "Failed to register clock\n");
break;
case INT3472_GPIO_TYPE_PRIVACY_LED:
case INT3472_GPIO_TYPE_STROBE:
ret = skl_int3472_register_led(int3472, gpio, con_id);
if (ret)
- err_msg = "Failed to register LED\n";
+ dev_err_probe(int3472->dev, ret,
+ "Failed to register LED\n");
break;
case INT3472_GPIO_TYPE_POWER_ENABLE:
@@ -413,7 +415,8 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
ret = skl_int3472_register_regulator(int3472, gpio, enable_time_us,
con_id, second_sensor);
if (ret)
- err_msg = "Failed to register regulator\n";
+ dev_err_probe(int3472->dev, ret,
+ "Failed to register regulator\n");
break;
default: /* Never reached */
@@ -436,11 +439,11 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
int3472->ngpios++;
ACPI_FREE(obj);
- if (ret < 0)
- return dev_err_probe(int3472->dev, ret, err_msg);
-
- /* Tell acpi_dev_get_resources() to not make a copy of the resource */
- return 1;
+ /*
+ * Either return an error or tell acpi_dev_get_resources() to not make a
+ * copy of the resource.
+ */
+ return ret < 0 ? ret : 1;
}
int int3472_discrete_parse_crs(struct int3472_discrete_device *int3472)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0061/1257] platform/x86: int3472: Increase handshake GPIO delay to 200 ms
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0060/1257] platform/x86: int3472: Fix uninitialised variable warning Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0062/1257] clk: mstar: msc313-mpll: fix off-by-one in clock array allocation Greg Kroah-Hartman
` (937 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Alexander, Hans de Goede,
Sakari Ailus, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <johannes.goede@oss.qualcomm.com>
[ Upstream commit 844982d3b99340c21dd2125f44e1ad04ace6a38e ]
There have been several reports of the sensor not properly powering on,
on laptops where an INT3472 handshake GPIO is used. Both with ov08x40 and
hi556 sensors.
Testing has shown that a delay of 200 ms is necessary in some cases.
The handshake GPIO is typically used to signal an extra bridge or other IC
with that IC running the full sensor power sequence based on the handshake
signal and also possible controlling I2C pass-through.
It seems that in some cases that extra IC takes up to 200 ms to before
the sensor is fully powered up and ready for I2C communication.
With the default handshake signal delay increased to 200 ms the quirk to
increase it to 45 ms for the ov08x40 is no longer necessary and is actually
undesirable since some ov08x40 setups also need the longer delay, drop it.
Fixes: 30359c239ba8 ("platform/x86: int3472: Increase ov08x40 handshake GPIO delay to 45 ms")
Closes: https://lore.kernel.org/platform-driver-x86/20260816204247.2844986-1-opensource@inspiredexperts.com/
Reported-by: James Alexander <opensource@inspiredexperts.com>
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2333331
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2333647
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/int3472/discrete.c | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c
index 9cd4f78875abf..6bc0ab3e8d1f4 100644
--- a/drivers/platform/x86/intel/int3472/discrete.c
+++ b/drivers/platform/x86/intel/int3472/discrete.c
@@ -15,6 +15,7 @@
#include <linux/platform_data/x86/int3472.h>
#include <linux/platform_device.h>
#include <linux/string_choices.h>
+#include <linux/time64.h>
#include <linux/uuid.h>
/*
@@ -178,13 +179,6 @@ static const struct int3472_gpio_map int3472_gpio_map[] = {
.type_to = INT3472_GPIO_TYPE_RESET,
.con_id = "enable",
},
- { /* ov08x40's handshake pin needs a 45 ms delay on some HP laptops */
- .hids = (const char * const[]) { "OVTI08F4", NULL },
- .type_from = INT3472_GPIO_TYPE_HANDSHAKE,
- .type_to = INT3472_GPIO_TYPE_HANDSHAKE,
- .con_id = "dvdd",
- .enable_time_us = 45 * USEC_PER_MSEC,
- },
{ /* Sensors which expect "vana" as con_id for power enable */
.hids = power_enable_hids_vana,
.type_from = INT3472_GPIO_TYPE_POWER_ENABLE,
@@ -273,8 +267,8 @@ static void int3472_get_con_id_and_polarity(struct int3472_discrete_device *int3
case INT3472_GPIO_TYPE_HANDSHAKE:
*con_id = "dvdd";
*gpio_flags = GPIO_ACTIVE_HIGH;
- /* Setups using a handshake pin need 25 ms enable delay */
- *enable_time_us = 25 * USEC_PER_MSEC;
+ /* Powering up the sensor through the handshake pin takes up to 200 ms */
+ *enable_time_us = 200 * USEC_PER_MSEC;
break;
default:
*con_id = "unknown";
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0062/1257] clk: mstar: msc313-mpll: fix off-by-one in clock array allocation
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0061/1257] platform/x86: int3472: Increase handshake GPIO delay to 200 ms Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0063/1257] ARM: imx: Fix suspend/resume crash with Clang CFI Greg Kroah-Hartman
` (936 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, hanzhijian, Brian Masney,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: hanzhijian <hanzhijian1991@gmail.com>
[ Upstream commit 712b75152c00a8ab0c56dbfe34caf88e3870ddde ]
The hws array of mpll->clk_data is allocated with struct_size() using
ARRAY_SIZE(output_dividers) as the element count, giving it 7 elements.
But the probe function stores the MPLL clock at hws[0] and one
fixed-factor clock for each output divider at hws[i + 1] for i in
[0, ARRAY_SIZE(output_dividers)), writing 8 elements in total. The
final write to hws[7] is past the end of the allocation.
clk_data->num is also set to NUMOUTPUTS (8), so the clock framework
reads hws[0..7], again accessing hws[7] out of bounds.
Use NUMOUTPUTS as the element count so the allocation matches the
number of clocks actually stored and exposed.
Found by smatch:
drivers/clk/mstar/clk-msc313-mpll.c:134 msc313_mpll_probe()
error: buffer overflow 'mpll->clk_data->hws' 7 <= 7
Fixes: bef7a78da716 ("clk: mstar: MStar/SigmaStar MPLL driver")
Cc: stable@vger.kernel.org
Signed-off-by: hanzhijian <hanzhijian1991@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/mstar/clk-msc313-mpll.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/mstar/clk-msc313-mpll.c b/drivers/clk/mstar/clk-msc313-mpll.c
index 61beb4e875250..bd45aa0aec011 100644
--- a/drivers/clk/mstar/clk-msc313-mpll.c
+++ b/drivers/clk/mstar/clk-msc313-mpll.c
@@ -105,7 +105,7 @@ static int msc313_mpll_probe(struct platform_device *pdev)
return PTR_ERR(mpll->loop_div_second);
mpll->clk_data = devm_kzalloc(dev, struct_size(mpll->clk_data, hws,
- ARRAY_SIZE(output_dividers)), GFP_KERNEL);
+ NUMOUTPUTS), GFP_KERNEL);
if (!mpll->clk_data)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0063/1257] ARM: imx: Fix suspend/resume crash with Clang CFI
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0062/1257] clk: mstar: msc313-mpll: fix off-by-one in clock array allocation Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0064/1257] bpf: Fix queue/stack map u32 index overflow Greg Kroah-Hartman
` (935 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nick Desaulniers, Yoav Moshe,
Sami Tolvanen, Frank Li, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yo'av Moshe <linux@yoavmoshe.com>
[ Upstream commit 242757d109bd5c9b8fb7194fb4d44625be0b859a ]
The suspend code that runs from OCRAM is copied there with fncpy(),
which does not copy the kCFI type hash preceding the function. With
CONFIG_CFI=y the indirect call through imx6_suspend_in_ocram_fn
therefore panics.
Keep the call covered by CFI instead of exempting it:
- Add SYM_TYPED_FUNC_START_ALIGNED(), a variant of
SYM_TYPED_FUNC_START() that aligns the function entry rather than
the type hash preceding it, and use it to declare imx6_suspend():
fncpy() requires the entry point of the function it copies to be
8-byte aligned. The macro lives in arch/arm/include/asm/linkage.h
since the requirement comes from arm's fncpy().
- Add a cfi_type member at the end of struct imx6_cpu_pm_info, which
directly precedes the OCRAM copy of the function. It fits in the
struct's tail padding, so no sizes or offsets change. Fill it using
cfi_get_func_hash(), putting the hash where the caller's CFI check
expects it: four bytes before the function entry.
Also mark ccm_base, suspend_ocram_base and imx6_suspend_in_ocram_fn
as __ro_after_init: they are only written during __init, and the
function pointer in particular should not be writable afterwards.
Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Yo'av Moshe <linux@yoavmoshe.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/include/asm/linkage.h | 29 +++++++++++++++++++++++++++++
arch/arm/mach-imx/pm-imx6.c | 26 +++++++++++++++++++++++---
arch/arm/mach-imx/suspend-imx6.S | 6 ++++--
3 files changed, 56 insertions(+), 5 deletions(-)
diff --git a/arch/arm/include/asm/linkage.h b/arch/arm/include/asm/linkage.h
index c4670694ada79..bba992f5d7a80 100644
--- a/arch/arm/include/asm/linkage.h
+++ b/arch/arm/include/asm/linkage.h
@@ -9,4 +9,33 @@
.type name, %function; \
END(name)
+#ifdef __ASSEMBLY__
+
+/*
+ * Variants of SYM_TYPED_START/SYM_TYPED_FUNC_START that align the
+ * function entry itself instead of the kCFI type hash preceding it,
+ * for functions whose entry point must meet an alignment requirement,
+ * such as the 8-byte alignment fncpy() demands of its source.
+ */
+#ifdef CONFIG_CFI
+
+#define SYM_TYPED_START_ALIGNED(name, linkage, align) \
+ linkage(name) ASM_NL \
+ .balign align ASM_NL \
+ .fill (align) - 4, 1, 0 ASM_NL \
+ __CFI_TYPE(name) ASM_NL \
+ name:
+
+#else /* CONFIG_CFI */
+
+#define SYM_TYPED_START_ALIGNED(name, linkage, align) \
+ SYM_START(name, linkage, .balign align)
+
+#endif /* CONFIG_CFI */
+
+#define SYM_TYPED_FUNC_START_ALIGNED(name, align) \
+ SYM_TYPED_START_ALIGNED(name, SYM_L_GLOBAL, align)
+
+#endif /* __ASSEMBLY__ */
+
#endif
diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
index a671ca498f887..3c73e2cdb8ceb 100644
--- a/arch/arm/mach-imx/pm-imx6.c
+++ b/arch/arm/mach-imx/pm-imx6.c
@@ -4,6 +4,8 @@
* Copyright 2011 Linaro Ltd.
*/
+#include <linux/build_bug.h>
+#include <linux/cfi.h>
#include <linux/clk/imx.h>
#include <linux/delay.h>
#include <linux/init.h>
@@ -18,6 +20,7 @@
#include <linux/of_platform.h>
#include <linux/platform_device.h>
#include <linux/regmap.h>
+#include <linux/stddef.h>
#include <linux/suspend.h>
#include <asm/cacheflush.h>
#include <asm/fncpy.h>
@@ -61,9 +64,9 @@
#define MX6Q_SUSPEND_OCRAM_SIZE 0x1000
#define MX6_MAX_MMDC_IO_NUM 33
-static void __iomem *ccm_base;
-static void __iomem *suspend_ocram_base;
-static void (*imx6_suspend_in_ocram_fn)(void __iomem *ocram_vbase);
+static void __iomem *ccm_base __ro_after_init;
+static void __iomem *suspend_ocram_base __ro_after_init;
+static void (*imx6_suspend_in_ocram_fn)(void __iomem *ocram_vbase) __ro_after_init;
/*
* suspend ocram space layout:
@@ -229,8 +232,18 @@ struct imx6_cpu_pm_info {
struct imx6_pm_base l2_base;
u32 mmdc_io_num; /* Number of MMDC IOs which need saved/restored. */
u32 mmdc_io_val[MX6_MAX_MMDC_IO_NUM][2]; /* To save offset and value */
+ u32 cfi_type; /* kCFI type hash of imx6_suspend() */
} __aligned(8);
+/*
+ * The ocram copy of imx6_suspend() starts right after struct imx6_cpu_pm_info,
+ * and the CFI check on the indirect call reads the kCFI type hash from the
+ * four bytes preceding the function entry, so cfi_type must occupy the last
+ * four bytes of the struct, i.e. fit into its tail padding.
+ */
+static_assert(offsetofend(struct imx6_cpu_pm_info, cfi_type) ==
+ sizeof(struct imx6_cpu_pm_info));
+
void imx6_set_int_mem_clk_lpm(bool enable)
{
u32 val = readl_relaxed(ccm_base + CGPR);
@@ -568,6 +581,13 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata)
mmdc_offset_array[i]);
}
+ /*
+ * Mask out the Thumb bit, as cfi_get_func_hash() expects the
+ * function's actual start address. Returns 0 if CONFIG_CFI=n.
+ */
+ pm_info->cfi_type =
+ cfi_get_func_hash((void *)((uintptr_t)&imx6_suspend & ~1UL));
+
imx6_suspend_in_ocram_fn = fncpy(
suspend_ocram_base + sizeof(*pm_info),
&imx6_suspend,
diff --git a/arch/arm/mach-imx/suspend-imx6.S b/arch/arm/mach-imx/suspend-imx6.S
index 63ccc2d0e920a..95d5f723ea0ed 100644
--- a/arch/arm/mach-imx/suspend-imx6.S
+++ b/arch/arm/mach-imx/suspend-imx6.S
@@ -3,6 +3,7 @@
* Copyright 2014 Freescale Semiconductor, Inc.
*/
+#include <linux/cfi_types.h>
#include <linux/linkage.h>
#include <asm/assembler.h>
#include <asm/asm-offsets.h>
@@ -148,7 +149,8 @@
.endm
-ENTRY(imx6_suspend)
+/* fncpy() requires an 8-byte-aligned entry; see arch/arm/include/asm/fncpy.h */
+SYM_TYPED_FUNC_START_ALIGNED(imx6_suspend, 8)
ldr r1, [r0, #PM_INFO_PBASE_OFFSET]
ldr r2, [r0, #PM_INFO_RESUME_ADDR_OFFSET]
ldr r3, [r0, #PM_INFO_DDR_TYPE_OFFSET]
@@ -329,4 +331,4 @@ resume:
resume_mmdc
ret lr
-ENDPROC(imx6_suspend)
+SYM_FUNC_END(imx6_suspend)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0064/1257] bpf: Fix queue/stack map u32 index overflow
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0063/1257] ARM: imx: Fix suspend/resume crash with Clang CFI Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0065/1257] hte: tegra194: Initialize slice locks before registering chip Greg Kroah-Hartman
` (934 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuan Chen, Andrii Nakryiko,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Chen <chenyuan@kylinos.cn>
[ Upstream commit 802a30c5db726639df7f93b3a1982ecc64202abe ]
The queue/stack map addresses elements[] with the product of a u32
head/tail index and value_size, but the storage itself is allocated in
64-bit arithmetic. When max_entries * value_size reaches or exceeds
U32_MAX, the product wraps and push/peek/pop operate on the wrong
element, corrupting map data and leaking stale values to user space.
max_entries == U32_MAX would also make the u32 capacity counter
qs->size (max_entries + 1) wrap to 0 and permanently break the map.
The original bound check was removed by commit a37fb7ef24a4 ("bpf:
Eliminate rlimit-based memory accounting for queue_stack_maps maps"),
which deleted the bpf_map_charge_init() call and with it the
U32_MAX - PAGE_SIZE check that had earlier been moved into
bpf_map_charge_init() by c85d69135a91. Oversized queue/stack maps can
therefore be created again.
Restore the bound in queue_stack_map_alloc_check() with a single
comparison that rejects any max_entries/value_size combination whose
element storage would reach or exceed U32_MAX bytes, keeping the u32
index multiplication overflow-free and the capacity counter valid.
Fixes: a37fb7ef24a4 ("bpf: Eliminate rlimit-based memory accounting for queue_stack_maps maps")
Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20260831063226.621309-2-chenyuan_fl@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/queue_stack_maps.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c
index 6e8b18c32a106..1cee2ba6e332b 100644
--- a/kernel/bpf/queue_stack_maps.c
+++ b/kernel/bpf/queue_stack_maps.c
@@ -59,6 +59,9 @@ static int queue_stack_map_alloc_check(union bpf_attr *attr)
*/
return -E2BIG;
+ if (attr->max_entries >= U32_MAX / attr->value_size)
+ return -E2BIG;
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0065/1257] hte: tegra194: Initialize slice locks before registering chip
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0064/1257] bpf: Fix queue/stack map u32 index overflow Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0066/1257] media: i2c: cvs: Add sensor node in bound callback Greg Kroah-Hartman
` (933 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Dipen Patel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 1329abe1bae416ab2cff89c3312d33f745d341c7 ]
Registering the HTE chip publishes its request callbacks to consumers.
Initialize every slice lock before registration so a concurrent HTE
request cannot use an uninitialized lock.
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Fixes: 09574cca6ad6 ("hte: Add Tegra194 HTE kernel provider")
Cc: stable@vger.kernel.org
Acked-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hte/hte-tegra194.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/hte/hte-tegra194.c b/drivers/hte/hte-tegra194.c
index 4a7702b32b24f..1612812abe8f6 100644
--- a/drivers/hte/hte-tegra194.c
+++ b/drivers/hte/hte-tegra194.c
@@ -910,17 +910,17 @@ static int tegra_hte_probe(struct platform_device *pdev)
hte_dev->chip = gc;
+ for (i = 0; i < slices; i++) {
+ hte_dev->sl[i].flags = 0;
+ spin_lock_init(&hte_dev->sl[i].s_lock);
+ }
+
ret = devm_hte_register_chip(hte_dev->chip);
if (ret) {
dev_err(gc->dev, "hte chip register failed");
return ret;
}
- for (i = 0; i < slices; i++) {
- hte_dev->sl[i].flags = 0;
- spin_lock_init(&hte_dev->sl[i].s_lock);
- }
-
val = HTE_TECTRL_ENABLE_ENABLE |
(HTE_TECTRL_INTR_ENABLE << HTE_TECTRL_INTR_SHIFT) |
(hte_dev->itr_thrshld << HTE_TECTRL_OCCU_SHIFT);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0066/1257] media: i2c: cvs: Add sensor node in bound callback
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0065/1257] hte: tegra194: Initialize slice locks before registering chip Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0067/1257] arm64: dts: qcom: sdm845-google: Set i2c3 frequency to 400 kHz Greg Kroah-Hartman
` (932 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Antti Laakso, Sakari Ailus,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antti Laakso <antti.laakso@linux.intel.com>
[ Upstream commit 7456b40bc992a3fc34b587545716729923d507b9 ]
Sensor device nodes are created in the complete callback, which is only
called when all devices are successfully registered. If any device fails
to register, e.g. due to a missing driver, the complete callback is
never invoked and sensor nodes are not created.
Create sensor device nodes in the bound callback instead, ensuring they
are available as soon as sensor is bound regardless of other devices
registration status.
Fixes: 8e2b43d2c10b ("media: i2c: cvs: Add driver of Intel Computer Vision Sensing Controller(CVS)")
Cc: stable@vger.kernel.org
Signed-off-by: Antti Laakso <antti.laakso@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/cvs/v4l2.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/media/i2c/cvs/v4l2.c b/drivers/media/i2c/cvs/v4l2.c
index 9fadca7a3beed..863112cde2665 100644
--- a/drivers/media/i2c/cvs/v4l2.c
+++ b/drivers/media/i2c/cvs/v4l2.c
@@ -13,6 +13,7 @@
#include <media/v4l2-async.h>
#include <media/v4l2-common.h>
#include <media/v4l2-ctrls.h>
+#include <media/v4l2-device.h>
#include <media/v4l2-event.h>
#include <media/v4l2-fwnode.h>
#include <media/v4l2-mc.h>
@@ -400,7 +401,7 @@ static int cvs_csi_notify_bound(struct v4l2_async_notifier *notifier,
struct v4l2_async_connection *asc)
{
struct icvs *ctx = notifier_to_csi(notifier);
- int pad;
+ int pad, ret;
pad = media_entity_get_fwnode_pad(&sd->entity, asc->match.fwnode,
MEDIA_PAD_FL_SOURCE);
@@ -409,9 +410,13 @@ static int cvs_csi_notify_bound(struct v4l2_async_notifier *notifier,
ctx->remote = &sd->entity.pads[pad];
- return media_create_pad_link(&sd->entity, pad, &ctx->subdev.entity,
- ICVS_CSI_PAD_SINK, MEDIA_LNK_FL_ENABLED |
- MEDIA_LNK_FL_IMMUTABLE);
+ ret = media_create_pad_link(&sd->entity, pad, &ctx->subdev.entity,
+ ICVS_CSI_PAD_SINK, MEDIA_LNK_FL_ENABLED |
+ MEDIA_LNK_FL_IMMUTABLE);
+ if (ret)
+ return ret;
+
+ return v4l2_device_register_subdev_nodes(sd->v4l2_dev);
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0067/1257] arm64: dts: qcom: sdm845-google: Set i2c3 frequency to 400 kHz
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0066/1257] media: i2c: cvs: Add sensor node in bound callback Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0068/1257] clk: mediatek: Add missing depend for COMMON_CLK_MT8173 Greg Kroah-Hartman
` (931 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg, Bjorn Andersson,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
[ Upstream commit a317bee7cd894188d99b4edd841744f70ed9cd8c ]
The Device Tree found in the downstream kernel for this device doesn't
explicitly set a bus frequency, resulting in 400 kHz being chosen.
This upstream DT also lacks it, however that results in a different
default value of 100 kHz. Set it to 400 explicitly to match the
downstream kernel.
Cc: stable@vger.kernel.org
Fixes: 10f91b0dfaf6 ("arm64: dts: qcom: sdm845-google-common: Enable NFC")
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://lore.kernel.org/r/20260902-sdm670-sargo-nfc-v1-1-bed1cbbffc46@ixit.cz
[bjorn: Updated commit message based on suggestion from Konrad]
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845-google-common.dtsi | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-google-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-google-common.dtsi
index 9e952f9862f24..f73d4ea57705f 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-google-common.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-google-common.dtsi
@@ -392,6 +392,8 @@ &gpu_zap_shader {
};
&i2c3 {
+ clock-frequency = <400000>;
+
status = "okay";
nfc@28 {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0068/1257] clk: mediatek: Add missing depend for COMMON_CLK_MT8173
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0067/1257] arm64: dts: qcom: sdm845-google: Set i2c3 frequency to 400 kHz Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0069/1257] wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup() Greg Kroah-Hartman
` (930 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Ribalda, Chen-Yu Tsai,
Brian Masney, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 84964d0ce3faed815e1b8e048ce5ce1c93badb18 ]
PM_GENERIC_DOMAINS_OF depends on OF, by adding a select to it without
adding a depend on OF, the following warning is triggered:
WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS_OF
Depends on [n]: PM_GENERIC_DOMAINS [=y] && OF [=n]
Selected by [y]:
- COMMON_CLK_MT8173_MFGTOP [=y] && COMMON_CLK [=y] && (ARCH_MEDIATEK || COMPILE_TEST [=y]) && COMMON_CLK_MT8173 [=y] && PM [=y]
This patch explicitly adds a dependency on OF to solve this issue.
Cc: stable@vger.kernel.org
Fixes: ebd0b73d2137 ("clk: mediatek: Add mt8173-mfgtop driver")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/mediatek/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/mediatek/Kconfig b/drivers/clk/mediatek/Kconfig
index b059d44577f1e..ba1ca9c90dbf1 100644
--- a/drivers/clk/mediatek/Kconfig
+++ b/drivers/clk/mediatek/Kconfig
@@ -541,6 +541,7 @@ config COMMON_CLK_MT8173_MFGTOP
tristate "Clock and power driver for MediaTek MT8173 mfgtop"
depends on COMMON_CLK_MT8173
depends on PM
+ depends on OF
default COMMON_CLK_MT8173
select PM_GENERIC_DOMAINS
select PM_GENERIC_DOMAINS_OF
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0069/1257] wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0068/1257] clk: mediatek: Add missing depend for COMMON_CLK_MT8173 Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0070/1257] media: i2c: ov8856 : remove ACPI node bypass mechanism Greg Kroah-Hartman
` (929 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang, Abdun Nihaal,
Rameshkumar Sundaram, Jeff Johnson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[ Upstream commit 6132d70d0890c03546f6970893fd71938efb2a2f ]
In ath11k_dp_srng_setup(), the memory allocated for
ring->vaddr_unaligned is not freed in the error paths that follow.
Fix that by calling ath11k_dp_srng_cleanup() in those error paths.
Compile tested only. Issue found using a prototype static analysis tool
built on the LLVM compiler infrastructure.
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260801114911.91483-1-nihaal@cse.iitm.ac.in
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/dp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/ath/ath11k/dp.c b/drivers/net/wireless/ath/ath11k/dp.c
index f389b97acbdd5..be65d73b904b6 100644
--- a/drivers/net/wireless/ath/ath11k/dp.c
+++ b/drivers/net/wireless/ath/ath11k/dp.c
@@ -313,6 +313,7 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,
case HAL_RXDMA_DIR_BUF:
break;
default:
+ ath11k_dp_srng_cleanup(ab, ring);
ath11k_warn(ab, "Not a valid ring type in dp :%d\n", type);
return -EINVAL;
}
@@ -324,6 +325,7 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,
ret = ath11k_hal_srng_setup(ab, type, ring_num, mac_id, ¶ms);
if (ret < 0) {
+ ath11k_dp_srng_cleanup(ab, ring);
ath11k_warn(ab, "failed to setup srng: %d ring_id %d\n",
ret, ring_num);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0070/1257] media: i2c: ov8856 : remove ACPI node bypass mechanism
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0069/1257] wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup() Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0071/1257] media: i2c: ov8856: fix debug message to report actual CSI-2 lane count Greg Kroah-Hartman
` (928 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Serin Yeh, Bryan ODonoghue,
Kieran Bingham, Sakari Ailus, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serin Yeh <serin.yeh@intel.com>
[ Upstream commit 609a71568664acb7ee57b42de002ca782e3769e8 ]
On Intel platforms the sensor is enumerated via ACPI, and an INT3472
"discrete" companion device (the power-logic-control driver under
drivers/platform/x86/intel/int3472) registers the sensor's
reset/powerdown GPIOs and the regulator supply. These resources are
therefore discoverable and usable through the standard gpiod/regulator
lookups at probe time.
However, the driver guarded both the GPIO/regulator acquisition in
ov8856_get_hwcfg() and the whole power-on/off sequence with
is_acpi_node() and skipped them on ACPI. As a result the sensor was
never powered or reset by the driver, and probe failed when reading the
chip ID in ov8856_identify_module().
Remove the is_acpi_node() checks so the GPIO/regulator resources are
acquired and the full power sequence runs regardless of the firmware
interface. The driver now behaves consistently across DT and ACPI
platforms and initialises the hardware correctly.
Tested on Intel platforms with kernel 6.17 and 7.0.
Fixes: d2fa1134a48b ("media: i2c: ov8856: Use V4L2 legacy sensor clock helper")
Cc: stable@vger.kernel.org
Signed-off-by: Serin Yeh <serin.yeh@intel.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov8856.c | 29 ++++++++++-------------------
1 file changed, 10 insertions(+), 19 deletions(-)
diff --git a/drivers/media/i2c/ov8856.c b/drivers/media/i2c/ov8856.c
index 8bedb47cd7cf6..9d2b0469a5761 100644
--- a/drivers/media/i2c/ov8856.c
+++ b/drivers/media/i2c/ov8856.c
@@ -2082,9 +2082,6 @@ static int ov8856_power_on(struct device *dev)
struct ov8856 *ov8856 = to_ov8856(sd);
int ret;
- if (is_acpi_node(dev_fwnode(dev)))
- return 0;
-
ret = clk_prepare_enable(ov8856->xvclk);
if (ret < 0) {
dev_err(dev, "failed to enable xvclk\n");
@@ -2120,9 +2117,6 @@ static int ov8856_power_off(struct device *dev)
struct v4l2_subdev *sd = dev_get_drvdata(dev);
struct ov8856 *ov8856 = to_ov8856(sd);
- if (is_acpi_node(dev_fwnode(dev)))
- return 0;
-
gpiod_set_value_cansleep(ov8856->reset_gpio, 1);
regulator_bulk_disable(ARRAY_SIZE(ov8856_supply_names),
ov8856->supplies);
@@ -2293,21 +2287,18 @@ static int ov8856_get_hwcfg(struct ov8856 *ov8856)
dev_warn(dev, "external clock rate %u is unsupported",
xvclk_rate);
- if (!is_acpi_node(fwnode)) {
- ov8856->reset_gpio = devm_gpiod_get_optional(dev, "reset",
- GPIOD_OUT_LOW);
- if (IS_ERR(ov8856->reset_gpio))
- return PTR_ERR(ov8856->reset_gpio);
+ ov8856->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+ GPIOD_OUT_LOW);
+ if (IS_ERR(ov8856->reset_gpio))
+ return PTR_ERR(ov8856->reset_gpio);
- for (i = 0; i < ARRAY_SIZE(ov8856_supply_names); i++)
- ov8856->supplies[i].supply = ov8856_supply_names[i];
+ for (i = 0; i < ARRAY_SIZE(ov8856_supply_names); i++)
+ ov8856->supplies[i].supply = ov8856_supply_names[i];
- ret = devm_regulator_bulk_get(dev,
- ARRAY_SIZE(ov8856_supply_names),
- ov8856->supplies);
- if (ret)
- return ret;
- }
+ ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(ov8856_supply_names),
+ ov8856->supplies);
+ if (ret)
+ return ret;
ep = fwnode_graph_get_next_endpoint(fwnode, NULL);
if (!ep)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0071/1257] media: i2c: ov8856: fix debug message to report actual CSI-2 lane count
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0070/1257] media: i2c: ov8856 : remove ACPI node bypass mechanism Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0072/1257] PCI: rcar-gen4: Limit Max_Read_Request_Size to 256 Bytes Greg Kroah-Hartman
` (927 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Serin Yeh, Kieran Bingham,
Sakari Ailus, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serin Yeh <serin.yeh@intel.com>
[ Upstream commit a15976e69b1c70ea16ef1f7172a846f6ef5dfa14 ]
The driver currently prints the number of data lanes using
ov8856->cur_mode->data_lanes in ov8856_get_hwcfg(). However,
the ov8856->cur_mode structure is not assigned to a clearly
supported mode at that point. Due to the missing pointer,
enabling dynamic debug may lead to a kernel panic.
Instead, the correct number of CSI-2 data lanes should be taken
from bus_cfg.bus.mipi_csi2.num_data_lanes, which represents the
real hardware configuration determined at runtime.
Fixes: c492ec9ae9ed ("media: ov8856: Add support for 2 data lanes")
Cc: stable@vger.kernel.org
Signed-off-by: Serin Yeh <serin.yeh@intel.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov8856.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov8856.c b/drivers/media/i2c/ov8856.c
index 9d2b0469a5761..6011233a218d4 100644
--- a/drivers/media/i2c/ov8856.c
+++ b/drivers/media/i2c/ov8856.c
@@ -2318,7 +2318,8 @@ static int ov8856_get_hwcfg(struct ov8856 *ov8856)
goto check_hwcfg_error;
}
- dev_dbg(dev, "Using %u data lanes\n", ov8856->cur_mode->data_lanes);
+ dev_dbg(dev, "Using %u data lanes\n",
+ bus_cfg.bus.mipi_csi2.num_data_lanes);
if (bus_cfg.bus.mipi_csi2.num_data_lanes == 2)
ov8856->priv_lane = &lane_cfg_2;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0072/1257] PCI: rcar-gen4: Limit Max_Read_Request_Size to 256 Bytes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0071/1257] media: i2c: ov8856: fix debug message to report actual CSI-2 lane count Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0073/1257] mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table Greg Kroah-Hartman
` (926 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Manivannan Sadhasivam,
Bjorn Helgaas, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit f0a5c6bd797c2b9900034983a1118d27eb2f2f16 ]
R-Car Gen4 PCIe controller has a hardware limitation of 256 Bytes
Max_Payload_Size (MPS). PCIe specification indicates that the MPS must not
exceed minimum MPS of any element along the packet path. The PCI core
already enforces this, but add a check to warn if MPS is ever set larger
than 256.
R-Car Gen4 Reference Manual, chapter 104.4.8 Usage notes for MRRS (Max Read
Request Size) states:
Please set "Max Read Request Size" to 128 bytes or 256 bytes.
If "Max Read Request Size" is set to anything other than the
above, the transferred data will not match the expected value.
This limitation also seems to apply to devices doing DMA reads, i.e.,
issuing MRd TLPs. This limitation can be triggered by using non-HMB NVMe
SSD with Max_Read_Request_Size 512 Bytes, for example Crucial P5 Plus. Any
write to the SSD (MRd TLP issued by the SSD controller) longer than 256
Bytes wraps around at the 256 Byte boundary, and the same data are written
to the SSD starting at offset 0 and at 256 Bytes.
Limit Max_Read_Request_Size to at most 256 Bytes for each device connected
to this PCIe controller to avoid this behavior.
A non-HMB (Host Memory Buffer) NVMe SSD can be identified using the
following command. Affected SSD reports 'hmpre' field as 0:
$ nvme id-ctrl /dev/nvme0 | grep hmpre
hmpre : 0
The symptom is a read from the SSD which wraps around at 256 Byte boundary.
The test for this symptom can be implemented by writing 512 Byte of random
data into the SSD and reading the data back. If the read back data repeat
after 256 Bytes, the device is affected.
$ dd if=/dev/urandom of=/tmp/data.bin bs=256 count=2 ; \
dd if=/tmp/data.bin of=/dev/nvme0n1 bs=256 count=2 ; \
dd if=/dev/nvme0n1 bs=256 count=2 of=/tmp/readback.bin
Expected data:
$ hexdump -vC /tmp/data.bin
00000000 97 81 b7 3b 0e 38 2b 4d a7 d3 e0 47 ff c2 4b ca
00000010 c1 85 98 f0 4a ac 03 a0 3b ab f3 19 44 dd 06 8b
...
00000100 7a ce 3c b2 e1 d5 d9 11 88 63 10 59 76 3c dc 32 <-- random
00000110 72 32 2a 7d a3 e1 aa 13 7c da 58 a1 7b 21 11 50 <-- data
Faulty readback, collected without this change in place:
$ hexdump -vC /tmp/readback.bin
00000000 97 81 b7 3b 0e 38 2b 4d a7 d3 e0 47 ff c2 4b ca <---.
00000010 c1 85 98 f0 4a ac 03 a0 3b ab f3 19 44 dd 06 8b <-. |
... | |
00000100 97 81 b7 3b 0e 38 2b 4d a7 d3 e0 47 ff c2 4b ca <-:-+- repeated
00000110 c1 85 98 f0 4a ac 03 a0 3b ab f3 19 44 dd 06 8b <-+--- data
^^^
|
'--- Repeat starts at offset 0x100 = 256 Bytes
Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260821020636.111719-1-marek.vasut+renesas@mailbox.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-rcar-gen4.c | 54 +++++++++++++++++++++
1 file changed, 54 insertions(+)
diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
index fbe465a29068f..241adcd727894 100644
--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
@@ -411,6 +411,57 @@ static int rcar_gen4_pcie_host_msi_init(struct dw_pcie_rp *pp)
return ret;
}
+static int rcar_gen4_pcie_enable_device(struct pci_host_bridge *bridge,
+ struct pci_dev *dev)
+{
+ /*
+ * R-Car Gen4 PCIe controller has a hardware limitation of 256 Bytes
+ * Max_Payload_Size (MPS). PCIe specification indicates that the MPS
+ * must not exceed minimum MPS of any element along the packet path.
+ * The controller reports Max_Payload_Size_Supported (MPSS) 256 Bytes
+ * for header type 0 and 128 Bytes for header type 1. The PCIe core
+ * will not allow MPS to be set higher than MPSS; warn here in case
+ * something went very wrong in the core.
+ *
+ * For details, refer to chapter "104.1.1 Features" in either of:
+ * R-Car S4 R19UH0161EJ0140 Rev.1.40 Jul. 31, 2026 or
+ * R-Car V4H R19UH0186EJ0140 Rev.1.40 Aug. 7, 2026 or
+ * R-Car V4M R19UH0217EJ0110 Rev.1.10 Jun. 30, 2026.
+ */
+ WARN_ON(pcie_get_mps(dev) > 256);
+
+ /*
+ * R-Car Gen4 Reference Manual, chapter 104.4.8 Usage notes for
+ * MRRS (Max Read Request Size) states:
+ *
+ * Please set "Max Read Request Size" to 128 bytes or 256 bytes.
+ * If "Max Read Request Size" is set to anything other than the
+ * above, the transferred data will not match the expected value.
+ *
+ * This limitation also seems to apply to devices issuing MRd TLPs.
+ * This limitation can be triggered by using non-HMB NVMe SSD with
+ * Max_Read_Request_Size 512 Bytes, for example Crucial P5 Plus.
+ * Any write into the SSD (MRd TLP issued by the SSD) longer than
+ * 256 Bytes wraps around at 256 Byte boundary, and the same data
+ * are written into the SSD starting at offset 0 and at 256 Bytes.
+ *
+ * Limit Max_Read_Request_Size to at most 256 Bytes for each
+ * device connected to this PCIe controller to avoid this behavior.
+ *
+ * For details, refer to aforementioned chapter in either of:
+ * R-Car S4 R19UH0161EJ0140 Rev.1.40 Jul. 31, 2026 or
+ * R-Car V4H R19UH0186EJ0140 Rev.1.40 Aug. 7, 2026 or
+ * R-Car V4M R19UH0217EJ0110 Rev.1.10 Jun. 30, 2026.
+ */
+ bridge->no_inc_mrrs = 1;
+ if (pcie_get_readrq(dev) > 256) {
+ pci_info(dev, "Limiting MRRS to 256 bytes\n");
+ pcie_set_readrq(dev, 256);
+ }
+
+ return 0;
+}
+
/* Host mode */
static int rcar_gen4_pcie_host_init(struct dw_pcie_rp *pp)
{
@@ -418,6 +469,9 @@ static int rcar_gen4_pcie_host_init(struct dw_pcie_rp *pp)
struct rcar_gen4_pcie *rcar = to_rcar_gen4_pcie(dw);
int ret;
+ if (pp->bridge)
+ pp->bridge->enable_device = rcar_gen4_pcie_enable_device;
+
gpiod_set_value_cansleep(dw->pe_rst, 1);
ret = rcar_gen4_pcie_common_init(rcar);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0073/1257] mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0072/1257] PCI: rcar-gen4: Limit Max_Read_Request_Size to 256 Bytes Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0074/1257] mtd: spi-nor: sfdp: check the length of the SCCR map Greg Kroah-Hartman
` (925 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, HyeongJun An, Michael Walle,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit b9f34a95a81021fa1f3c9cb8cfd458e66824cad6 ]
The spi_nor_parse_profile1() sizes its buffer from the table length the
flash reports in the SFDP parameter header. But it then reads DWORD1,
DWORD4 and DWORD5 without ever checking the table is that long.
So if a flash reports a length of one, the buffer is only four bytes
while DWORD4 and DWORD5 sit at byte offsets 12 and 16. With a length of
zero kmalloc() returns ZERO_SIZE_PTR rather than an error, so the NULL
check doesn't catch it and the first read dereferences it. And the value
doesn't just get thrown away. It ends up as the dummy cycle count for
8D-8D-8D fast reads.
To fix this, reject a table that's too short for the highest DWORD the
parser reads, the way spi_nor_parse_4bait() already does. The table is
optional, so this isn't fatal. The spi_nor_parse_sfdp() warns and
carries on.
Fixes: fb27f198971a ("mtd: spi-nor: sfdp: parse xSPI Profile 1.0 table")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/spi-nor/sfdp.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
index 4600983cb5799..ece8bbd4bc47d 100644
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -1175,6 +1175,7 @@ static int spi_nor_parse_4bait(struct spi_nor *nor,
#define PROFILE1_DWORD5_DUMMY_166MHZ GENMASK(31, 27)
#define PROFILE1_DWORD5_DUMMY_133MHZ GENMASK(21, 17)
#define PROFILE1_DWORD5_DUMMY_100MHZ GENMASK(11, 7)
+#define SFDP_PROFILE1_DWORD_MIN 5
/**
* spi_nor_parse_profile1() - parse the xSPI Profile 1.0 table
@@ -1192,6 +1193,9 @@ static int spi_nor_parse_profile1(struct spi_nor *nor,
int ret;
u8 dummy, opcode;
+ if (profile1_header->length < SFDP_PROFILE1_DWORD_MIN)
+ return -EINVAL;
+
len = profile1_header->length * sizeof(*dwords);
dwords = kmalloc(len, GFP_KERNEL);
if (!dwords)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0074/1257] mtd: spi-nor: sfdp: check the length of the SCCR map
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0073/1257] mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0075/1257] mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption Greg Kroah-Hartman
` (924 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, HyeongJun An, Michael Walle,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit 1413f38f37194673502e61cd3749e091c031370b ]
The spi_nor_parse_sccr() sizes its buffer from the table length the
flash reports in the SFDP parameter header. But it then reads DWORD1
and DWORD22 without ever checking the table is that long.
So if a flash reports a length of one, the buffer is only four bytes
while DWORD22 sits at byte offset 84. With a length of zero kmalloc()
returns ZERO_SIZE_PTR rather than an error, so the NULL check doesn't
catch it and the first read dereferences it.
To fix this, reject a table that's too short for the highest DWORD the
parser reads, the way spi_nor_parse_4bait() already does. The table is
optional, so this isn't fatal. The spi_nor_parse_sfdp() warns and
carries on.
The spi_nor_parse_sccr_mc() doesn't need the same check. It works out
the number of dice from the length it allocated with, so its highest
index stays inside the buffer.
Fixes: 7ab8b810757a ("mtd: spi-nor: sfdp: Add support for SCCR map for multi-chip device")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/spi-nor/sfdp.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
index ece8bbd4bc47d..98559536d41b2 100644
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -1266,6 +1266,7 @@ static int spi_nor_parse_profile1(struct spi_nor *nor,
}
#define SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE BIT(31)
+#define SFDP_SCCR_DWORD_MIN 22
/**
* spi_nor_parse_sccr() - Parse the Status, Control and Configuration Register
@@ -1284,6 +1285,9 @@ static int spi_nor_parse_sccr(struct spi_nor *nor,
size_t len;
int ret;
+ if (sccr_header->length < SFDP_SCCR_DWORD_MIN)
+ return -EINVAL;
+
len = sccr_header->length * sizeof(*dwords);
dwords = kmalloc(len, GFP_KERNEL);
if (!dwords)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0075/1257] mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0074/1257] mtd: spi-nor: sfdp: check the length of the SCCR map Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0076/1257] fs_pin: publish pins with RCU list helpers Greg Kroah-Hartman
` (923 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Michael Walle,
Tudor Ambarus, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <miquel.raynal@bootlin.com>
[ Upstream commit f594a33f9721f08facd98d0a31adc14ff6da9d70 ]
All the parallel locking helpers (spi_nor_prep_and_lock(),
spi_nor_prep_and_lock_pe() and spi_nor_prep_and_lock_rd()) call
spi_nor_prep() then wait with a killable sleep. If the sleep gets
killed, we leave the controller in its prepared state.
Call ->unprepare() in these cases.
Fixes: 74df43b3f626 ("mtd: spi-nor: Enhance locking to support reads while writes")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Acked-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/spi-nor/core.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index 8bc117b46e028..250e996284f96 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -1346,6 +1346,9 @@ int spi_nor_prep_and_lock(struct spi_nor *nor)
ret = wait_event_killable(nor->rww.wait,
spi_nor_rww_start_exclusive(nor));
+ if (ret)
+ spi_nor_unprep(nor);
+
return ret;
}
@@ -1417,6 +1420,9 @@ static int spi_nor_prep_and_lock_pe(struct spi_nor *nor, loff_t start, size_t le
ret = wait_event_killable(nor->rww.wait,
spi_nor_rww_start_pe(nor, start, len));
+ if (ret)
+ spi_nor_unprep(nor);
+
return ret;
}
@@ -1490,6 +1496,9 @@ static int spi_nor_prep_and_lock_rd(struct spi_nor *nor, loff_t start, size_t le
ret = wait_event_killable(nor->rww.wait,
spi_nor_rww_start_rd(nor, start, len));
+ if (ret)
+ spi_nor_unprep(nor);
+
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0076/1257] fs_pin: publish pins with RCU list helpers
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0075/1257] mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0077/1257] fs: make sure to call fsnotify_inoderemove() only once when inode is dead Greg Kroah-Hartman
` (922 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Jan Kara,
Christian Brauner (Amutable), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 8d01d6b4c17c406f37a9b6edac93dfb858af30d0 ]
pin_insert() initializes a pin before adding it under pin_lock. The kill
paths read the list heads under RCU without taking that lock. Plain hlist
insertion does not publish the earlier initialization to those readers.
KCSAN weak-memory checking reported acct_on() callback initialization
racing with pin_kill() after the superblock-list publication. The
corresponding LKMM model permits the stale read with plain publication;
the RCU release/acquire pair forbids it.
Use the RCU hlist add and dereference helpers for both pin lists.
Fixes: 2798d4ce6160 ("acct: get rid of acct_lock for acct->count")
Cc: stable@vger.kernel.org
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260903002100.34822-1-kmehltretter@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fs_pin.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/fs/fs_pin.c b/fs/fs_pin.c
index 47ef3c71ce907..1a508f2167e0a 100644
--- a/fs/fs_pin.c
+++ b/fs/fs_pin.c
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0
#include <linux/fs.h>
+#include <linux/rculist.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include "internal.h"
@@ -22,8 +23,8 @@ void pin_remove(struct fs_pin *pin)
void pin_insert(struct fs_pin *pin, struct vfsmount *m)
{
spin_lock(&pin_lock);
- hlist_add_head(&pin->s_list, &m->mnt_sb->s_pins);
- hlist_add_head(&pin->m_list, &real_mount(m)->mnt_pins);
+ hlist_add_head_rcu(&pin->s_list, &m->mnt_sb->s_pins);
+ hlist_add_head_rcu(&pin->m_list, &real_mount(m)->mnt_pins);
spin_unlock(&pin_lock);
}
@@ -73,7 +74,7 @@ void mnt_pin_kill(struct mount *m)
while (1) {
struct hlist_node *p;
rcu_read_lock();
- p = READ_ONCE(m->mnt_pins.first);
+ p = rcu_dereference(hlist_first_rcu(&m->mnt_pins));
if (!p) {
rcu_read_unlock();
break;
@@ -87,7 +88,7 @@ void group_pin_kill(struct hlist_head *p)
while (1) {
struct hlist_node *q;
rcu_read_lock();
- q = READ_ONCE(p->first);
+ q = rcu_dereference(hlist_first_rcu(p));
if (!q) {
rcu_read_unlock();
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0077/1257] fs: make sure to call fsnotify_inoderemove() only once when inode is dead
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0076/1257] fs_pin: publish pins with RCU list helpers Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0078/1257] arm64: dts: ti: k3-am62-verdin: Set MMC clock pins as OUTPUT Greg Kroah-Hartman
` (921 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amir Goldstein, Jan Kara,
Christian Brauner (Amutable), Sasha Levin, Daehyeon Ko
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <amir73il@gmail.com>
[ Upstream commit 669bb5af15d41a21359d00a441490f87a88eb52a ]
Daehyeon reported a race wherein fsnotify_removeinode() can be called
when inode still has a live alias. This can lead to several undesired
outcomes such as crashes in fsnotify code or avoidance of inode mark
notifications.
Check that inode is really "dead", meaning no nlink and no more aliases
before calling fsnotify_inoderemove() for final cleanup of inode marks.
Also do not allow open_by_handle() to add new aliases to a "dead" inode.
Ideally, we'd call fsnotify_inoderemove() once last inode reference is
dropped to make things simpler. Alas fsnotify inode marks currently hold
inode references and thus this doesn't work. Once we teach fsnotify to
avoid holding inode references, these games with dead inodes can go as
well.
Reported-and-tested-by: Daehyeon Ko <4ncienth@gmail.com>
Closes: https://lore.kernel.org/linux-fsdevel/20260827045007.3831259-1-4ncienth@gmail.com/
CC: stable@vger.kernel.org
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260902164924.1333135-2-jack@suse.cz
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dcache.c | 27 ++++++++++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
diff --git a/fs/dcache.c b/fs/dcache.c
index f44c7b39c3b38..2eb23222be549 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -450,6 +450,17 @@ static void dentry_free(struct dentry *dentry)
call_rcu(&dentry->d_rcu, __d_free);
}
+/*
+ * If inode is unlinked and doesn't have any aliases (i.e., all fds pointing to
+ * it are closed), it is pretty much dead. Except that file handle lookup could
+ * still revive it which causes issues to fsnotify. So once inode reaches this
+ * state we make sure to block creating any new aliases.
+ */
+static bool inode_notify_dead(struct inode *inode)
+{
+ return !inode->i_nlink && hlist_empty(&inode->i_dentry);
+}
+
/*
* Release the dentry's inode, using the filesystem
* d_iput() operation if defined.
@@ -459,6 +470,7 @@ static void dentry_unlink_inode(struct dentry * dentry)
__releases(dentry->d_inode->i_lock)
{
struct inode *inode = dentry->d_inode;
+ bool notify_dead;
raw_write_seqcount_begin(&dentry->d_seq);
__d_clear_type_and_inode(dentry);
@@ -469,9 +481,10 @@ static void dentry_unlink_inode(struct dentry * dentry)
*/
dentry->waiters = NULL;
raw_write_seqcount_end(&dentry->d_seq);
+ notify_dead = inode_notify_dead(inode);
spin_unlock(&dentry->d_lock);
spin_unlock(&inode->i_lock);
- if (!inode->i_nlink)
+ if (notify_dead)
fsnotify_inoderemove(inode);
if (dentry->d_op && dentry->d_op->d_iput)
dentry->d_op->d_iput(dentry, inode);
@@ -2243,7 +2256,12 @@ static struct dentry *__d_obtain_alias(struct inode *inode, bool disconnected)
sb = inode->i_sb;
- res = d_find_any_alias(inode); /* existing alias? */
+ spin_lock(&inode->i_lock);
+ if (!inode_notify_dead(inode))
+ res = __d_find_any_alias(inode); /* existing alias? */
+ else
+ res = ERR_PTR(-ESTALE);
+ spin_unlock(&inode->i_lock);
if (res)
goto out;
@@ -2255,7 +2273,10 @@ static struct dentry *__d_obtain_alias(struct inode *inode, bool disconnected)
security_d_instantiate(new, inode);
spin_lock(&inode->i_lock);
- res = __d_find_any_alias(inode); /* recheck under lock */
+ if (!inode_notify_dead(inode))
+ res = __d_find_any_alias(inode); /* recheck under lock */
+ else
+ res = ERR_PTR(-ESTALE);
if (likely(!res)) { /* still no alias, attach a disconnected dentry */
unsigned add_flags = d_flags_for_inode(inode);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0078/1257] arm64: dts: ti: k3-am62-verdin: Set MMC clock pins as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0077/1257] fs: make sure to call fsnotify_inoderemove() only once when inode is dead Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0079/1257] thermal: intel: powerclamp: Reject invalid window_size values Greg Kroah-Hartman
` (920 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Judith Mendez,
Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 0ddd661c19ec1465e1f2c204fa9b2488acfabf4b ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
Link: https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals [0]
Fixes: 316b80246b16 ("arm64: dts: ti: add verdin am62")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Judith Mendez <jm@ti.com>
Link: https://patch.msgid.link/20260813111238.56892-1-francesco@dolcini.it
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
index e97b2b047d104..895b1b7dcac71 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
@@ -573,7 +573,7 @@ AM62X_IOPAD(0x15c, PIN_INPUT, 0) /* (AB22) MDIO0_MDIO */ /* ETH_1_MDIO, SODIMM
pinctrl_sdhci0: main-mmc0-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
- AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+ AM62X_IOPAD(0x218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */
@@ -589,7 +589,7 @@ AM62X_IOPAD(0x1f8, PIN_INPUT_PULLUP, 0) /* (AC2) MMC0_DAT7 */
pinctrl_sdhci1: main-mmc1-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x23c, PIN_INPUT, 0) /* (A21) MMC1_CMD */ /* SODIMM 74 */
- AM62X_IOPAD(0x234, PIN_INPUT, 0) /* (B22) MMC1_CLK */ /* SODIMM 78 */
+ AM62X_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22) MMC1_CLK */ /* SODIMM 78 */
AM62X_IOPAD(0x230, PIN_INPUT, 0) /* (A22) MMC1_DAT0 */ /* SODIMM 80 */
AM62X_IOPAD(0x22c, PIN_INPUT, 0) /* (B21) MMC1_DAT1 */ /* SODIMM 82 */
AM62X_IOPAD(0x228, PIN_INPUT, 0) /* (C21) MMC1_DAT2 */ /* SODIMM 70 */
@@ -601,7 +601,7 @@ AM62X_IOPAD(0x224, PIN_INPUT, 0) /* (D22) MMC1_DAT3 */ /* SODIMM 72 */
pinctrl_sdhci2: main-mmc2-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x120, PIN_INPUT, 0) /* (C24) MMC2_CMD */ /* WiFi_SDIO_CMD */
- AM62X_IOPAD(0x118, PIN_INPUT, 0) /* (D25) MMC2_CLK */ /* WiFi_SDIO_CLK */
+ AM62X_IOPAD(0x118, PIN_OUTPUT,0) /* (D25) MMC2_CLK */ /* WiFi_SDIO_CLK */
AM62X_IOPAD(0x114, PIN_INPUT, 0) /* (B24) MMC2_DAT0 */ /* WiFi_SDIO_DATA0 */
AM62X_IOPAD(0x110, PIN_INPUT, 0) /* (C25) MMC2_DAT1 */ /* WiFi_SDIO_DATA1 */
AM62X_IOPAD(0x10c, PIN_INPUT, 0) /* (E23) MMC2_DAT2 */ /* WiFi_SDIO_DATA2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0079/1257] thermal: intel: powerclamp: Reject invalid window_size values
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0078/1257] arm64: dts: ti: k3-am62-verdin: Set MMC clock pins as OUTPUT Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0080/1257] thermal: intel: int340x: Fix temperature selection around 0 C Greg Kroah-Hartman
` (919 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Rafael J. Wysocki,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit 40989202104e498ff9adfb8c575d6cd159f13988 ]
window_size_set() sets ret to -EINVAL if new_window_size is outside the
valid range, but then falls through and still updates window_size to the
clamped value.
Return -EINVAL immediately and do not update window_size. Also drop the
now-redundant clamp() call.
Fixes: d6d71ee4a14a ("PM: Introduce Intel PowerClamp Driver")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20260815090136.88540-2-thorsten.blum@linux.dev
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/intel/intel_powerclamp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/thermal/intel/intel_powerclamp.c b/drivers/thermal/intel/intel_powerclamp.c
index bd7fd98dc310e..8026651133d5d 100644
--- a/drivers/thermal/intel/intel_powerclamp.c
+++ b/drivers/thermal/intel/intel_powerclamp.c
@@ -289,9 +289,10 @@ static int window_size_set(const char *arg, const struct kernel_param *kp)
pr_err("Out of recommended window size %lu, between 2-10\n",
new_window_size);
ret = -EINVAL;
+ goto exit_win;
}
- window_size = clamp(new_window_size, 2ul, 10ul);
+ window_size = new_window_size;
smp_mb();
exit_win:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0080/1257] thermal: intel: int340x: Fix temperature selection around 0 C
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0079/1257] thermal: intel: powerclamp: Reject invalid window_size values Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0081/1257] mtd: rawnand: ndfc: use devm_platform_ioremap_resource() Greg Kroah-Hartman
` (918 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Srinivas Pandruvada,
Rafael J. Wysocki, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit e56e2b49c67d132728e52ce493079e83cc914657 ]
Since commit 7251b9e8a007 ("thermal/intel: Fix intel_tcc_get_temp() to
support negative CPU temperature"), intel_tcc_get_temp() can report
negative temperatures.
proc_thermal_get_zone_temp() still uses *temp as the current maximum and
as an implicit "no reading yet" marker. However, this breaks when a CPU
reports 0 C, because a subsequent negative reading can overwrite it.
Use bool temp_valid to track whether a valid temperature has been read.
Initialize *temp with the first valid reading and only update it with
warmer readings.
Fixes: 7251b9e8a007 ("thermal/intel: Fix intel_tcc_get_temp() to support negative CPU temperature")
Cc: 6.3+ <stable@vger.kernel.org> # 6.3+
Signed-off-by: Thorsten Blum <blum@kernel.org>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260826153144.299746-3-blum@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../intel/int340x_thermal/processor_thermal_device.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
index f80dbe2ca7e47..b0284c2e2e74d 100644
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
@@ -179,17 +179,21 @@ static int proc_thermal_get_zone_temp(struct thermal_zone_device *zone,
{
int cpu;
int curr_temp, ret;
-
- *temp = 0;
+ bool temp_valid = false;
for_each_online_cpu(cpu) {
ret = intel_tcc_get_temp(cpu, &curr_temp, false);
if (ret < 0)
return ret;
- if (!*temp || curr_temp > *temp)
+ if (!temp_valid || curr_temp > *temp) {
*temp = curr_temp;
+ temp_valid = true;
+ }
}
+ if (!temp_valid)
+ return -ENODATA;
+
*temp *= 1000;
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0081/1257] mtd: rawnand: ndfc: use devm_platform_ioremap_resource()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0080/1257] thermal: intel: int340x: Fix temperature selection around 0 C Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0082/1257] riscv: dts: spacemit: k3: fix IMSIC num-guest-ids Greg Kroah-Hartman
` (917 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rosen Penev, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit 0d66f9895f286d2fab396a71e6efeb95c4a7e5a6 ]
Replace the open-coded of_iomap()/iounmap() with the managed
devm_platform_ioremap_resource() helper. This fixes a mapping leak on
driver remove (the old code never called iounmap()) and simplifies the
error path by dropping the manual cleanup in ndfc_probe().
There is no overlapping memory-region concern introduced by this
change: each supported board DT describes a single ndfc node with a
unique 0x2000 register region, and the EBC parent uses dcr-reg rather
than a MEM reg resource, so the newly added request_mem_region() cannot
conflict with an existing reservation. Distinct chip selects map to
distinct 64-bit physical addresses, so CS instances do not overlap.
Fixes: a808ad3b0d28 ("[MTD] [NAND] ndfc driver")
Cc: stable@vger.kernel.org
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/ndfc.c | 21 ++++++++-------------
1 file changed, 8 insertions(+), 13 deletions(-)
diff --git a/drivers/mtd/nand/raw/ndfc.c b/drivers/mtd/nand/raw/ndfc.c
index a48274297d3b1..d6db04d48c45a 100644
--- a/drivers/mtd/nand/raw/ndfc.c
+++ b/drivers/mtd/nand/raw/ndfc.c
@@ -185,10 +185,15 @@ static int ndfc_chip_init(struct ndfc_controller *ndfc,
static int ndfc_probe(struct platform_device *ofdev)
{
struct ndfc_controller *ndfc;
+ void __iomem *ndfcbase;
const __be32 *reg;
u32 ccr;
u32 cs;
- int err, len = 0;
+ int len = 0;
+
+ ndfcbase = devm_platform_ioremap_resource(ofdev, 0);
+ if (IS_ERR(ndfcbase))
+ return PTR_ERR(ndfcbase);
/* Read the reg property to get the chip select */
reg = of_get_property(ofdev->dev.of_node, "reg", &len);
@@ -210,11 +215,7 @@ static int ndfc_probe(struct platform_device *ofdev)
ndfc->ofdev = ofdev;
dev_set_drvdata(&ofdev->dev, ndfc);
- ndfc->ndfcbase = of_iomap(ofdev->dev.of_node, 0);
- if (!ndfc->ndfcbase) {
- dev_err(&ofdev->dev, "failed to get memory\n");
- return -EIO;
- }
+ ndfc->ndfcbase = ndfcbase;
ccr = NDFC_CCR_BS(ndfc->chip_select);
@@ -232,13 +233,7 @@ static int ndfc_probe(struct platform_device *ofdev)
iowrite32be(be32_to_cpup(reg), ndfc->ndfcbase + offset);
}
- err = ndfc_chip_init(ndfc, ofdev->dev.of_node);
- if (err) {
- iounmap(ndfc->ndfcbase);
- return err;
- }
-
- return 0;
+ return ndfc_chip_init(ndfc, ofdev->dev.of_node);
}
static void ndfc_remove(struct platform_device *ofdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0082/1257] riscv: dts: spacemit: k3: fix IMSIC num-guest-ids
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0081/1257] mtd: rawnand: ndfc: use devm_platform_ioremap_resource() Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0083/1257] isofs: fix Rock Ridge CE extent validation on multisession media Greg Kroah-Hartman
` (916 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guodong Xu, Yixun Lan,
GUO Ren (XuanTie), Junhui Liu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: GUO Ren (XuanTie) <guoren@kernel.org>
[ Upstream commit 69f95409f0053f787ad60175944080621a8b7d95 ]
The initial K3 device tree used generic/placeholder values for the
IMSIC guest configuration:
riscv,num-guest-ids = <511>;
According to the SpacemiT K3 User Manual this values is incorrect
for the X100 cores:
- Advanced Interrupt Architecture (AIA):
- M-mode MSI: 512
- S-mode MSI: 512
- VS-mode MSI: 64
Therefore, S-mode IMSIC (simsic) needs num-guest-ids = 63.
Fixes: 56f37e391a62 ("riscv: dts: spacemit: add initial support for K3 SoC")
Cc: stable@vger.kernel.org
Cc: Guodong Xu <docular.xu@gmail.com>
Cc: Yixun Lan <dlan@kernel.org>
Signed-off-by: GUO Ren (XuanTie) <guoren@kernel.org>
Reviewed-by: Yixun Lan <dlan@kernel.org>
Reviewed-by: Junhui Liu <junhui.liu@pigmoral.tech>
Link: https://patch.msgid.link/20260817033038.2286436-1-guoren@kernel.org
Signed-off-by: Yixun Lan <dlan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/boot/dts/spacemit/k3.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/boot/dts/spacemit/k3.dtsi b/arch/riscv/boot/dts/spacemit/k3.dtsi
index c3f2dce0969c0..f9c2ffedeae80 100644
--- a/arch/riscv/boot/dts/spacemit/k3.dtsi
+++ b/arch/riscv/boot/dts/spacemit/k3.dtsi
@@ -1248,7 +1248,7 @@ simsic: interrupt-controller@e0400000 {
msi-controller;
riscv,guest-index-bits = <6>;
riscv,hart-index-bits = <4>;
- riscv,num-guest-ids = <511>;
+ riscv,num-guest-ids = <63>;
riscv,num-ids = <511>;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0083/1257] isofs: fix Rock Ridge CE extent validation on multisession media
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0082/1257] riscv: dts: spacemit: k3: fix IMSIC num-guest-ids Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0084/1257] arm64: dts: mediatek: mt7986: correct timer frequency Greg Kroah-Hartman
` (915 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Baolin Liu, Jan Kara, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Liu <liubaolin@kylinos.cn>
[ Upstream commit 43de050fa4a31f7e7a73cf8974dcf6037e161a39 ]
Commit a36d990f5913 ("isofs: validate Rock Ridge CE continuation extent
against volume size") compares the CE extent directly with s_nzones. The
extent is an absolute block number, while s_nzones is the number of blocks
relative to the selected ISO session. The comparison is therefore wrong
when a multisession disc starts at a non-zero block.
isofs_get_last_session() selects the last session on multisession
media, and its volume descriptors describe a volume beginning at that
session's LBA.
For example, a session beginning at LBA 45447 with 64 blocks can contain a
valid CE at absolute LBA 45467. The existing check rejects that CE, so the
ER continuation record is not read, Rock Ridge is disabled, and the mount
falls back to Joliet names.
Save the selected session start in filesystem-block units and validate the
CE extent against the half-open interval [session_start, session_end).
Scale the session length to the same block units and retain a separate
block-device limit. The lower bound is intentional: accepting arbitrary
blocks before the selected session could make a CE read data from a
previous session or another filesystem on the device.
Only apply the bounds check when cont_extent is non-zero. A zero extent is
the in-memory sentinel indicating that no CE continuation was found, rather
than a request to read block zero.
For a single-session image, session_start is zero and the effective volume
boundary remains unchanged.
Build-tested with:
make CONFIG_RUST= CONFIG_RUST_DRIVERS= fs/isofs/
Fixes: a36d990f5913 ("isofs: validate Rock Ridge CE continuation extent against volume size")
Cc: stable@vger.kernel.org
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
Link: https://patch.msgid.link/20260907082602.3777551-1-liubaolin12138@163.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/isofs/inode.c | 2 ++
fs/isofs/isofs.h | 2 ++
fs/isofs/rock.c | 11 +++++++++--
3 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 337836a0a1704..b766b5c9c593b 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -821,6 +821,8 @@ static int isofs_fill_super(struct super_block *s, struct fs_context *fc)
if (!sb_set_blocksize(s, orig_zonesize))
goto out_freesbi;
+ sbi->s_session_start = (sector_t)vol_desc_start <<
+ (ISOFS_BLOCK_BITS - s->s_blocksize_bits);
sbi->s_nls_iocharset = NULL;
#ifdef CONFIG_JOLIET
diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
index dacb9cdae4fd1..79ca0256843aa 100644
--- a/fs/isofs/isofs.h
+++ b/fs/isofs/isofs.h
@@ -35,6 +35,8 @@ struct isofs_sb_info {
unsigned long s_firstdatazone;
unsigned long s_log_zone_size;
unsigned long s_max_size;
+ /* Session start in filesystem block units. */
+ sector_t s_session_start;
int s_rock_offset; /* offset of SUSP fields within SU area */
s32 s_sbsector;
diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
index 2628f31bd3a5d..84e0d764c2100 100644
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -9,6 +9,7 @@
#include <linux/slab.h>
#include <linux/pagemap.h>
+#include <linux/blkdev.h>
#include "isofs.h"
#include "rock.h"
@@ -84,6 +85,10 @@ static void init_rock_state(struct rock_state *rs, struct inode *inode)
*/
static int rock_continue(struct rock_state *rs)
{
+ struct super_block *sb = rs->inode->i_sb;
+ struct isofs_sb_info *sbi = ISOFS_SB(sb);
+ sector_t session_end = sbi->s_session_start +
+ ((sector_t)sbi->s_nzones << (ISOFS_BLOCK_BITS - sb->s_blocksize_bits));
int ret = 1;
int blocksize = 1 << rs->inode->i_blkbits;
const int min_de_size = offsetof(struct rock_ridge, u);
@@ -101,11 +106,13 @@ static int rock_continue(struct rock_state *rs)
goto out;
}
- if ((unsigned)rs->cont_extent >= ISOFS_SB(rs->inode->i_sb)->s_nzones) {
+ if (rs->cont_extent &&
+ (rs->cont_extent < sbi->s_session_start ||
+ rs->cont_extent >= session_end)) {
printk(KERN_NOTICE "rock: corrupted directory entry. "
"extent=%u out of volume (nzones=%lu)\n",
(unsigned)rs->cont_extent,
- ISOFS_SB(rs->inode->i_sb)->s_nzones);
+ sbi->s_nzones);
ret = -EIO;
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0084/1257] arm64: dts: mediatek: mt7986: correct timer frequency
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0083/1257] isofs: fix Rock Ridge CE extent validation on multisession media Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0085/1257] media: hws: report measured colorimetry Greg Kroah-Hartman
` (914 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrea Pesaresi,
AngeloGioacchino Del Regno, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Pesaresi <andreapesaresi82@gmail.com>
[ Upstream commit 1cf18e4b9815beaf0439c5b57b65b45151c82ad7 ]
The MT7986 architected timer runs at 12,986,200 Hz rather than 13 MHz.
Firmware reports 13 MHz through CNTFRQ_EL0, causing the system clock to
run slow by about 1062 ppm. This exceeds the kernel's 500 ppm NTP
correction limit and leaves clock discipline saturated.
The corrected rate comes from MediaTek's downstream OpenWrt feed, where
it is applied to both MT7986A and MT7986B. Since upstream mt7986b.dtsi
includes mt7986a.dtsi, add it once to the common timer node so the
architected timer driver uses the actual counter rate.
Fixes: 50137c150f5f ("arm64: dts: mediatek: add basic mt7986 support")
Cc: stable@vger.kernel.org
Link: https://github.com/mediatek/mtk-openwrt-feeds/commit/6a4c41c41410cd5042ad10c39da6593ba036283c
Link: https://github.com/openwrt/openwrt/issues/24789
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
index 9ebc196107e5a..318639a7c64e9 100644
--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
@@ -657,6 +657,7 @@ cpu_trip_active_low: active-low {
timer {
compatible = "arm,armv8-timer";
interrupt-parent = <&gic>;
+ clock-frequency = <12986200>;
interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
<GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
<GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0085/1257] media: hws: report measured colorimetry
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0084/1257] arm64: dts: mediatek: mt7986: correct timer frequency Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0086/1257] media: hws: Wait for IRQ handler before returning buffers Greg Kroah-Hartman
` (913 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ben Hoff, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hoff <hoff.benjamin.k@gmail.com>
[ Upstream commit 4d28f97400376d4064c69e2c194ce18eeb69f3e5 ]
At 1920x1080, the driver advertises V4L2_COLORSPACE_REC709 with
V4L2_YCBCR_ENC_DEFAULT. The default maps to a Rec.709 matrix, but
controlled A/B captures using the in-tree and baseline drivers show that
both produce YUYV samples using a BT.601 matrix and full-range
quantization. The captures differ by at most one code value, whereas a
601-to-709 conversion would move primary luma values by roughly 11 to 33
codes.
Set the Y'CbCr encoding explicitly to V4L2_YCBCR_ENC_601 at every
resolution. Keep the resolution-based colorspace so HD retains presumed
Rec.709 primaries and transfer characteristics while SD continues to use
SMPTE 170M. Refresh the colorspace on detected geometry changes so an
SD/HD transition does not leave stale metadata.
The decoder mode register is undocumented. Stop claiming that value 0x13
selects BT.709; both drivers use that value while producing the measured
output.
Fixes: ba07fd2f5742 ("media: pci: add AVMatrix HWS capture driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Ben Hoff <hoff.benjamin.k@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/hws/hws.h | 4 ++--
drivers/media/pci/hws/hws_reg.h | 3 ++-
drivers/media/pci/hws/hws_v4l2_ioctl.c | 5 +++--
drivers/media/pci/hws/hws_video.c | 4 +++-
4 files changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/media/pci/hws/hws.h b/drivers/media/pci/hws/hws.h
index 8fbe1fe27844d..d87d52674b692 100644
--- a/drivers/media/pci/hws/hws.h
+++ b/drivers/media/pci/hws/hws.h
@@ -33,8 +33,8 @@ struct hws_pix_state {
u32 sizeimage; /* full frame */
enum v4l2_field field; /* V4L2_FIELD_NONE or INTERLACED */
enum v4l2_colorspace colorspace; /* e.g., REC709 */
- enum v4l2_ycbcr_encoding ycbcr_enc; /* V4L2_YCBCR_ENC_DEFAULT */
- enum v4l2_quantization quantization; /* V4L2_QUANTIZATION_LIM_RANGE */
+ enum v4l2_ycbcr_encoding ycbcr_enc; /* V4L2_YCBCR_ENC_601 */
+ enum v4l2_quantization quantization; /* V4L2_QUANTIZATION_FULL_RANGE */
enum v4l2_xfer_func xfer_func; /* V4L2_XFER_FUNC_DEFAULT */
bool interlaced; /* cached hardware state */
u32 half_size; /* hardware half-frame size */
diff --git a/drivers/media/pci/hws/hws_reg.h b/drivers/media/pci/hws/hws_reg.h
index e4fb4af444340..f6027a16a1938 100644
--- a/drivers/media/pci/hws/hws_reg.h
+++ b/drivers/media/pci/hws/hws_reg.h
@@ -70,7 +70,8 @@
#define HWS_CTL_IRQ_ENABLE_BIT BIT(0) /* Global interrupt enable bit */
/* Write 0x00 to fully reset decoder,
* set bit 31=1 to "start run",
- * low byte=0x13 selects YUYV/BT.709/etc,
+ * low byte=0x13 is the vendor baseline capture-mode value; its individual
+ * bit meanings are not documented,
* in ReadChipId() we also write 0x00 and 0x10 here for chip-ID sequencing.
*/
diff --git a/drivers/media/pci/hws/hws_v4l2_ioctl.c b/drivers/media/pci/hws/hws_v4l2_ioctl.c
index 0303e311ee4a8..ce396b7225d22 100644
--- a/drivers/media/pci/hws/hws_v4l2_ioctl.c
+++ b/drivers/media/pci/hws/hws_v4l2_ioctl.c
@@ -511,8 +511,9 @@ static inline void hws_set_colorimetry_state(struct hws_pix_state *p)
{
bool sd = p->height <= 576;
+ /* Captured samples use full-range BT.601 Y'CbCr at every resolution. */
p->colorspace = sd ? V4L2_COLORSPACE_SMPTE170M : V4L2_COLORSPACE_REC709;
- p->ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
+ p->ycbcr_enc = V4L2_YCBCR_ENC_601;
p->quantization = V4L2_QUANTIZATION_FULL_RANGE;
p->xfer_func = V4L2_XFER_FUNC_DEFAULT;
}
@@ -736,7 +737,7 @@ static inline void hws_set_colorimetry_fmt(struct v4l2_pix_format *p)
bool sd = p->height <= 576;
p->colorspace = sd ? V4L2_COLORSPACE_SMPTE170M : V4L2_COLORSPACE_REC709;
- p->ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
+ p->ycbcr_enc = V4L2_YCBCR_ENC_601;
p->quantization = V4L2_QUANTIZATION_FULL_RANGE;
p->xfer_func = V4L2_XFER_FUNC_DEFAULT;
}
diff --git a/drivers/media/pci/hws/hws_video.c b/drivers/media/pci/hws/hws_video.c
index 18e4bc6901d30..09cfb5a909f9c 100644
--- a/drivers/media/pci/hws/hws_video.c
+++ b/drivers/media/pci/hws/hws_video.c
@@ -327,7 +327,7 @@ int hws_video_init_channel(struct hws_pcie_dev *pdev, int ch)
vid->pix.sizeimage = vid->pix.bytesperline * vid->pix.height;
vid->pix.field = V4L2_FIELD_NONE;
vid->pix.colorspace = V4L2_COLORSPACE_REC709;
- vid->pix.ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT;
+ vid->pix.ycbcr_enc = V4L2_YCBCR_ENC_601;
vid->pix.quantization = V4L2_QUANTIZATION_FULL_RANGE;
vid->pix.xfer_func = V4L2_XFER_FUNC_DEFAULT;
vid->pix.interlaced = false;
@@ -895,6 +895,8 @@ static void hws_video_apply_mode_change(struct hws_pcie_dev *pdx,
v->pix.width = w;
v->pix.height = h;
v->pix.interlaced = interlaced;
+ v->pix.colorspace = h <= 576 ? V4L2_COLORSPACE_SMPTE170M :
+ V4L2_COLORSPACE_REC709;
hws_set_current_dv_timings(v, w, h, interlaced);
v->current_fps = fps;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0086/1257] media: hws: Wait for IRQ handler before returning buffers
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0085/1257] media: hws: report measured colorimetry Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0087/1257] media: pci: hws: only init channels the device actually has Greg Kroah-Hartman
` (912 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao-Qun Huang, Ben Hoff,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-Qun Huang <alvinhuang0603@gmail.com>
[ Upstream commit 1ba17b5a54187e8bb251ff9636ed65c84719b013 ]
hws_stop_streaming() disables capture and then collects the active and
queued buffers straight away. Clearing cap_active and setting
stop_requested only stops a VDONE handler that has not checked them
yet; one already running on another CPU has passed those checks and
cannot be recalled.
That handler snapshots v->active into a local pointer and drops
irq_lock before it touches the buffer, so stop_streaming can run in
between. Without a next_prepared buffer both paths complete the same
buffer, and the second vb2_buffer_done() hits the WARN_ON for a buffer
that is no longer active. With a next_prepared buffer the snapshot is
the only remaining reference to the old active buffer, so
stop_streaming returns without it and vb2 reports "stop_streaming
operation is leaving buffer %u in active state" before completing it
with an error.
Either way the driver breaks the vb2 rule that stop_streaming has to
give back every buffer it owns before it returns.
Wait for the handler once the hardware is disabled and before the
buffers are collected. The live mode change and the channel cleanup
paths already do this around the same collect helper.
Fixes: ba07fd2f5742 ("media: pci: add AVMatrix HWS capture driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Reviewed-by: Ben Hoff <hoff.benjamin.k@gmail.com>
Tested-by: Ben Hoff <hoff.benjamin.k@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/hws/hws_video.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/pci/hws/hws_video.c b/drivers/media/pci/hws/hws_video.c
index 09cfb5a909f9c..dbe0fc2a66b57 100644
--- a/drivers/media/pci/hws/hws_video.c
+++ b/drivers/media/pci/hws/hws_video.c
@@ -1294,6 +1294,8 @@ static void hws_stop_streaming(struct vb2_queue *q)
WRITE_ONCE(v->stop_requested, true);
hws_enable_video_capture(v->parent, v->channel_index, false);
+ if (hws->irq >= 0)
+ synchronize_irq(hws->irq);
/* 2) Collect in-flight + queued under the IRQ lock */
spin_lock_irqsave(&v->irq_lock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0087/1257] media: pci: hws: only init channels the device actually has
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0086/1257] media: hws: Wait for IRQ handler before returning buffers Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0088/1257] media: cx231xx-audio: drain wq_trigger before audio fini Greg Kroah-Hartman
` (911 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linkai Gong, Ben Hoff, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linkai Gong <gonglinkai@kylinos.cn>
[ Upstream commit ad5390c35ccf98cec66ef1009351305f25b5a757 ]
hws_probe() initializes max_channels (always 4) control handlers, but
register/unregister only walk cur_max_video_ch (1 or 2 on smaller
chips). The extra handlers are never freed.
Initialize the same number of channels that cleanup uses.
Fixes: ba07fd2f5742 ("media: pci: add AVMatrix HWS capture driver")
Cc: stable@vger.kernel.org
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Reviewed-by: Ben Hoff <hoff.benjamin.k@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/hws/hws_pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/pci/hws/hws_pci.c b/drivers/media/pci/hws/hws_pci.c
index 30bb7d34465b8..87ba27877f29a 100644
--- a/drivers/media/pci/hws/hws_pci.c
+++ b/drivers/media/pci/hws/hws_pci.c
@@ -441,7 +441,7 @@ static int hws_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
hws_init_video_sys(hws, false);
/* 5) Init channels (video state, locks, vb2, ctrls) */
- for (i = 0; i < hws->max_channels; i++) {
+ for (i = 0; i < hws->cur_max_video_ch; i++) {
ret = hws_video_init_channel(hws, i);
if (ret) {
dev_err(&pdev->dev, "video channel init failed (ch=%d)\n", i);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0088/1257] media: cx231xx-audio: drain wq_trigger before audio fini
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0087/1257] media: pci: hws: only init channels the device actually has Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0089/1257] media: cx231xx: Fix cleanup path on failure Greg Kroah-Hartman
` (910 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit a691c54986412e1fa87f036d2577d5a78a75e658 ]
audio_trigger() is deferred work (dev->wq_trigger) armed from
snd_cx231xx_capture_trigger() on every PCM START/STOP; it dereferences
dev->adev state and may free the URBs via cx231xx_isoc_audio_deinit().
cx231xx_audio_fini() tore down that state without draining wq_trigger,
so work armed before or racing fini ran against freed state.
Use disable_work_sync() in fini to drain the work and prevent further
queueing. Initialize the work, lock and stream_started counter at the
top of cx231xx_audio_init(), before any fallible allocation, and clear
the partially-built audio state on its error path, so fini is safe even
if a later step fails.
This issue was found by an in-house static analysis tool.
Fixes: 61b04cb24a12 ("[media] cx231xx-audio: fix some locking issues")
Cc: stable@vger.kernel.org # v6.10+
Link: https://lore.kernel.org/r/8c7e1294-b906-4636-890c-b64d03b0e1d0@kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/cx231xx/cx231xx-audio.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/media/usb/cx231xx/cx231xx-audio.c b/drivers/media/usb/cx231xx/cx231xx-audio.c
index b24ceef497e4c..af04fb104cc4e 100644
--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -581,12 +581,19 @@ static int cx231xx_audio_init(struct cx231xx *dev)
dev_dbg(dev->dev,
"probing for cx231xx non standard usbaudio\n");
+ /*
+ * Extension init errors are ignored by the cx231xx core, so fini()
+ * must be safe even if initialization fails part way through.
+ */
+ spin_lock_init(&adev->slock);
+ INIT_WORK(&dev->wq_trigger, audio_trigger);
+ atomic_set(&dev->stream_started, 0);
+
err = snd_card_new(dev->dev, index[devnr], "Cx231xx Audio",
THIS_MODULE, 0, &card);
if (err < 0)
return err;
- spin_lock_init(&adev->slock);
err = snd_pcm_new(card, "Cx231xx Audio", 0, 0, 1, &pcm);
if (err < 0)
goto err_free_card;
@@ -601,8 +608,6 @@ static int cx231xx_audio_init(struct cx231xx *dev)
strscpy(card->shortname, "Cx231xx Audio", sizeof(card->shortname));
strscpy(card->longname, "Conexant cx231xx Audio", sizeof(card->longname));
- INIT_WORK(&dev->wq_trigger, audio_trigger);
-
err = snd_card_register(card);
if (err < 0)
goto err_free_card;
@@ -656,8 +661,10 @@ static int cx231xx_audio_init(struct cx231xx *dev)
err_free_pkt_size:
kfree(adev->alt_max_pkt_size);
+ adev->alt_max_pkt_size = NULL;
err_free_card:
snd_card_free(card);
+ adev->sndcard = NULL;
return err;
}
@@ -674,6 +681,8 @@ static int cx231xx_audio_fini(struct cx231xx *dev)
return 0;
}
+ disable_work_sync(&dev->wq_trigger);
+
if (dev->adev.sndcard) {
snd_card_free_when_closed(dev->adev.sndcard);
kfree(dev->adev.alt_max_pkt_size);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0089/1257] media: cx231xx: Fix cleanup path on failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0088/1257] media: cx231xx-audio: drain wq_trigger before audio fini Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0090/1257] firewire: core: fix source bus ID detection for AT context in big-endian systems Greg Kroah-Hartman
` (909 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Farhad Alemi, Andi Shyti,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Shyti <andi.shyti@kernel.org>
[ Upstream commit 6e30287eaf3e41b86dfb86df3b811526693d74b4 ]
If cx231xx_init_v4l2() fails the probe currently jumps to
err_init, which only unregisters the V4L2 device. The analog
devices and I2C resources are left registered while the driver
state can be released.
A subsequent driver bind attempts to create the same I2C mux
channel links and triggers a warning when the existing
"channel-0" link is encountered. The remaining devices may also
access released driver state. This produces the following warning
can't create symlink to channel 0
WARNING: drivers/i2c/i2c-mux.c:403 at i2c_mux_add_adapter+0xcd8/0xeb0
Call Trace:
i2c_mux_add_adapter+0xcdc/0xeb0
cx231xx_dev_init+0x2fb/0x1260
cx231xx_usb_probe+0xc48/0x2140
usb_probe_interface+0x657/0xc70
...
Jump to err_video_alt instead, which performs the full device
cleanup before unregistering the V4L2 device.
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Closes: https://github.com/farhad-alemi/public_bug_reports/tree/main/185-warning-in-i2c-mux-add-adapter/
Fixes: 4d2a7d3509f5 ("[media] cx231xx: move analog init code to a separate function")
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Cc: <stable@vger.kernel.org> # v3.17+
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/cx231xx/cx231xx-cards.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
index 69b24205bc567..b0941cd2a2d85 100644
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1826,7 +1826,7 @@ static int cx231xx_usb_probe(struct usb_interface *interface,
retval = cx231xx_init_v4l2(dev, udev, interface, isoc_pipe);
if (retval)
- goto err_init;
+ goto err_video_alt;
if (dev->current_pcb_config.ts1_source != 0xff) {
/* compute alternate max packet sizes for TS1 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0090/1257] firewire: core: fix source bus ID detection for AT context in big-endian systems
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0089/1257] media: cx231xx: Fix cleanup path on failure Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0091/1257] media: au0828: Free URBs when starting DVB streaming fails Greg Kroah-Hartman
` (908 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Sakamoto, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
[ Upstream commit 6393d75914a6ac95a05621db8d9d6a98eafe72f7 ]
The source bus ID bit in AT DMA context is not detected correctly on
big-endian systems because the little-endian data is not converted to
CPU endianness.
Fix the bug. The helper functions related to this are never used in
driver code, so extend the test to check the field instead.
Cc: stable@vger.kernel.org # v6.12
Fixes: 8db9d1557122 ("firewire: ohci: add static inline functions to serialize/deserialize data of AT DMA")
Link: https://lore.kernel.org/r/20260908122840.2886621-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firewire/ohci-serdes-test.c | 4 ++--
drivers/firewire/ohci.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/firewire/ohci-serdes-test.c b/drivers/firewire/ohci-serdes-test.c
index 258f668619ef1..87b136e041de3 100644
--- a/drivers/firewire/ohci-serdes-test.c
+++ b/drivers/firewire/ohci-serdes-test.c
@@ -43,7 +43,7 @@ static void test_self_id_receive_buffer_deserialization(struct kunit *test)
static void test_at_data_serdes(struct kunit *test)
{
static const __le32 expected[] = {
- cpu_to_le32(0x00020e80),
+ cpu_to_le32(0x00820e80),
cpu_to_le32(0xffc2ffff),
cpu_to_le32(0xe0000000),
};
@@ -56,7 +56,7 @@ static void test_at_data_serdes(struct kunit *test)
unsigned int destination_id = ohci1394_at_data_get_destination_id(expected);
u64 destination_offset = ohci1394_at_data_get_destination_offset(expected);
- KUNIT_EXPECT_FALSE(test, has_src_bus_id);
+ KUNIT_EXPECT_TRUE(test, has_src_bus_id);
KUNIT_EXPECT_EQ(test, 0x02, speed);
KUNIT_EXPECT_EQ(test, 0x03, tlabel);
KUNIT_EXPECT_EQ(test, 0x02, retry);
diff --git a/drivers/firewire/ohci.h b/drivers/firewire/ohci.h
index 218666cfe14a5..63ccf2f445045 100644
--- a/drivers/firewire/ohci.h
+++ b/drivers/firewire/ohci.h
@@ -178,7 +178,7 @@
static inline bool ohci1394_at_data_get_src_bus_id(const __le32 *data)
{
- return !!((data[0] & OHCI1394_AT_DATA_Q0_srcBusID_MASK) >> OHCI1394_AT_DATA_Q0_srcBusID_SHIFT);
+ return !!((le32_to_cpu(data[0]) & OHCI1394_AT_DATA_Q0_srcBusID_MASK) >> OHCI1394_AT_DATA_Q0_srcBusID_SHIFT);
}
static inline void ohci1394_at_data_set_src_bus_id(__le32 *data, bool src_bus_id)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0091/1257] media: au0828: Free URBs when starting DVB streaming fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0090/1257] firewire: core: fix source bus ID detection for AT context in big-endian systems Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0092/1257] media: i2c: tc358743: add missing color-space strings Greg Kroah-Hartman
` (907 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit b8dd133d96a40012f4b67fd48d8ddd7306a3e024 ]
start_urb_transfer() stores each allocated URB in dev->urbs[], but sets
urb_streaming only after all URBs have been submitted. If a later URB or
transfer buffer allocation fails, earlier entries are left allocated. A
submission failure calls stop_urb_transfer(), but that function returns
immediately while urb_streaming is false, leaving both submitted and
unsubmitted URBs behind.
Make stop_urb_transfer() release every populated slot regardless of the
streaming flag and clear each slot after release. Route all start errors
through this cleanup. usb_kill_urb() safely handles both submitted and
unsubmitted URBs, while the existing preallocation check preserves the
lifetime of shared transfer buffers.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 265a6510629a ("V4L/DVB (7621): Add support for Hauppauge HVR950Q/HVR850/FusioHDTV7-USB")
Cc: stable@vger.kernel.org
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/au0828/au0828-dvb.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au0828/au0828-dvb.c
index d3fff47f0edf5..601a12e122f1c 100644
--- a/drivers/media/usb/au0828/au0828-dvb.c
+++ b/drivers/media/usb/au0828/au0828-dvb.c
@@ -163,9 +163,6 @@ static int stop_urb_transfer(struct au0828_dev *dev)
dprintk(2, "%s()\n", __func__);
- if (!dev->urb_streaming)
- return 0;
-
if (dev->bulk_timeout_running == 1) {
dev->bulk_timeout_running = 0;
timer_delete(&dev->bulk_timeout);
@@ -179,6 +176,7 @@ static int stop_urb_transfer(struct au0828_dev *dev)
kfree(dev->urbs[i]->transfer_buffer);
usb_free_urb(dev->urbs[i]);
+ dev->urbs[i] = NULL;
}
}
@@ -200,8 +198,10 @@ static int start_urb_transfer(struct au0828_dev *dev)
for (i = 0; i < URB_COUNT; i++) {
dev->urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
- if (!dev->urbs[i])
- return -ENOMEM;
+ if (!dev->urbs[i]) {
+ ret = -ENOMEM;
+ goto err;
+ }
purb = dev->urbs[i];
@@ -217,7 +217,7 @@ static int start_urb_transfer(struct au0828_dev *dev)
ret = -ENOMEM;
pr_err("%s: failed big buffer allocation, err = %d\n",
__func__, ret);
- return ret;
+ goto err;
}
purb->status = -EINPROGRESS;
@@ -235,10 +235,9 @@ static int start_urb_transfer(struct au0828_dev *dev)
for (i = 0; i < URB_COUNT; i++) {
ret = usb_submit_urb(dev->urbs[i], GFP_ATOMIC);
if (ret != 0) {
- stop_urb_transfer(dev);
pr_err("%s: failed urb submission, err = %d\n",
__func__, ret);
- return ret;
+ goto err;
}
}
@@ -249,6 +248,10 @@ static int start_urb_transfer(struct au0828_dev *dev)
dev->bulk_timeout_running = 1;
return 0;
+
+err:
+ stop_urb_transfer(dev);
+ return ret;
}
static void au0828_start_transport(struct au0828_dev *dev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0092/1257] media: i2c: tc358743: add missing color-space strings
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0091/1257] media: au0828: Free URBs when starting DVB streaming fails Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0093/1257] media: go7007: bound EZ-USB I2C transfers to the usb_buf size Greg Kroah-Hartman
` (906 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Linkai Gong, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linkai Gong <gonglinkai@kylinos.cn>
[ Upstream commit cb37e83f1bbdf0964ed0a9524ce45a0694f98205 ]
VI_STATUS3 S_V_COLOR is four bits, so the index after the shift
is 0-15. input_color_space[] only has 14 entries. Add the two
reserved values so log_status() cannot walk off the table.
Fixes: d32d98642de6 ("[media] Driver for Toshiba TC358743 HDMI to CSI-2 bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/tc358743.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index fbd38bbfee038..ce75812cbf72b 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1373,7 +1373,8 @@ static int tc358743_log_status(struct v4l2_subdev *sd)
static const char * const input_color_space[] = {
"RGB", "YCbCr 601", "opRGB", "YCbCr 709", "NA (4)",
"xvYCC 601", "NA(6)", "xvYCC 709", "NA(8)", "sYCC601",
- "NA(10)", "NA(11)", "NA(12)", "opYCC 601"};
+ "NA(10)", "NA(11)", "NA(12)", "opYCC 601", "NA(14)",
+ "NA(15)"};
v4l2_info(sd, "-----Chip status-----\n");
v4l2_info(sd, "Chip ID: 0x%02x\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0093/1257] media: go7007: bound EZ-USB I2C transfers to the usb_buf size
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0092/1257] media: i2c: tc358743: add missing color-space strings Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0094/1257] media: saa7146: Initialize interrupt lock before requesting IRQ Greg Kroah-Hartman
` (905 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shengzhuo Wei, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengzhuo Wei <me@cherr.cc>
[ Upstream commit 816c4628b23e8c3d925978433f4dd1a13620c01b ]
go7007_usb_i2c_master_xfer() copies msgs[i].len bytes into go->usb_buf,
a 16-byte buffer embedded in struct go7007, without any length check.
The adapter declares no transfer limits, so an SMBus block transfer
issued through /dev/i2c-N can write up to 34 bytes into it and corrupt
the struct fields that follow the buffer.
Bound the transfer size with i2c_adapter_quirks so the I2C core
rejects oversized messages before they reach the driver.
Fixes: 7955f03d18d1 ("[media] go7007: move out of staging into drivers/media/usb.")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Assisted-by: GLM:5.3
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/go7007/go7007-usb.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index c0cb92fa6ab94..867548d655b3f 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1029,10 +1029,16 @@ static const struct i2c_algorithm go7007_usb_algo = {
.functionality = go7007_usb_functionality,
};
+static const struct i2c_adapter_quirks go7007_usb_quirks = {
+ .max_write_len = 12,
+ .max_read_len = 15,
+};
+
static struct i2c_adapter go7007_usb_adap_templ = {
.owner = THIS_MODULE,
.name = "WIS GO7007SB EZ-USB",
.algo = &go7007_usb_algo,
+ .quirks = &go7007_usb_quirks,
};
/********************* USB add/remove functions *********************/
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0094/1257] media: saa7146: Initialize interrupt lock before requesting IRQ
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0093/1257] media: go7007: bound EZ-USB I2C transfers to the usb_buf size Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0095/1257] media: vim2m: keep transaction buffer count stable while streaming Greg Kroah-Hartman
` (904 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit e07c75a6bc4adf1ed09ede31756261e2c6bdede5 ]
The saa7146 interrupt handler can call SAA7146_IER_DISABLE(), which
serializes register access with dev->int_slock. request_irq() allows the
shared handler to run before saa7146_init_one() reaches the current lock
initialization block.
Initialize dev->int_slock before requesting the interrupt so every handler
path sees an initialized lock.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/common/saa7146/saa7146_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/common/saa7146/saa7146_core.c b/drivers/media/common/saa7146/saa7146_core.c
index c297d019f2b3f..70d6ca00513f8 100644
--- a/drivers/media/common/saa7146/saa7146_core.c
+++ b/drivers/media/common/saa7146/saa7146_core.c
@@ -340,6 +340,8 @@ static int saa7146_init_one(struct pci_dev *pci, const struct pci_device_id *ent
goto out;
}
+ spin_lock_init(&dev->int_slock);
+
/* create a nice device name */
sprintf(dev->name, "saa7146 (%d)", saa7146_num);
@@ -425,7 +427,6 @@ static int saa7146_init_one(struct pci_dev *pci, const struct pci_device_id *ent
dev->ext = ext;
mutex_init(&dev->v4l2_lock);
- spin_lock_init(&dev->int_slock);
spin_lock_init(&dev->slock);
mutex_init(&dev->i2c_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0095/1257] media: vim2m: keep transaction buffer count stable while streaming
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0094/1257] media: saa7146: Initialize interrupt lock before requesting IRQ Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0096/1257] media: vimc: sensor: fix pixel_rate type to resolve do_div() warning Greg Kroah-Hartman
` (903 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Younho Choi, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Younho Choi <gdool88@mju.ac.kr>
[ Upstream commit 50f5fed44d8e24081e8feed5154746fe193f11b8 ]
V4L2_CID_TRANS_NUM_BUFS controls how many buffer pairs a vim2m
mem2mem job processes before the job is completed. The driver stores
the value in ctx->translen and device_work() uses it later to decide
whether the current transaction should continue.
Letting userspace change this control while streaming is active can
make a queued job observe a different transaction length than the one
it started with. That leaves the transaction state inconsistent with
the buffers currently queued for the job.
Grab the transaction buffer count control while either queue is
streaming, and release it only after both queues have stopped
streaming. The V4L2 control framework then rejects changes with
-EBUSY while the value is in use, while still allowing userspace to
configure the value before streaming starts.
Keep the control handler alive until after v4l2_m2m_ctx_release(),
since releasing the mem2mem context can call stop_streaming(), which
now ungrabs the control.
Fixes: 96d8eab5d0a1 ("V4L/DVB: [v5,2/2] v4l: Add a mem-to-mem videobuf framework test device")
Cc: stable@vger.kernel.org
Signed-off-by: Younho Choi <gdool88@mju.ac.kr>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vim2m.c | 29 ++++++++++++++++++++++++++---
1 file changed, 26 insertions(+), 3 deletions(-)
diff --git a/drivers/media/test-drivers/vim2m.c b/drivers/media/test-drivers/vim2m.c
index bb2dd11eef0e4..f4a2c40838292 100644
--- a/drivers/media/test-drivers/vim2m.c
+++ b/drivers/media/test-drivers/vim2m.c
@@ -205,6 +205,7 @@ struct vim2m_ctx {
struct vim2m_dev *dev;
struct v4l2_ctrl_handler hdl;
+ struct v4l2_ctrl *trans_num_bufs_ctrl;
/* Processed buffers in this transaction */
u8 num_processed;
@@ -1258,9 +1259,27 @@ static int vim2m_start_streaming(struct vb2_queue *q, unsigned int count)
ctx->aborting = 0;
q_data->sequence = 0;
+ v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, true);
+
return 0;
}
+static bool vim2m_other_queue_is_streaming(struct vim2m_ctx *ctx,
+ struct vb2_queue *q)
+{
+ struct vb2_queue *other_vq;
+
+ if (!ctx->fh.m2m_ctx)
+ return false;
+
+ if (V4L2_TYPE_IS_OUTPUT(q->type))
+ other_vq = v4l2_m2m_get_dst_vq(ctx->fh.m2m_ctx);
+ else
+ other_vq = v4l2_m2m_get_src_vq(ctx->fh.m2m_ctx);
+
+ return vb2_is_streaming(other_vq);
+}
+
static void vim2m_stop_streaming(struct vb2_queue *q)
{
struct vim2m_ctx *ctx = vb2_get_drv_priv(q);
@@ -1274,11 +1293,14 @@ static void vim2m_stop_streaming(struct vb2_queue *q)
else
vbuf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
if (!vbuf)
- return;
+ break;
v4l2_ctrl_request_complete(vbuf->vb2_buf.req_obj.req,
&ctx->hdl);
v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR);
}
+
+ if (!vim2m_other_queue_is_streaming(ctx, q))
+ v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, false);
}
static void vim2m_buf_request_complete(struct vb2_buffer *vb)
@@ -1380,7 +1402,8 @@ static int vim2m_open(struct file *file)
vim2m_ctrl_trans_time_msec.def = default_transtime;
v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_time_msec, NULL);
- v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL);
+ ctx->trans_num_bufs_ctrl =
+ v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL);
if (hdl->error) {
rc = hdl->error;
v4l2_ctrl_handler_free(hdl);
@@ -1435,10 +1458,10 @@ static int vim2m_release(struct file *file)
v4l2_fh_del(&ctx->fh, file);
v4l2_fh_exit(&ctx->fh);
- v4l2_ctrl_handler_free(&ctx->hdl);
mutex_lock(&dev->dev_mutex);
v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
mutex_unlock(&dev->dev_mutex);
+ v4l2_ctrl_handler_free(&ctx->hdl);
kfree(ctx);
atomic_dec(&dev->num_inst);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0096/1257] media: vimc: sensor: fix pixel_rate type to resolve do_div() warning
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0095/1257] media: vim2m: keep transaction buffer count stable while streaming Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0097/1257] media: vicodec: fix out-of-bounds write on under-rounded coded dimensions Greg Kroah-Hartman
` (902 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Faizel K B,
Ricardo Ribalda, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Faizel K B <faizel.kb@gmail.com>
[ Upstream commit bbc952491f5f05f2274c811d34174d5b88632103 ]
vsensor->pixel_rate->val is a plain s32 field. Declaring the local
"pixel_rate" variable as u64 misrepresented its actual range and made
do_div()'s divisor look wider than the 32-bit division it actually
performs, which is exactly what the do_div() coccinelle check warns.
Revert pixel_rate back to its original s32 type to match
vsensor->pixel_rate->val, resolving the warning correctly.
Fixes: ec1e620b2454 ("media: vimc: sensor: Add pixel_rate,vblank and hblank configuration")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202604191731.10nxGZ92-lkp@intel.com/
Link: https://lore.kernel.org/lkml/CANiDSCs9s03DUjKwcPgDtZt2QJ4i0FGwab4zpEP+wCawagSC2Q@mail.gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Faizel K B <faizel.kb@gmail.com>
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vimc/vimc-sensor.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/media/test-drivers/vimc/vimc-sensor.c b/drivers/media/test-drivers/vimc/vimc-sensor.c
index 83dcc9d61ee05..7cb544fdfddbb 100644
--- a/drivers/media/test-drivers/vimc/vimc-sensor.c
+++ b/drivers/media/test-drivers/vimc/vimc-sensor.c
@@ -97,18 +97,14 @@ static void vimc_sensor_update_frame_timing(struct v4l2_subdev *sd,
{
struct vimc_sensor_device *vsensor =
container_of(sd, struct vimc_sensor_device, sd);
- u64 pixel_rate = vsensor->pixel_rate->val;
+ u32 pixel_rate = vsensor->pixel_rate->val;
u32 hts = width + vsensor->hblank->val;
u32 vts = height + vsensor->vblank->val;
u64 total_pixels = (u64)hts * vts;
u64 frame_interval_ns;
- /* Sanity check, pixel rate is fixed and fits in 32 bits. */
- if (WARN_ON(pixel_rate >= 0x100000000))
- return;
-
frame_interval_ns = total_pixels * NSEC_PER_SEC;
- do_div(frame_interval_ns, (u32)pixel_rate);
+ do_div(frame_interval_ns, pixel_rate);
vsensor->hw.fps_jiffies = nsecs_to_jiffies(frame_interval_ns);
if (vsensor->hw.fps_jiffies == 0)
vsensor->hw.fps_jiffies = 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0097/1257] media: vicodec: fix out-of-bounds write on under-rounded coded dimensions
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0096/1257] media: vimc: sensor: fix pixel_rate type to resolve do_div() warning Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0098/1257] media: vicodec: make encoder CAPTURE dimensions read-only Greg Kroah-Hartman
` (901 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
[ Upstream commit 0183746ebca4c478027e2261b904f844f1443b19 ]
A capture format whose width or height is one more than a multiple of 16
makes the FWHT codec write one 8x8 block row, or column, past the end of
the capture plane, and read the same block out of the reference frame for
P-coded frames.
vic_round_dim() is documented to round a frame dimension up so that both
the luma and the chroma plane end up a multiple of 8, but it only rounds
the chroma plane:
round_up((dim) / (div), 8) * (div)
For div == 2 the result is a multiple of 16 in every case but one: when
dim % 16 == 1, dim / div is already a multiple of 8 and the macro returns
dim - 1. encode_plane() and decode_plane() round the same dimension with
round_up(dim, 8), which yields dim + 7 -- one block more than the coded
dimension that sized the buffer.
On a KASAN-enabled kernel, a 641x360 YUYV P-frame triggers:
BUG: KASAN: slab-out-of-bounds in add_deltas+0x450/0xcc0
Read of size 1 at addr ffff888009070800 by task trigger_bin/70
Call Trace:
add_deltas+0x450/0xcc0
decode_plane+0x1916/0x3390
fwht_decode_frame+0x173/0x620
v4l2_fwht_decode+0x751/0x1120
device_run+0x6bb/0x1850
Round the dimension itself up to a multiple of 8 * div. The rounding
changes only for div == 2 and dim % 16 == 1, and MAX_WIDTH and MAX_HEIGHT
are both multiples of 16, so the rounded value still fits the advertised
limits.
Fixes: 3b15f68e19c2 ("media: vicodec: Add support for resolution change event.")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vicodec/codec-fwht.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/test-drivers/vicodec/codec-fwht.h b/drivers/media/test-drivers/vicodec/codec-fwht.h
index 0eab24020e9e6..4b4d390310899 100644
--- a/drivers/media/test-drivers/vicodec/codec-fwht.h
+++ b/drivers/media/test-drivers/vicodec/codec-fwht.h
@@ -61,7 +61,7 @@
* both luma and chroma components resolutions are rounded up to
* a multiple of 8
*/
-#define vic_round_dim(dim, div) (round_up((dim) / (div), 8) * (div))
+#define vic_round_dim(dim, div) round_up(dim, 8 * (div))
struct fwht_cframe_hdr {
u32 magic1;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0098/1257] media: vicodec: make encoder CAPTURE dimensions read-only
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0097/1257] media: vicodec: fix out-of-bounds write on under-rounded coded dimensions Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0099/1257] media: vidtv: fix frontend reference leak on unbind Greg Kroah-Hartman
` (900 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
[ Upstream commit 2532e9d2f8ccb330a9c924b1ee34c5629240d352 ]
Setting the encoder's compressed CAPTURE format to a smaller resolution
than the raw OUTPUT format makes the encoder write past the end of the
CAPTURE buffer.
For a stateful encoder the CAPTURE width and height are not
client-settable; Documentation/userspace-api/media/v4l/dev-encoder.rst
specifies them as "ignored (read-only)" on VIDIOC_S_FMT. vicodec only
implements half of that: vidioc_s_fmt_vid_out() derives the CAPTURE coded
size and sizeimage from the OUTPUT format, but S_FMT on the CAPTURE queue
overwrites them. The encoder then takes its geometry from the OUTPUT
queue alone, and v4l2_fwht_encode() gets no destination length.
Overwrite the requested width and height with the OUTPUT queue's coded
dimensions in vidioc_try_fmt_vid_cap(), making them read-only as the
interface requires.
Fixes: efec9c815e5d ("media: vicodec: pass on enc output format to capture side")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vicodec/vicodec-core.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/media/test-drivers/vicodec/vicodec-core.c b/drivers/media/test-drivers/vicodec/vicodec-core.c
index ff9d50fb05fd1..25ec3a43fc712 100644
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -890,6 +890,8 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
struct v4l2_format *f)
{
struct vicodec_ctx *ctx = file2ctx(file);
+ struct vicodec_q_data *q_data_out =
+ get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT);
struct v4l2_pix_format_mplane *pix_mp;
struct v4l2_pix_format *pix;
@@ -900,6 +902,10 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
pix = &f->fmt.pix;
pix->pixelformat = ctx->is_enc ? V4L2_PIX_FMT_FWHT :
find_fmt(f->fmt.pix.pixelformat)->id;
+ if (ctx->is_enc) {
+ pix->width = q_data_out->coded_width;
+ pix->height = q_data_out->coded_height;
+ }
pix->colorspace = ctx->state.colorspace;
pix->xfer_func = ctx->state.xfer_func;
pix->ycbcr_enc = ctx->state.ycbcr_enc;
@@ -911,6 +917,10 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
pix_mp = &f->fmt.pix_mp;
pix_mp->pixelformat = ctx->is_enc ? V4L2_PIX_FMT_FWHT :
find_fmt(pix_mp->pixelformat)->id;
+ if (ctx->is_enc) {
+ pix_mp->width = q_data_out->coded_width;
+ pix_mp->height = q_data_out->coded_height;
+ }
pix_mp->colorspace = ctx->state.colorspace;
pix_mp->xfer_func = ctx->state.xfer_func;
pix_mp->ycbcr_enc = ctx->state.ycbcr_enc;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0099/1257] media: vidtv: fix frontend reference leak on unbind
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0098/1257] media: vicodec: make encoder CAPTURE dimensions read-only Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0100/1257] media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail Greg Kroah-Hartman
` (899 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+32f018fd65e799f79ae0,
Piyush Patle, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piyush Patle <piyushpatle228@gmail.com>
[ Upstream commit 6f412f9fe6a1f3ce9694757f50353bbec221d832 ]
dvb_register_frontend() keeps two references to the frontend. One is
released by dvb_unregister_frontend(), and the other by
dvb_frontend_detach(). vidtv only called dvb_unregister_frontend(), so
the second reference was never released. As a result,
__dvb_frontend_free() was never called, leaking the frontend private
data and its struct dvb_device.
The detach call was removed by commit 63101b756893 ("media: vidtv: fix
driver unbind/remove") because it caused an OOPS. The demod .release
callback freed vidtv_demod_state, and the I2C remove callbacks then
accessed the freed state.
That commit also removed those accesses from the I2C remove callbacks.
Restore the detach call, but remove the demod .release callback.
vidtv_demod_state is owned by the I2C client and is already freed by
vidtv_demod_i2c_remove(), so the frontend detach path should not free
it.
Tested with kmemleak and KASAN over 10 bind/unbind cycles. The reported
frontend and dvb_device leaks were present before the fix and were gone
after it, with no KASAN reports.
Reported-by: syzbot+32f018fd65e799f79ae0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=32f018fd65e799f79ae0
Fixes: 63101b756893 ("media: vidtv: fix driver unbind/remove")
Cc: stable@vger.kernel.org
Tested-by: syzbot+32f018fd65e799f79ae0@syzkaller.appspotmail.com
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vidtv/vidtv_bridge.c | 2 ++
drivers/media/test-drivers/vidtv/vidtv_demod.c | 9 ---------
2 files changed, 2 insertions(+), 9 deletions(-)
diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
index fd69b4ee16f4b..9887860b01980 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
@@ -474,6 +474,7 @@ static int vidtv_bridge_dvb_init(struct vidtv_dvb *dvb)
fail_demod_probe:
for (i = i - 1; i >= 0; --i) {
dvb_unregister_frontend(dvb->fe[i]);
+ dvb_frontend_detach(dvb->fe[i]);
fail_fe:
dvb_module_release(dvb->i2c_client_tuner[i]);
fail_tuner_probe:
@@ -552,6 +553,7 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
for (i = 0; i < NUM_FE; ++i) {
dvb_unregister_frontend(dvb->fe[i]);
+ dvb_frontend_detach(dvb->fe[i]);
dvb_module_release(dvb->i2c_client_tuner[i]);
dvb_module_release(dvb->i2c_client_demod[i]);
}
diff --git a/drivers/media/test-drivers/vidtv/vidtv_demod.c b/drivers/media/test-drivers/vidtv/vidtv_demod.c
index 6e5fe402976bb..3aa5860046386 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_demod.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_demod.c
@@ -343,13 +343,6 @@ static int vidtv_diseqc_send_burst(struct dvb_frontend *fe,
return 0;
}
-static void vidtv_demod_release(struct dvb_frontend *fe)
-{
- struct vidtv_demod_state *state = fe->demodulator_priv;
-
- kfree(state);
-}
-
static const struct dvb_frontend_ops vidtv_demod_ops = {
.delsys = {
SYS_DVBT,
@@ -390,8 +383,6 @@ static const struct dvb_frontend_ops vidtv_demod_ops = {
FE_CAN_HIERARCHY_AUTO,
},
- .release = vidtv_demod_release,
-
.set_frontend = vidtv_demod_set_frontend,
.get_frontend = vidtv_demod_get_frontend,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0100/1257] media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0099/1257] media: vidtv: fix frontend reference leak on unbind Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0101/1257] media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA Greg Kroah-Hartman
` (898 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c7fc4794e59786f5b4dc,
Jeffin Philip, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffin Philip <jeffinphilip14@gmail.com>
[ Upstream commit 2af02ccd048b77713695d7817cf645ca50bf349e ]
Attempting to unbind a dvbdevice that is in the process of feeding
data causes a UAF as we free the underlying device without
stopping the feed first. Fix this by stopping the stream first using
vidtv_stop_streaming(). However, our codepath in the reproducer
(mentioned in the below reply) does not decrement our users
(dmxdev->dvr_dvbdev->users) to 1 after it has been incremented to 2
by our read() in the reproducer, that is only possible on .release.
This can cause a task hang as dvb_dmxdev_release() uses wait_event()
in the wait_queue unless we use a close(fd)(in the reproducer).
Is this a problem? Please advise.
Reported-by: syzbot+c7fc4794e59786f5b4dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c7fc4794e59786f5b4dc
Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vidtv/vidtv_bridge.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
index 9887860b01980..f951b877ada6a 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
@@ -551,6 +551,8 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
mutex_destroy(&dvb->feed_lock);
+ vidtv_stop_streaming(dvb);
+
for (i = 0; i < NUM_FE; ++i) {
dvb_unregister_frontend(dvb->fe[i]);
dvb_frontend_detach(dvb->fe[i]);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0101/1257] media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0100/1257] media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0102/1257] staging: media: av7110: fix corrupted BER reporting in sp8870 Greg Kroah-Hartman
` (897 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Julian Braha, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Braha <julianbraha@gmail.com>
[ Upstream commit 1179929b3abd4adb6ca7fae91d649c64a7293aca ]
VIDEO_MMP_CAMERA selects I2C_GPIO without ensuring
'GPIOLIB || COMPILE_TEST' is enabled, despite I2C_GPIO depending on it.
Let's add the same dependency to VIDEO_MMP_CAMERA.
This unmet dependency bug was found by kconfirm, a static analysis tool for
Kconfig.
Fixes: 67a8dbbc4e04 ("[media] marvell-cam: Basic working MMP camera driver")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Braha <julianbraha@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/marvell/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/marvell/Kconfig b/drivers/media/platform/marvell/Kconfig
index d31f4730f2a38..ab58175e433c3 100644
--- a/drivers/media/platform/marvell/Kconfig
+++ b/drivers/media/platform/marvell/Kconfig
@@ -22,6 +22,7 @@ config VIDEO_MMP_CAMERA
depends on V4L_PLATFORM_DRIVERS
depends on I2C && VIDEO_DEV
depends on ARCH_MMP || COMPILE_TEST
+ depends on GPIOLIB || COMPILE_TEST
depends on COMMON_CLK
select VIDEO_OV7670 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR
select I2C_GPIO
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0102/1257] staging: media: av7110: fix corrupted BER reporting in sp8870
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0101/1257] media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0103/1257] staging: media: av7110: fix sp8870 initialization failure state Greg Kroah-Hartman
` (896 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Punnay Sharma, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Punnay Sharma <punnaysharma805@gmail.com>
[ Upstream commit 5764f9bd7b7a72c6df49db6c8c00d4f9994a55ba ]
In sp8870_read_ber(), the 14-bit Bit Error Rate (BER) is assembled by
reading two I2C registers: 0xC08 (lower 6 bits) and 0xC07 (upper 8 bits).
The current implementation masks the lower bits via `tmp = ret & 0x3F;`
but subsequently overwrites `tmp` entirely when processing the upper
bits using a direct assignment (`tmp = ret << 6;`). This logical error
causes the lower 6 bits of the BER hardware metric to be silently
discarded.
Fix this by using a bitwise OR (`tmp |= ret << 6;`) to correctly merge
the MSB and LSB payloads before returning the metric to the DVB core.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Punnay Sharma <punnaysharma805@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/av7110/sp8870.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/av7110/sp8870.c b/drivers/staging/media/av7110/sp8870.c
index 29fb4934c039c..77bebf2c7d5d8 100644
--- a/drivers/staging/media/av7110/sp8870.c
+++ b/drivers/staging/media/av7110/sp8870.c
@@ -401,7 +401,7 @@ static int sp8870_read_ber(struct dvb_frontend *fe, u32 *ber)
if (ret < 0)
return -EIO;
- tmp = ret << 6;
+ tmp |= ret << 6;
if (tmp >= 0x3FFF0)
tmp = ~0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0103/1257] staging: media: av7110: fix sp8870 initialization failure state
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0102/1257] staging: media: av7110: fix corrupted BER reporting in sp8870 Greg Kroah-Hartman
@ 2026-11-07 13:39 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0104/1257] media: m2m-deinterlace: fix default capture field Greg Kroah-Hartman
` (895 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Punnay Sharma, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Punnay Sharma <punnaysharma805@gmail.com>
[ Upstream commit 30684fa98394bc0eb4362282908612aab7d4dad9 ]
The SP8870 DVB frontend driver prematurely flags the device as
initialized at the very beginning of the sp8870_init() routine, prior
to requesting the firmware (dvb-fe-sp8870.fw) and executing the I2C
upload sequence.
If request_firmware() times out or sp8870_firmware_upload() encounters
an I2C bus error, the function aborts and returns -EIO. However,
because `state->initialised` is already set to 1, all subsequent
invocations of `fe->ops.init()` by the DVB core will immediately return
0 (success) without attempting to load the firmware again. This leaves
the demodulator microcontroller halted and the frontend permanently dead
until the module is forcibly reloaded.
Relocate the `state->initialised = 1` assignment to the end of
sp8870_init(), ensuring the flag is only set after the firmware is
successfully uploaded and the system controller is actually restarted.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Punnay Sharma <punnaysharma805@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/av7110/sp8870.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/media/av7110/sp8870.c b/drivers/staging/media/av7110/sp8870.c
index 77bebf2c7d5d8..be62933cef450 100644
--- a/drivers/staging/media/av7110/sp8870.c
+++ b/drivers/staging/media/av7110/sp8870.c
@@ -315,7 +315,6 @@ static int sp8870_init(struct dvb_frontend *fe)
sp8870_wake_up(state);
if (state->initialised)
return 0;
- state->initialised = 1;
dprintk("initialising frontend...\n");
@@ -353,6 +352,8 @@ static int sp8870_init(struct dvb_frontend *fe)
sp8870_writereg(state, 0x0D00, 0x010);
sp8870_writereg(state, 0x0D01, 0x000);
+ state->initialised = 1;
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0104/1257] media: m2m-deinterlace: fix default capture field
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-11-07 13:39 ` [PATCH 7.3 0103/1257] staging: media: av7110: fix sp8870 initialization failure state Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0105/1257] wifi: mac80211: queue frames while off-channel Greg Kroah-Hartman
` (894 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacopo Mondi, Xu Rao, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
[ Upstream commit 4ee3ebede5d01efdcdd88c94f9df271d2eb237de ]
queue_init() initializes default formats for both the source and capture
queues. It first sets the source field to V4L2_FIELD_SEQ_TB, but then
stores the capture default, V4L2_FIELD_INTERLACED_TB, in the source queue
again while initializing the capture queue.
This overwrites the valid source default and leaves the capture field at
its zero-initialized value, V4L2_FIELD_ANY. vidioc_streamon() accepts
only V4L2_FIELD_SEQ_TB or V4L2_FIELD_SEQ_BT on the source queue, and
requires the capture queue to use a compatible interlaced or NONE field.
Userspace that relies on the default formats can therefore get -EINVAL
when starting streaming.
Initialize the capture field instead. The bug is usually hidden because
mem2mem applications commonly call S_FMT on both queues before streaming;
the TRY_FMT paths normalize the fields and S_FMT overwrites q_data[].field.
Fixes: 8f0755c06b90 ("[media] media: Add mem2mem deinterlacing driver")
Cc: stable@vger.kernel.org
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/m2m-deinterlace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/m2m-deinterlace.c b/drivers/media/platform/m2m-deinterlace.c
index 1d0e70eaea3d0..9dcc4bd6cbdd5 100644
--- a/drivers/media/platform/m2m-deinterlace.c
+++ b/drivers/media/platform/m2m-deinterlace.c
@@ -822,7 +822,7 @@ static int queue_init(void *priv, struct vb2_queue *src_vq,
q_data[V4L2_M2M_DST].width = 640;
q_data[V4L2_M2M_DST].height = 480;
q_data[V4L2_M2M_DST].sizeimage = (640 * 480 * 3) / 2;
- q_data[V4L2_M2M_SRC].field = V4L2_FIELD_INTERLACED_TB;
+ q_data[V4L2_M2M_DST].field = V4L2_FIELD_INTERLACED_TB;
return vb2_queue_init(dst_vq);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0105/1257] wifi: mac80211: queue frames while off-channel
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0104/1257] media: m2m-deinterlace: fix default capture field Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0106/1257] ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+ Greg Kroah-Hartman
` (893 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanislaw Gruszka, Johannes Berg,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <stf_xl@wp.pl>
[ Upstream commit 13e51269b6656768dc595ed6025e4974f2026543 ]
Drivers without FAST_XMIT and hardware scan support currently drop TX
frames during software scanning while being off-channel. This happens
in ieee80211_tx_h_check_assoc() before frames reach internal TX queue.
Move the off-channel check to invoke_tx_handlers_late(), after
ieee80211_queue_skb(). Frames can then remain queued and be transmitted
when the interface returns on-channel. This how TX works currently when
code goes via ieee80211_xmit_fast() path.
Below is rt2x00 driver ping output example while scanning, before and
after the fix. After the fix, packets are no longer lost. Some have
increased latency, what is expected behavior.
BEFORE:
64 bytes from 192.168.0.1: icmp_seq=29 ttl=64 time=3.61 ms
64 bytes from 192.168.0.1: icmp_seq=31 ttl=64 time=3.33 ms # Missed 30
64 bytes from 192.168.0.1: icmp_seq=32 ttl=64 time=4.03 ms
64 bytes from 192.168.0.1: icmp_seq=34 ttl=64 time=3.10 ms # Missed 33
64 bytes from 192.168.0.1: icmp_seq=36 ttl=64 time=3.04 ms # Missed 35
64 bytes from 192.168.0.1: icmp_seq=38 ttl=64 time=3.05 ms # Missed 37
64 bytes from 192.168.0.1: icmp_seq=40 ttl=64 time=4.14 ms # Missed 39
64 bytes from 192.168.0.1: icmp_seq=41 ttl=64 time=4.50 ms
AFTER:
64 bytes from 192.168.0.1: icmp_seq=29 ttl=64 time=3.40 ms
64 bytes from 192.168.0.1: icmp_seq=30 ttl=64 time=6.10 ms
64 bytes from 192.168.0.1: icmp_seq=31 ttl=64 time=4.69 ms
64 bytes from 192.168.0.1: icmp_seq=32 ttl=64 time=4.49 ms
64 bytes from 192.168.0.1: icmp_seq=33 ttl=64 time=148 ms
64 bytes from 192.168.0.1: icmp_seq=34 ttl=64 time=6.83 ms
64 bytes from 192.168.0.1: icmp_seq=35 ttl=64 time=8.66 ms
64 bytes from 192.168.0.1: icmp_seq=36 ttl=64 time=13.0 ms
64 bytes from 192.168.0.1: icmp_seq=37 ttl=64 time=4.78 ms
64 bytes from 192.168.0.1: icmp_seq=38 ttl=64 time=3.85 ms
Cc: <stable@vger.kernel.org>
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Link: https://patch.msgid.link/20260908124651.2995-1-stf_xl@wp.pl
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/tx.c | 52 +++++++++++++++++++++++++----------------------
1 file changed, 28 insertions(+), 24 deletions(-)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d51f810dd2c5b..5714634c81033 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -269,7 +269,6 @@ ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
static ieee80211_tx_result debug_noinline
ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
{
-
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
bool assoc = false;
@@ -277,20 +276,6 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
return TX_CONTINUE;
- if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
- test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
- !ieee80211_is_probe_req(hdr->frame_control) &&
- !ieee80211_is_any_nullfunc(hdr->frame_control))
- /*
- * When software scanning only nullfunc frames (to notify
- * the sleep state to the AP) and probe requests (for the
- * active scan) are allowed, all other frames should not be
- * sent and we should not get here, but if we do
- * nonetheless, drop them to avoid sending them
- * off-channel. See __ieee80211_start_scan() for more.
- */
- return TX_DROP;
-
if (tx->sdata->vif.type == NL80211_IFTYPE_OCB)
return TX_CONTINUE;
@@ -807,6 +792,33 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
return TX_CONTINUE;
}
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_check_offchannel(struct ieee80211_tx_data *tx)
+{
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
+ if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
+ return TX_CONTINUE;
+
+ if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
+ test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
+ !ieee80211_is_probe_req(hdr->frame_control) &&
+ !ieee80211_is_any_nullfunc(hdr->frame_control)) {
+ /*
+ * When software scanning only nullfunc frames (to notify
+ * the sleep state to the AP) and probe requests (for the
+ * active scan) are allowed, all other frames should not be
+ * sent and we should not get here, but if we do
+ * nonetheless, drop them to avoid sending them
+ * off-channel. See __ieee80211_start_scan() for more.
+ */
+ return TX_DROP;
+ }
+
+ return TX_CONTINUE;
+}
+
static __le16 ieee80211_tx_next_seq(struct sta_info *sta, int tid)
{
u16 *seq = &sta->tid_seq[tid];
@@ -1873,6 +1885,7 @@ static int invoke_tx_handlers_late(struct ieee80211_tx_data *tx)
goto txh_done;
}
+ CALL_TXH(ieee80211_tx_h_check_offchannel);
CALL_TXH(ieee80211_tx_h_michael_mic_add);
CALL_TXH(ieee80211_tx_h_sequence);
CALL_TXH(ieee80211_tx_h_fragment);
@@ -4745,10 +4758,6 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
queue = ieee80211_select_queue(sdata, sta, skb);
skb_set_queue_mapping(skb, queue);
- if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
- test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
- goto out_free;
-
skb = skb_share_check(skb, GFP_ATOMIC);
if (unlikely(!skb))
return;
@@ -4825,11 +4834,6 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
ieee80211_tpt_led_trig_tx(local, len);
ieee80211_tx_8023(sdata, skb, sta, false);
-
- return;
-
-out_free:
- kfree_skb(skb);
}
static bool ieee80211_check_mcast_offload(struct ieee80211_sub_if_data *sdata,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0106/1257] ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0105/1257] wifi: mac80211: queue frames while off-channel Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0107/1257] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check Greg Kroah-Hartman
` (892 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
[ Upstream commit 233d36a96009682208cc4ca1139b9e5641a8bf09 ]
wsa_macro_set_spkr_mode() unconditionally writes CDC_WSA_COMPANDER1_CTL3
(0x5CC) and CDC_WSA_COMPANDER1_CTL7 (0x5DC). On v2.5+ silicon these
registers moved to CDC_2_5_WSA_COMPANDER1_CTL3 (0x5EC) and
CDC_2_5_WSA_COMPANDER1_CTL7 (0x5FC); the v2.1 addresses are dead on
that hardware, so the update_bits() calls take a bus error:
wsa_macro 6c90000.codec: ASoC error (-5): at
snd_soc_component_update_bits() on 6c90000.codec for
register: [0x000005dc]
The flat regcache had been hiding the read side of this by returning
the zero-initialised cache slot instead of doing a bus read, so the
error only becomes visible once the cache reports the miss honestly
and regmap falls back to a real bus read.
Select the correct address for Compander1 CTL3/CTL7 based on
codec_version. The Compander0 and Boost registers used in the same
function have the same address across versions, so they stay
unchanged. Also collapse the two mode branches to a single sequence
with mode-selected values, which is what the switch was doing anyway.
Fixes: 727de4fbc546 ("ASoC: codecs: lpass-wsa-macro: Correct support for newer v2.5 version")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20260908082806.648797-2-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/lpass-wsa-macro.c | 42 ++++++++++++++++++------------
1 file changed, 25 insertions(+), 17 deletions(-)
diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c
index 38e37908baf91..f7dad096bfa39 100644
--- a/sound/soc/codecs/lpass-wsa-macro.c
+++ b/sound/soc/codecs/lpass-wsa-macro.c
@@ -1129,27 +1129,35 @@ static const struct regmap_config wsa_regmap_config = {
int wsa_macro_set_spkr_mode(struct snd_soc_component *component, int mode)
{
struct wsa_macro *wsa = snd_soc_component_get_drvdata(component);
+ unsigned int comp1_ctl3, comp1_ctl7;
+ u8 comp_val, boost_val;
wsa->spkr_mode = mode;
- switch (mode) {
- case WSA_MACRO_SPKR_MODE_1:
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL3, 0x80, 0x00);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL3, 0x80, 0x00);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL7, 0x01, 0x00);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL7, 0x01, 0x00);
- snd_soc_component_update_bits(component, CDC_WSA_BOOST0_BOOST_CTL, 0x7C, 0x44);
- snd_soc_component_update_bits(component, CDC_WSA_BOOST1_BOOST_CTL, 0x7C, 0x44);
- break;
- default:
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL3, 0x80, 0x80);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL3, 0x80, 0x80);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL7, 0x01, 0x01);
- snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL7, 0x01, 0x01);
- snd_soc_component_update_bits(component, CDC_WSA_BOOST0_BOOST_CTL, 0x7C, 0x58);
- snd_soc_component_update_bits(component, CDC_WSA_BOOST1_BOOST_CTL, 0x7C, 0x58);
- break;
+ /* Compander1 CTL3/CTL7 moved on v2.5+ silicon. */
+ if (wsa->codec_version >= LPASS_CODEC_VERSION_2_5) {
+ comp1_ctl3 = CDC_2_5_WSA_COMPANDER1_CTL3;
+ comp1_ctl7 = CDC_2_5_WSA_COMPANDER1_CTL7;
+ } else {
+ comp1_ctl3 = CDC_WSA_COMPANDER1_CTL3;
+ comp1_ctl7 = CDC_WSA_COMPANDER1_CTL7;
}
+
+ if (mode == WSA_MACRO_SPKR_MODE_1) {
+ comp_val = 0x00;
+ boost_val = 0x44;
+ } else {
+ comp_val = 0x80;
+ boost_val = 0x58;
+ }
+
+ snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL3, 0x80, comp_val);
+ snd_soc_component_update_bits(component, comp1_ctl3, 0x80, comp_val);
+ snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL7, 0x01, comp_val ? 0x01 : 0x00);
+ snd_soc_component_update_bits(component, comp1_ctl7, 0x01, comp_val ? 0x01 : 0x00);
+ snd_soc_component_update_bits(component, CDC_WSA_BOOST0_BOOST_CTL, 0x7C, boost_val);
+ snd_soc_component_update_bits(component, CDC_WSA_BOOST1_BOOST_CTL, 0x7C, boost_val);
+
return 0;
}
EXPORT_SYMBOL(wsa_macro_set_spkr_mode);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0107/1257] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0106/1257] ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+ Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0108/1257] media: microchip-isc: fix awb_mutex and lock lifecycle Greg Kroah-Hartman
` (891 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Wang Yan,
Athira Rajeev, Arnaldo Carvalho de Melo, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yan <wangyan01@kylinos.cn>
[ Upstream commit d9c7e2ede92ce258a5d4a6cbc55f75acd379c97d ]
min_sz is set to sizeof(u64) * POWERPC_VPADTL_TYPE, but the code reads
auxtrace_info->priv[POWERPC_VPADTL_TYPE], which needs at least
POWERPC_VPADTL_TYPE + 1 elements. POWERPC_VPADTL_TYPE is the first
enumerator of the priv index enum (0), so min_sz evaluates to 0 and the
check validates only the perf_record_auxtrace_info header itself. A
PERF_RECORD_AUXTRACE_INFO event carrying a zero-length priv array then
passes the size check, and the subsequent priv[POWERPC_VPADTL_TYPE]
read runs one u64 past the validated region.
This is the same off-by-one fixed for Intel PT by commit c4362d5e1a5e
("perf intel-pt: Fix off-by-one in auxtrace_info minimum size check")
and for Intel BTS by commit b9fb8225951c ("perf intel-bts: Fix off-by-one
in auxtrace_info minimum size check").
Use sizeof(u64) * (POWERPC_VPADTL_TYPE + 1) so the highest accessed
priv index is covered by the minimum-size validation.
Fixes: c4bbd4ec2e50a9ed ("perf powerpc: Process auxtrace events and display in 'perf report -D'")
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Cc: Athira Rajeev <atrajeev@linux.ibm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/powerpc-vpadtl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/powerpc-vpadtl.c b/tools/perf/util/powerpc-vpadtl.c
index af6783cfdb53d..032864e3884af 100644
--- a/tools/perf/util/powerpc-vpadtl.c
+++ b/tools/perf/util/powerpc-vpadtl.c
@@ -683,7 +683,7 @@ int powerpc_vpadtl_process_auxtrace_info(union perf_event *event,
struct perf_session *session)
{
struct perf_record_auxtrace_info *auxtrace_info = &event->auxtrace_info;
- size_t min_sz = sizeof(u64) * POWERPC_VPADTL_TYPE;
+ size_t min_sz = sizeof(u64) * (POWERPC_VPADTL_TYPE + 1);
struct powerpc_vpadtl *vpa;
int err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0108/1257] media: microchip-isc: fix awb_mutex and lock lifecycle
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0107/1257] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0109/1257] media: microchip-isc: synchronize the IRQ before disabling clocks on stop Greg Kroah-Hartman
` (890 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eugen Hristev, Balakrishnan Sambath,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit 5540b48c0702f6a1389db3d473d7fd0db930422a ]
isc->lock and awb_mutex were initialised in isc_async_complete() and
destroyed in isc_async_unbind(), tying their lifetime to the subdev
bind/unbind cycle instead of the device:
- isc_async_unbind() destroyed awb_mutex before cancel_work_sync(),
which takes it;
- a failed .complete() left them initialised, and isc->lock was
destroyed only on the .complete() error path, so the normal unbind
path leaked it;
- a rebind runs .complete() again and reinitialises a live mutex.
Initialise both with devm_mutex_init() at probe so they live for the
whole device lifetime and are freed at remove, and drop the init and
destroy from the .complete()/.unbind() callbacks.
isc_async_complete_err then only returned ret, so drop the label and
return directly at each error site.
Fixes: 314c96e5203d ("media: atmel: atmel-isc-base: use mutex to lock awb workq from streaming")
Cc: stable@vger.kernel.org
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/microchip/microchip-isc-base.c | 15 ++++-----------
.../platform/microchip/microchip-sama5d2-isc.c | 9 +++++++++
.../platform/microchip/microchip-sama7g5-isc.c | 9 +++++++++
3 files changed, 22 insertions(+), 11 deletions(-)
diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index 32bdeae04ad07..ca4f3b5f58aa9 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1703,7 +1703,6 @@ static void isc_async_unbind(struct v4l2_async_notifier *notifier,
{
struct isc_device *isc = container_of(notifier->v4l2_dev,
struct isc_device, v4l2_dev);
- mutex_destroy(&isc->awb_mutex);
cancel_work_sync(&isc->awb_work);
video_unregister_device(&isc->video_dev);
v4l2_ctrl_handler_free(&isc->ctrls.handler);
@@ -1767,8 +1766,6 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
isc->current_subdev = container_of(notifier,
struct isc_subdev_entity, notifier);
- mutex_init(&isc->lock);
- mutex_init(&isc->awb_mutex);
init_completion(&isc->comp);
@@ -1787,7 +1784,7 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
ret = vb2_queue_init(q);
if (ret < 0) {
dev_err(isc->dev, "vb2_queue_init() failed: %d\n", ret);
- goto isc_async_complete_err;
+ return ret;
}
/* Init video dma queues */
@@ -1798,13 +1795,13 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
ret = isc_set_default_fmt(isc);
if (ret) {
dev_err(isc->dev, "Could not set default format\n");
- goto isc_async_complete_err;
+ return ret;
}
ret = isc_ctrl_init(isc);
if (ret) {
dev_err(isc->dev, "Init isc ctrols failed: %d\n", ret);
- goto isc_async_complete_err;
+ return ret;
}
/* Register video device */
@@ -1824,7 +1821,7 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
if (ret < 0) {
dev_err(isc->dev, "video_register_device failed: %d\n", ret);
- goto isc_async_complete_err;
+ return ret;
}
ret = isc_scaler_link(isc);
@@ -1839,10 +1836,6 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
isc_async_complete_unregister_device:
video_unregister_device(vdev);
-
-isc_async_complete_err:
- mutex_destroy(&isc->awb_mutex);
- mutex_destroy(&isc->lock);
return ret;
}
diff --git a/drivers/media/platform/microchip/microchip-sama5d2-isc.c b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
index 88e6d8e1c6c9c..18e1ec0b94fa6 100644
--- a/drivers/media/platform/microchip/microchip-sama5d2-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
@@ -30,6 +30,7 @@
#include <linux/interrupt.h>
#include <linux/math64.h>
#include <linux/module.h>
+#include <linux/mutex.h>
#include <linux/of.h>
#include <linux/of_graph.h>
#include <linux/platform_device.h>
@@ -424,6 +425,14 @@ static int microchip_isc_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, isc);
isc->dev = dev;
+ ret = devm_mutex_init(dev, &isc->lock);
+ if (ret)
+ return ret;
+
+ ret = devm_mutex_init(dev, &isc->awb_mutex);
+ if (ret)
+ return ret;
+
io_base = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(io_base))
return PTR_ERR(io_base);
diff --git a/drivers/media/platform/microchip/microchip-sama7g5-isc.c b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
index 77c6c183451bf..07cfe1109ff09 100644
--- a/drivers/media/platform/microchip/microchip-sama7g5-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
@@ -33,6 +33,7 @@
#include <linux/interrupt.h>
#include <linux/math64.h>
#include <linux/module.h>
+#include <linux/mutex.h>
#include <linux/of.h>
#include <linux/of_graph.h>
#include <linux/platform_device.h>
@@ -413,6 +414,14 @@ static int microchip_xisc_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, isc);
isc->dev = dev;
+ ret = devm_mutex_init(dev, &isc->lock);
+ if (ret)
+ return ret;
+
+ ret = devm_mutex_init(dev, &isc->awb_mutex);
+ if (ret)
+ return ret;
+
io_base = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(io_base))
return PTR_ERR(io_base);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0109/1257] media: microchip-isc: synchronize the IRQ before disabling clocks on stop
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0108/1257] media: microchip-isc: fix awb_mutex and lock lifecycle Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0110/1257] media: microchip-isc: disable histogram and flush AWB work on teardown Greg Kroah-Hartman
` (889 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balakrishnan Sambath, Eugen Hristev,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit 19fa5407da5ef3e605cacfcd90f70d8b2c121cd7 ]
isc_stop_streaming() masks the DMA interrupt and then drops the runtime
PM reference, which disables the ISC clocks. microchip_isc_interrupt()
may still be executing on another CPU at that point; it reads ISC_INTSR
over regmap, and touching the unclocked registers triggers an external
abort.
Store the IRQ number at probe and call synchronize_irq() after masking
the interrupt, before dropping the PM reference.
Fixes: 106267444f12 ("[media] atmel-isc: add the Image Sensor Controller code")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/microchip/microchip-isc-base.c | 3 +++
drivers/media/platform/microchip/microchip-isc.h | 1 +
drivers/media/platform/microchip/microchip-sama5d2-isc.c | 2 ++
drivers/media/platform/microchip/microchip-sama7g5-isc.c | 2 ++
4 files changed, 8 insertions(+)
diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index ca4f3b5f58aa9..debbc38717de1 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -425,6 +425,9 @@ static void isc_stop_streaming(struct vb2_queue *vq)
/* Disable DMA interrupt */
regmap_write(isc->regmap, ISC_INTDIS, ISC_INT_DDONE);
+ /* let a running IRQ handler finish before the clock is disabled */
+ synchronize_irq(isc->irq);
+
pm_runtime_put_sync(isc->dev);
/* Disable stream on the sub device */
diff --git a/drivers/media/platform/microchip/microchip-isc.h b/drivers/media/platform/microchip/microchip-isc.h
index ad4e98a1dd8fc..f5e322c2e36bc 100644
--- a/drivers/media/platform/microchip/microchip-isc.h
+++ b/drivers/media/platform/microchip/microchip-isc.h
@@ -287,6 +287,7 @@ struct isc_device {
u32 dcfg;
struct device *dev;
+ int irq;
struct v4l2_device v4l2_dev;
struct video_device video_dev;
diff --git a/drivers/media/platform/microchip/microchip-sama5d2-isc.c b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
index 18e1ec0b94fa6..5bd109e93a8fb 100644
--- a/drivers/media/platform/microchip/microchip-sama5d2-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
@@ -448,6 +448,8 @@ static int microchip_isc_probe(struct platform_device *pdev)
if (irq < 0)
return irq;
+ isc->irq = irq;
+
ret = devm_request_irq(dev, irq, microchip_isc_interrupt, 0,
"microchip-sama5d2-isc", isc);
if (ret < 0) {
diff --git a/drivers/media/platform/microchip/microchip-sama7g5-isc.c b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
index 07cfe1109ff09..d978ce448a4d2 100644
--- a/drivers/media/platform/microchip/microchip-sama7g5-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
@@ -437,6 +437,8 @@ static int microchip_xisc_probe(struct platform_device *pdev)
if (irq < 0)
return irq;
+ isc->irq = irq;
+
ret = devm_request_irq(dev, irq, microchip_isc_interrupt, 0,
"microchip-sama7g5-xisc", isc);
if (ret < 0) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0110/1257] media: microchip-isc: disable histogram and flush AWB work on teardown
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0109/1257] media: microchip-isc: synchronize the IRQ before disabling clocks on stop Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0111/1257] media: microchip-isc: do not touch WB registers when not streaming Greg Kroah-Hartman
` (888 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balakrishnan Sambath, Eugen Hristev,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit 00d87c379915a3689b2488bd37f490875d79e20f ]
isc_stop_streaming() and the isc_start_streaming() error path dropped the
runtime PM reference with the histogram still enabled. A HISDONE firing
just before the stop, or a failed isc_update_profile() on the start path,
can queue isc_awb_work(), which reads the histogram registers before
taking its own PM reference and faults on the unclocked device.
Disable the histogram, synchronize the IRQ and flush the work before the
device is left unclocked. isc_configure() is the one enabling the
histogram and then calling isc_update_profile(), so do the cleanup in its
own failure path; isc_stop_streaming() does the same on teardown.
synchronize_irq() must come before cancel_work_sync(), so an in-flight
handler cannot re-queue awb_work after it is cancelled.
Fixes: 93d4a26c3dab ("[media] atmel-isc: add the isc pipeline function")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/microchip/microchip-isc-base.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index debbc38717de1..0f486dd5bd82c 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -289,6 +289,7 @@ static int isc_configure(struct isc_device *isc)
struct regmap *regmap = isc->regmap;
u32 pfe_cfg0, dcfg, mask, pipeline;
struct isc_subdev_entity *subdev = isc->current_subdev;
+ int ret;
pfe_cfg0 = isc->config.sd_format->pfe_cfg0_bps;
pipeline = isc->config.bits_pipeline;
@@ -321,7 +322,15 @@ static int isc_configure(struct isc_device *isc)
isc_set_histogram(isc, false);
/* Update profile */
- return isc_update_profile(isc);
+ ret = isc_update_profile(isc);
+ if (ret) {
+ /* flush the histogram work before the clocks are gated */
+ isc_set_histogram(isc, false);
+ synchronize_irq(isc->irq);
+ cancel_work_sync(&isc->awb_work);
+ }
+
+ return ret;
}
static int isc_prepare_streaming(struct vb2_queue *vq)
@@ -425,9 +434,13 @@ static void isc_stop_streaming(struct vb2_queue *vq)
/* Disable DMA interrupt */
regmap_write(isc->regmap, ISC_INTDIS, ISC_INT_DDONE);
+ isc_set_histogram(isc, false);
+
/* let a running IRQ handler finish before the clock is disabled */
synchronize_irq(isc->irq);
+ cancel_work_sync(&isc->awb_work);
+
pm_runtime_put_sync(isc->dev);
/* Disable stream on the sub device */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0111/1257] media: microchip-isc: do not touch WB registers when not streaming
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0110/1257] media: microchip-isc: disable histogram and flush AWB work on teardown Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0112/1257] media: microchip-isc: fix PM runtime leak in AWB work handler Greg Kroah-Hartman
` (887 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eugen Hristev, Balakrishnan Sambath,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit d8983c47d4d95eb1ed889dbb7516d3738fa854d8 ]
isc_s_awb_ctrl() called isc_update_awb_ctrls() unconditionally, writing
the white balance registers even when the device is runtime suspended;
on many ARM platforms accessing the unclocked registers is an external
abort. The write was also done without awb_lock, racing isc_awb_work(),
which holds it so the DMA done IRQ cannot latch a half-updated pipeline.
Write the registers only while streaming and not stopping, under
awb_lock, and update the profile there. The isc->stop check covers the
window where isc_stop_streaming() has gated the clocks but vb2 still
reports streaming. Otherwise the new values stay cached and
isc_configure() programs them at the next stream start.
Fixes: 4e52889f48fe ("media: atmel: atmel-isc-base: expose white balance as v4l2 controls")
Cc: stable@vger.kernel.org
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/microchip/microchip-isc-base.c | 20 +++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index 0f486dd5bd82c..cf4611443fd13 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1511,20 +1511,24 @@ static int isc_s_awb_ctrl(struct v4l2_ctrl *ctrl)
if (ctrl->cluster[ISC_CTRL_GB_OFF]->is_new)
ctrls->offset[ISC_HIS_CFG_MODE_GB] = isc->gb_off_ctrl->val;
- isc_update_awb_ctrls(isc);
-
mutex_lock(&isc->awb_mutex);
- if (vb2_is_streaming(&isc->vb2_vidq)) {
+ if (vb2_is_streaming(&isc->vb2_vidq) && !isc->stop) {
+ unsigned long flags;
+
/*
- * If we are streaming, we can update profile to
- * have the new settings in place.
+ * awb_lock keeps the DMA done IRQ from latching a
+ * partially written WB pipeline.
*/
+ spin_lock_irqsave(&isc->awb_lock, flags);
+ isc_update_awb_ctrls(isc);
+ spin_unlock_irqrestore(&isc->awb_lock, flags);
+
isc_update_profile(isc);
} else {
/*
- * The auto cluster will activate automatically this
- * control. This has to be deactivated when not
- * streaming.
+ * Not streaming: keep the cached values for the next
+ * stream start and deactivate the cluster-activated
+ * do_white_balance button.
*/
v4l2_ctrl_activate(isc->do_wb_ctrl, false);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0112/1257] media: microchip-isc: fix PM runtime leak in AWB work handler
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0111/1257] media: microchip-isc: do not touch WB registers when not streaming Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0113/1257] media: microchip-isc: dont sleep in the clk .is_enabled callback Greg Kroah-Hartman
` (886 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balakrishnan Sambath, Eugen Hristev,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit 21ad8225822a892c4c273bf1368d477a83a19dbb ]
Early return when streaming stops skips pm_runtime_put_sync(),
leaking the reference and preventing runtime suspend.
Fixes: 314c96e5203d ("media: atmel: atmel-isc-base: use mutex to lock awb workq from streaming")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/microchip/microchip-isc-base.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index cf4611443fd13..21d108eb93c7b 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1432,7 +1432,7 @@ static void isc_awb_work(struct work_struct *w)
/* streaming is not active anymore */
if (isc->stop) {
mutex_unlock(&isc->awb_mutex);
- return;
+ goto out_pm_put;
}
isc_update_profile(isc);
@@ -1443,6 +1443,7 @@ static void isc_awb_work(struct work_struct *w)
if (ctrls->awb)
regmap_write(regmap, ISC_CTRLEN, ISC_CTRL_HISREQ);
+out_pm_put:
pm_runtime_put_sync(isc->dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0113/1257] media: microchip-isc: dont sleep in the clk .is_enabled callback
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0112/1257] media: microchip-isc: fix PM runtime leak in AWB work handler Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0114/1257] media: stm32: csi: correct remote pad retrieval Greg Kroah-Hartman
` (885 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balakrishnan Sambath, Eugen Hristev,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit 61490ff518c7b3ea3ff1cd16bbc012e9e4f1ab74 ]
isc_clk_is_enabled() calls pm_runtime_resume_and_get() and
pm_runtime_put_sync(), which can sleep and are not safe here, as
.is_enabled must run in atomic context. clk_disable_unused() calls it so
at boot, and CONFIG_DEBUG_ATOMIC_SLEEP reports a "sleeping function
called from invalid context" BUG.
Use the atomic-safe pm_runtime_get_if_active() and pm_runtime_put()
instead. A suspended ISC has its clocks gated, so report the clock
disabled when the device is not already active.
Fixes: 01192aa1c5c2 ("media: atmel-isc: Enable the clocks during probe")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/microchip/microchip-isc-clk.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/microchip/microchip-isc-clk.c b/drivers/media/platform/microchip/microchip-isc-clk.c
index 24358d804e75d..66dc522a61908 100644
--- a/drivers/media/platform/microchip/microchip-isc-clk.c
+++ b/drivers/media/platform/microchip/microchip-isc-clk.c
@@ -98,15 +98,14 @@ static int isc_clk_is_enabled(struct clk_hw *hw)
{
struct isc_clk *isc_clk = to_isc_clk(hw);
u32 status;
- int ret;
- ret = pm_runtime_resume_and_get(isc_clk->dev);
- if (ret < 0)
+ /* Runs in atomic context, so must not sleep to resume the ISC. */
+ if (pm_runtime_get_if_active(isc_clk->dev) <= 0)
return 0;
regmap_read(isc_clk->regmap, ISC_CLKSR, &status);
- pm_runtime_put_sync(isc_clk->dev);
+ pm_runtime_put(isc_clk->dev);
return status & ISC_CLK(isc_clk->id) ? 1 : 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0114/1257] media: stm32: csi: correct remote pad retrieval
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0113/1257] media: microchip-isc: dont sleep in the clk .is_enabled callback Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0115/1257] media: stm32: csi: unregister async notifier on cleanup Greg Kroah-Hartman
` (884 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Alain Volmat, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alain Volmat <alain.volmat@foss.st.com>
[ Upstream commit b83651d321d4fd07979a59f359dcb0266391f17a ]
The function media_entity_get_fwnode_pad is called in order to
retrieve the remote pad, which is the source of the CSI.
However this function is expecting the sensor endpoint fwnode
and not sensor device fwnode as it is currently given.
Correct this by properly relying on the notified matched fwnode
data instead of the subdev entity fwnode.
Cc: stable@kernel.org
Fixes: dcb0f4c16be5 ("media: stm32: csi: addition of the STM32 CSI driver")
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/st/stm32/stm32-csi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/st/stm32/stm32-csi.c b/drivers/media/platform/st/stm32/stm32-csi.c
index fd2b6dfbd44c5..ecd0ed8e76b59 100644
--- a/drivers/media/platform/st/stm32/stm32-csi.c
+++ b/drivers/media/platform/st/stm32/stm32-csi.c
@@ -825,7 +825,7 @@ static int stm32_csi_async_bound(struct v4l2_async_notifier *notifier,
int remote_pad;
remote_pad = media_entity_get_fwnode_pad(&s_subdev->entity,
- s_subdev->fwnode,
+ asd->match.fwnode,
MEDIA_PAD_FL_SOURCE);
if (remote_pad < 0) {
dev_err(csidev->dev, "Couldn't find output pad for subdev %s\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0115/1257] media: stm32: csi: unregister async notifier on cleanup
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0114/1257] media: stm32: csi: correct remote pad retrieval Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0116/1257] mtd: rawnand: sunxi: reject ECC maximization on small pages Greg Kroah-Hartman
` (883 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 4957d480a0c87cf3d024e6ff1f57d1222f9212cb ]
stm32_csi_parse_dt() registers the async notifier before probe finishes.
If a later operation fails, the error path only cleans up the notifier's
connections. It does not unregister the notifier, leaving its entry on
the global notifier list after the devm-allocated csidev is freed.
The remove path has the same problem. A later async operation can then
walk the stale notifier entry and access freed memory.
Unregister the notifier before cleaning up its resources on both paths.
Fixes: dcb0f4c16be5 ("media: stm32: csi: addition of the STM32 CSI driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/st/stm32/stm32-csi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/st/stm32/stm32-csi.c b/drivers/media/platform/st/stm32/stm32-csi.c
index ecd0ed8e76b59..78c68cf90ffcb 100644
--- a/drivers/media/platform/st/stm32/stm32-csi.c
+++ b/drivers/media/platform/st/stm32/stm32-csi.c
@@ -1059,6 +1059,7 @@ static int stm32_csi_probe(struct platform_device *pdev)
return 0;
err_cleanup:
+ v4l2_async_nf_unregister(&csidev->notifier);
v4l2_async_nf_cleanup(&csidev->notifier);
return ret;
}
@@ -1067,6 +1068,8 @@ static void stm32_csi_remove(struct platform_device *pdev)
{
struct stm32_csi_dev *csidev = platform_get_drvdata(pdev);
+ v4l2_async_nf_unregister(&csidev->notifier);
+ v4l2_async_nf_cleanup(&csidev->notifier);
v4l2_async_unregister_subdev(&csidev->sd);
pm_runtime_disable(&pdev->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0116/1257] mtd: rawnand: sunxi: reject ECC maximization on small pages
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0115/1257] media: stm32: csi: unregister async notifier on cleanup Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0117/1257] mtd: rawnand: sunxi: fix free OOB section offsets Greg Kroah-Hartman
` (882 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Hilliard, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hilliard <james.hilliard1@gmail.com>
[ Upstream commit a3c84084a73e170374b7dd493947efdef4ee57bc ]
When nand-ecc-maximize is set, the driver selects a 1024-byte ECC step
and divides the available OOB bytes by the resulting number of steps. A
NAND with a smaller page therefore produces zero steps and a division by
zero.
The older controllers also provide a 512-byte ECC block mode, but the
hardware documentation describes that as an ECC block size within NAND
pages whose supported sizes start at 1024 bytes. It does not document a
512-byte NAND page mode.
Reject pages smaller than 1024 bytes before deriving the step count. This
prevents the division by zero at the point where the incompatible
maximized geometry is selected without changing explicitly configured
512-byte ECC block handling.
Fixes: 4796d8655915 ("mtd: nand: sunxi: Support ECC maximization")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/sunxi_nand.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 45ccbce91551b..4f9c229c34bc0 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -2077,6 +2077,9 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
if (nanddev->ecc.user_conf.flags & NAND_ECC_MAXIMIZE_STRENGTH) {
int bytes = mtd->oobsize;
+ if (mtd->writesize < 1024)
+ return -EINVAL;
+
ecc->size = 1024;
nsectors = mtd->writesize / ecc->size;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0117/1257] mtd: rawnand: sunxi: fix free OOB section offsets
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0116/1257] mtd: rawnand: sunxi: reject ECC maximization on small pages Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0118/1257] pinctrl: renesas: rzt2h: Fix used_irqs indexing in clear path Greg Kroah-Hartman
` (881 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Hilliard, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hilliard <james.hilliard1@gmail.com>
[ Upstream commit c56d52865624ca236c44838ef9366a8597b6af6c ]
The sunxi hardware ECC OOB layout places protected user data before the
ECC bytes for every step. Since variable user-data lengths were
introduced, free sections after the first use sunxi_get_ecc_offset(),
which skips the protected user data and points at the ECC bytes instead.
As a result, the MTD free-OOB interface addresses ECC bytes rather than
the protected user data for those sections. Use sunxi_get_oob_offset() to
point each free section at the beginning of its protected user data. Keep
the special two-byte offset for section zero to reserve the bad block
marker.
Fixes: 54dcd6aa69db ("mtd: rawnand: sunxi: introduce maximize variable user data length")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/sunxi_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 4f9c229c34bc0..89fe3c0379f74 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -2012,7 +2012,7 @@ static int sunxi_nand_ooblayout_free(struct mtd_info *mtd, int section,
return 0;
}
- oobregion->offset = sunxi_get_ecc_offset(sunxi_nand, ecc, section);
+ oobregion->offset = sunxi_get_oob_offset(sunxi_nand, ecc, section);
oobregion->length = user_data_sz;
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0118/1257] pinctrl: renesas: rzt2h: Fix used_irqs indexing in clear path
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0117/1257] mtd: rawnand: sunxi: fix free OOB section offsets Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0119/1257] media: adv7604: avoid negative array index in log_status when cp_read fails Greg Kroah-Hartman
` (880 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Cosmin Tanislav,
Geert Uytterhoeven, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
[ Upstream commit c0de88659b68402ed7e53fb998a058ef430c787b ]
struct rzt2h_pinctrl::used_irqs is supposed to be indexed based on the
parent IRQ number. Do the translation using rzt2h_gpio_irq_map and
clear it properly.
Cc: stable@kernel.org
Fixes: 829dde3369a9 ("pinctrl: renesas: rzt2h: Add GPIO IRQ chip to handle interrupts")
Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260817185700.322370-2-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/renesas/pinctrl-rzt2h.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/renesas/pinctrl-rzt2h.c b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
index eb70aee39f1ae..a37f1e3994467 100644
--- a/drivers/pinctrl/renesas/pinctrl-rzt2h.c
+++ b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
@@ -1050,8 +1050,13 @@ static void rzt2h_gpio_irq_domain_free(struct irq_domain *domain, unsigned int v
irq_hw_number_t hwirq = irqd_to_hwirq(d);
u8 port = RZT2H_PIN_ID_TO_PORT(hwirq);
u8 pin = RZT2H_PIN_ID_TO_PIN(hwirq);
+ u8 parent_irq;
+
+ parent_irq = rzt2h_gpio_irq_map[hwirq];
+ if (parent_irq < RZT2H_INTERRUPTS_START)
+ return;
- if (test_and_clear_bit(hwirq - RZT2H_INTERRUPTS_START, pctrl->used_irqs))
+ if (test_and_clear_bit(parent_irq - RZT2H_INTERRUPTS_START, pctrl->used_irqs))
rzt2h_pinctrl_set_gpio_en(pctrl, port, pin, false);
irq_domain_free_irqs_common(domain, virq, nr_irqs);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0119/1257] media: adv7604: avoid negative array index in log_status when cp_read fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0118/1257] pinctrl: renesas: rzt2h: Fix used_irqs indexing in clear path Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0120/1257] media: stv090x: bound DiSEqC reply length to msg[] size Greg Kroah-Hartman
` (879 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 10d8dfda1c08f6788049aa100685e223d857f901 ]
cp_read() returns the negative errno from regmap_read() on I2C failure.
adv76xx_log_status() shifts the result right by 4 and uses it directly
to index csc_coeff_sel_rb[16] causing the right shift of a negative
number to result in -1, reading a negative place in the array.
Commit 8163419e3e05 ("media: adv7842: Avoid possible out-of-bounds
array accesses in adv7842_cp_log_status()") fixed the identical pattern
in the adv7842, so do the same thing here.
Fixes: 54450f591c99 ("[media] adv7604: driver for the Analog Devices ADV7604 video decoder")
Cc: stable@kernel.org
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/adv7604.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index ac9c69ce438f1..231edd3797abe 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -2641,8 +2641,9 @@ static int adv76xx_log_status(struct v4l2_subdev *sd)
"(16-235)" : "(0-255)",
(reg_io_0x02 & 0x08) ? "enabled" : "disabled");
}
+ ret = cp_read(sd, info->cp_csc) >> 4;
v4l2_info(sd, "Color space conversion: %s\n",
- csc_coeff_sel_rb[cp_read(sd, info->cp_csc) >> 4]);
+ ret < 0 ? "" : csc_coeff_sel_rb[ret]);
if (!is_digital_input(sd))
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0120/1257] media: stv090x: bound DiSEqC reply length to msg[] size
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0119/1257] media: adv7604: avoid negative array index in log_status when cp_read fails Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0121/1257] media: stv0900: " Greg Kroah-Hartman
` (878 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit bad6ce6e0856f344910ba95b006e6c0ebee2d9c8 ]
The FIFO_BYTENBR_FIELD register field is 4 bits wide, giving a length
of 0..15, but reply->msg is __u8[4] in struct dvb_diseqc_slave_reply.
A faulty or malicious DiSEqC slave (or i2c bus glitch) reporting more
than 4 bytes will the array and clobber the stack.
The stb0899, tda10071, and s5h1420 drivers all properly bound the FIFO
count against sizeof(reply->msg) before the read loop, so do the same
thing in this driver.
Fixes: e415c689a884 ("V4L/DVB (11579): Initial go at TT S2-1600")
Cc: stable@kernel.org
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-frontends/stv090x.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/dvb-frontends/stv090x.c b/drivers/media/dvb-frontends/stv090x.c
index 932bbed5497aa..63be9ee104abc 100644
--- a/drivers/media/dvb-frontends/stv090x.c
+++ b/drivers/media/dvb-frontends/stv090x.c
@@ -3902,6 +3902,8 @@ static int stv090x_recv_slave_reply(struct dvb_frontend *fe, struct dvb_diseqc_s
if (rx_end) {
reply->msg_len = STV090x_GETFIELD_Px(reg, FIFO_BYTENBR_FIELD);
+ if (reply->msg_len > sizeof(reply->msg))
+ reply->msg_len = sizeof(reply->msg);
for (i = 0; i < reply->msg_len; i++)
reply->msg[i] = STV090x_READ_DEMOD(state, DISRXDATA);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0121/1257] media: stv0900: bound DiSEqC reply length to msg[] size
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0120/1257] media: stv090x: bound DiSEqC reply length to msg[] size Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0122/1257] media: synopsys: hdmirx: use request_any_context_irq() for 5V detection IRQ Greg Kroah-Hartman
` (877 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 6d7e70111b9c80a9e4cb17fe6a6c4f5470847722 ]
The FIFO_BYTENBR field is 4 bits (mask 0x0f), giving a length of 0..15
but reply->msg is __u8[4] in struct dvb_diseqc_slave_reply. A faulty or
malicious device reporting more than 4 bytes will the array and clobber
the stack.
The stb0899, tda10071, and s5h1420 drivers all properly bound the FIFO
count against sizeof(reply->msg) before the read loop, so do the same
thing in this driver.
Fixes: 99277b3824e4 ("V4L/DVB (10803): Add core code for ST STV0900 dual demodulator.")
Cc: stable@kernel.org
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-frontends/stv0900_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/dvb-frontends/stv0900_core.c b/drivers/media/dvb-frontends/stv0900_core.c
index d15c55de2723e..0ca6b6d812731 100644
--- a/drivers/media/dvb-frontends/stv0900_core.c
+++ b/drivers/media/dvb-frontends/stv0900_core.c
@@ -1773,6 +1773,8 @@ static int stv0900_recv_slave_reply(struct dvb_frontend *fe,
if (stv0900_get_bits(intp, RX_END)) {
reply->msg_len = stv0900_get_bits(intp, FIFO_BYTENBR);
+ if (reply->msg_len > sizeof(reply->msg))
+ reply->msg_len = sizeof(reply->msg);
for (i = 0; i < reply->msg_len; i++)
reply->msg[i] = stv0900_read_reg(intp, DISRXDATA);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0122/1257] media: synopsys: hdmirx: use request_any_context_irq() for 5V detection IRQ
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0121/1257] media: stv0900: " Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0123/1257] media: nuvoton: npcm-video: quiesce VCD IRQ before teardown Greg Kroah-Hartman
` (876 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Alexander Shiyan,
Dmitry Osipenko, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <eagle.alexander923@gmail.com>
[ Upstream commit fce1e4fa3867c0ff19a31f9977741696710855a6 ]
Replace devm_request_irq() with devm_request_any_context_irq()
for the 5V detection interrupt handler. This allows the kernel
to choose the appropriate execution context (hardirq or threaded)
depending on the underlying interrupt controller. On some platforms,
the interrupt may be nested or require a threaded handler, and
using the fixed hardirq version can cause probe failures.
Switching to the more flexible function improves driver portability
without affecting functionality.
Fixes: 7b59b132ad43 ("media: platform: synopsys: Add support for HDMI input driver")
Cc: stable@kernel.org
Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
index 25f8ca0d6d946..e84d4418c530e 100644
--- a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
+++ b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
@@ -2609,10 +2609,11 @@ static int hdmirx_setup_irq(struct snps_hdmirx_dev *hdmirx_dev,
irq_set_status_flags(irq, IRQ_NOAUTOEN);
hdmirx_dev->det_irq = irq;
- ret = devm_request_irq(dev, irq, hdmirx_5v_det_irq_handler,
- IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING,
- "rk_hdmirx-5v", hdmirx_dev);
- if (ret) {
+ ret = devm_request_any_context_irq(dev, irq, hdmirx_5v_det_irq_handler,
+ IRQF_TRIGGER_FALLING |
+ IRQF_TRIGGER_RISING,
+ "rk_hdmirx-5v", hdmirx_dev);
+ if (ret < 0) {
dev_err_probe(dev, ret, "failed to request hdmirx-5v irq\n");
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0123/1257] media: nuvoton: npcm-video: quiesce VCD IRQ before teardown
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0122/1257] media: synopsys: hdmirx: use request_any_context_irq() for 5V detection IRQ Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0124/1257] media: v4l2-ctrls: default HEVC SPS chroma format to 4:2:0 Greg Kroah-Hartman
` (875 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Fan Wu, Marvin Lin,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit ae8a4b51df30e39c07704efd5500361d8138c4d0 ]
The VCD IRQ is devm-requested, but npcm_video_remove() frees the video
object before devres releases that IRQ. The threaded handler dereferences
video->vcd_regmap before checking VIDEO_STREAMING, so an interrupt in that
interval can access freed memory.
Request the IRQ with IRQF_NO_AUTOEN. Enable it after starting capture and
setting VIDEO_STREAMING, and disable it first in stop_streaming().
disable_irq() waits for an in-flight threaded handler to finish, after
which stop_streaming() can mask and reset the VCD without a handler
re-enabling it.
Use vb2_video_unregister_device() during remove. It releases the vb2
queue and calls stop_streaming() for an active stream, ensuring that the
IRQ is disabled before the video object is freed. Do not release the queue
separately.
If streaming is never started, IRQF_NO_AUTOEN keeps the IRQ disabled
until devres releases it.
This issue was found by an in-house static analysis tool.
Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine")
Cc: stable@kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Tested-by: Marvin Lin <kflin@nuvoton.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/nuvoton/npcm-video.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/nuvoton/npcm-video.c b/drivers/media/platform/nuvoton/npcm-video.c
index 52505af35c087..c28d9d7edd834 100644
--- a/drivers/media/platform/nuvoton/npcm-video.c
+++ b/drivers/media/platform/nuvoton/npcm-video.c
@@ -120,6 +120,7 @@ struct npcm_video {
struct list_head buffers;
struct mutex buffer_lock; /* buffer list lock */
+ int irq;
unsigned long flags;
unsigned int sequence;
@@ -1486,6 +1487,7 @@ static int npcm_video_start_streaming(struct vb2_queue *q, unsigned int count)
}
set_bit(VIDEO_STREAMING, &video->flags);
+ enable_irq(video->irq);
return 0;
}
@@ -1494,6 +1496,7 @@ static void npcm_video_stop_streaming(struct vb2_queue *q)
struct npcm_video *video = vb2_get_drv_priv(q);
struct regmap *vcd = video->vcd_regmap;
+ disable_irq(video->irq);
clear_bit(VIDEO_STREAMING, &video->flags);
regmap_write(vcd, VCD_INTE, 0);
regmap_write(vcd, VCD_STAT, VCD_STAT_CLEAR);
@@ -1707,9 +1710,10 @@ static int npcm_video_init(struct npcm_video *video)
dev_err(dev, "Failed to find VCD IRQ\n");
return -ENODEV;
}
+ video->irq = irq;
rc = devm_request_threaded_irq(dev, irq, NULL, npcm_video_irq,
- IRQF_ONESHOT, DEVICE_NAME, video);
+ IRQF_ONESHOT | IRQF_NO_AUTOEN, DEVICE_NAME, video);
if (rc < 0) {
dev_err(dev, "Failed to request IRQ %d\n", irq);
return rc;
@@ -1807,8 +1811,7 @@ static void npcm_video_remove(struct platform_device *pdev)
struct v4l2_device *v4l2_dev = dev_get_drvdata(dev);
struct npcm_video *video = to_npcm_video(v4l2_dev);
- video_unregister_device(&video->vdev);
- vb2_queue_release(&video->queue);
+ vb2_video_unregister_device(&video->vdev);
v4l2_ctrl_handler_free(&video->ctrl_handler);
v4l2_device_unregister(v4l2_dev);
if (video->ece.enable)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0124/1257] media: v4l2-ctrls: default HEVC SPS chroma format to 4:2:0
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0123/1257] media: nuvoton: npcm-video: quiesce VCD IRQ before teardown Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0125/1257] media: require two-byte Cypress type 04 records Greg Kroah-Hartman
` (874 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Tharit Tangkijwanichakul,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tharit Tangkijwanichakul <tharitt97@gmail.com>
[ Upstream commit 4f4b6a9220f0401ae84bd2644aabd7221930c1c5 ]
The default value of a compound control is zero initialized when no
explicit default is provided. For V4L2_CTRL_TYPE_HEVC_SPS this results
in chroma_format_idc being set to 0, which represents monochrome video.
Most stateless HEVC decoders do not support monochrome video. In
particular, the VDPU38x variant of rkvdec fails v4l2-compliance in two
tests related to V4L2_CID_STATELESS_HEVC_SPS. The Control ioctls test
reads the control with GET_EXT_CTRLS and writes the same value
back; TRY_EXT_CTRLS then returns -EINVAL because the VDPU38x
rkvdec_hevc_validate_sps() rejects sps->chroma_format_idc == 0.
v4l2-compliance 1.33.0-5491, 64 bits, 64-bit time_t
v4l2-compliance SHA: b32589c51481 2026-07-16 08:51:38
Control ioctls:
fail: v4l2-test-controls.cpp(942):
try_ext_ctrls returned an error (22)
test VIDIOC_G/S/TRY_EXT_CTRLS: FAIL
Buffer ioctls:
fail: v4l2-test-buffers.cpp(3102): node->streamon(q.g_type())
fail: v4l2-test-buffers.cpp(3157): testBlockingDQBuf(node, m2m_q)
test blocking wait: FAIL
Set the common HEVC SPS compound control default to
chroma_format_idc = 1, corresponding to 4:2:0.
Fixes: c9a59dc2acc7 ("media: rkvdec: Add HEVC support for the VDPU381 variant")
Cc: stable@kernel.org
Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-ctrls-core.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
index 648b88c868bc6..47fb60b1f0c07 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -115,6 +115,7 @@ static void std_init_compound(const struct v4l2_ctrl *ctrl, u32 idx,
struct v4l2_ctrl_fwht_params *p_fwht_params;
struct v4l2_ctrl_h264_scaling_matrix *p_h264_scaling_matrix;
struct v4l2_ctrl_av1_sequence *p_av1_sequence;
+ struct v4l2_ctrl_hevc_sps *p_hevc_sps;
void *p = ptr.p + idx * ctrl->elem_size;
if (ctrl->p_def.p_const)
@@ -188,6 +189,12 @@ static void std_init_compound(const struct v4l2_ctrl *ctrl, u32 idx,
*/
memset(p_h264_scaling_matrix, 16, sizeof(*p_h264_scaling_matrix));
break;
+ case V4L2_CTRL_TYPE_HEVC_SPS:
+ p_hevc_sps = p;
+
+ /* 4:2:0 */
+ p_hevc_sps->chroma_format_idc = 1;
+ break;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0125/1257] media: require two-byte Cypress type 04 records
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0124/1257] media: v4l2-ctrls: default HEVC SPS chroma format to 4:2:0 Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0126/1257] drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties Greg Kroah-Hartman
` (873 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Pengpeng Hou, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit e22872703386c3885d8c6bd595124587bc4e5081 ]
Both Cypress Intel HEX parsers read two address bytes from type 04
records. Generic record framing permits any record length, so a short
record can make the parser consume the checksum or bytes beyond the
firmware record. A longer record also violates the Intel HEX type 04
layout.
Require the type 04 payload length to be exactly two bytes in both
implementations.
Fixes: 79a63c60a6a2 ("[media] media: move dvb-usb-v2/cypress_firmware.c to media/common")
Fixes: 776338e121b9 ("[PATCH] dvb: Add generalized dvb-usb driver")
Cc: stable@kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/common/cypress_firmware.c | 2 ++
drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/drivers/media/common/cypress_firmware.c b/drivers/media/common/cypress_firmware.c
index 66274fdf52438..d0f66ed01c4b1 100644
--- a/drivers/media/common/cypress_firmware.c
+++ b/drivers/media/common/cypress_firmware.c
@@ -59,6 +59,8 @@ static int cypress_get_hexline(const struct firmware *fw,
if (hx->type == 0x04) {
/* b[4] and b[5] are the Extended linear address record data
* field */
+ if (hx->len != 2)
+ return -EINVAL;
hx->addr |= (b[4] << 24) | (b[5] << 16);
}
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
index 0fb3fa6100e4a..675d9d1d4f472 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
@@ -141,6 +141,8 @@ int dvb_usb_get_hexline(const struct firmware *fw, struct hexline *hx,
if (hx->type == 0x04) {
/* b[4] and b[5] are the Extended linear address record data field */
+ if (hx->len != 2)
+ return -EINVAL;
hx->addr |= (b[4] << 24) | (b[5] << 16);
/* hx->len -= 2;
data_offs += 2; */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0126/1257] drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0125/1257] media: require two-byte Cypress type 04 records Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0127/1257] dmaengine: altera-msgdma: initialize state before requesting IRQ Greg Kroah-Hartman
` (872 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luca Ceresoli, Damon Ding,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damon Ding <damon.ding@rock-chips.com>
[ Upstream commit 02f569dd66c94dd67b2586f776235cf4177409ed ]
Revert the change that made samsung,link-rate and samsung,lane-count
optional for Exynos DP. Add error checking to fail probe early if the
required DT properties are missing.
If these properties are missing, video_info->max_link_rate and
video_info->max_lane_count remain zero, and so do link_train.link_rate
and link_train.lane_count used in the subsequent link training flow,
resulting in link training failure.
There is no way at all a device can work without these properties.
Here is the code flow when either max_link_rate or max_lane_count is 0:
analogix_dp_commit()
-> analogix_dp_full_link_train(dp, max_lanes = 0, max_rate = 0)
analogix_dp_full_link_train(max_lanes, max_rate):
// Read sink capabilities via DPCD and sanitize them
link_rate = read_dpcd(DP_MAX_LINK_RATE); // >= 0x06 after fixup
lane_count = read_dpcd(DP_MAX_LANE_COUNT); // >= 1 after fixup
// Clamp by the limits from DT
if (link_rate > max_rate) // 0x06 > 0, always true
link_rate = max_rate; // link_rate = 0
if (lane_count > max_lanes) // 1 > 0, always true
lane_count = max_lanes; // lane_count = 0
// Configure TX with the zeroed values
set_link_bandwidth(link_rate = 0)
// writel() is only executed for bwtype == 0x06/0x0a,
// so LINK_BW_SET is never written and stays at
// reset value; phy_configure() gets link_rate = 0.
set_lane_count(lane_count = 0)
// writel(0, ANALOGIX_DP_LANE_COUNT_SET) enables 0 lanes;
// phy_configure() is called with lanes = 0.
// Program sink for link training
drm_dp_dpcd_write(DP_LINK_BW_SET, {link_rate = 0/lane_count = 0})
// DP spec requires link rate in {0x06, 0x0a, 0x14} and
// lane count in {1, 2, 4}. Writing zeros is illegal, so
// the sink cannot enter the training state.
// Training loop
for (lane = 0; lane < lane_count /* 0 */; lane++)
// loop body never executes; training_lane[] stays
// uninitialized and no training register is programmed
Since the sanitized sink values are always non-zero (link_rate >= 0x06,
lane_count >= 1), the clamping with a zero maximum unconditionally
forces the training parameters to zero. Clock recovery can never be
achieved, so link training fails deterministically.
Consequently, making these properties mandatory again cannot break
any existing device: a DT without them could never have worked in
the first place. Failing probe early with a clear error message is
more helpful than a silent link training failure at runtime.
Fixes: 0d0abd894ead ("drm: bridge: analogix/dp: add max link rate and lane count limit for RK3288")
Cc: stable@vger.kernel.org
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Damon Ding <damon.ding@rock-chips.com>
Link: https://patch.msgid.link/20260828065153.590802-4-damon.ding@rock-chips.com
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
index 30c0c0b41d5aa..4213cd68d5a0d 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
@@ -1248,6 +1248,7 @@ static int analogix_dp_dt_parse_pdata(struct analogix_dp_device *dp)
{
struct device_node *dp_node = dp->dev->of_node;
struct video_info *video_info = &dp->video_info;
+ u32 val;
switch (dp->plat_data->dev_type) {
case RK3288_DP:
@@ -1269,10 +1270,14 @@ static int analogix_dp_dt_parse_pdata(struct analogix_dp_device *dp)
* NOTE: those property parseing code is used for
* providing backward compatibility for samsung platform.
*/
- of_property_read_u32(dp_node, "samsung,link-rate",
- &video_info->max_link_rate);
- of_property_read_u32(dp_node, "samsung,lane-count",
- &video_info->max_lane_count);
+ if (of_property_read_u32(dp_node, "samsung,link-rate", &val))
+ return dev_err_probe(dp->dev, -EINVAL,
+ "Failed to get samsung,link-rate\n");
+ video_info->max_link_rate = val;
+ if (of_property_read_u32(dp_node, "samsung,lane-count", &val))
+ return dev_err_probe(dp->dev, -EINVAL,
+ "Failed to get samsung,lane-count\n");
+ video_info->max_lane_count = val;
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0127/1257] dmaengine: altera-msgdma: initialize state before requesting IRQ
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0126/1257] drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0128/1257] ACPI: pfr_update: zero-initialize capability query result Greg Kroah-Hartman
` (871 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Adrian Ng Ho Yin,
Frank Li, Vinod Koul, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit a5f8e3471fc20567df888267885dec3eb340eb37 ]
msgdma_probe() registers the IRQ before initializing the tasklet, lock,
and descriptor lists used by the interrupt handler. A pending interrupt
can access incomplete state during probe.
Initialize the handler state before requesting the IRQ so the interrupt
path observes ready software state.
Fixes: a85c6f1b2921 ("dmaengine: Add driver for Altera / Intel mSGDMA IP core")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Acked-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260830053308.2190597-1-runyu.xiao@seu.edu.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/altera-msgdma.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/dma/altera-msgdma.c b/drivers/dma/altera-msgdma.c
index e23e5b441a24e..412f4bce1d4aa 100644
--- a/drivers/dma/altera-msgdma.c
+++ b/drivers/dma/altera-msgdma.c
@@ -847,11 +847,6 @@ static int msgdma_probe(struct platform_device *pdev)
if (mdev->irq < 0)
return -ENXIO;
- ret = devm_request_irq(&pdev->dev, mdev->irq, msgdma_irq_handler,
- 0, dev_name(&pdev->dev), mdev);
- if (ret)
- return ret;
-
tasklet_setup(&mdev->irq_tasklet, msgdma_tasklet);
dma_cookie_init(&mdev->dmachan);
@@ -863,6 +858,11 @@ static int msgdma_probe(struct platform_device *pdev)
INIT_LIST_HEAD(&mdev->done_list);
INIT_LIST_HEAD(&mdev->free_list);
+ ret = devm_request_irq(&pdev->dev, mdev->irq, msgdma_irq_handler,
+ 0, dev_name(&pdev->dev), mdev);
+ if (ret)
+ return ret;
+
dma_dev = &mdev->dmadev;
/* Set DMA capabilities */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0128/1257] ACPI: pfr_update: zero-initialize capability query result
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0127/1257] dmaengine: altera-msgdma: initialize state before requesting IRQ Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0129/1257] hte: tegra194-test: shut down timer before GPIO release Greg Kroah-Hartman
` (870 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Karl Mehltretter,
Rafael J. Wysocki, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit d776369a9eded071df83e4738e1572c4c5b912d7 ]
query_capability() copies four ACPI buffers into fixed-size fields using
the firmware-supplied lengths. The existing overflow guard rejects
oversized buffers, but shorter buffers are accepted and leave trailing
bytes of the stack-allocated cap_hdr uninitialized. PFRU_IOC_QUERY_CAP
then copies the entire structure to userspace.
Zero-initialize cap_hdr before querying the firmware. This preserves the
existing handling of short firmware responses while preventing disclosure
of kernel stack data. Oversized buffers remain rejected.
A QEMU _DSM returning one-byte buffers reproduced nonzero stack suffix
bytes in all four fields. With this change, the ioctl still succeeds and
each unwritten suffix is zero-filled, while 64-byte buffers continue to
return -EINVAL.
Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/1a001e1fee9.637da6dc3533246.238498880682901704%40a0rg.com
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260827053741.79425-1-kmehltretter@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/pfr_update.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
index 9afd2c52fdbd8..98ace679601b8 100644
--- a/drivers/acpi/pfr_update.c
+++ b/drivers/acpi/pfr_update.c
@@ -422,7 +422,7 @@ static int start_update(int action, struct pfru_device *pfru_dev)
static long pfru_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
- struct pfru_update_cap_info cap_hdr;
+ struct pfru_update_cap_info cap_hdr = {};
struct pfru_device *pfru_dev = to_pfru_dev(file);
void __user *p = (void __user *)arg;
u32 rev;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0129/1257] hte: tegra194-test: shut down timer before GPIO release
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0128/1257] ACPI: pfr_update: zero-initialize capability query result Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0130/1257] power: supply: qcom_smbx: include base when petting watchdog Greg Kroah-Hartman
` (869 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Dipen Patel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 30167fadbf87fa901a2fee49c30a5c5a506a43e8 ]
tegra_hte_test_remove() releases GPIO descriptors before stopping
hte.timer. gpio_timer_cb() accesses hte.gpio_out and rearms the timer, so
a callback concurrent with remove can use a released descriptor and rearm
after teardown.
Shut down the timer before releasing the GPIO descriptors.
timer_shutdown_sync() waits for a running callback and prevents it from
being rearmed.
Fixes: 9a75a7cd03c9 ("hte: Add Tegra HTE test driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Acked-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hte/hte-tegra194-test.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hte/hte-tegra194-test.c b/drivers/hte/hte-tegra194-test.c
index 32907d951ec9a..cca33868fb03d 100644
--- a/drivers/hte/hte-tegra194-test.c
+++ b/drivers/hte/hte-tegra194-test.c
@@ -217,10 +217,10 @@ static void tegra_hte_test_remove(struct platform_device *pdev)
{
(void)pdev;
+ timer_shutdown_sync(&hte.timer);
free_irq(hte.gpio_in_irq, &hte);
gpiod_put(hte.gpio_in);
gpiod_put(hte.gpio_out);
- timer_delete_sync(&hte.timer);
}
static struct platform_driver tegra_hte_test_driver = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0130/1257] power: supply: qcom_smbx: include base when petting watchdog
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0129/1257] hte: tegra194-test: shut down timer before GPIO release Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0131/1257] power: supply: qcom_smbx: test battery health status bits Greg Kroah-Hartman
` (868 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Snyders, Konrad Dybcio,
Sebastian Reichel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Snyders <robin@snyders.xyz>
[ Upstream commit 2f0dec12007891398e6e3041aca0b8656918973d ]
BARK_BITE_WDOG_PET is an offset from the charger peripheral base, but
the watchdog bark handler writes it as an absolute SPMI address. This can
write another PMIC peripheral and leave the charger watchdog unserviced.
Add the charger base, as all other qcom_smbx register accesses do.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-1-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index 67fdb43353388..e6f2328f295c7 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -764,7 +764,7 @@ static irqreturn_t smb_handle_wdog_bark(int irq, void *data)
power_supply_changed(chip->chg_psy);
- rc = regmap_write(chip->regmap, BARK_BITE_WDOG_PET,
+ rc = regmap_write(chip->regmap, chip->base + BARK_BITE_WDOG_PET,
BARK_BITE_WDOG_PET_BIT);
if (rc < 0)
dev_err(chip->dev, "Couldn't pet the dog rc=%d\n", rc);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0131/1257] power: supply: qcom_smbx: test battery health status bits
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0130/1257] power: supply: qcom_smbx: include base when petting watchdog Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0132/1257] power: supply: qcom_smbx: fix float voltage selector Greg Kroah-Hartman
` (867 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Snyders, Konrad Dybcio,
Sebastian Reichel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Snyders <robin@snyders.xyz>
[ Upstream commit 68f645192f64e1037685dbdb0dffb41a5a012056 ]
BATTERY_CHARGER_STATUS_2 contains independent status and fault bits.
Switching on the complete register only recognizes a fault when it is the
sole asserted bit, and can report a healthy battery when another status
bit is set at the same time.
Test the relevant fault bits in priority order, matching the Qualcomm
downstream driver handling.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-2-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 22 ++++++++--------------
1 file changed, 8 insertions(+), 14 deletions(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index e6f2328f295c7..0e50d81aefc2a 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -632,26 +632,20 @@ static int smb_get_prop_health(struct smb_chip *chip, int *val)
return rc;
}
- switch (stat) {
- case CHARGER_ERROR_STATUS_BAT_OV_BIT:
+ if (stat & CHARGER_ERROR_STATUS_BAT_OV_BIT)
*val = POWER_SUPPLY_HEALTH_OVERVOLTAGE;
- return 0;
- case BAT_TEMP_STATUS_TOO_COLD_BIT:
+ else if (stat & BAT_TEMP_STATUS_TOO_COLD_BIT)
*val = POWER_SUPPLY_HEALTH_COLD;
- return 0;
- case BAT_TEMP_STATUS_TOO_HOT_BIT:
+ else if (stat & BAT_TEMP_STATUS_TOO_HOT_BIT)
*val = POWER_SUPPLY_HEALTH_OVERHEAT;
- return 0;
- case BAT_TEMP_STATUS_COLD_SOFT_LIMIT_BIT:
+ else if (stat & BAT_TEMP_STATUS_COLD_SOFT_LIMIT_BIT)
*val = POWER_SUPPLY_HEALTH_COOL;
- return 0;
- case BAT_TEMP_STATUS_HOT_SOFT_LIMIT_BIT:
+ else if (stat & BAT_TEMP_STATUS_HOT_SOFT_LIMIT_BIT)
*val = POWER_SUPPLY_HEALTH_WARM;
- return 0;
- default:
+ else
*val = POWER_SUPPLY_HEALTH_GOOD;
- return 0;
- }
+
+ return 0;
}
static int smb_get_property(struct power_supply *psy,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0132/1257] power: supply: qcom_smbx: fix float voltage selector
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0131/1257] power: supply: qcom_smbx: test battery health status bits Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0133/1257] power: supply: qcom_smbx: validate battery float voltage Greg Kroah-Hartman
` (866 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Snyders, Konrad Dybcio,
Sebastian Reichel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Snyders <robin@snyders.xyz>
[ Upstream commit 2a26d260e72a95e9f13b9e475f63aa404600fcb2 ]
FLOAT_VOLTAGE_CFG encodes 3,487,500 uV as selector zero and advances in
7,500 uV steps. The current calculation adds one to that selector, so it
programs the requested float voltage one step too high.
Remove the extra offset and name the hardware encoding constants.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-3-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index 0e50d81aefc2a..e236b95c0ebf3 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -352,6 +352,8 @@
/* pmi8998 registers represent current in increments of 1/40th of an amp */
#define CURRENT_SCALE_FACTOR 25000
+#define SMB2_FLOAT_VOLTAGE_MIN_UV 3487500
+#define SMB2_FLOAT_VOLTAGE_STEP_UV 7500
/* clang-format on */
enum charger_status {
@@ -993,7 +995,8 @@ static int smb_probe(struct platform_device *pdev)
return dev_err_probe(chip->dev, rc,
"Failed to init status change work\n");
- rc = (chip->batt_info->voltage_max_design_uv - 3487500) / 7500 + 1;
+ rc = (chip->batt_info->voltage_max_design_uv -
+ SMB2_FLOAT_VOLTAGE_MIN_UV) / SMB2_FLOAT_VOLTAGE_STEP_UV;
rc = regmap_update_bits(chip->regmap, chip->base + FLOAT_VOLTAGE_CFG,
FLOAT_VOLTAGE_SETTING_MASK, rc);
if (rc < 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0133/1257] power: supply: qcom_smbx: validate battery float voltage
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0132/1257] power: supply: qcom_smbx: fix float voltage selector Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0134/1257] power: supply: qcom_smbx: notify battery overvoltage recovery Greg Kroah-Hartman
` (865 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Snyders, Sebastian Reichel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Snyders <robin@snyders.xyz>
[ Upstream commit a2d7dc538da2cb4a7426f0742197e762cb635f38 ]
power_supply_get_battery_info() leaves absent optional properties at
-EINVAL. The driver uses voltage_max_design_uv without checking it, so a
missing or out-of-range value can become an invalid float-voltage
selector.
Prefer the constant-charge voltage because it describes the charger's CV
target, then fall back to the battery design voltage. Both properties are
optional in the simple-battery binding, so preserve the hardware setting
when neither is present. Reject a supplied target outside the SMB2 range.
smb_init_hw() enables charging before battery data is parsed and before
the remaining fallible probe steps. Save the initial charging-enable bit
and install a managed rollback before initialization. Keep the rollback
active across battery-info, voltage, IRQ and wake-IRQ setup, then remove it
only after probe can no longer fail.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-4-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 61 ++++++++++++++++++++++++++++++--
1 file changed, 58 insertions(+), 3 deletions(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index e236b95c0ebf3..55ffe9857e494 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -353,6 +353,7 @@
/* pmi8998 registers represent current in increments of 1/40th of an amp */
#define CURRENT_SCALE_FACTOR 25000
#define SMB2_FLOAT_VOLTAGE_MIN_UV 3487500
+#define SMB2_FLOAT_VOLTAGE_MAX_UV 4920000
#define SMB2_FLOAT_VOLTAGE_STEP_UV 7500
/* clang-format on */
@@ -380,6 +381,7 @@ struct smb_init_register {
* @base: Base address for smb registers
* @regmap: Register map
* @batt_info: Battery data from DT
+ * @initial_charge_enable: Charging enable state before hardware setup
* @status_change_work: Worker to handle plug/unplug events
* @cable_irq: USB plugin IRQ
* @wakeup_enabled: If the cable IRQ will cause a wakeup
@@ -393,6 +395,7 @@ struct smb_chip {
unsigned int base;
struct regmap *regmap;
struct power_supply_battery_info *batt_info;
+ u8 initial_charge_enable;
struct delayed_work status_change_work;
int cable_irq;
@@ -905,6 +908,19 @@ static int smb_init_hw(struct smb_chip *chip)
return 0;
}
+static void smb_restore_charge_enable(void *data)
+{
+ struct smb_chip *chip = data;
+ int rc;
+
+ rc = regmap_update_bits(chip->regmap,
+ chip->base + CHARGING_ENABLE_CMD,
+ CHARGING_ENABLE_CMD_BIT,
+ chip->initial_charge_enable);
+ if (rc < 0)
+ dev_err(chip->dev, "Couldn't restore charging state: %d\n", rc);
+}
+
static int smb_init_irq(struct smb_chip *chip, int *irq, const char *name,
irqreturn_t (*handler)(int irq, void *data))
{
@@ -931,6 +947,9 @@ static int smb_probe(struct platform_device *pdev)
struct power_supply_config supply_config = {};
struct power_supply_desc *desc;
struct smb_chip *chip;
+ unsigned int charge_enable;
+ unsigned int float_voltage_sel;
+ int float_voltage_uv;
int rc, irq;
chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
@@ -961,6 +980,18 @@ static int smb_probe(struct platform_device *pdev)
"Couldn't get usbin_i IIO channel\n");
}
+ rc = regmap_read(chip->regmap, chip->base + CHARGING_ENABLE_CMD,
+ &charge_enable);
+ if (rc < 0)
+ return dev_err_probe(chip->dev, rc,
+ "Couldn't read charging state\n");
+
+ chip->initial_charge_enable = charge_enable & CHARGING_ENABLE_CMD_BIT;
+ rc = devm_add_action_or_reset(chip->dev, smb_restore_charge_enable, chip);
+ if (rc)
+ return dev_err_probe(chip->dev, rc,
+ "Couldn't register charging state rollback\n");
+
rc = smb_init_hw(chip);
if (rc < 0)
return rc;
@@ -995,13 +1026,35 @@ static int smb_probe(struct platform_device *pdev)
return dev_err_probe(chip->dev, rc,
"Failed to init status change work\n");
- rc = (chip->batt_info->voltage_max_design_uv -
- SMB2_FLOAT_VOLTAGE_MIN_UV) / SMB2_FLOAT_VOLTAGE_STEP_UV;
+ if (power_supply_battery_info_has_prop(chip->batt_info,
+ POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE_MAX)) {
+ float_voltage_uv =
+ chip->batt_info->constant_charge_voltage_max_uv;
+ } else if (power_supply_battery_info_has_prop(chip->batt_info,
+ POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN)) {
+ float_voltage_uv = chip->batt_info->voltage_max_design_uv;
+ } else {
+ dev_warn(chip->dev, "No battery float voltage; preserving hardware setting\n");
+ goto skip_float_voltage;
+ }
+
+ if (float_voltage_uv < SMB2_FLOAT_VOLTAGE_MIN_UV ||
+ float_voltage_uv > SMB2_FLOAT_VOLTAGE_MAX_UV)
+ return dev_err_probe(chip->dev, -EINVAL,
+ "float voltage %d uV outside %d-%d uV\n",
+ float_voltage_uv,
+ SMB2_FLOAT_VOLTAGE_MIN_UV,
+ SMB2_FLOAT_VOLTAGE_MAX_UV);
+
+ float_voltage_sel =
+ (float_voltage_uv - SMB2_FLOAT_VOLTAGE_MIN_UV) /
+ SMB2_FLOAT_VOLTAGE_STEP_UV;
rc = regmap_update_bits(chip->regmap, chip->base + FLOAT_VOLTAGE_CFG,
- FLOAT_VOLTAGE_SETTING_MASK, rc);
+ FLOAT_VOLTAGE_SETTING_MASK, float_voltage_sel);
if (rc < 0)
return dev_err_probe(chip->dev, rc, "Couldn't set vbat max\n");
+skip_float_voltage:
rc = smb_init_irq(chip, &irq, "bat-ov", smb_handle_batt_overvoltage);
if (rc < 0)
return rc;
@@ -1025,6 +1078,8 @@ static int smb_probe(struct platform_device *pdev)
if (rc < 0)
return dev_err_probe(chip->dev, rc, "Couldn't set wake irq\n");
+ devm_remove_action(chip->dev, smb_restore_charge_enable, chip);
+
platform_set_drvdata(pdev, chip);
/* Initialise charger state */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0134/1257] power: supply: qcom_smbx: notify battery overvoltage recovery
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0133/1257] power: supply: qcom_smbx: validate battery float voltage Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0135/1257] power: supply: bq27xxx: synchronize work cancellation on suspend Greg Kroah-Hartman
` (864 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Snyders, Sebastian Reichel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Snyders <robin@snyders.xyz>
[ Upstream commit 2548e4fa576a87a3b0d1b15a9c3f909bc54887b5 ]
The battery-overvoltage IRQ is configured for both edges, but its handler
only notifies the power-supply core while the fault bit is asserted. The
falling edge therefore does not publish the recovered health and status.
The handler also ignores register-read failures before testing status.
Handle read errors, log only an asserted fault, and notify the
power-supply core after every successful edge read.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-5-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index 55ffe9857e494..f5557b8cc92ae 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -722,16 +722,22 @@ static irqreturn_t smb_handle_batt_overvoltage(int irq, void *data)
{
struct smb_chip *chip = data;
unsigned int status;
+ int rc;
- regmap_read(chip->regmap, chip->base + BATTERY_CHARGER_STATUS_2,
- &status);
+ rc = regmap_read(chip->regmap,
+ chip->base + BATTERY_CHARGER_STATUS_2, &status);
+ if (rc < 0) {
+ dev_err(chip->dev, "Couldn't read charger status: %d\n", rc);
+ return IRQ_HANDLED;
+ }
if (status & CHARGER_ERROR_STATUS_BAT_OV_BIT) {
/* The hardware stops charging automatically */
dev_err(chip->dev, "battery overvoltage detected\n");
- power_supply_changed(chip->chg_psy);
}
+ power_supply_changed(chip->chg_psy);
+
return IRQ_HANDLED;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0135/1257] power: supply: bq27xxx: synchronize work cancellation on suspend
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0134/1257] power: supply: qcom_smbx: notify battery overvoltage recovery Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0136/1257] power: supply: bq27xxx: Ensure poll work is cancelled on remove Greg Kroah-Hartman
` (863 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shengzhuo Wei, Sebastian Reichel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengzhuo Wei <me@cherr.cc>
[ Upstream commit f0ff5673aa07ded2bb383ac526c1faee4fe9ca07 ]
The poll work requeues itself via mod_delayed_work() while the device
is not removed. cancel_delayed_work() does not wait for a callback
that is already running, so a poll racing with suspend can keep
issuing I2C transfers after suspend returns and requeue itself into
early resume.
Use cancel_delayed_work_sync() to quiesce polling before suspend
completes, as the teardown path already does.
Fixes: dfcb264a01a9 ("power: supply: bq27xxx: Stop and start delayed work in suspend and resume")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Link: https://patch.msgid.link/20260827-bq27xxx-suspend-cancel-sync-v1-1-77a67711cbc3@cherr.cc
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/bq27xxx_battery.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
index 01c9ec1116fa0..4d4809a70b622 100644
--- a/drivers/power/supply/bq27xxx_battery.c
+++ b/drivers/power/supply/bq27xxx_battery.c
@@ -2291,7 +2291,7 @@ static int bq27xxx_battery_suspend(struct device *dev)
{
struct bq27xxx_device_info *di = dev_get_drvdata(dev);
- cancel_delayed_work(&di->work);
+ cancel_delayed_work_sync(&di->work);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0136/1257] power: supply: bq27xxx: Ensure poll work is cancelled on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0135/1257] power: supply: bq27xxx: synchronize work cancellation on suspend Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0137/1257] iio: imu: inv_icm42600: fix odr change not caught in certain cases Greg Kroah-Hartman
` (862 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Sebastian Reichel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit db560f4b1c5253853f978385db066220e0c218dc ]
The di->work poll work is queued from the poll callback itself and from
bq27xxx_external_power_changed(). The cancel_delayed_work_sync() in
bq27xxx_battery_teardown() runs while the power_supply is still
registered, so external_power_changed() can re-arm the work after the
cancel, and it runs after the driver data has been freed.
Register a devm_delayed_work_autocancel() before
devm_power_supply_register(), so on unwind the power_supply is
unregistered first, after which no new external_power_changed()
callback can be dispatched, and the poll work is cancelled only then.
Drop the now-redundant cancel from bq27xxx_battery_teardown().
This issue was found by an in-house static analysis tool.
Fixes: 740b755a3b34 ("bq27x00: Poll battery state")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260903081312.225535-1-fanwu01@zju.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/bq27xxx_battery.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
index 4d4809a70b622..cd30993b8a89e 100644
--- a/drivers/power/supply/bq27xxx_battery.c
+++ b/drivers/power/supply/bq27xxx_battery.c
@@ -43,6 +43,7 @@
*/
#include <linux/device.h>
+#include <linux/devm-helpers.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/param.h>
@@ -2234,7 +2235,6 @@ int bq27xxx_battery_setup(struct bq27xxx_device_info *di)
};
int ret;
- INIT_DELAYED_WORK(&di->work, bq27xxx_battery_poll);
ret = devm_mutex_init(di->dev, &di->lock);
if (ret)
return ret;
@@ -2255,6 +2255,12 @@ int bq27xxx_battery_setup(struct bq27xxx_device_info *di)
psy_desc->get_property = bq27xxx_battery_get_property;
psy_desc->external_power_changed = bq27xxx_external_power_changed;
+ /* Cancel the poll work after the power_supply is unregistered. */
+ ret = devm_delayed_work_autocancel(di->dev, &di->work,
+ bq27xxx_battery_poll);
+ if (ret)
+ return ret;
+
di->bat = devm_power_supply_register(di->dev, psy_desc, &psy_cfg);
if (IS_ERR(di->bat))
return dev_err_probe(di->dev, PTR_ERR(di->bat),
@@ -2281,8 +2287,6 @@ void bq27xxx_battery_teardown(struct bq27xxx_device_info *di)
mutex_lock(&di->lock);
di->removed = true;
mutex_unlock(&di->lock);
-
- cancel_delayed_work_sync(&di->work);
}
EXPORT_SYMBOL_GPL(bq27xxx_battery_teardown);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0137/1257] iio: imu: inv_icm42600: fix odr change not caught in certain cases
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0136/1257] power: supply: bq27xxx: Ensure poll work is cancelled on remove Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0138/1257] sched/fair: Reset NUMA fault locality after scan period update Greg Kroah-Hartman
` (861 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit f670d4d3477386d62017936f0121909f93ac17f8 ]
When using both accel and gyro with different frequencies, the ODR
change flag in the FIFO header can be sometime in a packet with
invalid data. Since we are ignoring these packets, we miss the ODR
change and any further change are blocked until sensor is turned off.
Fix this by moving the packet data validity check after the ODR change
flag check.
Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 8 ++++----
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 8 ++++----
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
index 4b0e3cd8a5067..b2ad1bd202b4f 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -1227,15 +1227,15 @@ int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev)
if (size <= 0)
return size;
- /* skip packet if no accel data or data is invalid */
- if (accel == NULL || !inv_icm42600_fifo_is_data_valid(accel))
- continue;
-
/* update odr */
if (odr & INV_ICM42600_SENSOR_ACCEL)
inv_sensors_timestamp_apply_odr(ts, st->fifo.period,
st->fifo.nb.total, no);
+ /* skip packet if no accel data or data is invalid */
+ if (accel == NULL || !inv_icm42600_fifo_is_data_valid(accel))
+ continue;
+
memcpy(&buffer.accel, accel, sizeof(buffer.accel));
/* convert 8 bits FIFO temperature in high resolution format */
buffer.temp = temp ? (*temp * 64) : 0;
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
index 253bf571439d9..41e46276e6f22 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
@@ -808,15 +808,15 @@ int inv_icm42600_gyro_parse_fifo(struct iio_dev *indio_dev)
if (size <= 0)
return size;
- /* skip packet if no gyro data or data is invalid */
- if (gyro == NULL || !inv_icm42600_fifo_is_data_valid(gyro))
- continue;
-
/* update odr */
if (odr & INV_ICM42600_SENSOR_GYRO)
inv_sensors_timestamp_apply_odr(ts, st->fifo.period,
st->fifo.nb.total, no);
+ /* skip packet if no gyro data or data is invalid */
+ if (gyro == NULL || !inv_icm42600_fifo_is_data_valid(gyro))
+ continue;
+
memcpy(&buffer.gyro, gyro, sizeof(buffer.gyro));
/* convert 8 bits FIFO temperature in high resolution format */
buffer.temp = temp ? (*temp * 64) : 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0138/1257] sched/fair: Reset NUMA fault locality after scan period update
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0137/1257] iio: imu: inv_icm42600: fix odr change not caught in certain cases Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0139/1257] PCI: rzg3s: Disable refclk on probe failure Greg Kroah-Hartman
` (860 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Binwon Song, Eric Kim,
Peter Zijlstra (Intel), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Kim <seohyun.kim@outlook.kr>
[ Upstream commit e81ee06308379a5f2ededf997bcf17551bce5db7 ]
When updating the task scan period for NUMA locality checks,
update_task_scan_period() checks whether there were no faults or failed
migration on the last scan window, at which it prolongs the scan period.
However, p->numa_faults_locality, which is used to check for migration
failure and number of faults at the previous scan window is not cleared
after changing the scan period, which unintentionally increases
numa_scan_period up to numa_scan_period_max even when there were no
migration failures or no faults at previous scan.
Fix this by jumping to the out label on early exit at this case to
ensure p->numa_faults_locality is always cleared before returning.
Closes: https://lore.kernel.org/all/20250404095354.311156-1-qlsdnjs236@chungbuk.ac.kr/
Reported-by: Binwon Song <qlsdnjs236@chungbuk.ac.kr>
Signed-off-by: Eric Kim <seohyun.kim@outlook.kr>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/Message-ID:
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 0f2364479f9d2..b336048eafa2c 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3713,7 +3713,7 @@ static void update_task_scan_period(struct task_struct *p,
p->mm->numa_next_scan = jiffies +
msecs_to_jiffies(p->numa_scan_period);
- return;
+ goto out;
}
/*
@@ -3757,7 +3757,10 @@ static void update_task_scan_period(struct task_struct *p,
p->numa_scan_period = clamp(p->numa_scan_period + diff,
task_scan_min(p), task_scan_max(p));
- memset(p->numa_faults_locality, 0, sizeof(p->numa_faults_locality));
+
+out:
+ memset(p->numa_faults_locality, 0,
+ sizeof(p->numa_faults_locality));
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0139/1257] PCI: rzg3s: Disable refclk on probe failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0138/1257] sched/fair: Reset NUMA fault locality after scan period update Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0140/1257] PCI: rzg3s: Propagate platform_get_irq_byname() errors Greg Kroah-Hartman
` (859 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Manivannan Sadhasivam,
Claudiu Beznea, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit f03f56f21ce0770f38f3251924a0ca98699c38ed ]
rzg3s_pcie_host_init_port() enables the PCIe reference clock using
clk_prepare_enable(), but if rzg3s_pcie_probe() subsequently fails, for
example because pci_host_probe() returns an error, the probe error path
only releases the clock handle with clk_put().
Balance clk_prepare_enable() by calling clk_disable_unprepare() in the
probe cleanup path before releasing the clock, ensuring the reference
clock is properly disabled on probe failure.
Fixes: 7ef502fb35b28 ("PCI: Add Renesas RZ/G3S host controller driver")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260811200013.185956-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rzg3s-host.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pci/controller/pcie-rzg3s-host.c b/drivers/pci/controller/pcie-rzg3s-host.c
index a1a78bdb7af11..01488660ab081 100644
--- a/drivers/pci/controller/pcie-rzg3s-host.c
+++ b/drivers/pci/controller/pcie-rzg3s-host.c
@@ -1897,6 +1897,7 @@ static int rzg3s_pcie_probe(struct platform_device *pdev)
return 0;
host_probe_teardown:
+ clk_disable_unprepare(host->port.refclk);
rzg3s_pcie_teardown_irqdomain(host);
host->data->config_deinit(host);
rpm_put:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0140/1257] PCI: rzg3s: Propagate platform_get_irq_byname() errors
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0139/1257] PCI: rzg3s: Disable refclk on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0141/1257] PCI: rzg3s: Fix IRQ domain initialization error handling Greg Kroah-Hartman
` (858 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Manivannan Sadhasivam,
Claudiu Beznea, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 49daf16c881bc91a55355a3e7f03471c2b213255 ]
platform_get_irq_byname() may return specific error codes such as
-EPROBE_DEFER, but rzg3s_pcie_init_irqdomain() replaces all failures
with -EINVAL.
This breaks probe deferral by preventing the driver core from retrying
probe once the interrupt provider becomes available.
Propagate the original error code instead.
Fixes: 7ef502fb35b28 ("PCI: Add Renesas RZ/G3S host controller driver")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260811200013.185956-3-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rzg3s-host.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/pcie-rzg3s-host.c b/drivers/pci/controller/pcie-rzg3s-host.c
index 01488660ab081..f51b5d7c19983 100644
--- a/drivers/pci/controller/pcie-rzg3s-host.c
+++ b/drivers/pci/controller/pcie-rzg3s-host.c
@@ -1019,7 +1019,7 @@ static int rzg3s_pcie_init_irqdomain(struct rzg3s_pcie_host *host)
irq = platform_get_irq_byname(pdev, irq_name);
if (irq < 0)
- return dev_err_probe(dev, -EINVAL,
+ return dev_err_probe(dev, irq,
"Failed to parse and map INT%c IRQ\n",
'A' + i);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0141/1257] PCI: rzg3s: Fix IRQ domain initialization error handling
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0140/1257] PCI: rzg3s: Propagate platform_get_irq_byname() errors Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0142/1257] media: vivid: round the height down to the vertical subsampling factor Greg Kroah-Hartman
` (857 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Manivannan Sadhasivam,
Claudiu Beznea, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 5d9e9b3a27994a2fadce283801b7104a68ea4c48 ]
rzg3s_pcie_init_irqdomain() installs chained handlers for the INTx
parent interrupts before creating the INTx irqdomain and initializing
MSI support.
If any subsequent step fails, such as obtaining an INTx IRQ,
creating the irqdomain, or initializing MSI, the error path returns
without removing any chained handlers that were already installed.
This leaves stale handler and data pointers attached to the parent
interrupts.
Add a helper to tear down the INTx IRQ setup, including removing the IRQ
domain and clearing the chained handlers. Use it to unwind partially
completed initialization and from the normal IRQ domain teardown path.
Fixes: 7ef502fb35b28 ("PCI: Add Renesas RZ/G3S host controller driver")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260811200013.185956-4-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rzg3s-host.c | 50 +++++++++++++++++-------
1 file changed, 36 insertions(+), 14 deletions(-)
diff --git a/drivers/pci/controller/pcie-rzg3s-host.c b/drivers/pci/controller/pcie-rzg3s-host.c
index f51b5d7c19983..3f7393c49a08c 100644
--- a/drivers/pci/controller/pcie-rzg3s-host.c
+++ b/drivers/pci/controller/pcie-rzg3s-host.c
@@ -1006,22 +1006,38 @@ static const struct irq_domain_ops rzg3s_pcie_intx_domain_ops = {
.xlate = irq_domain_xlate_onetwocell,
};
+static void rzg3s_pcie_teardown_intx(struct rzg3s_pcie_host *host,
+ int count)
+{
+ while (--count >= 0) {
+ irq_set_chained_handler_and_data(host->intx_irqs[count], NULL,
+ NULL);
+ }
+
+ if (host->intx_domain)
+ irq_domain_remove(host->intx_domain);
+}
+
static int rzg3s_pcie_init_irqdomain(struct rzg3s_pcie_host *host)
{
struct device *dev = host->dev;
struct platform_device *pdev = to_platform_device(dev);
+ int i, ret;
- for (int i = 0; i < PCI_NUM_INTX; i++) {
+ for (i = 0; i < PCI_NUM_INTX; i++) {
char irq_name[5] = {0};
int irq;
scnprintf(irq_name, ARRAY_SIZE(irq_name), "int%c", 'a' + i);
irq = platform_get_irq_byname(pdev, irq_name);
- if (irq < 0)
- return dev_err_probe(dev, irq,
- "Failed to parse and map INT%c IRQ\n",
- 'A' + i);
+ if (irq < 0) {
+ ret = irq;
+ dev_err_probe(dev, ret,
+ "Failed to parse and map INT%c IRQ\n",
+ 'A' + i);
+ goto teardown_intx;
+ }
host->intx_irqs[i] = irq;
irq_set_chained_handler_and_data(irq,
@@ -1033,21 +1049,27 @@ static int rzg3s_pcie_init_irqdomain(struct rzg3s_pcie_host *host)
PCI_NUM_INTX,
&rzg3s_pcie_intx_domain_ops,
host);
- if (!host->intx_domain)
- return dev_err_probe(dev, -EINVAL,
- "Failed to add irq domain for INTx IRQs\n");
+ if (!host->intx_domain) {
+ ret = -EINVAL;
+ dev_err_probe(dev, ret,
+ "Failed to add irq domain for INTx IRQs\n");
+ goto teardown_intx;
+ }
irq_domain_update_bus_token(host->intx_domain, DOMAIN_BUS_WIRED);
if (IS_ENABLED(CONFIG_PCI_MSI)) {
- int ret = rzg3s_pcie_init_msi(host);
+ ret = rzg3s_pcie_init_msi(host);
- if (ret) {
- irq_domain_remove(host->intx_domain);
- return ret;
- }
+ if (ret)
+ goto teardown_intx;
}
return 0;
+
+teardown_intx:
+ rzg3s_pcie_teardown_intx(host, i);
+
+ return ret;
}
static void rzg3s_pcie_teardown_irqdomain(struct rzg3s_pcie_host *host)
@@ -1055,7 +1077,7 @@ static void rzg3s_pcie_teardown_irqdomain(struct rzg3s_pcie_host *host)
if (IS_ENABLED(CONFIG_PCI_MSI))
rzg3s_pcie_teardown_msi(host);
- irq_domain_remove(host->intx_domain);
+ rzg3s_pcie_teardown_intx(host, PCI_NUM_INTX);
}
static int rzg3s_pcie_set_max_link_speed(struct rzg3s_pcie_host *host)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0142/1257] media: vivid: round the height down to the vertical subsampling factor
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0141/1257] PCI: rzg3s: Fix IRQ domain initialization error handling Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0143/1257] media: cx231xx: preserve I2C transfer length Greg Kroah-Hartman
` (856 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+cb43e758a4dc84dd467f,
Maxim Skokov, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Skokov <skokovmaksimevg@gmail.com>
[ Upstream commit a2ec28dd2a88d0721fc4a30242861e2be01d4023 ]
syzbot reports a vmalloc out-of-bounds write in the test pattern
generator:
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2617 [inline]
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x2063/0x4160 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705
Write of size 720 at addr ffffc900038f9d50 by task vivid-000-vid-c/6017
The reproducer requests a 720x49 NV12 capture format, i.e. an odd
height for a format whose chroma plane is vertically subsampled.
The buffer size is derived from the height by a truncating division:
sizes[p] = (tpg_g_line_width(&dev->tpg, p) * h) /
dev->fmt_cap->vdownsampling[p] +
dev->fmt_cap->data_offset[p];
For a single buffer holding both planes tpg_g_line_width() returns
720 + 720 / 2 = 1080, so 1080 * 49 = 52920 bytes get allocated.
tpg_fill_plane_buffer() however emits one chroma line for every two
luma lines, i.e. DIV_ROUND_UP(49, 2) = 25 lines, and thus needs
49 * 720 + 25 * 720 = 53280 bytes. The memcpy() of the last chroma
line runs 360 bytes past the end of the buffer.
An odd height is not meaningful for a 4:2:0 format in the first place,
since the chroma plane would have to hold half a line. Rather than
fixing up each of the ~10 sites that divide the height by
vdownsampling[], round the height down to a multiple of the vertical
subsampling factor where it enters the driver. Adjusting the format is
what TRY_FMT/S_FMT are for, and it keeps every later division exact.
Formats without vertical subsampling are unaffected and keep accepting
odd heights.
Tested with the syzbot reproducer, which no longer triggers the splat,
and by streaming NV12, NV21, YUV420, YVU420 and YUYV at heights 47,
48, 49, 51, 480, 481 and 1081. v4l2-compliance gives identical results
before and after (48 of 50 succeeded on the vivid device in both
cases; the two failures are pre-existing and unrelated).
Fixes: ddcaee9dd4c0 ("[media] vivid: add support for single buffer planar formats")
Cc: stable@kernel.org
Reported-by: syzbot+cb43e758a4dc84dd467f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cb43e758a4dc84dd467f
Signed-off-by: Maxim Skokov <skokovmaksimevg@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vivid/vivid-vid-cap.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c
index e204490847095..147af0f9b0777 100644
--- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c
+++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c
@@ -570,6 +570,7 @@ int vivid_try_fmt_vid_cap(struct file *file, void *priv,
const struct vivid_fmt *fmt;
unsigned bytesperline, max_bpl;
unsigned factor = 1;
+ unsigned int vdiv = 1;
unsigned w, h;
unsigned p;
bool user_set_csc = !!(mp->flags & V4L2_PIX_FMT_FLAG_SET_CSC);
@@ -622,6 +623,18 @@ int vivid_try_fmt_vid_cap(struct file *file, void *priv,
mp->height = r.height / factor;
}
+ /*
+ * The chroma planes of vertically subsampled formats hold
+ * height / vdownsampling lines. If the height is not a multiple of
+ * the subsampling factor, then the buffer size calculations round
+ * that number down while the test pattern generator rounds it up,
+ * so the generator writes one line past the end of the buffer.
+ * Round the height down to keep both in sync.
+ */
+ for (p = 0; p < fmt->planes; p++)
+ vdiv = max(vdiv, fmt->vdownsampling[p]);
+ mp->height = rounddown(mp->height, vdiv);
+
/* This driver supports custom bytesperline values */
mp->num_planes = fmt->buffers;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0143/1257] media: cx231xx: preserve I2C transfer length
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0142/1257] media: vivid: round the height down to the vertical subsampling factor Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0144/1257] media: vivid: cancel svid ctrl work on release Greg Kroah-Hartman
` (855 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+ddccc0c0dbc0a38ffccb,
Juan Perdomo, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juan Perdomo <jcperdomo100@gmail.com>
[ Upstream commit a19c9502a69bbd42c18816b09cbefdeb4cb68066 ]
The I2C core stores message lengths in u16, but cx231xx truncates them to
u8 when populating cx231xx_i2c_xfer_data. A 0x700-byte read therefore
becomes a zero-length request. USB treats zero-length control transfers as
OUT regardless of bRequestType, so the IN control pipe trips the
usb_submit_urb() direction warning.
Use u16 for buf_size, matching both i2c_msg.len and
VENDOR_REQUEST_IN.wLength. Oversized transfers then reach the existing
URB_MAX_CTRL_SIZE check and return -EINVAL.
Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Cc: stable@kernel.org
Reported-by: syzbot+ddccc0c0dbc0a38ffccb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ddccc0c0dbc0a38ffccb
Tested-by: syzbot+ddccc0c0dbc0a38ffccb@syzkaller.appspotmail.com
Signed-off-by: Juan Perdomo <jcperdomo100@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/cx231xx/cx231xx.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/cx231xx/cx231xx.h b/drivers/media/usb/cx231xx/cx231xx.h
index 19f5036a78d7f..f85d054fbb5cf 100644
--- a/drivers/media/usb/cx231xx/cx231xx.h
+++ b/drivers/media/usb/cx231xx/cx231xx.h
@@ -463,7 +463,7 @@ struct cx231xx_i2c_xfer_data {
u8 direction; /* 1 - IN, 0 - OUT */
u8 saddr_len; /* sub address len */
u16 saddr_dat; /* sub addr data */
- u8 buf_size; /* buffer size */
+ u16 buf_size; /* buffer size */
u8 *p_buffer; /* pointer to the buffer */
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0144/1257] media: vivid: cancel svid ctrl work on release
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0143/1257] media: cx231xx: preserve I2C transfer length Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0145/1257] media: vicodec: zero-initialize stateful decoder heap buffers Greg Kroah-Hartman
` (854 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit 1adaefca7111235ff0a2219dd4899ac24601d6e8 ]
vivid_dev_release() cancels update_hdmi_ctrl_work but not its sibling
update_svid_ctrl_work, which vivid_vid_cap_s_ctrl() queues on
update_svid_ctrls_workqueue when a VIVID_CID_SVID_IS_CONNECTED_TO_OUTPUT
control is changed. The two work items were added together, but only
one of them is cancelled on release.
If the svid work is still pending or running when the last v4l2_device
reference is dropped, update_svid_ctrls_work_handler() runs after
kfree(dev): the handler iterates the global vivid_devs[] array and
calls v4l2_ctrl_modify_range() on every vivid_dev instance, including
this one after it has been freed.
Add the missing cancel_work_sync() next to the hdmi sibling, before
vivid_free_controls() releases the control handlers the work uses.
This issue was found by an in-house static analysis tool.
Fixes: d7c969f37515 ("media: vivid: Add 'Is Connected To' menu controls")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vivid/vivid-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/test-drivers/vivid/vivid-core.c b/drivers/media/test-drivers/vivid/vivid-core.c
index 62cfb5feb2cf5..c042d92db175d 100644
--- a/drivers/media/test-drivers/vivid/vivid-core.c
+++ b/drivers/media/test-drivers/vivid/vivid-core.c
@@ -854,6 +854,7 @@ static void vivid_dev_release(struct v4l2_device *v4l2_dev)
struct vivid_dev *dev = container_of(v4l2_dev, struct vivid_dev, v4l2_dev);
cancel_work_sync(&dev->update_hdmi_ctrl_work);
+ cancel_work_sync(&dev->update_svid_ctrl_work);
vivid_free_controls(dev);
v4l2_device_unregister(&dev->v4l2_dev);
#ifdef CONFIG_MEDIA_CONTROLLER
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0145/1257] media: vicodec: zero-initialize stateful decoder heap buffers
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0144/1257] media: vivid: cancel svid ctrl work on release Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0146/1257] crypto: atmel-tdes - zero-initialize device state Greg Kroah-Hartman
` (853 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
[ Upstream commit 27953c044974baf7e24dee3e9342fe0103dea80c ]
The stateful decoder leaks uninitialized kernel heap memory to userspace.
A process that can open the decoder video node gets it back in the CAPTURE
buffers it dequeues.
The reference frame and the compressed frame buffer are allocated with
kvmalloc() in vicodec_start_streaming(), and the decoder can read them
before they have been written. The first frame is allowed to be a P-frame,
in which case it is decoded against a reference frame that was never
produced, and the padding rows below the visible area are never written
for any frame.
Use kvzalloc() for both allocations.
Fixes: 256bf813ba39 ("media: vicodec: add the virtual codec driver")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vicodec/vicodec-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/test-drivers/vicodec/vicodec-core.c b/drivers/media/test-drivers/vicodec/vicodec-core.c
index 25ec3a43fc712..7ea024b14f0e9 100644
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -1605,9 +1605,9 @@ static int vicodec_start_streaming(struct vb2_queue *q,
}
state->ref_stride = q_data->coded_width * info->luma_alpha_step;
- state->ref_frame.buf = kvmalloc(total_planes_size, GFP_KERNEL);
+ state->ref_frame.buf = kvzalloc(total_planes_size, GFP_KERNEL);
state->ref_frame.luma = state->ref_frame.buf;
- new_comp_frame = kvmalloc(ctx->comp_max_size, GFP_KERNEL);
+ new_comp_frame = kvzalloc(ctx->comp_max_size, GFP_KERNEL);
if (!state->ref_frame.luma || !new_comp_frame) {
kvfree(state->ref_frame.luma);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0146/1257] crypto: atmel-tdes - zero-initialize device state
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0145/1257] media: vicodec: zero-initialize stateful decoder heap buffers Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0147/1257] crypto: atmel-aes - fix AADLENR for standalone GHASH Greg Kroah-Hartman
` (852 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Thorsten Blum,
Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit dbe70508d507acd677e67eaf029040f5e3a3b2b3 ]
Commit c659d07f11a3 ("crypto: atmel-tdes - Switch to managed version of
kzalloc") accidentally replaced kzalloc() with devm_kmalloc(), so the
device state is no longer zeroed.
atmel_tdes_hw_init() tests dd->flags during probe: a stale TDES_FLAGS_INIT
skips the hardware reset, and a stale TDES_FLAGS_BUSY makes
atmel_tdes_handle_queue() treat the engine as permanently busy, leaving
every request queued and never dispatched.
Seen on a SAM9X75 Curiosity: the first TDES request after boot never
completes and the TDES interrupt count stays at zero, while the AES and
SHA engines on the same SoC work normally.
Switch to devm_kzalloc(), matching the Atmel AES and SHA drivers.
Fixes: c659d07f11a3 ("crypto: atmel-tdes - Switch to managed version of kzalloc")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-tdes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/atmel-tdes.c b/drivers/crypto/atmel-tdes.c
index ffea1db74651d..2756dab3f4c7f 100644
--- a/drivers/crypto/atmel-tdes.c
+++ b/drivers/crypto/atmel-tdes.c
@@ -933,7 +933,7 @@ static int atmel_tdes_probe(struct platform_device *pdev)
struct resource *tdes_res;
int err;
- tdes_dd = devm_kmalloc(&pdev->dev, sizeof(*tdes_dd), GFP_KERNEL);
+ tdes_dd = devm_kzalloc(&pdev->dev, sizeof(*tdes_dd), GFP_KERNEL);
if (!tdes_dd)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0147/1257] crypto: atmel-aes - fix AADLENR for standalone GHASH
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0146/1257] crypto: atmel-tdes - zero-initialize device state Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0148/1257] lib/842: reject output overflows from index and short data Greg Kroah-Hartman
` (851 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 0dd8cded0e6f8c9635fe1d79d60dc7b2599b099b ]
atmel_aes_gcm_ghash_init() writes dd->total, the request's text length,
to AES_AADLENR. But the GHASH it runs hashes the dd->datalen bytes passed
in: the 16-byte length block, or the padded IV when the IV is not 96 bits.
The data sheet requires AES_AADLENR to hold the length of that input.
With empty plaintext and empty AAD, dd->total is 0 and the tag comes out
wrong. Later requests only pass because dd->total still holds the
previous request's length.
This is testmgr's first gcm(aes) vector, so CONFIG_CRYPTO_SELFTESTS=y
fails at boot:
alg: aead: atmel-gcm-aes encryption test failed (wrong result) on test
vector 0, cfg="in-place (one sglist)"
Without selftests the broken atmel-gcm-aes is preferred at priority 300.
Seen on a SAM9X75 Curiosity with 6.18 and current mainline.
Write dd->datalen instead.
Fixes: d4419548dba9 ("crypto: atmel-aes - add support to GCM mode")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-aes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
index 50d97cef75b89..8e4de859cadc0 100644
--- a/drivers/crypto/atmel-aes.c
+++ b/drivers/crypto/atmel-aes.c
@@ -1267,7 +1267,7 @@ static int atmel_aes_gcm_ghash_init(struct atmel_aes_dev *dd)
struct atmel_aes_gcm_ctx *ctx = atmel_aes_gcm_ctx_cast(dd->ctx);
/* Set the data length. */
- atmel_aes_write(dd, AES_AADLENR, dd->total);
+ atmel_aes_write(dd, AES_AADLENR, dd->datalen);
atmel_aes_write(dd, AES_CLENR, 0);
/* If needed, overwrite the GCM Intermediate Hash Word Registers */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0148/1257] lib/842: reject output overflows from index and short data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0147/1257] crypto: atmel-aes - fix AADLENR for standalone GHASH Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0149/1257] lib/842: require a complete history block for repeat templates Greg Kroah-Hartman
` (850 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 38ed7182f3491ec1449ff246551e11ad82adba45 ]
The output length passed to sw842_decompress() is the caller's buffer
capacity. Indexed copies write 2, 4 or 8 bytes and short-data templates
write up to 7, but neither checks that capacity before writing and
decrementing p->olen.
Overwriting an undersized destination then underflows p->olen, which is
unsigned, so every later bounds check in the stream passes. Subsequent
operations keep writing past the destination, and a matching CRC lets
sw842_decompress() return success with an output length larger than the
capacity the caller supplied.
This is reachable through zram's compressed writeback path. With 842
selected, targeted corruption of the compressed data on its backing device
made a KASAN kernel report vmalloc-out-of-bounds writes in __do_index() and
sw842_decompress() when zram read the page back.
Check the remaining output before both operations and return -ENOSPC,
matching the other output-producing templates.
Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/842/842_decompress.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/lib/842/842_decompress.c b/lib/842/842_decompress.c
index 582085ef8b49c..87d1e0f8a4926 100644
--- a/lib/842/842_decompress.c
+++ b/lib/842/842_decompress.c
@@ -165,6 +165,9 @@ static int __do_index(struct sw842_param *p, u8 size, u8 bits, u64 fsize)
u64 index, offset, total = round_down(p->out - p->ostart, 8);
int ret;
+ if (size > p->olen)
+ return -ENOSPC;
+
ret = next_bits(p, &index, bits);
if (ret)
return ret;
@@ -344,6 +347,8 @@ int sw842_decompress(const u8 *in, unsigned int ilen,
if (!bytes || bytes > SHORT_DATA_BITS_MAX)
return -EINVAL;
+ if (bytes > p.olen)
+ return -ENOSPC;
while (bytes-- > 0) {
ret = next_bits(&p, &tmp, 8);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0149/1257] lib/842: require a complete history block for repeat templates
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0148/1257] lib/842: reject output overflows from index and short data Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0150/1257] crypto: ccp - Initialize DBC ioctl mutex before registering device Greg Kroah-Hartman
` (849 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit deb631649882bbf43f7c2fc79b5990139fd744ba ]
An 842 repeat template copies the preceding eight-byte output block. The
decoder rejects a repeat only when no output has been produced. A
short-data operation can produce between one and seven bytes before a
repeat.
Such a stream makes the repeat copy read before the start of the output
buffer. Depending on the surrounding mapping, this can fault or bring
preceding memory into the decompressed data.
This is also reachable through zram's compressed writeback path. With 842
selected, targeted corruption of the compressed data on its backing device
to a short-data-then-repeat stream made a KASAN kernel report a
vmalloc-out-of-bounds read when zram read the page back.
Require at least one complete output block before accepting a repeat.
Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/842/842_decompress.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/842/842_decompress.c b/lib/842/842_decompress.c
index 87d1e0f8a4926..45a9815abd637 100644
--- a/lib/842/842_decompress.c
+++ b/lib/842/842_decompress.c
@@ -309,7 +309,7 @@ int sw842_decompress(const u8 *in, unsigned int ilen,
if (ret)
return ret;
- if (p.out == out) /* no previous bytes */
+ if (p.out - p.ostart < 8) /* no complete previous block */
return -EINVAL;
/* copy rep + 1 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0150/1257] crypto: ccp - Initialize DBC ioctl mutex before registering device
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0149/1257] lib/842: require a complete history block for repeat templates Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0151/1257] gfs2: reject invalid inode sizes Greg Kroah-Hartman
` (848 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Tom Lendacky, Herbert Xu,
Sasha Levin, Mario Limonciello (AMD)
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit e9b1d168f2a70c0764d5748893fdf631c504c171 ]
dbc_dev_init() registers the DBC misc device before initializing
ioctl_mutex. Once misc_register() publishes the device, userspace can
open it and invoke dbc_ioctl() while the mutex is still uninitialized.
Initialize ioctl_mutex before calling misc_register() so the published
ioctl callback always sees an initialized mutex.
Fixes: c04cf9e14f10 ("crypto: ccp - Add support for fetching a nonce for dynamic boost control")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260829133410.1708684-1-runyu.xiao@seu.edu.cn/
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Assisted-by: Codex:GPT-5
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> ---
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ccp/dbc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/ccp/dbc.c b/drivers/crypto/ccp/dbc.c
index 410084a9039c9..4db49a14550c9 100644
--- a/drivers/crypto/ccp/dbc.c
+++ b/drivers/crypto/ccp/dbc.c
@@ -236,6 +236,8 @@ int dbc_dev_init(struct psp_device *psp)
goto cleanup_mbox;
}
+ mutex_init(&dbc_dev->ioctl_mutex);
+
dbc_dev->char_dev.minor = MISC_DYNAMIC_MINOR;
dbc_dev->char_dev.name = "dbc";
dbc_dev->char_dev.fops = &dbc_fops;
@@ -244,8 +246,6 @@ int dbc_dev_init(struct psp_device *psp)
if (ret)
goto cleanup_mbox;
- mutex_init(&dbc_dev->ioctl_mutex);
-
return 0;
cleanup_mbox:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0151/1257] gfs2: reject invalid inode sizes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0150/1257] crypto: ccp - Initialize DBC ioctl mutex before registering device Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0152/1257] PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier() Greg Kroah-Hartman
` (847 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiaming Zhang, Andreas Gruenbacher,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaming Zhang <r772577952@gmail.com>
[ Upstream commit 33ed0a0567e0abe66ea65e89dad2e35082890fbe ]
A corrupted GFS2 image can store a dinode size that is larger than what VFS
i_size can represent. gfs2_dinode_in() reads the on-disk di_size as a u64 and
writes it directly into inode->i_size. If the value is larger than S64_MAX, the
incore i_size becomes negative. That negative value can bypass the existing
stuffed inode size check:
inode->i_size > gfs2_max_stuffed_size(ip)
Later, gfs2_quotad may try to sync the quota file and unstuff the quota inode.
gfs2_unstuffer_folio() reads the negative i_size into an unsigned length and
passes it to memcpy(), turning it into a huge copy size and triggering a
out-of-bound issue.
Reject dinodes whose size exceeds sb->s_maxbytes before storing the value in
inode->i_size. Also make the stuffed inode check use the raw on-disk size while
it is still unsigned.
Fixes: 70376c7ff312 ("gfs2: Always check inode size of inline inodes")
Closes: https://lore.kernel.org/lkml/CANypQFaF6bvORKKbRALvEL0k_epFaneFiOQqco4gjdmKVbdURg@mail.gmail.com/
Assisted-by: Codex:gpt-5.5-xhigh
Cc: stable@vger.kernel.org
Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/glops.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 28f32424ee64b..2e53ba3709eb6 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -393,6 +393,7 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
umode_t mode = be32_to_cpu(str->di_mode);
struct inode *inode = &ip->i_inode;
bool is_new = inode_state_read_once(inode) & I_NEW;
+ u64 size;
if (unlikely(ip->i_no_addr != be64_to_cpu(str->di_num.no_addr))) {
gfs2_consist_inode(ip);
@@ -418,7 +419,12 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
i_uid_write(inode, be32_to_cpu(str->di_uid));
i_gid_write(inode, be32_to_cpu(str->di_gid));
set_nlink(inode, be32_to_cpu(str->di_nlink));
- i_size_write(inode, be64_to_cpu(str->di_size));
+ size = be64_to_cpu(str->di_size);
+ if (unlikely(size > inode->i_sb->s_maxbytes)) {
+ gfs2_consist_inode(ip);
+ return -EIO;
+ }
+ i_size_write(inode, size);
gfs2_set_inode_blocks(inode, be64_to_cpu(str->di_blocks));
atime.tv_sec = be64_to_cpu(str->di_atime);
atime.tv_nsec = be32_to_cpu(str->di_atime_nsec);
@@ -462,7 +468,7 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
return -EIO;
}
- if (gfs2_is_stuffed(ip) && inode->i_size > gfs2_max_stuffed_size(ip)) {
+ if (gfs2_is_stuffed(ip) && size > gfs2_max_stuffed_size(ip)) {
gfs2_consist_inode(ip);
return -EIO;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0152/1257] PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0151/1257] gfs2: reject invalid inode sizes Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0153/1257] iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands Greg Kroah-Hartman
` (846 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Rafael J. Wysocki,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <include@grrlz.net>
[ Upstream commit 61f7eee7d4664079fbce821576891c3ee5ccf597 ]
cpu_pm_notify() walks the notifier chain lockless under only
rcu_read_lock(). That only works if a removed notifier block is not
freed until every concurrent walker is done with it.
The chain used to be an atomic_notifier, whose unregister ends in
synchronize_rcu(). Commit b2f6662ac08d ("PM: cpu: Make notifier chain
use a raw_spinlock_t") switched it over to a raw_notifier, and in
doing so replaced that with raw_notifier_chain_unregister(), which
does not synchronize. The grace period quietly went away, so a driver
that frees the memory holding its notifier block right after
cpu_pm_unregister_notifier() returns can race with a concurrent
walker:
cpu1 (idle exit) cpu2 (driver remove)
---------------- --------------------
cpu_pm_notify(CPU_PM_EXIT)
rcu_read_lock()
nb = rcu_dereference_raw(*nl)
cpu_pm_unregister_notifier(&od->nb)
unlink, no grace period
remove() frees od (devm)
nb->notifier_call(nb, ...)
/* use after free */
The rcu_read_lock() on cpu1 does not stop cpu2 from freeing the
block, and nothing else does. The read side is the idle exit path,
so this can hit on any system where a driver with a cpu_pm notifier
gets unbound.
Add the grace period back. It is only needed when a notifier was
actually removed, so wait on success and return -ENOENT without
waiting otherwise. The kerneldoc gets back the "may sleep" note that
the same commit dropped.
Fixes: b2f6662ac08d ("PM: cpu: Make notifier chain use a raw_spinlock_t")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Bradley Morgan <include@grrlz.net>
[ rjw: Subject tweak ]
Link: https://patch.msgid.link/20260813074343.26460-3-include@grrlz.net
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cpu_pm.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c
index 7481fbb947d32..a2a598ad6e6d5 100644
--- a/kernel/cpu_pm.c
+++ b/kernel/cpu_pm.c
@@ -10,6 +10,7 @@
#include <linux/cpu_pm.h>
#include <linux/module.h>
#include <linux/notifier.h>
+#include <linux/rcupdate.h>
#include <linux/spinlock.h>
#include <linux/syscore_ops.h>
@@ -76,7 +77,8 @@ EXPORT_SYMBOL_GPL(cpu_pm_register_notifier);
*
* Remove a driver from the CPU PM notifier list.
*
- * This function has the same return conditions as raw_notifier_chain_unregister.
+ * This function may sleep, and has the same return conditions as
+ * raw_notifier_chain_unregister.
*/
int cpu_pm_unregister_notifier(struct notifier_block *nb)
{
@@ -86,6 +88,11 @@ int cpu_pm_unregister_notifier(struct notifier_block *nb)
raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags);
ret = raw_notifier_chain_unregister(&cpu_pm_notifier.chain, nb);
raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags);
+
+ /* Wait for the rcu_read_lock() walkers in cpu_pm_notify(). */
+ if (!ret)
+ synchronize_rcu();
+
return ret;
}
EXPORT_SYMBOL_GPL(cpu_pm_unregister_notifier);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0153/1257] iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0152/1257] PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier() Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0154/1257] PCI: endpoint: pci-epf-vntb: Manage virtual NTB and PCI bus lifetime Greg Kroah-Hartman
` (845 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Pranjal Shrivastava,
Nicolin Chen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <nicolinc@nvidia.com>
[ Upstream commit 26564d25cd814dfd72a21a2c52b81e678cf02bae ]
The arm_vsmmu_cache_invalidate() op hands a guest's invalidation commands
to the trusted main command queue after enforcing only the VMID or the SID,
and passes the rest of the command through to the queue unchanged.
That lets a guest set bits the host never meant to forward: a reserved or
undefined bit makes a command malformed; per the Arm SMMUv3 specification,
in its section 4.1.3 "Command errors", a CERROR_ILL is raised, among other
cases, when:
A valid command opcode is used and a Reserved or undefined field is
optionally detected as non-zero, which results in the command being
treated as malformed.
Restrict each opcode to the fields that the driver supports and reject the
command with -EIO if it sets any other bit, before the command reaches the
queue. This stops the host from forwarding any bit whose meaning it does
not control. Document this contract in the uAPI header, so user space must
take the responsibility to forward valid commands only.
Some fields and whole opcodes are legal only on an SMMU that implements
the matching feature, so accept them conditionally:
- NUM, SCALE, TG and TTL need FEAT_RANGE_INV.
- SCALE bit 25, for values above 31, and TTL == 0b01 with a 16KB TG
need SMMU_IDR5.DS, gated on ARM_SMMU_FEAT_DS so that a VMM exposing
DS from the reported IDR5 register keeps working.
- ASID is limited to asid_bits, since its upper 8 bits are RES0 on an
SMMU that only supports 8-bit ASIDs.
- ATC_INV needs FEAT_ATS. Per the specification's section 4.5 "ATS and
PRI", CMD_ATC_INV is ILLEGAL when:
SMMU_IDR0.ATS == 0 and this command is issued on a Non-secure or
Secure Command queue.
- SSV, SSID and Global need a non-zero ssid_bits. Without it, setting
them is not illegal but CONSTRAINED UNPREDICTABLE, which a guest
should not be able to provoke. Global also takes effect only when
SSV == 1, broadening the invalidation from the one SSID to all the
PASIDs of the single device that the SID field addresses.
Some values inside the accepted fields are Reserved too:
- NUM == 0, SCALE == 0 and TTL == 0 together are a Reserved combination
and cause a CERROR_ILL.
- NUM, SCALE and TTL turn RES0 when TG == 0.
- An ATC_INV Size above 52, the invalidate-all span, is permitted to
raise a CERROR_ILL.
Reject these Reserved values the same way. In contrast, an out-of-range
address or ID value is defined as CONSTRAINED UNPREDICTABLE that would
be scoped to the guest itself, so it does not deserve a check.
Fixes: d68beb276ba2 ("iommu/arm-smmu-v3: Support IOMMU_HWPT_INVALIDATE using a VIOMMU object")
Cc: stable@vger.kernel.org
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Assisted-by: Claude:claude-fable-5
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Link: https://patch.msgid.link/40f4aabf98e434d6ac9f42a8d278b92200f202ca.1788127877.git.nicolinc@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 129 ++++++++++++++++--
include/uapi/linux/iommufd.h | 4 +-
2 files changed, 121 insertions(+), 12 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
index 25982bdbcbd9a..747b9d47ff7e4 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
@@ -322,6 +322,106 @@ struct arm_vsmmu_invalidation_cmd {
};
};
+/* Reject the range field values that the spec defines as Reserved */
+static int arm_vsmmu_validate_range(struct arm_smmu_device *smmu, u64 data[2])
+{
+ bool range = !!(data[0] & (CMDQ_TLBI_0_NUM | CMDQ_TLBI_0_SCALE));
+ u8 ttl = FIELD_GET(CMDQ_TLBI_1_TTL, data[1]);
+ u8 tg = FIELD_GET(CMDQ_TLBI_1_TG, data[1]);
+
+ /* NUM, SCALE and TTL are RES0 when TG == 0 */
+ if (!tg)
+ return (range || ttl) ? -EIO : 0;
+ /* TTL == 0b01 with a 16KB TG requires SMMU_IDR5.DS */
+ if (tg == 2 && ttl == 1 && !(smmu->features & ARM_SMMU_FEAT_DS))
+ return -EIO;
+ /* NUM == 0, SCALE == 0 with TTL == 0 is a reserved combination */
+ if (!range && !ttl)
+ return -EIO;
+ return 0;
+}
+
+static int arm_vsmmu_validate_user_cmd(struct arm_vsmmu *vsmmu, u64 data[2])
+{
+ struct arm_smmu_device *smmu = vsmmu->smmu;
+ u64 allowed[2] = { CMDQ_0_OP };
+
+ /* Collect the fields userspace is allowed to set for each opcode */
+ switch (data[0] & CMDQ_0_OP) {
+ case CMDQ_OP_TLBI_NSNH_ALL:
+ break;
+ case CMDQ_OP_TLBI_NH_VA:
+ /* An SMMU with 8-bit ASIDs treats the upper 8 bits as RES0 */
+ allowed[0] |= FIELD_PREP(CMDQ_TLBI_0_ASID,
+ GENMASK(smmu->asid_bits - 1, 0));
+ fallthrough;
+ case CMDQ_OP_TLBI_NH_VAA:
+ /* NUM/SCALE/TG/TTL are range fields gated on FEAT_RANGE_INV */
+ if (smmu->features & ARM_SMMU_FEAT_RANGE_INV) {
+ if (arm_vsmmu_validate_range(smmu, data))
+ return -EIO;
+ allowed[0] |= CMDQ_TLBI_0_NUM | CMDQ_TLBI_0_SCALE;
+ allowed[1] |= CMDQ_TLBI_1_TG | CMDQ_TLBI_1_TTL;
+ /* SCALE bit 25 (values above 31) is RES0 without DS */
+ if (!(smmu->features & ARM_SMMU_FEAT_DS))
+ allowed[0] &= ~FIELD_PREP(CMDQ_TLBI_0_SCALE,
+ BIT(5));
+ }
+ allowed[0] |= CMDQ_TLBI_0_VMID;
+ allowed[1] |= CMDQ_TLBI_1_LEAF | CMDQ_TLBI_1_VA_MASK;
+ break;
+ case CMDQ_OP_TLBI_NH_ASID:
+ /* An SMMU with 8-bit ASIDs treats the upper 8 bits as RES0 */
+ allowed[0] |= FIELD_PREP(CMDQ_TLBI_0_ASID,
+ GENMASK(smmu->asid_bits - 1, 0));
+ fallthrough;
+ case CMDQ_OP_TLBI_NH_ALL:
+ allowed[0] |= CMDQ_TLBI_0_VMID;
+ break;
+ case CMDQ_OP_ATC_INV:
+ /* ATC_INV is illegal unless the SMMU implements ATS */
+ if (!(smmu->features & ARM_SMMU_FEAT_ATS))
+ return -EIO;
+ /* A Size above 52 (invalidate-all) may raise a CERROR_ILL */
+ if (FIELD_GET(CMDQ_ATC_1_SIZE, data[1]) > ATC_INV_SIZE_ALL)
+ return -EIO;
+ /*
+ * SSV/SSID/Global need substream support. SSID and Global are
+ * IGNORED (not RES0) when SSV == 0, so they need no SSV check.
+ */
+ if (smmu->ssid_bits)
+ allowed[0] |= CMDQ_0_SSV | CMDQ_ATC_0_SSID |
+ CMDQ_ATC_0_GLOBAL;
+ allowed[0] |= CMDQ_ATC_0_SID;
+ allowed[1] |= CMDQ_ATC_1_SIZE | CMDQ_ATC_1_ADDR_MASK;
+ break;
+ case CMDQ_OP_CFGI_CD:
+ /* No SSV for CFGI_CD; SSID requires substream support */
+ if (smmu->ssid_bits)
+ allowed[0] |= CMDQ_CFGI_0_SSID;
+ allowed[1] |= CMDQ_CFGI_1_LEAF;
+ fallthrough;
+ case CMDQ_OP_CFGI_CD_ALL:
+ allowed[0] |= CMDQ_CFGI_0_SID;
+ break;
+ default:
+ return -EIO;
+ }
+
+ /*
+ * Reject any other bit, e.g. a RES0 bit or a Secure bit, before the
+ * command reaches the trusted main cmdq, so a guest cannot wedge the
+ * shared queue for every device with a CERROR_ILL.
+ *
+ * By contrast, an out-of-range address or ID value does not need a
+ * check: the spec defines it as CONSTRAINED UNPREDICTABLE, which is
+ * scoped to the guest itself and does not raise a CERROR_ILL.
+ */
+ if ((data[0] & ~allowed[0]) || (data[1] & ~allowed[1]))
+ return -EIO;
+ return 0;
+}
+
/*
* Convert, in place, the raw invalidation command into an internal format that
* can be passed to arm_smmu_cmdq_issue_cmdlist(). Internally commands are
@@ -332,33 +432,40 @@ struct arm_vsmmu_invalidation_cmd {
static int arm_vsmmu_convert_user_cmd(struct arm_vsmmu *vsmmu,
struct arm_vsmmu_invalidation_cmd *cmd)
{
+ u64 *data = cmd->cmd.data;
+ int ret;
+
/* Commands are le64 stored in u64 */
- cmd->cmd.data[0] = le64_to_cpu(cmd->ucmd.cmd[0]);
- cmd->cmd.data[1] = le64_to_cpu(cmd->ucmd.cmd[1]);
+ data[0] = le64_to_cpu(cmd->ucmd.cmd[0]);
+ data[1] = le64_to_cpu(cmd->ucmd.cmd[1]);
+
+ ret = arm_vsmmu_validate_user_cmd(vsmmu, data);
+ if (ret)
+ return ret;
- switch (cmd->cmd.data[0] & CMDQ_0_OP) {
+ switch (data[0] & CMDQ_0_OP) {
case CMDQ_OP_TLBI_NSNH_ALL:
/* Convert to NH_ALL */
- cmd->cmd.data[0] = CMDQ_OP_TLBI_NH_ALL |
- FIELD_PREP(CMDQ_TLBI_0_VMID, vsmmu->vmid);
- cmd->cmd.data[1] = 0;
+ data[0] = CMDQ_OP_TLBI_NH_ALL |
+ FIELD_PREP(CMDQ_TLBI_0_VMID, vsmmu->vmid);
+ data[1] = 0;
break;
case CMDQ_OP_TLBI_NH_VA:
case CMDQ_OP_TLBI_NH_VAA:
case CMDQ_OP_TLBI_NH_ALL:
case CMDQ_OP_TLBI_NH_ASID:
- cmd->cmd.data[0] &= ~CMDQ_TLBI_0_VMID;
- cmd->cmd.data[0] |= FIELD_PREP(CMDQ_TLBI_0_VMID, vsmmu->vmid);
+ data[0] &= ~CMDQ_TLBI_0_VMID;
+ data[0] |= FIELD_PREP(CMDQ_TLBI_0_VMID, vsmmu->vmid);
break;
case CMDQ_OP_ATC_INV:
case CMDQ_OP_CFGI_CD:
case CMDQ_OP_CFGI_CD_ALL: {
- u32 sid, vsid = FIELD_GET(CMDQ_CFGI_0_SID, cmd->cmd.data[0]);
+ u32 sid, vsid = FIELD_GET(CMDQ_CFGI_0_SID, data[0]);
if (arm_vsmmu_vsid_to_sid(vsmmu, vsid, &sid))
return -EIO;
- cmd->cmd.data[0] &= ~CMDQ_CFGI_0_SID;
- cmd->cmd.data[0] |= FIELD_PREP(CMDQ_CFGI_0_SID, sid);
+ data[0] &= ~CMDQ_CFGI_0_SID;
+ data[0] |= FIELD_PREP(CMDQ_CFGI_0_SID, sid);
break;
}
default:
diff --git a/include/uapi/linux/iommufd.h b/include/uapi/linux/iommufd.h
index 206fa667c7828..5d47d1421c1fc 100644
--- a/include/uapi/linux/iommufd.h
+++ b/include/uapi/linux/iommufd.h
@@ -948,7 +948,9 @@ struct iommu_hwpt_vtd_s1_invalidate {
* CMDQ_OP_CFGI_CD
* CMDQ_OP_CFGI_CD_ALL
*
- * -EIO will be returned if the command is not supported.
+ * User space must forward only valid commands: the kernel rejects, with
+ * -EIO, any command carrying an unsupported opcode, an unsupported field,
+ * or a field value that the underlying SMMU hardware does not implement.
*/
struct iommu_viommu_arm_smmuv3_invalidate {
__aligned_le64 cmd[2];
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0154/1257] PCI: endpoint: pci-epf-vntb: Manage virtual NTB and PCI bus lifetime
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0153/1257] iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0155/1257] iio: light: isl29028: fix runtime PM reference leak on error paths Greg Kroah-Hartman
` (844 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Manivannan Sadhasivam,
Bjorn Helgaas, Frank Li, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 5cdbd6d3a3a147fa9975e35f2602cbec9a72a932 ]
The virtual PCI driver registers an ntb_dev but has no remove callback.
Unbinding the endpoint function can therefore free BARs while the NTB
device and its client still use them. It also leaves the virtual PCI
devices and root bus allocated.
Allocate an ntb_dev for each virtual PCI probe and unregister it from the
matching remove callback. Start command processing only after registration.
Publish the device for doorbell IRQs at the same point. During remove, stop
the command work and drain IRQ handlers before unregistering the device.
Retain the root bus returned by pci_scan_bus() so it can be removed on
unbind. Unregister the virtual PCI driver before releasing endpoint
resources. Stop and remove the root bus under the PCI rescan/remove lock,
then release its host bridge.
Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: stable@vger.kernel.org # 6.0+
Link: https://patch.msgid.link/20260901063238.631166-3-den@valinux.co.jp
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/endpoint/functions/pci-epf-vntb.c | 85 +++++++++++++++----
1 file changed, 70 insertions(+), 15 deletions(-)
diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
index c3caec927d748..8ae50779452a9 100644
--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
+++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
@@ -132,7 +132,7 @@ struct epf_ntb_ctrl {
} __packed;
struct epf_ntb {
- struct ntb_dev ntb;
+ struct ntb_dev *ntb;
struct pci_epf *epf;
struct config_group group;
@@ -166,10 +166,15 @@ struct epf_ntb {
void __iomem *vpci_mw_addr[MAX_MW];
struct delayed_work cmd_handler;
+ struct pci_bus *vpci_bus;
};
#define to_epf_ntb(epf_group) container_of((epf_group), struct epf_ntb, group)
-#define ntb_ndev(__ntb) container_of(__ntb, struct epf_ntb, ntb)
+
+static struct epf_ntb *ntb_ndev(struct ntb_dev *ntb)
+{
+ return ntb->pdev->sysdata;
+}
static struct pci_epf_header epf_ntb_header = {
.vendorid = PCI_ANY_ID,
@@ -195,7 +200,7 @@ static int epf_ntb_link_up(struct epf_ntb *ntb, bool link_up)
else
ntb->reg->link_status &= ~LINK_STATUS_UP;
- ntb_link_event(&ntb->ntb);
+ ntb_link_event(ntb->ntb);
return 0;
}
@@ -284,7 +289,7 @@ static void epf_ntb_cmd_handler(struct work_struct *work)
i++) {
if (ntb->epf_db[i]) {
atomic64_or(1 << (i - EPF_IRQ_DB_START), &ntb->db);
- ntb_db_event(&ntb->ntb, i - EPF_IRQ_DB_START);
+ ntb_db_event(ntb->ntb, i - EPF_IRQ_DB_START);
ntb->epf_db[i] = 0;
}
}
@@ -348,12 +353,18 @@ static void epf_ntb_cmd_handler(struct work_struct *work)
static irqreturn_t epf_ntb_doorbell_handler(int irq, void *data)
{
struct epf_ntb *ntb = data;
+ struct ntb_dev *ndev;
int i;
+ /* Pair with smp_store_release() in pci_vntb_probe() */
+ ndev = smp_load_acquire(&ntb->ntb);
+ if (!ndev)
+ return IRQ_HANDLED;
+
for (i = EPF_IRQ_DB_START; i < ntb->db_count; i++)
if (irq == ntb->epf->db_msg[i].virq) {
atomic64_or(1 << (i - EPF_IRQ_DB_START), &ntb->db);
- ntb_db_event(&ntb->ntb, i - EPF_IRQ_DB_START);
+ ntb_db_event(ndev, i - EPF_IRQ_DB_START);
}
return IRQ_HANDLED;
@@ -985,7 +996,6 @@ static int epf_ntb_epc_init(struct epf_ntb *ntb)
}
INIT_DELAYED_WORK(&ntb->cmd_handler, epf_ntb_cmd_handler);
- queue_work(kpcintb_workqueue, &ntb->cmd_handler.work);
atomic64_set(&ntb->peer_db_pending, 0);
enable_work(&ntb->peer_db_work);
@@ -1337,6 +1347,7 @@ static int vpci_scan_bus(void *sysdata)
pr_err("create pci bus failed\n");
return -EINVAL;
}
+ ndev->vpci_bus = vpci_bus;
pci_bus_add_devices(vpci_bus);
@@ -1420,7 +1431,7 @@ static int vntb_epf_mw_set_trans(struct ntb_dev *ndev, int pidx, int idx,
int ret;
struct device *dev;
- dev = &ntb->ntb.dev;
+ dev = &ndev->dev;
barno = ntb->epf_ntb_bar[BAR_MW1 + idx];
epf_bar = &ntb->epf->bar[barno];
epf_bar->phys_addr = addr;
@@ -1558,7 +1569,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
ret = pci_epc_raise_irq(epf->epc, func_no, vfunc_no,
PCI_IRQ_MSI, interrupt_num);
if (ret)
- dev_err(&ntb->ntb.dev,
+ dev_err(&epf->dev,
"Failed to raise IRQ for interrupt_num %u: %d\n",
interrupt_num, ret);
}
@@ -1676,13 +1687,18 @@ static const struct ntb_dev_ops vntb_epf_ops = {
static int pci_vntb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
{
- int ret;
struct epf_ntb *ndev = (struct epf_ntb *)pdev->sysdata;
struct device *dev = &pdev->dev;
+ struct ntb_dev *ntb;
+ int ret;
- ndev->ntb.pdev = pdev;
- ndev->ntb.topo = NTB_TOPO_NONE;
- ndev->ntb.ops = &vntb_epf_ops;
+ ntb = devm_kzalloc(dev, sizeof(*ntb), GFP_KERNEL);
+ if (!ntb)
+ return -ENOMEM;
+
+ ntb->pdev = pdev;
+ ntb->topo = NTB_TOPO_NONE;
+ ntb->ops = &vntb_epf_ops;
ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
if (ret) {
@@ -1690,16 +1706,41 @@ static int pci_vntb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
return ret;
}
- ret = ntb_register_device(&ndev->ntb);
+ ret = ntb_register_device(ntb);
if (ret) {
dev_err(dev, "Failed to register NTB device\n");
return ret;
}
+ /* Publish after ntb_register_device() succeeds */
+ smp_store_release(&ndev->ntb, ntb);
+ queue_delayed_work(kpcintb_workqueue, &ndev->cmd_handler, 0);
+
dev_dbg(dev, "PCI Virtual NTB driver loaded\n");
return 0;
}
+static void pci_vntb_remove(struct pci_dev *pdev)
+{
+ struct epf_ntb *ndev = pdev->sysdata;
+ struct ntb_dev *ntb;
+ unsigned int i;
+
+ /* Stop the work reader, then close and drain the IRQ gate */
+ cancel_delayed_work_sync(&ndev->cmd_handler);
+
+ ntb = xchg(&ndev->ntb, NULL);
+
+ if (ndev->msi_doorbell)
+ for (i = 0; i < ndev->db_count; i++) {
+ if (epf_ntb_db_irq_is_duplicated(ndev->epf, i))
+ continue;
+ synchronize_irq(ndev->epf->db_msg[i].virq);
+ }
+
+ ntb_unregister_device(ntb);
+}
+
static struct pci_device_id pci_vntb_table[] = {
{
PCI_DEVICE(0xffff, 0xffff),
@@ -1711,6 +1752,7 @@ static struct pci_driver vntb_pci_driver = {
.name = "pci-vntb",
.id_table = pci_vntb_table,
.probe = pci_vntb_probe,
+ .remove = pci_vntb_remove,
};
/* ============ PCIe EPF Driver Bind ====================*/
@@ -1791,12 +1833,25 @@ static int epf_ntb_bind(struct pci_epf *epf)
*/
static void epf_ntb_unbind(struct pci_epf *epf)
{
+ struct pci_host_bridge *bridge;
struct epf_ntb *ntb = epf_get_drvdata(epf);
+ pci_unregister_driver(&vntb_pci_driver);
+
+ if (ntb->vpci_bus) {
+ bridge = to_pci_host_bridge(ntb->vpci_bus->bridge);
+
+ pci_lock_rescan_remove();
+ pci_stop_root_bus(ntb->vpci_bus);
+ pci_remove_root_bus(ntb->vpci_bus);
+ ntb->vpci_bus = NULL;
+ pci_unlock_rescan_remove();
+
+ pci_free_host_bridge(bridge);
+ }
+
epf_ntb_epc_cleanup(ntb);
epf_ntb_config_spad_bar_free(ntb);
-
- pci_unregister_driver(&vntb_pci_driver);
}
// EPF driver probe
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0155/1257] iio: light: isl29028: fix runtime PM reference leak on error paths
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0154/1257] PCI: endpoint: pci-epf-vntb: Manage virtual NTB and PCI bus lifetime Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0156/1257] iio: adc: max14001: add missing MODULE_DEVICE_TABLE macro Greg Kroah-Hartman
` (843 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joshua Crofts, Fabio Cesari,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Cesari <fabio.cesari@gmail.com>
[ Upstream commit 0e30d15b15647df786e60022650613e16dd70645 ]
isl29028_read_raw() and isl29028_write_raw() take a runtime PM reference
with pm_runtime_resume_and_get() but return directly on their error
paths without dropping it. The usage count never balances again and the
device stops entering autosuspend for good. In isl29028_read_raw() this
needs a regmap access to fail; in isl29028_write_raw() one rejected
sysfs write is enough, for example
echo 200 > in_proximity_sampling_frequency
which is outside the [1:100] range and returns -EINVAL with the
reference still held.
Take the reference with PM_RUNTIME_ACQUIRE_AUTOSUSPEND() instead, so it
is released on every return path.
This also stops the return value of pm_runtime_put_autosuspend() from
reaching userspace. That value only says whether the device could be
suspended right away, so -EAGAIN or -EPERM turns a successful access
into a failure, and with CONFIG_PM=n the stub returns -ENOSYS on every
access.
Fixes: 2db5054ac28d ("staging: iio: isl29028: add runtime power management support")
Suggested-by: Joshua Crofts <joshua.crofts1@gmail.com>
Cc: stable@vger.kernel.org
Assisted-by: LLM coccinelle
Signed-off-by: Fabio Cesari <fabio.cesari@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/isl29028.c | 33 ++++++++-------------------------
1 file changed, 8 insertions(+), 25 deletions(-)
diff --git a/drivers/iio/light/isl29028.c b/drivers/iio/light/isl29028.c
index 33deb1726689e..e481ac908fc13 100644
--- a/drivers/iio/light/isl29028.c
+++ b/drivers/iio/light/isl29028.c
@@ -342,8 +342,9 @@ static int isl29028_write_raw(struct iio_dev *indio_dev,
struct device *dev = regmap_get_device(chip->regmap);
int ret;
- ret = pm_runtime_resume_and_get(dev);
- if (ret < 0)
+ PM_RUNTIME_ACQUIRE_AUTOSUSPEND(dev, pm);
+ ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
+ if (ret)
return ret;
mutex_lock(&chip->lock);
@@ -392,14 +393,7 @@ static int isl29028_write_raw(struct iio_dev *indio_dev,
mutex_unlock(&chip->lock);
- if (ret < 0)
- return ret;
-
- ret = pm_runtime_put_autosuspend(dev);
- if (ret < 0)
- return ret;
-
- return 0;
+ return ret;
}
static int isl29028_read_raw(struct iio_dev *indio_dev,
@@ -408,10 +402,11 @@ static int isl29028_read_raw(struct iio_dev *indio_dev,
{
struct isl29028_chip *chip = iio_priv(indio_dev);
struct device *dev = regmap_get_device(chip->regmap);
- int ret, pm_ret;
+ int ret;
- ret = pm_runtime_resume_and_get(dev);
- if (ret < 0)
+ PM_RUNTIME_ACQUIRE_AUTOSUSPEND(dev, pm);
+ ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
+ if (ret)
return ret;
mutex_lock(&chip->lock);
@@ -461,18 +456,6 @@ static int isl29028_read_raw(struct iio_dev *indio_dev,
mutex_unlock(&chip->lock);
- if (ret < 0)
- return ret;
-
- /**
- * Preserve the ret variable if the call to
- * pm_runtime_put_autosuspend() is successful so the reading
- * (if applicable) is returned to user space.
- */
- pm_ret = pm_runtime_put_autosuspend(dev);
- if (pm_ret < 0)
- return pm_ret;
-
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0156/1257] iio: adc: max14001: add missing MODULE_DEVICE_TABLE macro
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0155/1257] iio: light: isl29028: fix runtime PM reference leak on error paths Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0157/1257] affs: validate blocks before freeing them Greg Kroah-Hartman
` (842 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joshua Crofts, Andy Shevchenko,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
[ Upstream commit ed6179c3c2b2545fa1c7174604ecfed55c9ddd6e ]
The MAX14001 has an SPI ID table, but does not export it with the
MODULE_DEVICE_TABLE(spi, ...) macro. Because of this, SPI-based module
autoloading fails on systems that don't use devicetree (e.g. via
spi_board_info).
Add the missing macro to export the alias information.
Fixes: 59795109fa67 ("iio: adc: max14001: New driver")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/max14001.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/adc/max14001.c b/drivers/iio/adc/max14001.c
index 58adeac62dde4..7694fbb6a9fd4 100644
--- a/drivers/iio/adc/max14001.c
+++ b/drivers/iio/adc/max14001.c
@@ -366,6 +366,7 @@ static const struct spi_device_id max14001_id_table[] = {
{ .name = "max14002", .driver_data = (kernel_ulong_t)&max14002_chip_info },
{ }
};
+MODULE_DEVICE_TABLE(spi, max14001_id_table);
static const struct of_device_id max14001_of_match[] = {
{ .compatible = "adi,max14001", .data = &max14001_chip_info },
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0157/1257] affs: validate blocks before freeing them
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0156/1257] iio: adc: max14001: add missing MODULE_DEVICE_TABLE macro Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0158/1257] dm vdo indexer: prevent delta list overflow on load Greg Kroah-Hartman
` (841 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kyle Zeng, David Sterba, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
[ Upstream commit 78ea2058abf3ee053c0bd9c1b9a77304cb4ae58b ]
affs_free_block() accepts block numbers from on-disk file block tables
when truncating or unlinking files. The function currently rejects only
block numbers greater than s_partition_size before subtracting
s_reserved and using the result to index the in-memory bitmap descriptor
array.
That check still accepts reserved blocks and the one-past-end block at
s_partition_size. A crafted image can therefore make the subtraction
underflow or make the computed bitmap index equal to s_bmap_count,
leading to an out-of-bounds access on s_bitmap before the bitmap block is
read and updated.
Use the existing AFFS block validity helper so freeing uses the same
range as block reads and writes: s_reserved <= block < s_partition_size.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
CC: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/affs/bitmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/affs/bitmap.c b/fs/affs/bitmap.c
index 40bc4ce6af4ac..f013a2a94d4d4 100644
--- a/fs/affs/bitmap.c
+++ b/fs/affs/bitmap.c
@@ -46,7 +46,7 @@ affs_free_block(struct super_block *sb, u32 block)
pr_debug("%s(%u)\n", __func__, block);
- if (block > sbi->s_partition_size)
+ if (!affs_validblock(sb, block))
goto err_range;
blk = block - sbi->s_reserved;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0158/1257] dm vdo indexer: prevent delta list overflow on load
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0157/1257] affs: validate blocks before freeing them Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0159/1257] dm vdo indexer: validate record page numbers better Greg Kroah-Hartman
` (840 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Sakai, Mikulas Patocka,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Sakai <msakai@redhat.com>
[ Upstream commit 936293c9f3f4f2a0d1b80df9332e96c552ac3b37 ]
Check for corrupted delta lists sizes that overflow the
memory available for the delta_lists. An overflow can
cause the delta list data to be written outside the
reserved delta memory space.
Signed-off-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-vdo/indexer/delta-index.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/md/dm-vdo/indexer/delta-index.c b/drivers/md/dm-vdo/indexer/delta-index.c
index b288749067dee..257612b81a9d9 100644
--- a/drivers/md/dm-vdo/indexer/delta-index.c
+++ b/drivers/md/dm-vdo/indexer/delta-index.c
@@ -800,7 +800,7 @@ static void compute_new_list_offsets(struct delta_zone *delta_zone, u32 growing_
(delta_zone->size * BITS_PER_BYTE - delta_lists[tail_guard_index].size);
}
-static void rebalance_lists(struct delta_zone *delta_zone)
+static int rebalance_lists(struct delta_zone *delta_zone)
{
struct delta_list *delta_lists;
u32 i;
@@ -811,9 +811,17 @@ static void rebalance_lists(struct delta_zone *delta_zone)
for (i = 0; i <= delta_zone->list_count + 1; i++)
used_space += get_delta_list_byte_size(&delta_lists[i]);
+ if (delta_zone->size < used_space) {
+ return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
+ "delta zone lists overflow zone size %zu",
+ delta_zone->size);
+ }
+
compute_new_list_offsets(delta_zone, 0, 0, used_space);
for (i = 1; i <= delta_zone->list_count + 1; i++)
delta_lists[i].start = delta_zone->new_offsets[i];
+
+ return UDS_SUCCESS;
}
/* Start restoring a delta index from multiple input streams. */
@@ -941,8 +949,11 @@ int uds_start_restoring_delta_index(struct delta_index *delta_index,
}
/* Prepare each zone to start receiving the delta list data. */
- for (z = 0; z < delta_index->zone_count; z++)
- rebalance_lists(&delta_index->delta_zones[z]);
+ for (z = 0; z < delta_index->zone_count; z++) {
+ result = rebalance_lists(&delta_index->delta_zones[z]);
+ if (result != UDS_SUCCESS)
+ return result;
+ }
return UDS_SUCCESS;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0159/1257] dm vdo indexer: validate record page numbers better
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0158/1257] dm vdo indexer: prevent delta list overflow on load Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0160/1257] f2fs: drop pending discard commands before reserving device alias Greg Kroah-Hartman
` (839 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Sakai, Mikulas Patocka,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Sakai <msakai@redhat.com>
[ Upstream commit e3683a76a313a81f3f7bc7f65e4fc1e61232838b ]
Move the record_page_number validation check into the
chapter index lookup function in order to detect (and
discard) corrupted values on all paths.
Signed-off-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-vdo/indexer/chapter-index.c | 15 +++++++++++----
drivers/md/dm-vdo/indexer/volume.c | 6 ------
2 files changed, 11 insertions(+), 10 deletions(-)
diff --git a/drivers/md/dm-vdo/indexer/chapter-index.c b/drivers/md/dm-vdo/indexer/chapter-index.c
index bb3b0ab5d50dc..9fb9e59238d4c 100644
--- a/drivers/md/dm-vdo/indexer/chapter-index.c
+++ b/drivers/md/dm-vdo/indexer/chapter-index.c
@@ -284,10 +284,17 @@ int uds_search_chapter_index_page(struct delta_index_page *index_page,
if (result != UDS_SUCCESS)
return result;
- if (was_entry_found(&entry, address))
- *record_page_ptr = uds_get_delta_entry_value(&entry);
- else
+ if (!was_entry_found(&entry, address)) {
*record_page_ptr = NO_CHAPTER_INDEX_ENTRY;
+ return UDS_SUCCESS;
+ }
- return UDS_SUCCESS;
+ *record_page_ptr = uds_get_delta_entry_value(&entry);
+ result = VDO_ASSERT(*record_page_ptr < geometry->record_pages_per_chapter,
+ "0 <= %d < %u", *record_page_ptr,
+ geometry->record_pages_per_chapter);
+ if (result != VDO_SUCCESS)
+ *record_page_ptr = NO_CHAPTER_INDEX_ENTRY;
+
+ return result;
}
diff --git a/drivers/md/dm-vdo/indexer/volume.c b/drivers/md/dm-vdo/indexer/volume.c
index 78c3729f1f65e..38e51fa1cbd05 100644
--- a/drivers/md/dm-vdo/indexer/volume.c
+++ b/drivers/md/dm-vdo/indexer/volume.c
@@ -891,12 +891,6 @@ int uds_search_cached_record_page(struct volume *volume, struct uds_request *req
if (record_page_number == NO_CHAPTER_INDEX_ENTRY)
return UDS_SUCCESS;
- result = VDO_ASSERT(record_page_number < geometry->record_pages_per_chapter,
- "0 <= %d < %u", record_page_number,
- geometry->record_pages_per_chapter);
- if (result != VDO_SUCCESS)
- return result;
-
page_number = geometry->index_pages_per_chapter + record_page_number;
physical_page = map_to_physical_page(&volume->geometry, chapter, page_number);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0160/1257] f2fs: drop pending discard commands before reserving device alias
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0159/1257] dm vdo indexer: validate record page numbers better Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0161/1257] f2fs: force out-place update for all writes on compressed file Greg Kroah-Hartman
` (838 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wenjie Qi, Daeho Jeong, Chao Yu,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <daehojeong@google.com>
[ Upstream commit 5d37f99e4d25eaf42efe2dda8b947585478168f6 ]
When reserving a device alias via f2fs_ioc_reserve_dev_alias(),
f2fs_reserve_device_alias() bulk-marks all blocks in the target device
range as valid in SIT.
However, if the device was previously in the released state, stale
pending discard commands covering that range may still exist in dcc->root.
When f2fs_issue_discard_thread later processes those commands,
__check_sit_bitmap() detects valid blocks in the discard range and
triggers a kernel BUG().
To fix this:
1. Introduce f2fs_drop_discard_cmd_range() to traverse the discard rbtree,
drop all pending D_PREP discard commands in the range,
and wait for any in-flight discard bios under dcc->cmd_lock.
2. Call f2fs_drop_discard_cmd_range() in f2fs_ioc_reserve_dev_alias()
before f2fs_reserve_device_alias().
Reported-by: Wenjie Qi <qiwenjie@xiaomi.com>
Fixes: eae3faf210bd ("f2fs: support dynamic reserve/release for device aliasing")
Cc: stable@vger.kernel.org
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Reviewed-by: Wenjie Qi <qiwenjie@xiaomi.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/f2fs.h | 3 +++
fs/f2fs/file.c | 1 +
fs/f2fs/segment.c | 54 +++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 58 insertions(+)
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 9940a6cecf1a2..0c85d90307f70 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -466,6 +466,7 @@ struct discard_entry {
#define MAX_PLIST_NUM 512
#define plist_idx(blk_num) ((blk_num) >= MAX_PLIST_NUM ? \
(MAX_PLIST_NUM - 1) : ((blk_num) - 1))
+#define MAX_DISCARD_DROP_COUNT 512
enum {
D_PREP, /* initial */
@@ -4064,6 +4065,8 @@ void f2fs_reserve_device_alias(struct f2fs_sb_info *sbi, block_t addr,
bool f2fs_is_checkpointed_data(struct f2fs_sb_info *sbi, block_t blkaddr);
int f2fs_start_discard_thread(struct f2fs_sb_info *sbi);
void f2fs_drop_discard_cmd(struct f2fs_sb_info *sbi);
+void f2fs_drop_discard_cmd_range(struct f2fs_sb_info *sbi,
+ block_t start, block_t len);
void f2fs_stop_discard_thread(struct f2fs_sb_info *sbi);
bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi, bool need_check);
void f2fs_clear_prefree_segments(struct f2fs_sb_info *sbi,
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index edc352569e87e..29466a7367e55 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3843,6 +3843,7 @@ static int f2fs_ioc_reserve_dev_alias(struct file *filp)
write_unlock(&et->lock);
clear_inode_flag(inode, FI_NO_EXTENT);
+ f2fs_drop_discard_cmd_range(sbi, ei.blk, ei.len);
f2fs_reserve_device_alias(sbi, ei.blk, ei.len);
i_size_write(inode, (loff_t)ei.len << sbi->log_blocksize);
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 63b712d3d599e..db4af7a6b138e 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1871,6 +1871,60 @@ static unsigned int __wait_all_discard_cmd(struct f2fs_sb_info *sbi,
return discard_blks;
}
+void f2fs_drop_discard_cmd_range(struct f2fs_sb_info *sbi,
+ block_t start, block_t len)
+{
+ struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
+ struct discard_cmd *prev_dc = NULL, *next_dc = NULL;
+ struct rb_node **insert_p = NULL, *insert_parent = NULL;
+ struct discard_cmd *dc, *wait_dc;
+ u64 cur = start;
+ u64 end = (u64)start + len;
+ int count;
+
+ if (!f2fs_realtime_discard_enable(sbi))
+ return;
+
+next:
+ count = 0;
+ wait_dc = NULL;
+
+ mutex_lock(&dcc->cmd_lock);
+ while (cur < end) {
+ dc = __lookup_discard_cmd_ret(&dcc->root, cur,
+ &prev_dc, &next_dc, &insert_p, &insert_parent);
+ if (!dc)
+ dc = next_dc;
+
+ if (!dc || (u64)dc->di.lstart >= end)
+ break;
+
+ if (dc->state == D_PREP) {
+ cur = (u64)dc->di.lstart + dc->di.len;
+ __remove_discard_cmd(sbi, dc);
+ if (++count >= MAX_DISCARD_DROP_COUNT)
+ break;
+ continue;
+ }
+
+ dc->ref++;
+ cur = (u64)dc->di.lstart + dc->di.len;
+ wait_dc = dc;
+ break;
+ }
+ mutex_unlock(&dcc->cmd_lock);
+
+ if (wait_dc) {
+ __wait_one_discard_bio(sbi, wait_dc);
+ goto next;
+ }
+
+ if (count >= MAX_DISCARD_DROP_COUNT) {
+ cond_resched();
+ goto next;
+ }
+}
+
/* This should be covered by global mutex, &sit_i->sentry_lock */
static void f2fs_wait_discard_bio(struct f2fs_sb_info *sbi, block_t blkaddr)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0161/1257] f2fs: force out-place update for all writes on compressed file
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0160/1257] f2fs: drop pending discard commands before reserving device alias Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0162/1257] f2fs: compress: fix to handle race between truncate and writeback Greg Kroah-Hartman
` (837 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jiucheng Xu, Chao Yu,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiucheng Xu <jiucheng.xu@amlogic.com>
[ Upstream commit a64a3fec11e77a3a0dc0009bdc58b925e45a1bb4 ]
For compressed file, compressed write may fail and fall back to raw
write.
-Thread A - Thread B
- f2fs_write_multi_pages - f2fs_down_write(&sbi->cp_rwsem);
- f2fs_write_compressed_pages - ...
- f2fs_trylock_op - ...
- f2fs_down_read_trylock(&sbi->cp_rwsem); - ...
- f2fs_write_raw_pages - ...
Thread B acquires the lock first, which causes Thread A to fail lock
acquisition and fall back to raw-data write.
IPU_FORCE is enabled on small-capacity storage devices (< 16GB),
so f2fs_write_raw_pages() overwrites the original compressed data
in-place.
The in-memory node has been updated with raw-data addresses, while the
node metadata stored on eMMC still remains in compressed state.
If a power-cut occurs before the node is flushed to disk, on-disk
inconsistency arises: disk data is raw, yet metadata treats it as a
compressed cluster, leading to decompression failure.
To eliminate this risk completely, force out-place update for all
write operations on compressed file.
Cc: stable@kernel.org
Fixes: 4c8ff7095bef ("f2fs: support data compression")
Signed-off-by: Jiucheng Xu <jiucheng.xu@amlogic.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/data.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 21f396ebe22ca..5a4af37b358d3 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2909,10 +2909,12 @@ bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio)
return true;
if (f2fs_used_in_atomic_write(inode))
return true;
- /* rewrite low ratio compress data w/ OPU mode to avoid fragmentation */
- if (f2fs_compressed_file(inode) &&
- F2FS_OPTION(sbi).compress_mode == COMPR_MODE_USER &&
- is_inode_flag_set(inode, FI_ENABLE_COMPRESS))
+ /*
+ * rewrite low ratio compress data w/ OPU mode to avoid fragmentation.
+ * If IO comes from compressed write path and fallback to raw write,
+ * force out‑place to prevent metadata‑data inconsistency.
+ */
+ if (f2fs_compressed_file(inode))
return true;
/* swap file is migrating in aligned write mode */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0162/1257] f2fs: compress: fix to handle race between truncate and writeback
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0161/1257] f2fs: force out-place update for all writes on compressed file Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0163/1257] ACPI: SBS: Fix NULL pointer dereference on allocation failure Greg Kroah-Hartman
` (836 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Zhiguo Niu, Chao Yu,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit c0337e331b065074ce20e4258a578e07dd7e4083 ]
fsstress reports a kernel BUG in f2fs_truncate_partial_cluster():
kernel BUG at fs/f2fs/compress.c:1238!
RIP: 0010:f2fs_truncate_partial_cluster+0x292/0x2a0
Call Trace:
<TASK>
f2fs_truncate+0xf6/0x210
f2fs_setattr+0x6b7/0x770
notify_change+0x33b/0x520
do_truncate+0xc2/0xf0
vfs_truncate+0x153/0x1d0
ksys_truncate+0x78/0xd0
__x64_sys_truncate+0x16/0x20
do_syscall_64+0xbe/0x540
The root cause is that Thread A (truncate) and Thread B (background
writeback or fsync) can race as follows:
Thread A Thread B
- f2fs_setattr
- f2fs_truncate
- f2fs_truncate_blocks
- f2fs_truncate_partial_cluster
- f2fs_is_compressed_cluster
return 1
- f2fs_write_cache_pages
- f2fs_write_multi_pages
- f2fs_write_raw_pages
- f2fs_write_single_data_page
dn.data_blkaddr != COMPRESS_ADDR
(cluster converted to normal)
- f2fs_prepare_compress_overwrite
- f2fs_is_compressed_cluster
return 0
- return 0
- f2fs_bug_on(sbi, err == 0): BUG!
Writeback path does not acquire i_gc_rwsem or filemap_invalidate_lock.
When a compressed cluster fails compression during writeback, it is
overwritten with raw data blocks. If Thread A checked
f2fs_is_compressed_cluster() before the conversion, but calls
f2fs_prepare_compress_overwrite() after the conversion,
f2fs_prepare_compress_overwrite() returns 0 because the cluster is no
longer a compressed cluster.
To fix this, remove the f2fs_bug_on() and retry checking the cluster status
when f2fs_prepare_compress_overwrite() returns 0, so that it can fall back
to f2fs_do_truncate_blocks() to handle it as a normal cluster.
Cc: stable@kernel.org
Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
Reviewed-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/compress.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index ce88092d9ce26..b711076040128 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -1222,6 +1222,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
int i;
int err;
+repeat:
err = f2fs_is_compressed_cluster(inode, start_idx);
if (err < 0)
return err;
@@ -1233,12 +1234,11 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
/* truncate compressed cluster */
err = f2fs_prepare_compress_overwrite(inode, &pagep,
start_idx, &fsdata);
-
- /* should not be a normal cluster */
- f2fs_bug_on(F2FS_I_SB(inode), err == 0);
-
- if (err <= 0)
+ if (err < 0)
return err;
+ else if (err == 0)
+ /* the cluster became non-compressed one due to race case */
+ goto repeat;
rpages = fsdata;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0163/1257] ACPI: SBS: Fix NULL pointer dereference on allocation failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0162/1257] f2fs: compress: fix to handle race between truncate and writeback Greg Kroah-Hartman
@ 2026-11-07 13:40 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0164/1257] ata: sata_inic162x: remove dangerous broken driver Greg Kroah-Hartman
` (835 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Rafael J. Wysocki,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 2b30842e52d9a364428b598f5edd4b12fa772f5a ]
acpi_sbs_probe() jumps to the common error path when kzalloc_obj()
fails, but platform_set_drvdata() is only called after the allocation
succeeds.
The error path calls acpi_sbs_remove(), which retrieves the unset
driver data and dereferences the resulting NULL pointer when locking
sbs->lock, causing a NULL pointer dereference.
Return -ENOMEM directly when the allocation fails, since no resources
have been initialized at that point and there is nothing to clean up.
This issue was found by manual code inspection.
Fixes: 9460eaae2ee42 ("ACPI: SBS: Convert the driver to a platform one")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260912113355.644238-1-lgs201920130244@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/sbs.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
index 86b7c79758526..4b84b3cd11e38 100644
--- a/drivers/acpi/sbs.c
+++ b/drivers/acpi/sbs.c
@@ -639,10 +639,8 @@ static int acpi_sbs_probe(struct platform_device *pdev)
return -ENODEV;
sbs = kzalloc_obj(struct acpi_sbs);
- if (!sbs) {
- result = -ENOMEM;
- goto end;
- }
+ if (!sbs)
+ return -ENOMEM;
mutex_init(&sbs->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0164/1257] ata: sata_inic162x: remove dangerous broken driver
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2026-11-07 13:40 ` [PATCH 7.3 0163/1257] ACPI: SBS: Fix NULL pointer dereference on allocation failure Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0165/1257] pinctrl: renesas: rzt2h: Restore correct pin mode on IRQ free Greg Kroah-Hartman
` (834 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ethan Nelson-Moore, Damien Le Moal,
Niklas Cassel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
[ Upstream commit 96fdeb7e3fd8d937f8351ed90824c9d904e590a1 ]
The sata_inic162x driver was labeled as "very experimental" in
commit bb9696192826 ("libata: make it clear that sata_inic162x is
experimental") due to data corruption issues, but not marked as broken.
Since then, no changes have been made to it that could fix these
issues. Since the driver was not marked as broken, and the message
about potential data corruption is only visible in the code and dmesg,
it is possible that someone could enable the driver without realizing
its potential for data corruption. Remove the driver to protect users'
data.
Fixes: 1fd7a697a37b ("sata_inic162x: finally, driver for initio 162x SATA controllers, take #2")
Cc: stable@vger.kernel.org
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915014714.41274-1-enelsonmoore@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/Kconfig | 7 -
drivers/ata/Makefile | 1 -
drivers/ata/sata_inic162x.c | 903 ------------------------------------
3 files changed, 911 deletions(-)
delete mode 100644 drivers/ata/sata_inic162x.c
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 28ca856ecc754..8ef9398b704f8 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -328,13 +328,6 @@ config SATA_AHCI_SEATTLE
If unsure, say N
-config SATA_INIC162X
- tristate "Initio 162x SATA support (Very Experimental)"
- depends on PCI
- select SATA_HOST
- help
- This option enables support for Initio 162x Serial ATA.
-
config SATA_ACARD_AHCI
tristate "ACard AHCI variant (ATP 8620)"
depends on PCI
diff --git a/drivers/ata/Makefile b/drivers/ata/Makefile
index b96025abd45e3..55b89c09dd74a 100644
--- a/drivers/ata/Makefile
+++ b/drivers/ata/Makefile
@@ -11,7 +11,6 @@ obj-$(CONFIG_SATA_AHCI_SEATTLE) += ahci_seattle.o libahci.o libahci_platform.o
obj-$(CONFIG_SATA_AHCI_PLATFORM) += ahci_platform.o libahci.o libahci_platform.o
obj-$(CONFIG_SATA_FSL) += sata_fsl.o
obj-$(CONFIG_SATA_GEMINI) += sata_gemini.o
-obj-$(CONFIG_SATA_INIC162X) += sata_inic162x.o
obj-$(CONFIG_SATA_SIL24) += sata_sil24.o
obj-$(CONFIG_SATA_DWC) += sata_dwc_460ex.o
obj-$(CONFIG_SATA_HIGHBANK) += sata_highbank.o libahci.o
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
deleted file mode 100644
index 065408975f5b5..0000000000000
--- a/drivers/ata/sata_inic162x.c
+++ /dev/null
@@ -1,903 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/*
- * sata_inic162x.c - Driver for Initio 162x SATA controllers
- *
- * Copyright 2006 SUSE Linux Products GmbH
- * Copyright 2006 Tejun Heo <teheo@novell.com>
- *
- * **** WARNING ****
- *
- * This driver never worked properly and unfortunately data corruption is
- * relatively common. There isn't anyone working on the driver and there's
- * no support from the vendor. Do not use this driver in any production
- * environment.
- *
- * http://thread.gmane.org/gmane.linux.debian.devel.bugs.rc/378525/focus=54491
- * https://bugzilla.kernel.org/show_bug.cgi?id=60565
- *
- * *****************
- *
- * This controller is eccentric and easily locks up if something isn't
- * right. Documentation is available at initio's website but it only
- * documents registers (not programming model).
- *
- * This driver has interesting history. The first version was written
- * from the documentation and a 2.4 IDE driver posted on a Taiwan
- * company, which didn't use any IDMA features and couldn't handle
- * LBA48. The resulting driver couldn't handle LBA48 devices either
- * making it pretty useless.
- *
- * After a while, initio picked the driver up, renamed it to
- * sata_initio162x, updated it to use IDMA for ATA DMA commands and
- * posted it on their website. It only used ATA_PROT_DMA for IDMA and
- * attaching both devices and issuing IDMA and !IDMA commands
- * simultaneously broke it due to PIRQ masking interaction but it did
- * show how to use the IDMA (ADMA + some initio specific twists)
- * engine.
- *
- * Then, I picked up their changes again and here's the usable driver
- * which uses IDMA for everything. Everything works now including
- * LBA48, CD/DVD burning, suspend/resume and hotplug. There are some
- * issues tho. Result Tf is not resported properly, NCQ isn't
- * supported yet and CD/DVD writing works with DMA assisted PIO
- * protocol (which, for native SATA devices, shouldn't cause any
- * noticeable difference).
- *
- * Anyways, so, here's finally a working driver for inic162x. Enjoy!
- *
- * initio: If you guys wanna improve the driver regarding result TF
- * access and other stuff, please feel free to contact me. I'll be
- * happy to assist.
- */
-
-#include <linux/gfp.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/pci.h>
-#include <scsi/scsi_host.h>
-#include <linux/libata.h>
-#include <linux/blkdev.h>
-#include <scsi/scsi_device.h>
-
-#define DRV_NAME "sata_inic162x"
-#define DRV_VERSION "0.4"
-
-enum {
- MMIO_BAR_PCI = 5,
- MMIO_BAR_CARDBUS = 1,
-
- NR_PORTS = 2,
-
- IDMA_CPB_TBL_SIZE = 4 * 32,
-
- INIC_DMA_BOUNDARY = 0xffffff,
-
- HOST_ACTRL = 0x08,
- HOST_CTL = 0x7c,
- HOST_STAT = 0x7e,
- HOST_IRQ_STAT = 0xbc,
- HOST_IRQ_MASK = 0xbe,
-
- PORT_SIZE = 0x40,
-
- /* registers for ATA TF operation */
- PORT_TF_DATA = 0x00,
- PORT_TF_FEATURE = 0x01,
- PORT_TF_NSECT = 0x02,
- PORT_TF_LBAL = 0x03,
- PORT_TF_LBAM = 0x04,
- PORT_TF_LBAH = 0x05,
- PORT_TF_DEVICE = 0x06,
- PORT_TF_COMMAND = 0x07,
- PORT_TF_ALT_STAT = 0x08,
- PORT_IRQ_STAT = 0x09,
- PORT_IRQ_MASK = 0x0a,
- PORT_PRD_CTL = 0x0b,
- PORT_PRD_ADDR = 0x0c,
- PORT_PRD_XFERLEN = 0x10,
- PORT_CPB_CPBLAR = 0x18,
- PORT_CPB_PTQFIFO = 0x1c,
-
- /* IDMA register */
- PORT_IDMA_CTL = 0x14,
- PORT_IDMA_STAT = 0x16,
-
- PORT_RPQ_FIFO = 0x1e,
- PORT_RPQ_CNT = 0x1f,
-
- PORT_SCR = 0x20,
-
- /* HOST_CTL bits */
- HCTL_LEDEN = (1 << 3), /* enable LED operation */
- HCTL_IRQOFF = (1 << 8), /* global IRQ off */
- HCTL_FTHD0 = (1 << 10), /* fifo threshold 0 */
- HCTL_FTHD1 = (1 << 11), /* fifo threshold 1*/
- HCTL_PWRDWN = (1 << 12), /* power down PHYs */
- HCTL_SOFTRST = (1 << 13), /* global reset (no phy reset) */
- HCTL_RPGSEL = (1 << 15), /* register page select */
-
- HCTL_KNOWN_BITS = HCTL_IRQOFF | HCTL_PWRDWN | HCTL_SOFTRST |
- HCTL_RPGSEL,
-
- /* HOST_IRQ_(STAT|MASK) bits */
- HIRQ_PORT0 = (1 << 0),
- HIRQ_PORT1 = (1 << 1),
- HIRQ_SOFT = (1 << 14),
- HIRQ_GLOBAL = (1 << 15), /* STAT only */
-
- /* PORT_IRQ_(STAT|MASK) bits */
- PIRQ_OFFLINE = (1 << 0), /* device unplugged */
- PIRQ_ONLINE = (1 << 1), /* device plugged */
- PIRQ_COMPLETE = (1 << 2), /* completion interrupt */
- PIRQ_FATAL = (1 << 3), /* fatal error */
- PIRQ_ATA = (1 << 4), /* ATA interrupt */
- PIRQ_REPLY = (1 << 5), /* reply FIFO not empty */
- PIRQ_PENDING = (1 << 7), /* port IRQ pending (STAT only) */
-
- PIRQ_ERR = PIRQ_OFFLINE | PIRQ_ONLINE | PIRQ_FATAL,
- PIRQ_MASK_DEFAULT = PIRQ_REPLY | PIRQ_ATA,
- PIRQ_MASK_FREEZE = 0xff,
-
- /* PORT_PRD_CTL bits */
- PRD_CTL_START = (1 << 0),
- PRD_CTL_WR = (1 << 3),
- PRD_CTL_DMAEN = (1 << 7), /* DMA enable */
-
- /* PORT_IDMA_CTL bits */
- IDMA_CTL_RST_ATA = (1 << 2), /* hardreset ATA bus */
- IDMA_CTL_RST_IDMA = (1 << 5), /* reset IDMA machinery */
- IDMA_CTL_GO = (1 << 7), /* IDMA mode go */
- IDMA_CTL_ATA_NIEN = (1 << 8), /* ATA IRQ disable */
-
- /* PORT_IDMA_STAT bits */
- IDMA_STAT_PERR = (1 << 0), /* PCI ERROR MODE */
- IDMA_STAT_CPBERR = (1 << 1), /* ADMA CPB error */
- IDMA_STAT_LGCY = (1 << 3), /* ADMA legacy */
- IDMA_STAT_UIRQ = (1 << 4), /* ADMA unsolicited irq */
- IDMA_STAT_STPD = (1 << 5), /* ADMA stopped */
- IDMA_STAT_PSD = (1 << 6), /* ADMA pause */
- IDMA_STAT_DONE = (1 << 7), /* ADMA done */
-
- IDMA_STAT_ERR = IDMA_STAT_PERR | IDMA_STAT_CPBERR,
-
- /* CPB Control Flags*/
- CPB_CTL_VALID = (1 << 0), /* CPB valid */
- CPB_CTL_QUEUED = (1 << 1), /* queued command */
- CPB_CTL_DATA = (1 << 2), /* data, rsvd in datasheet */
- CPB_CTL_IEN = (1 << 3), /* PCI interrupt enable */
- CPB_CTL_DEVDIR = (1 << 4), /* device direction control */
-
- /* CPB Response Flags */
- CPB_RESP_DONE = (1 << 0), /* ATA command complete */
- CPB_RESP_REL = (1 << 1), /* ATA release */
- CPB_RESP_IGNORED = (1 << 2), /* CPB ignored */
- CPB_RESP_ATA_ERR = (1 << 3), /* ATA command error */
- CPB_RESP_SPURIOUS = (1 << 4), /* ATA spurious interrupt error */
- CPB_RESP_UNDERFLOW = (1 << 5), /* APRD deficiency length error */
- CPB_RESP_OVERFLOW = (1 << 6), /* APRD exccess length error */
- CPB_RESP_CPB_ERR = (1 << 7), /* CPB error flag */
-
- /* PRD Control Flags */
- PRD_DRAIN = (1 << 1), /* ignore data excess */
- PRD_CDB = (1 << 2), /* atapi packet command pointer */
- PRD_DIRECT_INTR = (1 << 3), /* direct interrupt */
- PRD_DMA = (1 << 4), /* data transfer method */
- PRD_WRITE = (1 << 5), /* data dir, rsvd in datasheet */
- PRD_IOM = (1 << 6), /* io/memory transfer */
- PRD_END = (1 << 7), /* APRD chain end */
-};
-
-/* Comman Parameter Block */
-struct inic_cpb {
- u8 resp_flags; /* Response Flags */
- u8 error; /* ATA Error */
- u8 status; /* ATA Status */
- u8 ctl_flags; /* Control Flags */
- __le32 len; /* Total Transfer Length */
- __le32 prd; /* First PRD pointer */
- u8 rsvd[4];
- /* 16 bytes */
- u8 feature; /* ATA Feature */
- u8 hob_feature; /* ATA Ex. Feature */
- u8 device; /* ATA Device/Head */
- u8 mirctl; /* Mirror Control */
- u8 nsect; /* ATA Sector Count */
- u8 hob_nsect; /* ATA Ex. Sector Count */
- u8 lbal; /* ATA Sector Number */
- u8 hob_lbal; /* ATA Ex. Sector Number */
- u8 lbam; /* ATA Cylinder Low */
- u8 hob_lbam; /* ATA Ex. Cylinder Low */
- u8 lbah; /* ATA Cylinder High */
- u8 hob_lbah; /* ATA Ex. Cylinder High */
- u8 command; /* ATA Command */
- u8 ctl; /* ATA Control */
- u8 slave_error; /* Slave ATA Error */
- u8 slave_status; /* Slave ATA Status */
- /* 32 bytes */
-} __packed;
-
-/* Physical Region Descriptor */
-struct inic_prd {
- __le32 mad; /* Physical Memory Address */
- __le16 len; /* Transfer Length */
- u8 rsvd;
- u8 flags; /* Control Flags */
-} __packed;
-
-struct inic_pkt {
- struct inic_cpb cpb;
- struct inic_prd prd[LIBATA_MAX_PRD + 1]; /* + 1 for cdb */
- u8 cdb[ATAPI_CDB_LEN];
-} __packed;
-
-struct inic_host_priv {
- void __iomem *mmio_base;
- u16 cached_hctl;
-};
-
-struct inic_port_priv {
- struct inic_pkt *pkt;
- dma_addr_t pkt_dma;
- u32 *cpb_tbl;
- dma_addr_t cpb_tbl_dma;
-};
-
-static const struct scsi_host_template inic_sht = {
- ATA_BASE_SHT(DRV_NAME),
- .sg_tablesize = LIBATA_MAX_PRD, /* maybe it can be larger? */
-
- /*
- * This controller is braindamaged. dma_boundary is 0xffff like others
- * but it will lock up the whole machine HARD if 65536 byte PRD entry
- * is fed. Reduce maximum segment size.
- */
- .dma_boundary = INIC_DMA_BOUNDARY,
- .max_segment_size = 65536 - 512,
-};
-
-static const int scr_map[] = {
- [SCR_STATUS] = 0,
- [SCR_ERROR] = 1,
- [SCR_CONTROL] = 2,
-};
-
-static void __iomem *inic_port_base(struct ata_port *ap)
-{
- struct inic_host_priv *hpriv = ap->host->private_data;
-
- return hpriv->mmio_base + ap->port_no * PORT_SIZE;
-}
-
-static void inic_reset_port(void __iomem *port_base)
-{
- void __iomem *idma_ctl = port_base + PORT_IDMA_CTL;
-
- /* stop IDMA engine */
- readw(idma_ctl); /* flush */
- msleep(1);
-
- /* mask IRQ and assert reset */
- writew(IDMA_CTL_RST_IDMA, idma_ctl);
- readw(idma_ctl); /* flush */
- msleep(1);
-
- /* release reset */
- writew(0, idma_ctl);
-
- /* clear irq */
- writeb(0xff, port_base + PORT_IRQ_STAT);
-}
-
-static int inic_scr_read(struct ata_link *link, unsigned sc_reg, u32 *val)
-{
- void __iomem *scr_addr = inic_port_base(link->ap) + PORT_SCR;
-
- if (unlikely(sc_reg >= ARRAY_SIZE(scr_map)))
- return -EINVAL;
-
- *val = readl(scr_addr + scr_map[sc_reg] * 4);
-
- /* this controller has stuck DIAG.N, ignore it */
- if (sc_reg == SCR_ERROR)
- *val &= ~SERR_PHYRDY_CHG;
- return 0;
-}
-
-static int inic_scr_write(struct ata_link *link, unsigned sc_reg, u32 val)
-{
- void __iomem *scr_addr = inic_port_base(link->ap) + PORT_SCR;
-
- if (unlikely(sc_reg >= ARRAY_SIZE(scr_map)))
- return -EINVAL;
-
- writel(val, scr_addr + scr_map[sc_reg] * 4);
- return 0;
-}
-
-static void inic_stop_idma(struct ata_port *ap)
-{
- void __iomem *port_base = inic_port_base(ap);
-
- readb(port_base + PORT_RPQ_FIFO);
- readb(port_base + PORT_RPQ_CNT);
- writew(0, port_base + PORT_IDMA_CTL);
-}
-
-static void inic_host_err_intr(struct ata_port *ap, u8 irq_stat, u16 idma_stat)
-{
- struct ata_eh_info *ehi = &ap->link.eh_info;
- struct inic_port_priv *pp = ap->private_data;
- struct inic_cpb *cpb = &pp->pkt->cpb;
- bool freeze = false;
-
- ata_ehi_clear_desc(ehi);
- ata_ehi_push_desc(ehi, "irq_stat=0x%x idma_stat=0x%x",
- irq_stat, idma_stat);
-
- inic_stop_idma(ap);
-
- if (irq_stat & (PIRQ_OFFLINE | PIRQ_ONLINE)) {
- ata_ehi_push_desc(ehi, "hotplug");
- ata_ehi_hotplugged(ehi);
- freeze = true;
- }
-
- if (idma_stat & IDMA_STAT_PERR) {
- ata_ehi_push_desc(ehi, "PCI error");
- freeze = true;
- }
-
- if (idma_stat & IDMA_STAT_CPBERR) {
- ata_ehi_push_desc(ehi, "CPB error");
-
- if (cpb->resp_flags & CPB_RESP_IGNORED) {
- __ata_ehi_push_desc(ehi, " ignored");
- ehi->err_mask |= AC_ERR_INVALID;
- freeze = true;
- }
-
- if (cpb->resp_flags & CPB_RESP_ATA_ERR)
- ehi->err_mask |= AC_ERR_DEV;
-
- if (cpb->resp_flags & CPB_RESP_SPURIOUS) {
- __ata_ehi_push_desc(ehi, " spurious-intr");
- ehi->err_mask |= AC_ERR_HSM;
- freeze = true;
- }
-
- if (cpb->resp_flags &
- (CPB_RESP_UNDERFLOW | CPB_RESP_OVERFLOW)) {
- __ata_ehi_push_desc(ehi, " data-over/underflow");
- ehi->err_mask |= AC_ERR_HSM;
- freeze = true;
- }
- }
-
- if (freeze)
- ata_port_freeze(ap);
- else
- ata_port_abort(ap);
-}
-
-static void inic_host_intr(struct ata_port *ap)
-{
- void __iomem *port_base = inic_port_base(ap);
- struct ata_queued_cmd *qc = ata_qc_from_tag(ap, ap->link.active_tag);
- u8 irq_stat;
- u16 idma_stat;
-
- /* read and clear IRQ status */
- irq_stat = readb(port_base + PORT_IRQ_STAT);
- writeb(irq_stat, port_base + PORT_IRQ_STAT);
- idma_stat = readw(port_base + PORT_IDMA_STAT);
-
- if (unlikely((irq_stat & PIRQ_ERR) || (idma_stat & IDMA_STAT_ERR)))
- inic_host_err_intr(ap, irq_stat, idma_stat);
-
- if (unlikely(!qc))
- goto spurious;
-
- if (likely(idma_stat & IDMA_STAT_DONE)) {
- inic_stop_idma(ap);
-
- /* Depending on circumstances, device error
- * isn't reported by IDMA, check it explicitly.
- */
- if (unlikely(readb(port_base + PORT_TF_COMMAND) &
- (ATA_DF | ATA_ERR)))
- qc->err_mask |= AC_ERR_DEV;
-
- ata_qc_complete(qc);
- return;
- }
-
- spurious:
- ata_port_warn(ap, "unhandled interrupt: cmd=0x%x irq_stat=0x%x idma_stat=0x%x\n",
- qc ? qc->tf.command : 0xff, irq_stat, idma_stat);
-}
-
-static irqreturn_t inic_interrupt(int irq, void *dev_instance)
-{
- struct ata_host *host = dev_instance;
- struct inic_host_priv *hpriv = host->private_data;
- u16 host_irq_stat;
- int i, handled = 0;
-
- host_irq_stat = readw(hpriv->mmio_base + HOST_IRQ_STAT);
-
- if (unlikely(!(host_irq_stat & HIRQ_GLOBAL)))
- goto out;
-
- spin_lock(&host->lock);
-
- for (i = 0; i < NR_PORTS; i++)
- if (host_irq_stat & (HIRQ_PORT0 << i)) {
- inic_host_intr(host->ports[i]);
- handled++;
- }
-
- spin_unlock(&host->lock);
-
- out:
- return IRQ_RETVAL(handled);
-}
-
-static int inic_check_atapi_dma(struct ata_queued_cmd *qc)
-{
- /* For some reason ATAPI_PROT_DMA doesn't work for some
- * commands including writes and other misc ops. Use PIO
- * protocol instead, which BTW is driven by the DMA engine
- * anyway, so it shouldn't make much difference for native
- * SATA devices.
- */
- if (atapi_cmd_type(qc->cdb[0]) == READ)
- return 0;
- return 1;
-}
-
-static void inic_fill_sg(struct inic_prd *prd, struct ata_queued_cmd *qc)
-{
- struct scatterlist *sg;
- unsigned int si;
- u8 flags = 0;
-
- if (qc->tf.flags & ATA_TFLAG_WRITE)
- flags |= PRD_WRITE;
-
- if (ata_is_dma(qc->tf.protocol))
- flags |= PRD_DMA;
-
- for_each_sg(qc->sg, sg, qc->n_elem, si) {
- prd->mad = cpu_to_le32(sg_dma_address(sg));
- prd->len = cpu_to_le16(sg_dma_len(sg));
- prd->flags = flags;
- prd++;
- }
-
- WARN_ON(!si);
- prd[-1].flags |= PRD_END;
-}
-
-static enum ata_completion_errors inic_qc_prep(struct ata_queued_cmd *qc)
-{
- struct inic_port_priv *pp = qc->ap->private_data;
- struct inic_pkt *pkt = pp->pkt;
- struct inic_cpb *cpb = &pkt->cpb;
- struct inic_prd *prd = pkt->prd;
- bool is_atapi = ata_is_atapi(qc->tf.protocol);
- bool is_data = ata_is_data(qc->tf.protocol);
- unsigned int cdb_len = 0;
-
- if (is_atapi)
- cdb_len = qc->dev->cdb_len;
-
- /* prepare packet, based on initio driver */
- memset(pkt, 0, sizeof(struct inic_pkt));
-
- cpb->ctl_flags = CPB_CTL_VALID | CPB_CTL_IEN;
- if (is_atapi || is_data)
- cpb->ctl_flags |= CPB_CTL_DATA;
-
- cpb->len = cpu_to_le32(qc->nbytes + cdb_len);
- cpb->prd = cpu_to_le32(pp->pkt_dma + offsetof(struct inic_pkt, prd));
-
- cpb->device = qc->tf.device;
- cpb->feature = qc->tf.feature;
- cpb->nsect = qc->tf.nsect;
- cpb->lbal = qc->tf.lbal;
- cpb->lbam = qc->tf.lbam;
- cpb->lbah = qc->tf.lbah;
-
- if (qc->tf.flags & ATA_TFLAG_LBA48) {
- cpb->hob_feature = qc->tf.hob_feature;
- cpb->hob_nsect = qc->tf.hob_nsect;
- cpb->hob_lbal = qc->tf.hob_lbal;
- cpb->hob_lbam = qc->tf.hob_lbam;
- cpb->hob_lbah = qc->tf.hob_lbah;
- }
-
- cpb->command = qc->tf.command;
- /* don't load ctl - dunno why. it's like that in the initio driver */
-
- /* setup PRD for CDB */
- if (is_atapi) {
- memcpy(pkt->cdb, qc->cdb, ATAPI_CDB_LEN);
- prd->mad = cpu_to_le32(pp->pkt_dma +
- offsetof(struct inic_pkt, cdb));
- prd->len = cpu_to_le16(cdb_len);
- prd->flags = PRD_CDB | PRD_WRITE;
- if (!is_data)
- prd->flags |= PRD_END;
- prd++;
- }
-
- /* setup sg table */
- if (is_data)
- inic_fill_sg(prd, qc);
-
- pp->cpb_tbl[0] = pp->pkt_dma;
-
- return AC_ERR_OK;
-}
-
-static unsigned int inic_qc_issue(struct ata_queued_cmd *qc)
-{
- struct ata_port *ap = qc->ap;
- void __iomem *port_base = inic_port_base(ap);
-
- /* fire up the ADMA engine */
- writew(HCTL_FTHD0 | HCTL_LEDEN, port_base + HOST_CTL);
- writew(IDMA_CTL_GO, port_base + PORT_IDMA_CTL);
- writeb(0, port_base + PORT_CPB_PTQFIFO);
-
- return 0;
-}
-
-static void inic_tf_read(struct ata_port *ap, struct ata_taskfile *tf)
-{
- void __iomem *port_base = inic_port_base(ap);
-
- tf->error = readb(port_base + PORT_TF_FEATURE);
- tf->nsect = readb(port_base + PORT_TF_NSECT);
- tf->lbal = readb(port_base + PORT_TF_LBAL);
- tf->lbam = readb(port_base + PORT_TF_LBAM);
- tf->lbah = readb(port_base + PORT_TF_LBAH);
- tf->device = readb(port_base + PORT_TF_DEVICE);
- tf->status = readb(port_base + PORT_TF_COMMAND);
-}
-
-static void inic_qc_fill_rtf(struct ata_queued_cmd *qc)
-{
- struct ata_taskfile *rtf = &qc->result_tf;
- struct ata_taskfile tf;
-
- /* FIXME: Except for status and error, result TF access
- * doesn't work. I tried reading from BAR0/2, CPB and BAR5.
- * None works regardless of which command interface is used.
- * For now return true iff status indicates device error.
- * This means that we're reporting bogus sector for RW
- * failures. Eeekk....
- */
- inic_tf_read(qc->ap, &tf);
-
- if (tf.status & ATA_ERR) {
- rtf->status = tf.status;
- rtf->error = tf.error;
- }
-}
-
-static void inic_freeze(struct ata_port *ap)
-{
- void __iomem *port_base = inic_port_base(ap);
-
- writeb(PIRQ_MASK_FREEZE, port_base + PORT_IRQ_MASK);
- writeb(0xff, port_base + PORT_IRQ_STAT);
-}
-
-static void inic_thaw(struct ata_port *ap)
-{
- void __iomem *port_base = inic_port_base(ap);
-
- writeb(0xff, port_base + PORT_IRQ_STAT);
- writeb(PIRQ_MASK_DEFAULT, port_base + PORT_IRQ_MASK);
-}
-
-static int inic_check_ready(struct ata_link *link)
-{
- void __iomem *port_base = inic_port_base(link->ap);
-
- return ata_check_ready(readb(port_base + PORT_TF_COMMAND));
-}
-
-/*
- * SRST and SControl hardreset don't give valid signature on this
- * controller. Only controller specific hardreset mechanism works.
- */
-static int inic_hardreset(struct ata_link *link, unsigned int *class,
- unsigned long deadline)
-{
- struct ata_port *ap = link->ap;
- void __iomem *port_base = inic_port_base(ap);
- void __iomem *idma_ctl = port_base + PORT_IDMA_CTL;
- const unsigned int *timing = sata_ehc_deb_timing(&link->eh_context);
- int rc;
-
- /* hammer it into sane state */
- inic_reset_port(port_base);
-
- writew(IDMA_CTL_RST_ATA, idma_ctl);
- readw(idma_ctl); /* flush */
- ata_msleep(ap, 1);
- writew(0, idma_ctl);
-
- rc = sata_link_resume(link, timing, deadline);
- if (rc) {
- ata_link_warn(link,
- "failed to resume link after reset (errno=%d)\n",
- rc);
- return rc;
- }
-
- *class = ATA_DEV_NONE;
- if (ata_link_online(link)) {
- struct ata_taskfile tf;
-
- /* wait for link to become ready */
- rc = ata_wait_after_reset(link, deadline, inic_check_ready);
- /* link occupied, -ENODEV too is an error */
- if (rc) {
- ata_link_warn(link,
- "device not ready after hardreset (errno=%d)\n",
- rc);
- return rc;
- }
-
- inic_tf_read(ap, &tf);
- *class = ata_port_classify(ap, &tf);
- }
-
- return 0;
-}
-
-static void inic_error_handler(struct ata_port *ap)
- __must_hold(&ap->host->eh_mutex)
-{
- void __iomem *port_base = inic_port_base(ap);
-
- inic_reset_port(port_base);
- ata_std_error_handler(ap);
-}
-
-static void inic_post_internal_cmd(struct ata_queued_cmd *qc)
-{
- /* make DMA engine forget about the failed command */
- if (qc->flags & ATA_QCFLAG_EH)
- inic_reset_port(inic_port_base(qc->ap));
-}
-
-static void init_port(struct ata_port *ap)
-{
- void __iomem *port_base = inic_port_base(ap);
- struct inic_port_priv *pp = ap->private_data;
-
- /* clear packet and CPB table */
- memset(pp->pkt, 0, sizeof(struct inic_pkt));
- memset(pp->cpb_tbl, 0, IDMA_CPB_TBL_SIZE);
-
- /* setup CPB lookup table addresses */
- writel(pp->cpb_tbl_dma, port_base + PORT_CPB_CPBLAR);
-}
-
-static int inic_port_resume(struct ata_port *ap)
-{
- init_port(ap);
- return 0;
-}
-
-static int inic_port_start(struct ata_port *ap)
-{
- struct device *dev = ap->host->dev;
- struct inic_port_priv *pp;
-
- /* alloc and initialize private data */
- pp = devm_kzalloc(dev, sizeof(*pp), GFP_KERNEL);
- if (!pp)
- return -ENOMEM;
- ap->private_data = pp;
-
- /* Alloc resources */
- pp->pkt = dmam_alloc_coherent(dev, sizeof(struct inic_pkt),
- &pp->pkt_dma, GFP_KERNEL);
- if (!pp->pkt)
- return -ENOMEM;
-
- pp->cpb_tbl = dmam_alloc_coherent(dev, IDMA_CPB_TBL_SIZE,
- &pp->cpb_tbl_dma, GFP_KERNEL);
- if (!pp->cpb_tbl)
- return -ENOMEM;
-
- init_port(ap);
-
- return 0;
-}
-
-static struct ata_port_operations inic_port_ops = {
- .inherits = &sata_port_ops,
-
- .check_atapi_dma = inic_check_atapi_dma,
- .qc_prep = inic_qc_prep,
- .qc_issue = inic_qc_issue,
- .qc_fill_rtf = inic_qc_fill_rtf,
-
- .freeze = inic_freeze,
- .thaw = inic_thaw,
- .reset.hardreset = inic_hardreset,
- .error_handler = inic_error_handler,
- .post_internal_cmd = inic_post_internal_cmd,
-
- .scr_read = inic_scr_read,
- .scr_write = inic_scr_write,
-
- .port_resume = inic_port_resume,
- .port_start = inic_port_start,
-};
-
-static const struct ata_port_info inic_port_info = {
- .flags = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA,
- .pio_mask = ATA_PIO4,
- .mwdma_mask = ATA_MWDMA2,
- .udma_mask = ATA_UDMA6,
- .port_ops = &inic_port_ops
-};
-
-static int init_controller(void __iomem *mmio_base, u16 hctl)
-{
- int i;
- u16 val;
-
- hctl &= ~HCTL_KNOWN_BITS;
-
- /* Soft reset whole controller. Spec says reset duration is 3
- * PCI clocks, be generous and give it 10ms.
- */
- writew(hctl | HCTL_SOFTRST, mmio_base + HOST_CTL);
- readw(mmio_base + HOST_CTL); /* flush */
-
- for (i = 0; i < 10; i++) {
- msleep(1);
- val = readw(mmio_base + HOST_CTL);
- if (!(val & HCTL_SOFTRST))
- break;
- }
-
- if (val & HCTL_SOFTRST)
- return -EIO;
-
- /* mask all interrupts and reset ports */
- for (i = 0; i < NR_PORTS; i++) {
- void __iomem *port_base = mmio_base + i * PORT_SIZE;
-
- writeb(0xff, port_base + PORT_IRQ_MASK);
- inic_reset_port(port_base);
- }
-
- /* port IRQ is masked now, unmask global IRQ */
- writew(hctl & ~HCTL_IRQOFF, mmio_base + HOST_CTL);
- val = readw(mmio_base + HOST_IRQ_MASK);
- val &= ~(HIRQ_PORT0 | HIRQ_PORT1);
- writew(val, mmio_base + HOST_IRQ_MASK);
-
- return 0;
-}
-
-#ifdef CONFIG_PM_SLEEP
-static int inic_pci_device_resume(struct pci_dev *pdev)
-{
- struct ata_host *host = pci_get_drvdata(pdev);
- struct inic_host_priv *hpriv = host->private_data;
- int rc;
-
- rc = ata_pci_device_do_resume(pdev);
- if (rc)
- return rc;
-
- if (pdev->dev.power.power_state.event == PM_EVENT_SUSPEND) {
- rc = init_controller(hpriv->mmio_base, hpriv->cached_hctl);
- if (rc)
- return rc;
- }
-
- ata_host_resume(host);
-
- return 0;
-}
-#endif
-
-static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
-{
- const struct ata_port_info *ppi[] = { &inic_port_info, NULL };
- struct ata_host *host;
- struct inic_host_priv *hpriv;
- void __iomem * const *iomap;
- int mmio_bar;
- int i, rc;
-
- ata_print_version_once(&pdev->dev, DRV_VERSION);
-
- dev_alert(&pdev->dev, "inic162x support is broken with common data corruption issues and will be disabled by default, contact linux-ide@vger.kernel.org if in production use\n");
-
- /* alloc host */
- host = ata_host_alloc_pinfo(&pdev->dev, ppi, NR_PORTS);
- hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL);
- if (!host || !hpriv)
- return -ENOMEM;
-
- host->private_data = hpriv;
-
- /* Acquire resources and fill host. Note that PCI and cardbus
- * use different BARs.
- */
- rc = pcim_enable_device(pdev);
- if (rc)
- return rc;
-
- if (pci_resource_flags(pdev, MMIO_BAR_PCI) & IORESOURCE_MEM)
- mmio_bar = MMIO_BAR_PCI;
- else
- mmio_bar = MMIO_BAR_CARDBUS;
-
- rc = pcim_iomap_regions(pdev, 1 << mmio_bar, DRV_NAME);
- if (rc)
- return rc;
- host->iomap = iomap = pcim_iomap_table(pdev);
- hpriv->mmio_base = iomap[mmio_bar];
- hpriv->cached_hctl = readw(hpriv->mmio_base + HOST_CTL);
-
- for (i = 0; i < NR_PORTS; i++) {
- struct ata_port *ap = host->ports[i];
-
- ata_port_pbar_desc(ap, mmio_bar, -1, "mmio");
- ata_port_pbar_desc(ap, mmio_bar, i * PORT_SIZE, "port");
- }
-
- /* Set dma_mask. This devices doesn't support 64bit addressing. */
- rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
- if (rc) {
- dev_err(&pdev->dev, "32-bit DMA enable failed\n");
- return rc;
- }
-
- rc = init_controller(hpriv->mmio_base, hpriv->cached_hctl);
- if (rc) {
- dev_err(&pdev->dev, "failed to initialize controller\n");
- return rc;
- }
-
- pci_set_master(pdev);
- return ata_host_activate(host, pdev->irq, inic_interrupt, IRQF_SHARED,
- &inic_sht);
-}
-
-static const struct pci_device_id inic_pci_tbl[] = {
- { PCI_VDEVICE(INIT, 0x1622), },
- { },
-};
-
-static struct pci_driver inic_pci_driver = {
- .name = DRV_NAME,
- .id_table = inic_pci_tbl,
-#ifdef CONFIG_PM_SLEEP
- .suspend = ata_pci_device_suspend,
- .resume = inic_pci_device_resume,
-#endif
- .probe = inic_init_one,
- .remove = ata_pci_remove_one,
-};
-
-module_pci_driver(inic_pci_driver);
-
-MODULE_AUTHOR("Tejun Heo");
-MODULE_DESCRIPTION("low-level driver for Initio 162x SATA");
-MODULE_LICENSE("GPL v2");
-MODULE_DEVICE_TABLE(pci, inic_pci_tbl);
-MODULE_VERSION(DRV_VERSION);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0165/1257] pinctrl: renesas: rzt2h: Restore correct pin mode on IRQ free
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0164/1257] ata: sata_inic162x: remove dangerous broken driver Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0166/1257] pinctrl: renesas: rzt2h: Setup IRQ in .irq_{request,release}_resources() Greg Kroah-Hartman
` (833 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Cosmin Tanislav,
Geert Uytterhoeven, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
[ Upstream commit 7df755632142e59a5aec5f85f2654add49220102 ]
rzt2h_gpio_irq_domain_free() calls rzt2h_pinctrl_set_gpio_en() with
false leaving the pin in interrupt function instead of returning it to
GPIO mode.
Pass true to rzt2h_pinctrl_set_gpio_en() to take the pin out of
interrupt function after we're done using it as an IRQ.
rzt2h_pinctrl_set_pfc_mode() switches the pin to Hi-Z, losing the
previous PM value.
Save the PM value before switching to Hi-Z, and restore it after the
IRQ is freed.
Cc: stable@kernel.org
Fixes: 829dde3369a9 ("pinctrl: renesas: rzt2h: Add GPIO IRQ chip to handle interrupts")
Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260913195654.3371385-2-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/renesas/pinctrl-rzt2h.c | 43 +++++++++++++++++++++----
1 file changed, 37 insertions(+), 6 deletions(-)
diff --git a/drivers/pinctrl/renesas/pinctrl-rzt2h.c b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
index a37f1e3994467..7b44db3d0470a 100644
--- a/drivers/pinctrl/renesas/pinctrl-rzt2h.c
+++ b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
@@ -96,6 +96,7 @@ struct rzt2h_pinctrl {
struct gpio_chip gpio_chip;
struct pinctrl_gpio_range gpio_range;
DECLARE_BITMAP(used_irqs, RZT2H_INTERRUPTS_NUM);
+ u8 saved_pm[RZT2H_INTERRUPTS_NUM];
raw_spinlock_t lock; /* lock read/write registers */
struct mutex mutex; /* serialize adding groups and functions */
bool safety_port_enabled;
@@ -170,6 +171,26 @@ static int rzt2h_validate_pin(struct rzt2h_pinctrl *pctrl, unsigned int offset)
return (pincfg & BIT(pin)) ? 0 : -EINVAL;
}
+static u8 rzt2h_pin_read_pm(struct rzt2h_pinctrl *pctrl, u8 port, u8 pin)
+{
+ u16 reg = rzt2h_pinctrl_readw(pctrl, port, PM(port));
+
+ return field_get(PM_PIN_MASK(pin), reg);
+}
+
+static void rzt2h_pin_write_pm(struct rzt2h_pinctrl *pctrl, u8 port, u8 pin,
+ unsigned int pm)
+{
+ u16 reg;
+
+ guard(raw_spinlock_irqsave)(&pctrl->lock);
+
+ reg = rzt2h_pinctrl_readw(pctrl, port, PM(port));
+ reg &= ~PM_PIN_MASK(pin);
+ reg |= pm << (pin * 2);
+ rzt2h_pinctrl_writew(pctrl, port, reg, PM(port));
+}
+
static void rzt2h_pinctrl_set_gpio_en(struct rzt2h_pinctrl *pctrl,
u8 port, u8 pin, bool en)
{
@@ -1023,16 +1044,23 @@ static int rzt2h_gpio_child_to_parent_hwirq(struct gpio_chip *gc,
struct rzt2h_pinctrl *pctrl = gpiochip_get_data(gc);
u8 port = RZT2H_PIN_ID_TO_PORT(child);
u8 pin = RZT2H_PIN_ID_TO_PIN(child);
- u8 parent_irq;
+ u8 parent_irq, irq_idx;
parent_irq = rzt2h_gpio_irq_map[child];
if (parent_irq < RZT2H_INTERRUPTS_START)
return -EINVAL;
- if (test_and_set_bit(parent_irq - RZT2H_INTERRUPTS_START,
- pctrl->used_irqs))
+ irq_idx = parent_irq - RZT2H_INTERRUPTS_START;
+ if (test_and_set_bit(irq_idx, pctrl->used_irqs))
return -EBUSY;
+ /*
+ * rzt2h_pinctrl_set_pfc_mode() sets PM to Hi-Z before switching to the
+ * interrupt function, losing the previous PM value.
+ * Save it so it can be restored when the IRQ is freed.
+ */
+ pctrl->saved_pm[irq_idx] = rzt2h_pin_read_pm(pctrl, port, pin);
+
rzt2h_pinctrl_set_pfc_mode(pctrl, port, pin, PFC_FUNC_INTERRUPT);
*parent = parent_irq;
@@ -1050,14 +1078,17 @@ static void rzt2h_gpio_irq_domain_free(struct irq_domain *domain, unsigned int v
irq_hw_number_t hwirq = irqd_to_hwirq(d);
u8 port = RZT2H_PIN_ID_TO_PORT(hwirq);
u8 pin = RZT2H_PIN_ID_TO_PIN(hwirq);
- u8 parent_irq;
+ u8 parent_irq, irq_idx;
parent_irq = rzt2h_gpio_irq_map[hwirq];
if (parent_irq < RZT2H_INTERRUPTS_START)
return;
- if (test_and_clear_bit(parent_irq - RZT2H_INTERRUPTS_START, pctrl->used_irqs))
- rzt2h_pinctrl_set_gpio_en(pctrl, port, pin, false);
+ irq_idx = parent_irq - RZT2H_INTERRUPTS_START;
+ if (test_and_clear_bit(irq_idx, pctrl->used_irqs)) {
+ rzt2h_pin_write_pm(pctrl, port, pin, pctrl->saved_pm[irq_idx]);
+ rzt2h_pinctrl_set_gpio_en(pctrl, port, pin, true);
+ }
irq_domain_free_irqs_common(domain, virq, nr_irqs);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0166/1257] pinctrl: renesas: rzt2h: Setup IRQ in .irq_{request,release}_resources()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0165/1257] pinctrl: renesas: rzt2h: Restore correct pin mode on IRQ free Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0167/1257] pinctrl: renesas: rzt2h: Fix reading pin value in IRQ function Greg Kroah-Hartman
` (832 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Cosmin Tanislav,
Geert Uytterhoeven, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
[ Upstream commit d9980f93cef0f90a11f26296c68ed16b61a95ced ]
When exporting a GPIO using the deprecated sysfs GPIO API,
gpio_is_visible() calls gpiod_to_irq() to determine whether a GPIO is
IRQ-capable, which ends up using
struct gpio_irq_chip::child_to_parent_hwirq().
When using the GPIO character device, it is possible to request a line
and to dynamically switch between using it as an IRQ or as a GPIO, by
updating the edge detector.
The current struct gpio_irq_chip::child_to_parent_hwirq() implementation
makes the assumption that it will only be called with the intention of
setting up the IRQ permanently, and that it will only be released when
the IRQ domain is freed.
Since we now know that this is not the case, take the following steps in
order to properly handle that case.
Implement struct irq_chip::irq_{request,release}_resources() based on
the default GPIOCHIP_IRQ_RESOURCE_HELPERS implementations.
Move the IRQ setup and release logic inside them.
Keep the mapping logic inside ::child_to_parent_hwirq() to be able to
provide a proper HW IRQ number, but do not actually setup the IRQ.
Remove rzt2h_gpio_irq_domain_free() as its only purpose was to free the
acquired IRQs. irq_domain_free_irqs_common() will still be set up as
struct gpio_irq_chip::child_irq_domain_ops::free by
gpiochip_hierarchy_setup_domain_ops().
Cc: stable@kernel.org
Fixes: 829dde3369a9 ("pinctrl: renesas: rzt2h: Add GPIO IRQ chip to handle interrupts")
Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260913195654.3371385-3-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/renesas/pinctrl-rzt2h.c | 79 +++++++++++++++----------
1 file changed, 49 insertions(+), 30 deletions(-)
diff --git a/drivers/pinctrl/renesas/pinctrl-rzt2h.c b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
index 7b44db3d0470a..f8e64c3a015cd 100644
--- a/drivers/pinctrl/renesas/pinctrl-rzt2h.c
+++ b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
@@ -1021,32 +1021,17 @@ static int rzt2h_gpio_irq_set_wake(struct irq_data *d, unsigned int on)
return 0;
}
-static const struct irq_chip rzt2h_gpio_irqchip = {
- .name = "rzt2h-gpio",
- .irq_disable = rzt2h_gpio_irq_disable,
- .irq_enable = rzt2h_gpio_irq_enable,
- .irq_mask = irq_chip_mask_parent,
- .irq_unmask = irq_chip_unmask_parent,
- .irq_set_type = irq_chip_set_type_parent,
- .irq_set_wake = rzt2h_gpio_irq_set_wake,
- .irq_eoi = irq_chip_eoi_parent,
- .irq_set_affinity = irq_chip_set_affinity_parent,
- .flags = IRQCHIP_IMMUTABLE,
- GPIOCHIP_IRQ_RESOURCE_HELPERS,
-};
-
-static int rzt2h_gpio_child_to_parent_hwirq(struct gpio_chip *gc,
- unsigned int child,
- unsigned int child_type,
- unsigned int *parent,
- unsigned int *parent_type)
+static int rzt2h_gpio_irq_request_resources(struct irq_data *d)
{
+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
struct rzt2h_pinctrl *pctrl = gpiochip_get_data(gc);
- u8 port = RZT2H_PIN_ID_TO_PORT(child);
- u8 pin = RZT2H_PIN_ID_TO_PIN(child);
+ irq_hw_number_t hwirq = irqd_to_hwirq(d);
+ u8 port = RZT2H_PIN_ID_TO_PORT(hwirq);
+ u8 pin = RZT2H_PIN_ID_TO_PIN(hwirq);
u8 parent_irq, irq_idx;
+ int ret;
- parent_irq = rzt2h_gpio_irq_map[child];
+ parent_irq = rzt2h_gpio_irq_map[hwirq];
if (parent_irq < RZT2H_INTERRUPTS_START)
return -EINVAL;
@@ -1063,18 +1048,21 @@ static int rzt2h_gpio_child_to_parent_hwirq(struct gpio_chip *gc,
rzt2h_pinctrl_set_pfc_mode(pctrl, port, pin, PFC_FUNC_INTERRUPT);
- *parent = parent_irq;
- *parent_type = child_type;
+ ret = gpiochip_lock_as_irq(gc, hwirq);
+ if (ret) {
+ clear_bit(irq_idx, pctrl->used_irqs);
+ rzt2h_pin_write_pm(pctrl, port, pin, pctrl->saved_pm[irq_idx]);
+ rzt2h_pinctrl_set_gpio_en(pctrl, port, pin, true);
+ return ret;
+ }
return 0;
}
-static void rzt2h_gpio_irq_domain_free(struct irq_domain *domain, unsigned int virq,
- unsigned int nr_irqs)
+static void rzt2h_gpio_irq_release_resources(struct irq_data *d)
{
- struct irq_data *d = irq_domain_get_irq_data(domain, virq);
struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
- struct rzt2h_pinctrl *pctrl = container_of(gc, struct rzt2h_pinctrl, gpio_chip);
+ struct rzt2h_pinctrl *pctrl = gpiochip_get_data(gc);
irq_hw_number_t hwirq = irqd_to_hwirq(d);
u8 port = RZT2H_PIN_ID_TO_PORT(hwirq);
u8 pin = RZT2H_PIN_ID_TO_PIN(hwirq);
@@ -1090,7 +1078,39 @@ static void rzt2h_gpio_irq_domain_free(struct irq_domain *domain, unsigned int v
rzt2h_pinctrl_set_gpio_en(pctrl, port, pin, true);
}
- irq_domain_free_irqs_common(domain, virq, nr_irqs);
+ gpiochip_unlock_as_irq(gc, hwirq);
+}
+
+static const struct irq_chip rzt2h_gpio_irqchip = {
+ .name = "rzt2h-gpio",
+ .irq_disable = rzt2h_gpio_irq_disable,
+ .irq_enable = rzt2h_gpio_irq_enable,
+ .irq_mask = irq_chip_mask_parent,
+ .irq_unmask = irq_chip_unmask_parent,
+ .irq_set_type = irq_chip_set_type_parent,
+ .irq_set_wake = rzt2h_gpio_irq_set_wake,
+ .irq_eoi = irq_chip_eoi_parent,
+ .irq_request_resources = rzt2h_gpio_irq_request_resources,
+ .irq_release_resources = rzt2h_gpio_irq_release_resources,
+ .irq_set_affinity = irq_chip_set_affinity_parent,
+ .flags = IRQCHIP_IMMUTABLE,
+};
+
+static int rzt2h_gpio_child_to_parent_hwirq(struct gpio_chip *gc,
+ unsigned int child,
+ unsigned int child_type,
+ unsigned int *parent,
+ unsigned int *parent_type)
+{
+ u8 parent_irq = rzt2h_gpio_irq_map[child];
+
+ if (parent_irq < RZT2H_INTERRUPTS_START)
+ return -EINVAL;
+
+ *parent = parent_irq;
+ *parent_type = child_type;
+
+ return 0;
}
static void rzt2h_gpio_init_irq_valid_mask(struct gpio_chip *gc,
@@ -1158,7 +1178,6 @@ static int rzt2h_gpio_register(struct rzt2h_pinctrl *pctrl)
girq->parent_domain = parent_domain;
girq->child_to_parent_hwirq = rzt2h_gpio_child_to_parent_hwirq;
girq->populate_parent_alloc_arg = gpiochip_populate_parent_fwspec_twocell;
- girq->child_irq_domain_ops.free = rzt2h_gpio_irq_domain_free;
girq->init_valid_mask = rzt2h_gpio_init_irq_valid_mask;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0167/1257] pinctrl: renesas: rzt2h: Fix reading pin value in IRQ function
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0166/1257] pinctrl: renesas: rzt2h: Setup IRQ in .irq_{request,release}_resources() Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0168/1257] ata: ahci_st: Do not ignore errors when getting the reset controls Greg Kroah-Hartman
` (831 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Cosmin Tanislav,
Geert Uytterhoeven, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
[ Upstream commit 55297a587c3748f320485a3b37fcccfe6f0440bb ]
rzt2h_gpio_get() only reports a level for pins in input or output mode
and returns -EINVAL otherwise. When a pin is requested as an interrupt
it is switched to IRQ function and its I/O mode is set to Hi-Z, so its
value can no longer be read.
gpiolib calls gpiod_get_value_cansleep() to determine the edge's
direction when a line is watched with GPIO_V2_LINE_FLAG_EDGE_BOTH.
Non-zero values are translated to a rising edge, zero to a falling edge.
Since gpiod_get_value_cansleep() ends up calling rzt2h_gpio_get() which
returns -EINVAL when the pin is in IRQ function, every edge is reported
as rising.
When using the IRQ function, the input buffers are enabled and the PINm
registers reflect the live state of the input.
Report the input level even when the pin is used as an IRQ.
Cc: stable@kernel.org
Fixes: 829dde3369a9 ("pinctrl: renesas: rzt2h: Add GPIO IRQ chip to handle interrupts")
Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260913195654.3371385-4-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/renesas/pinctrl-rzt2h.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/pinctrl/renesas/pinctrl-rzt2h.c b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
index f8e64c3a015cd..5cfce6d68cd98 100644
--- a/drivers/pinctrl/renesas/pinctrl-rzt2h.c
+++ b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
@@ -171,6 +171,16 @@ static int rzt2h_validate_pin(struct rzt2h_pinctrl *pctrl, unsigned int offset)
return (pincfg & BIT(pin)) ? 0 : -EINVAL;
}
+static bool rzt2h_pin_mode_is_peripheral(struct rzt2h_pinctrl *pctrl, u8 port, u8 bit)
+{
+ return rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit);
+}
+
+static bool rzt2h_pin_read_input(struct rzt2h_pinctrl *pctrl, u8 port, u8 bit)
+{
+ return rzt2h_pinctrl_readb(pctrl, port, PIN(port)) & BIT(bit);
+}
+
static u8 rzt2h_pin_read_pm(struct rzt2h_pinctrl *pctrl, u8 port, u8 pin)
{
u16 reg = rzt2h_pinctrl_readw(pctrl, port, PM(port));
@@ -848,6 +858,9 @@ static int rzt2h_gpio_get(struct gpio_chip *chip, unsigned int offset)
u8 bit = RZT2H_PIN_ID_TO_PIN(offset);
u16 reg;
+ if (rzt2h_pin_mode_is_peripheral(pctrl, port, bit))
+ return rzt2h_pin_read_input(pctrl, port, bit);
+
reg = rzt2h_pinctrl_readw(pctrl, port, PM(port));
reg = (reg >> (bit * 2)) & PM_MASK;
if (reg & PM_INPUT)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0168/1257] ata: ahci_st: Do not ignore errors when getting the reset controls
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0167/1257] pinctrl: renesas: rzt2h: Fix reading pin value in IRQ function Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0169/1257] ata: ahci_st: Assert the power down reset in the probe() error path Greg Kroah-Hartman
` (830 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit c74ee9230a8d1d2f6fcbceff55f56f7dd9b9cccd ]
st_ahci_probe_resets() treats any error from devm_reset_control_get() as
"reset control not defined" and continues with a NULL reset control:
drv_data->pwr = devm_reset_control_get(dev, "pwr-dwn");
if (IS_ERR(drv_data->pwr)) {
dev_info(dev, "power reset control not defined\n");
drv_data->pwr = NULL;
}
This also swallows -EPROBE_DEFER, which is returned when the reset
controller providing the reset has not been probed yet. probe() then
continues as if the device tree did not specify any reset, so the resets
of the SATA IP are never deasserted, and st_ahci_configure_oob() and
ahci_platform_init_host() access the MMIO of an IP which is still held in
reset and powered down, which can result in an external abort.
The resets are optional in the binding, as they are not part of its
required properties, so use devm_reset_control_get_optional(), which
returns NULL if the reset is not specified in the device tree, and
propagate all other errors.
Note that an absent reset is now indicated by a NULL reset control
instead of an error, so the "reset control not defined" messages are
dropped.
Fixes: 76884cb2f7da ("ahci: st: Add support for ST's SATA IP")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-9-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/ahci_st.c | 31 ++++++++++++++-----------------
1 file changed, 14 insertions(+), 17 deletions(-)
diff --git a/drivers/ata/ahci_st.c b/drivers/ata/ahci_st.c
index 4336c8a6e2087..819269a022efd 100644
--- a/drivers/ata/ahci_st.c
+++ b/drivers/ata/ahci_st.c
@@ -104,23 +104,20 @@ static int st_ahci_probe_resets(struct ahci_host_priv *hpriv,
{
struct st_ahci_drv_data *drv_data = hpriv->plat_data;
- drv_data->pwr = devm_reset_control_get(dev, "pwr-dwn");
- if (IS_ERR(drv_data->pwr)) {
- dev_info(dev, "power reset control not defined\n");
- drv_data->pwr = NULL;
- }
-
- drv_data->sw_rst = devm_reset_control_get(dev, "sw-rst");
- if (IS_ERR(drv_data->sw_rst)) {
- dev_info(dev, "soft reset control not defined\n");
- drv_data->sw_rst = NULL;
- }
-
- drv_data->pwr_rst = devm_reset_control_get(dev, "pwr-rst");
- if (IS_ERR(drv_data->pwr_rst)) {
- dev_dbg(dev, "power soft reset control not defined\n");
- drv_data->pwr_rst = NULL;
- }
+ drv_data->pwr = devm_reset_control_get_optional(dev, "pwr-dwn");
+ if (IS_ERR(drv_data->pwr))
+ return dev_err_probe(dev, PTR_ERR(drv_data->pwr),
+ "failed to get pwr-dwn reset\n");
+
+ drv_data->sw_rst = devm_reset_control_get_optional(dev, "sw-rst");
+ if (IS_ERR(drv_data->sw_rst))
+ return dev_err_probe(dev, PTR_ERR(drv_data->sw_rst),
+ "failed to get sw-rst reset\n");
+
+ drv_data->pwr_rst = devm_reset_control_get_optional(dev, "pwr-rst");
+ if (IS_ERR(drv_data->pwr_rst))
+ return dev_err_probe(dev, PTR_ERR(drv_data->pwr_rst),
+ "failed to get pwr-rst reset\n");
return st_ahci_deassert_resets(hpriv, dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0169/1257] ata: ahci_st: Assert the power down reset in the probe() error path
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0168/1257] ata: ahci_st: Do not ignore errors when getting the reset controls Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0170/1257] ata: libahci: Free the IRQs when activating a multi-IRQ host fails Greg Kroah-Hartman
` (829 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 91e0a7452d7a81e924a499b23f30f3bf85fddbd2 ]
st_ahci_probe_resets() deasserts the "pwr-dwn" reset, but the probe()
error path of st_ahci_probe() only releases the host resources, so the
SATA IP is left powered up when probe() fails after
st_ahci_probe_resets() has succeeded, e.g. when
ahci_platform_enable_resources() fails.
The reset is asserted by st_ahci_host_stop(), however ->host_stop() is
only called through the ata_host_stop() devres action registered by
ata_host_start(), so it does not cover any failure happening before the
host has been started.
Factor the assert out into st_ahci_assert_pwrdwn() and call it when
either ahci_platform_enable_resources() or ahci_platform_init_host()
fails. The "pwr-dwn" reset control is an exclusive one, so asserting it
once more from st_ahci_host_stop() is harmless.
No functional change intended for ->host_stop() and st_ahci_suspend().
Fixes: 76884cb2f7da ("ahci: st: Add support for ST's SATA IP")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-10-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/ahci_st.c | 51 +++++++++++++++++++++++++------------------
1 file changed, 30 insertions(+), 21 deletions(-)
diff --git a/drivers/ata/ahci_st.c b/drivers/ata/ahci_st.c
index 819269a022efd..eea75961038cf 100644
--- a/drivers/ata/ahci_st.c
+++ b/drivers/ata/ahci_st.c
@@ -83,18 +83,27 @@ static int st_ahci_deassert_resets(struct ahci_host_priv *hpriv,
return 0;
}
-static void st_ahci_host_stop(struct ata_host *host)
+static int st_ahci_assert_pwrdwn(struct ahci_host_priv *hpriv,
+ struct device *dev)
{
- struct ahci_host_priv *hpriv = host->private_data;
struct st_ahci_drv_data *drv_data = hpriv->plat_data;
- struct device *dev = host->dev;
int err;
- if (drv_data->pwr) {
- err = reset_control_assert(drv_data->pwr);
- if (err)
- dev_err(dev, "unable to pwrdwn\n");
- }
+ if (!drv_data->pwr)
+ return 0;
+
+ err = reset_control_assert(drv_data->pwr);
+ if (err)
+ dev_err(dev, "unable to pwrdwn\n");
+
+ return err;
+}
+
+static void st_ahci_host_stop(struct ata_host *host)
+{
+ struct ahci_host_priv *hpriv = host->private_data;
+
+ st_ahci_assert_pwrdwn(hpriv, host->dev);
ahci_platform_disable_resources(hpriv);
}
@@ -159,38 +168,38 @@ static int st_ahci_probe(struct platform_device *pdev)
err = ahci_platform_enable_resources(hpriv);
if (err)
- return err;
+ goto assert_pwrdwn;
st_ahci_configure_oob(hpriv->mmio);
err = ahci_platform_init_host(pdev, hpriv, &st_ahci_port_info,
&ahci_platform_sht);
- if (err) {
- ahci_platform_disable_resources(hpriv);
- return err;
- }
+ if (err)
+ goto disable_resources;
return 0;
+
+disable_resources:
+ ahci_platform_disable_resources(hpriv);
+assert_pwrdwn:
+ st_ahci_assert_pwrdwn(hpriv, &pdev->dev);
+
+ return err;
}
static int st_ahci_suspend(struct device *dev)
{
struct ata_host *host = dev_get_drvdata(dev);
struct ahci_host_priv *hpriv = host->private_data;
- struct st_ahci_drv_data *drv_data = hpriv->plat_data;
int err;
err = ahci_platform_suspend_host(dev);
if (err)
return err;
- if (drv_data->pwr) {
- err = reset_control_assert(drv_data->pwr);
- if (err) {
- dev_err(dev, "unable to pwrdwn");
- return err;
- }
- }
+ err = st_ahci_assert_pwrdwn(hpriv, dev);
+ if (err)
+ return err;
ahci_platform_disable_resources(hpriv);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0170/1257] ata: libahci: Free the IRQs when activating a multi-IRQ host fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0169/1257] ata: ahci_st: Assert the power down reset in the probe() error path Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0171/1257] ata: libata: Do not leave ata_host_stop() registered when activation fails Greg Kroah-Hartman
` (828 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 34a4a34431ed81d85d14f8fb8035e5a25214ad39 ]
ahci_host_activate_multi_irqs() requests one IRQ per port, but it does
not free them when requesting one of them, or when registering the host,
fails. The IRQs are only freed by the driver core, when it releases the
devres of the device after probe() has returned, while the caller of
ahci_host_activate() releases the resources of the host in its probe()
error path, e.g. ahci_probe() disables the clocks, regulators, resets and
PHYs of the host. An IRQ handler running in that window would access the
MMIO of a host which is no longer clocked.
ahci_host_activate_multi_irqs() did free the IRQs until commit
0a142b26921c ("ahci: cleanup ahci_host_activate_multi_irqs"), which
removed the explicit free because devm makes it unnecessary. That is true
for freeing the IRQs as such, but not for the window described above:
devres is only released after probe() has returned, i.e. after the error
path of the caller has released the resources of the host.
Note that this window cannot be hit with the current users: the only user
of AHCI_HFLAG_MULTI_MSI is the AHCI PCI driver, which does not release
any resource in its probe() error path, and the ports of the host are
still frozen, i.e. their interrupts are masked, when ata_host_register()
fails.
Free the IRQs explicitly again, like ata_host_activate() does, so that
the IRQ handlers cannot run once ahci_host_activate() has failed.
Fixes: 0a142b26921c ("ahci: cleanup ahci_host_activate_multi_irqs")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-12-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libahci.c | 26 ++++++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 08ab56e955662..950c26e6953d0 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2736,11 +2736,33 @@ static int ahci_host_activate_multi_irqs(struct ata_host *host,
0, pp->irq_desc, host->ports[i]);
if (rc)
- return rc;
+ goto free_irqs;
ata_port_desc_misc(host->ports[i], irq);
}
- return ata_host_register(host, sht);
+ rc = ata_host_register(host, sht);
+ if (rc)
+ goto free_irqs;
+
+ return 0;
+
+free_irqs:
+ /*
+ * Free the IRQs which have been requested, so that the handlers can no
+ * longer access the MMIO of the host once we return, e.g. after the
+ * caller has disabled the clocks of the host.
+ */
+ while (--i >= 0) {
+ struct ahci_port_priv *pp = host->ports[i]->private_data;
+
+ if (!pp)
+ continue;
+
+ devm_free_irq(host->dev, hpriv->get_irq_vector(host, i),
+ host->ports[i]);
+ }
+
+ return rc;
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0171/1257] ata: libata: Do not leave ata_host_stop() registered when activation fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0170/1257] ata: libahci: Free the IRQs when activating a multi-IRQ host fails Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0172/1257] media: i2c: alvium-csi2: balance runtime PM usage count on remove Greg Kroah-Hartman
` (827 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit d2f977008cbbae195df678ee1e70e5802f9bd0b8 ]
ata_host_start() registers ata_host_stop() as a devres action as soon as
it has succeeded, which hands the release of the host resources over to
devres: ->port_stop() and ->host_stop() are then called by the driver
core when probe() fails.
ata_host_activate() and ahci_host_activate_multi_irqs() can both fail
after ata_host_start() has succeeded, e.g. if devm_request_irq() or
ata_host_register() fails, and they return the error with the devres
action still registered. A driver which releases the host resources in
its probe() error path therefore releases them twice: once itself and
once through ->host_stop().
All ahci-platform drivers are in that situation, e.g. ahci_probe() calls
ahci_platform_disable_resources() while ahci_host_stop() does the same
through devres. This gives refcount underflow warnings from the clk,
regulator and phy cores and, for shared resources, can disable resources
which are still in use by other devices.
Add ata_host_undo_start(), which stops the ports and drops the devres
action without calling ->host_stop(), and call it from both activation
helpers when they fail. Releasing the host resources on failure is then
always left to the caller, which is what all callers having a probe()
error path already assume.
This changes the semantics for the drivers which implement ->host_stop()
while also completely lacking error handling for the activate host call.
Add activate host error handling for sata_qstor and sata_fsl. For
sata_fsl this also means that hcr_base and host_priv are now released
when activating the host fails, which ->host_stop() did not do when
ata_host_start() itself failed.
Note that ata_pci_sff_activate_host() is deliberately left as is: none of
its callers releases the host resources in its probe() error path, they
all rely on ->host_stop() being called by devres, including
ata_pci_init_one(), which releases the devres group of the host itself.
Fixes: 1896b15eddb4 ("ahci_platform: perform platform exit in host_stop() hook")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-13-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libahci.c | 2 +
drivers/ata/libahci_platform.c | 4 ++
drivers/ata/libata-core.c | 75 +++++++++++++++++++++++++++++++---
drivers/ata/libata-sff.c | 5 +++
drivers/ata/sata_fsl.c | 6 ++-
drivers/ata/sata_qstor.c | 8 +++-
include/linux/libata.h | 1 +
7 files changed, 91 insertions(+), 10 deletions(-)
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 950c26e6953d0..f3fd56f153340 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2762,6 +2762,8 @@ static int ahci_host_activate_multi_irqs(struct ata_host *host,
host->ports[i]);
}
+ ata_host_undo_start(host);
+
return rc;
}
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index f6524135ea117..ae342080556ae 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -689,6 +689,10 @@ EXPORT_SYMBOL_GPL(ahci_platform_get_resources);
* ahci-platform host, note any necessary resources (ie clks, phys, etc.)
* must be initialized / enabled before calling this.
*
+ * On failure, ->host_stop() is not called, so the caller has to release the
+ * resources it enabled (clocks, regulators, resets, PHYs) in its probe()
+ * error path.
+ *
* RETURNS:
* 0 on success otherwise a negative error code
*/
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 92233fb25051a..f218773f187fc 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6128,6 +6128,46 @@ int ata_host_start(struct ata_host *host)
}
EXPORT_SYMBOL_GPL(ata_host_start);
+/**
+ * ata_host_undo_start - undo ata_host_start()
+ * @host: ATA host to undo_start
+ *
+ * Stop the ports of @host and drop the devres action registered by
+ * ata_host_start(), without calling ->host_stop(). Nothing is done if
+ * @host has not been started.
+ *
+ * This gives the release of the host resources back to the caller, which
+ * is what a driver whose probe() error path releases those resources
+ * itself needs when starting or activating the host fails.
+ *
+ * LOCKING:
+ * Inherited from calling layer (may sleep).
+ */
+void ata_host_undo_start(struct ata_host *host)
+{
+ int i;
+
+ if (!(host->flags & ATA_HOST_STARTED))
+ return;
+
+ for (i = 0; i < host->n_ports; i++) {
+ struct ata_port *ap = host->ports[i];
+
+ if (ap->ops->port_stop)
+ ap->ops->port_stop(ap);
+ }
+
+ /*
+ * Drop the action added by ata_host_start() without calling it.
+ * It does not exist if neither ->port_stop() nor ->host_stop() is
+ * implemented, in which case there is nothing to drop.
+ */
+ devres_destroy(host->dev, ata_host_stop, NULL, NULL);
+
+ host->flags &= ~ATA_HOST_STARTED;
+}
+EXPORT_SYMBOL_GPL(ata_host_undo_start);
+
/**
* ata_host_init - Initialize a host struct for sas (ipr, libsas)
* @host: host to initialize
@@ -6202,6 +6242,12 @@ static void async_port_probe(void *data, async_cookie_t cookie)
* starts ports, registers @host with ATA and SCSI layers and
* probe registered devices.
*
+ * On failure, the host remains started, i.e. the devres action
+ * registered by ata_host_start() is kept, so ->host_stop() is called by
+ * the driver core when probe() fails. A caller which releases the host
+ * resources in its own probe() error path must therefore call
+ * ata_host_undo_start().
+ *
* LOCKING:
* Inherited from calling layer (may sleep).
*
@@ -6295,6 +6341,10 @@ EXPORT_SYMBOL_GPL(ata_host_register);
* have set polling mode on the port. In this case, @irq_handler
* should be NULL.
*
+ * On failure, the ports are stopped again and the devres action
+ * registered by ata_host_start() is dropped without calling
+ * ->host_stop(), so releasing the host resources is left to the caller.
+ *
* LOCKING:
* Inherited from calling layer (may sleep).
*
@@ -6315,27 +6365,40 @@ int ata_host_activate(struct ata_host *host, int irq,
/* Special case for polling mode */
if (!irq) {
WARN_ON(irq_handler);
- return ata_host_register(host, sht);
+ rc = ata_host_register(host, sht);
+ if (rc)
+ goto undo_start;
+
+ return 0;
}
irq_desc = devm_kasprintf(host->dev, GFP_KERNEL, "%s[%s]",
dev_driver_string(host->dev),
dev_name(host->dev));
- if (!irq_desc)
- return -ENOMEM;
+ if (!irq_desc) {
+ rc = -ENOMEM;
+ goto undo_start;
+ }
rc = devm_request_irq(host->dev, irq, irq_handler, irq_flags,
irq_desc, host);
if (rc)
- return rc;
+ goto undo_start;
for (i = 0; i < host->n_ports; i++)
ata_port_desc_misc(host->ports[i], irq);
rc = ata_host_register(host, sht);
- /* if failed, just free the IRQ and leave ports alone */
- if (rc)
+ if (rc) {
+ /* Free the IRQ, so that the handler can no longer run */
devm_free_irq(host->dev, irq, host);
+ goto undo_start;
+ }
+
+ return 0;
+
+undo_start:
+ ata_host_undo_start(host);
return rc;
}
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 976e4e160494d..d5ef0338735c3 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -2267,6 +2267,11 @@ EXPORT_SYMBOL_GPL(ata_pci_sff_prepare_host);
* hosts. This separate helper is necessary because SFF hosts
* use two separate interrupts in legacy mode.
*
+ * Note that, unlike ata_host_activate(), the devres action registered
+ * by ata_host_start() is kept on failure, i.e. ->host_stop() is called
+ * by the driver core when probe() fails. All callers of this function
+ * rely on that, none of them releases the host resources itself.
+ *
* LOCKING:
* Inherited from calling layer (may sleep).
*
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index c6df55886fe1b..987d8acf1486c 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -1490,8 +1490,10 @@ static int sata_fsl_probe(struct platform_device *ofdev)
* device discovery process, invoking our port_start() handler &
* error_handler() to execute a dummy Softreset EH session
*/
- ata_host_activate(host, irq, sata_fsl_interrupt, SATA_FSL_IRQ_FLAG,
- &sata_fsl_sht);
+ retval = ata_host_activate(host, irq, sata_fsl_interrupt,
+ SATA_FSL_IRQ_FLAG, &sata_fsl_sht);
+ if (retval)
+ goto error_exit_with_cleanup;
host_priv->intr_coalescing.show = fsl_sata_intr_coalescing_show;
host_priv->intr_coalescing.store = fsl_sata_intr_coalescing_store;
diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
index 4e7f5b2ff3f69..f38310b84f51c 100644
--- a/drivers/ata/sata_qstor.c
+++ b/drivers/ata/sata_qstor.c
@@ -584,8 +584,12 @@ static int qs_ata_init_one(struct pci_dev *pdev,
qs_host_init(host, board_idx);
pci_set_master(pdev);
- return ata_host_activate(host, pdev->irq, qs_intr, IRQF_SHARED,
- &qs_ata_sht);
+ rc = ata_host_activate(host, pdev->irq, qs_intr, IRQF_SHARED,
+ &qs_ata_sht);
+ if (rc)
+ qs_host_stop(host);
+
+ return rc;
}
module_pci_driver(qs_ata_pci_driver);
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 48bde275968d0..3bd74d79f8126 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -1147,6 +1147,7 @@ extern struct ata_host *ata_host_alloc_pinfo(struct device *dev,
extern void ata_host_get(struct ata_host *host);
extern void ata_host_put(struct ata_host *host);
extern int ata_host_start(struct ata_host *host);
+void ata_host_undo_start(struct ata_host *host);
extern int ata_host_register(struct ata_host *host,
const struct scsi_host_template *sht);
extern int ata_host_activate(struct ata_host *host, int irq,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0172/1257] media: i2c: alvium-csi2: balance runtime PM usage count on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0171/1257] ata: libata: Do not leave ata_host_stop() registered when activation fails Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0173/1257] media: i2c: og01a1b: power off sensor " Greg Kroah-Hartman
` (826 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Sakari Ailus,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 0d2ca640318612402ae1c640d2da56b2914ff994 ]
alvium_probe() increments the runtime PM usage count with
pm_runtime_get_noresume() before enabling runtime PM. The probe error
path correctly balances this reference with pm_runtime_put_noidle(),
but the normal remove path only disables runtime PM.
pm_runtime_disable() does not decrement the usage count, so a
successful probe followed by driver removal leaves the runtime PM
usage count unbalanced.
Add the missing pm_runtime_put_noidle() to the remove path, matching
the existing probe error cleanup.
This issue was found by manual code inspection.
Fixes: 0a7af872915e ("media: i2c: Add support for alvium camera")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/alvium-csi2.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/i2c/alvium-csi2.c b/drivers/media/i2c/alvium-csi2.c
index f51f9b9877592..f218999e0ed90 100644
--- a/drivers/media/i2c/alvium-csi2.c
+++ b/drivers/media/i2c/alvium-csi2.c
@@ -2523,6 +2523,7 @@ static void alvium_remove(struct i2c_client *client)
* make sure to turn power off manually.
*/
pm_runtime_disable(dev);
+ pm_runtime_put_noidle(dev);
if (!pm_runtime_status_suspended(dev))
alvium_set_power(alvium, false);
pm_runtime_set_suspended(dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0173/1257] media: i2c: og01a1b: power off sensor on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0172/1257] media: i2c: alvium-csi2: balance runtime PM usage count on remove Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0174/1257] media: i2c: ov2735: fix power cleanup " Greg Kroah-Hartman
` (825 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Sakari Ailus,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit a26c5ac46191ae34b3413f7a45d6241f63e15d42 ]
og01a1b_probe() powers the sensor on explicitly before identifying and
initializing it. After a successful probe, runtime PM is enabled and
pm_runtime_idle() is used to allow the runtime suspend callback to
power the sensor off.
The probe error path explicitly calls og01a1b_power_off(), but the
normal remove path only disables runtime PM. pm_runtime_disable() does
not guarantee that an active device is runtime suspended, so the
sensor can remain powered when the driver is removed. This also leaves
the xvclk enable performed by og01a1b_power_on() unbalanced.
After disabling runtime PM, check whether the device is already
suspended. If it is still active, power the sensor off explicitly and
update the runtime PM state accordingly. Avoid powering it off again
when runtime suspend has already done so.
This issue was found by manual code inspection.
Fixes: a95ffde28783 ("media: i2c: og01a1b: Add support of xvclk supply clock in power management")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/og01a1b.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/media/i2c/og01a1b.c b/drivers/media/i2c/og01a1b.c
index 1675f0460969a..1cece90c59eeb 100644
--- a/drivers/media/i2c/og01a1b.c
+++ b/drivers/media/i2c/og01a1b.c
@@ -956,6 +956,11 @@ static void og01a1b_remove(struct i2c_client *client)
media_entity_cleanup(&sd->entity);
v4l2_ctrl_handler_free(sd->ctrl_handler);
pm_runtime_disable(og01a1b->dev);
+
+ if (!pm_runtime_status_suspended(og01a1b->dev)) {
+ og01a1b_power_off(og01a1b->dev);
+ pm_runtime_set_suspended(og01a1b->dev);
+ }
}
static int og01a1b_probe(struct i2c_client *client)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0174/1257] media: i2c: ov2735: fix power cleanup on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0173/1257] media: i2c: og01a1b: power off sensor " Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0175/1257] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str() Greg Kroah-Hartman
` (824 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Sakari Ailus,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 06d4f202f007b160e650e8dd861a5fc223024f34 ]
ov2735_probe() explicitly powers on the sensor before enabling runtime
PM. The probe failure paths call ov2735_power_off(), but the remove path
does not perform the corresponding power-off operation.
The managed runtime PM helpers only clean up the runtime PM state.
devm_pm_runtime_set_active_enabled() disables runtime PM and restores
the suspended state during device resource release, while
devm_pm_runtime_get_noresume() drops the runtime PM usage reference.
Neither helper invokes ov2735_power_off().
As a result, removing the driver after a successful probe can leave the
sensor clock and regulators enabled and the GPIOs in the powered state.
Call ov2735_power_off() from ov2735_remove() to match the successful
ov2735_power_on() performed during probe.
This issue was found by manual code inspection.
Fixes: fa9e6df636fb ("media: i2c: add ov2735 image sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov2735.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/i2c/ov2735.c b/drivers/media/i2c/ov2735.c
index dcb1add1fd9fc..2defcaa8b7950 100644
--- a/drivers/media/i2c/ov2735.c
+++ b/drivers/media/i2c/ov2735.c
@@ -1081,6 +1081,7 @@ static void ov2735_remove(struct i2c_client *client)
v4l2_subdev_cleanup(&ov2735->sd);
media_entity_cleanup(&sd->entity);
v4l2_ctrl_handler_free(ov2735->sd.ctrl_handler);
+ ov2735_power_off(ov2735->dev);
}
static DEFINE_RUNTIME_DEV_PM_OPS(ov2735_pm_ops,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0175/1257] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0174/1257] media: i2c: ov2735: fix power cleanup " Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0176/1257] ntfs3: reject empty iomap before reading its LCN Greg Kroah-Hartman
` (823 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit 6a6f3051e705b5c8facb0bf5984d5b981509e0b7 ]
hp_convert_hexstr_to_str() decodes an ACPI string made up of
space-separated ASCII hex-byte tokens of the form "0xHH". For
example, the four-byte input "0x41" decodes to the single
character 'A', and the nine-byte input "0x09 0x41" decodes to
"\tA": each token is read in a five-byte step (four characters for
the token, one for the trailing delimiter), and produces one output
byte, or two if that byte is '\\', '\r', '\n', or '\t', which are
written back out as a backslash followed by the matching letter.
The output buffer is sized with kmalloc(input_len, GFP_KERNEL), the
raw encoded length of the input, not the decoded length. For
well-formed input this is generous, since five input bytes never
decode to more than two output bytes. But input_len comes directly
from the ACPI string length reported by firmware and isn't
guaranteed to respect the five-byte encoding, so a short input_len
can undersize the allocation. With input_len == 1, only one byte is
allocated, yet decoding still produces at least one output byte
plus the NUL terminator written unconditionally afterwards, so two
bytes are needed. That terminator write then lands one byte past
the end of the allocation.
KASAN caught exactly this during BIOS attribute enumeration on
boot, triggered by a one-byte encoded input value:
BUG: KASAN: slab-out-of-bounds in hp_convert_hexstr_to_str+0x6d8/0x710 [hp_bioscfg]
Write of size 1 at addr ffff8881032e5d81 by task (udev-worker)/520
The buggy address is located 0 bytes to the right of
allocated 1-byte region [ffff8881032e5d80, ffff8881032e5d81)
Size the allocation to the worst-case decoded length instead of the
raw input length: two output bytes for every five-byte input chunk
(DIV_ROUND_UP(input_len, 5)), plus one byte for the terminator.
Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260915174615.63924-1-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
index 309634c1cc20e..ff28db7ced008 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *
*len = 0;
*str = NULL;
- new_str = kmalloc(input_len, GFP_KERNEL);
+ new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
if (!new_str)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0176/1257] ntfs3: reject empty iomap before reading its LCN
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0175/1257] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str() Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0177/1257] ntfs3: bound index head insertions by buffer capacity Greg Kroah-Hartman
` (822 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+4b4ec878e25fafefa70f,
Yousef Alhouseen, Konstantin Komarov, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
[ Upstream commit 666af227b12fcc3f4ac9827d449ee0910f7bcf9f ]
attr_data_get_block() can return success with a zero run length when no
cached or on-disk mapping covers a read VCN. In that case it does not
initialize the LCN output.
Check the returned length before comparing the LCN against the special
mapping values. This preserves the existing -EINVAL result for an empty
mapping without passing an uninitialized LCN to the comparisons.
Fixes: ecbb433f9a8e ("fs/ntfs3: fold file size handling into ntfs_set_size()")
Reported-by: syzbot+4b4ec878e25fafefa70f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b4ec878e25fafefa70f
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/inode.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 4ac26c80bd34f..fd844f9c556a8 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -981,6 +981,8 @@ static int ntfs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
if (err) {
return err;
}
+ if (!clen)
+ return -EINVAL;
if (lcn == EOF_LCN) {
/* request out of file. */
@@ -1016,11 +1018,6 @@ static int ntfs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
return 0;
}
- if (!clen) {
- /* broken file? */
- return -EINVAL;
- }
-
iomap->bdev = inode->i_sb->s_bdev;
iomap->offset = offset;
iomap->length = ((loff_t)clen << cluster_bits) - off;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0177/1257] ntfs3: bound index head insertions by buffer capacity
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0176/1257] ntfs3: reject empty iomap before reading its LCN Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0178/1257] crypto: atmel-tdes - sync output bounce buffer before DMA Greg Kroah-Hartman
` (821 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+45ef5a8d661162757547,
Yousef Alhouseen, Konstantin Komarov, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
[ Upstream commit 2f497d23652ff23da07b08cfb4b4a1c2a87f1892 ]
hdr_insert_head() shifts the existing index entries by ins_bytes without
checking that the resulting used size fits within hdr->total. A directory
index root larger than the newly allocated index buffer can therefore make
the memmove write beyond the buffer.
Reject insertions whose size would exceed the index header capacity and
make both split callers unwind the new node when that happens.
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Reported-by: syzbot+45ef5a8d661162757547@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=45ef5a8d661162757547
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/index.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 689712d3463d4..37e3e16b1f841 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -594,6 +594,8 @@ static const struct NTFS_DE *hdr_insert_head(struct INDEX_HDR *hdr,
if (!e)
return NULL;
+ if (size_add(used, ins_bytes) > le32_to_cpu(hdr->total))
+ return NULL;
/* Now we just make room for the inserted entries and jam it in. */
to_move = used - le32_to_cpu(hdr->de_off);
@@ -1801,7 +1803,10 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni,
}
/* Copy root entries into new buffer. */
- hdr_insert_head(hdr, re, to_move);
+ if (!hdr_insert_head(hdr, re, to_move)) {
+ err = -EINVAL;
+ goto out_put_n;
+ }
/* Update bitmap attribute. */
indx_mark_used(indx, ni, new_vbn >> indx->idx2vbn_bits);
@@ -1955,7 +1960,11 @@ static int indx_insert_into_buffer(struct ntfs_index *indx,
/* Copy all the entries <= sp into the new buffer. */
de_t = hdr_first_de(hdr1);
to_copy = PtrOffset(de_t, sp);
- hdr_insert_head(hdr2, de_t, to_copy);
+ if (!hdr_insert_head(hdr2, de_t, to_copy)) {
+ err = -EINVAL;
+ put_indx_node(n2);
+ goto out;
+ }
/* Remove all entries (sp including) from hdr1. */
used = used1 - to_copy - sp_size;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0178/1257] crypto: atmel-tdes - sync output bounce buffer before DMA
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0177/1257] ntfs3: bound index head insertions by buffer capacity Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0179/1257] usb: fotg210: validate endpoint index in ep0 handlers Greg Kroah-Hartman
` (820 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Thorsten Blum,
Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit a38fdcb9c944525ca71e6aaf35e708586d0ae87d ]
The slow path maps its output bounce buffer once at probe time with
dma_map_single() and DMA_FROM_DEVICE, then reuses the mapping for every
request. After the CPU copies a result from the buffer,
dma_sync_single_for_device() must hand the buffer back to the device before
the next DMA transfer. The driver omits this call, so cache lines from the
previous result can remain valid while the device writes the next one.
This bug was masked by the completion paths calling
dma_sync_single_for_device() immediately before the CPU copied the output,
where dma_sync_single_for_cpu() was required. For DMA_FROM_DEVICE on
ARM926, dma_sync_single_for_device() invokes arm926_dma_map_area(), which
invalidates the cache lines. The misplaced call therefore discarded the
stale lines before every copy-out.
Commit c8a9a647532f ("crypto: atmel-tdes - fix DMA sync direction")
correctly changed the completion paths to call dma_sync_single_for_cpu().
On ARM926, that function invokes arm926_dma_unmap_area(), which is a no-op.
The missing pre-DMA dma_sync_single_for_device() was therefore exposed on
ARM926-based SAM9X60 and SAM9X7 SoCs.
With CONFIG_CRYPTO_SELFTESTS=y all four DES/TDES algorithms fail on
SAM9X75:
alg: skcipher: atmel-ecb-tdes encryption test failed (wrong result) on
test vector 2, cfg="unaligned buffer, offset=1"
Call dma_sync_single_for_device() for the output buffer before starting DMA
in both atmel_tdes_crypt_pdc() and atmel_tdes_crypt_dma().
Fixes: c8a9a647532f ("crypto: atmel-tdes - fix DMA sync direction")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-tdes.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/crypto/atmel-tdes.c b/drivers/crypto/atmel-tdes.c
index 2756dab3f4c7f..ed80423b4209c 100644
--- a/drivers/crypto/atmel-tdes.c
+++ b/drivers/crypto/atmel-tdes.c
@@ -370,6 +370,8 @@ static int atmel_tdes_crypt_pdc(struct atmel_tdes_dev *dd,
if (!(dd->flags & TDES_FLAGS_FAST)) {
dma_sync_single_for_device(dd->dev, dma_addr_in, length,
DMA_TO_DEVICE);
+ dma_sync_single_for_device(dd->dev, dma_addr_out, length,
+ DMA_FROM_DEVICE);
}
len32 = DIV_ROUND_UP(length, sizeof(u32));
@@ -402,6 +404,8 @@ static int atmel_tdes_crypt_dma(struct atmel_tdes_dev *dd,
if (!(dd->flags & TDES_FLAGS_FAST)) {
dma_sync_single_for_device(dd->dev, dma_addr_in, length,
DMA_TO_DEVICE);
+ dma_sync_single_for_device(dd->dev, dma_addr_out, length,
+ DMA_FROM_DEVICE);
}
addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0179/1257] usb: fotg210: validate endpoint index in ep0 handlers
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0178/1257] crypto: atmel-tdes - sync output bounce buffer before DMA Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0180/1257] ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe() Greg Kroah-Hartman
` (819 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Liu Chao, Linus Walleij, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Chao <liuc63@xiaopeng.com>
[ Upstream commit bbddb219b00af0792242a0ad1dc7fb3344f38733 ]
fotg210_set_feature(), fotg210_clear_feature() and fotg210_get_status()
use wIndex from the USB setup packet to index the fotg210->ep[] array
without verifying that the endpoint number falls below
FOTG210_MAX_NUM_EP (5). USB_ENDPOINT_NUMBER_MASK is 0x0f, so a
malicious host can issue a setup packet with wIndex 5..15, resulting in
an out-of-bounds array read. The resulting wild pointer is then
dereferenced in fotg210_set_epnstall() or fotg210_is_epnstall(), which
compute an MMIO register offset from ep->epnum and perform iowrite32
through it.
fotg210_clear_feature() is especially problematic: the out-of-bounds
access occurs at function entry (source-level) regardless of which
USB_RECIP_* case is taken, because the ep pointer is computed before the
switch statement.
Add upper-bound checks on the endpoint number derived from wIndex in
all three functions. Invalid endpoint numbers in clear_feature now
trigger fotg210_request_error() (STALL) instead of silently falling
through to fotg210_set_cxdone(). Also add the missing le16_to_cpu()
conversion for ctrl->wIndex in fotg210_get_status() to fix a sparse
endianness warning.
Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260913120458.1608186-1-liuc63@xiaopeng.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/fotg210/fotg210-udc.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/fotg210/fotg210-udc.c b/drivers/usb/fotg210/fotg210-udc.c
index d9e024873a429..127a259c8d1ea 100644
--- a/drivers/usb/fotg210/fotg210-udc.c
+++ b/drivers/usb/fotg210/fotg210-udc.c
@@ -661,7 +661,7 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210,
case USB_RECIP_ENDPOINT: {
u8 epnum;
epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
- if (epnum)
+ if (epnum && epnum < FOTG210_MAX_NUM_EP)
fotg210_set_epnstall(fotg210->ep[epnum]);
else
fotg210_set_cxstall(fotg210);
@@ -677,8 +677,8 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210,
static void fotg210_clear_feature(struct fotg210_udc *fotg210,
struct usb_ctrlrequest *ctrl)
{
- struct fotg210_ep *ep =
- fotg210->ep[ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK];
+ u8 epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
+ struct fotg210_ep *ep;
switch (ctrl->bRequestType & USB_RECIP_MASK) {
case USB_RECIP_DEVICE:
@@ -688,7 +688,12 @@ static void fotg210_clear_feature(struct fotg210_udc *fotg210,
fotg210_set_cxdone(fotg210);
break;
case USB_RECIP_ENDPOINT:
- if (ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK) {
+ if (epnum >= FOTG210_MAX_NUM_EP) {
+ fotg210_request_error(fotg210);
+ break;
+ }
+ if (epnum) {
+ ep = fotg210->ep[epnum];
if (ep->wedged) {
fotg210_set_cxdone(fotg210);
break;
@@ -744,8 +749,8 @@ static void fotg210_get_status(struct fotg210_udc *fotg210,
fotg210->ep0_data = cpu_to_le16(0);
break;
case USB_RECIP_ENDPOINT:
- epnum = ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK;
- if (epnum)
+ epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
+ if (epnum && epnum < FOTG210_MAX_NUM_EP)
fotg210->ep0_data =
cpu_to_le16(fotg210_is_epnstall(fotg210->ep[epnum])
<< USB_ENDPOINT_HALT);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0180/1257] ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0179/1257] usb: fotg210: validate endpoint index in ep0 handlers Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0181/1257] ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id() Greg Kroah-Hartman
` (818 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Charles Keepax,
Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 480a5528cb6268d626632d45d4a1f29b4c0c11df ]
In wm8994_component_probe(), pm_runtime_get_sync() is invoked before
reading the GPIO configuration registers. If either regmap_read() fails,
the function jumps to err_irq without calling pm_runtime_put(), leaving
the runtime PM usage count incremented and causing a leak.
Add pm_runtime_put() on both GPIO read failure paths before jumping to
err_irq.
Fixes: f5a2cda4f1db ("ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260916072737.1970990-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wm8994.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 8bf58a6a8af7c..0d1b4b1fcecda 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -4340,6 +4340,7 @@ static int wm8994_component_probe(struct snd_soc_component *component)
ret = regmap_read(control->regmap, WM8994_GPIO_1, ®);
if (ret < 0) {
dev_err(component->dev, "Failed to read GPIO1 state: %d\n", ret);
+ pm_runtime_put(component->dev);
goto err_irq;
}
if ((reg & WM8994_GPN_FN_MASK) != WM8994_GP_FN_PIN_SPECIFIC) {
@@ -4352,6 +4353,7 @@ static int wm8994_component_probe(struct snd_soc_component *component)
ret = regmap_read(control->regmap, WM8994_GPIO_6, ®);
if (ret < 0) {
dev_err(component->dev, "Failed to read GPIO6 state: %d\n", ret);
+ pm_runtime_put(component->dev);
goto err_irq;
}
if ((reg & WM8994_GPN_FN_MASK) != WM8994_GP_FN_PIN_SPECIFIC) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0181/1257] ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0180/1257] ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe() Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0182/1257] iio: accel: kxcjk-1013: Disable autosuspend on remove Greg Kroah-Hartman
` (817 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Charles Keepax,
Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit e04dcb895b4622d67164e218a1179785e2c75999 ]
In arizona_start_hpdet_acc_id(), pm_runtime_get_sync() is called to keep
the device powered during headphone detection. If setting the HPDET mode
or starting the measurement fails and the function jumps to err,
pm_runtime_put_autosuspend() was not called while info->hpdet_active was
set to false, resulting in a runtime PM usage count leak.
Add pm_runtime_put_autosuspend() in the err error path to keep runtime PM
balanced.
Fixes: 9dd5e53d9d2f ("extcon: arizona: Retry HPDET identification for high impedance")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260916072900.1971595-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/arizona-jack.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/codecs/arizona-jack.c b/sound/soc/codecs/arizona-jack.c
index 819d080b11889..6587d46a18670 100644
--- a/sound/soc/codecs/arizona-jack.c
+++ b/sound/soc/codecs/arizona-jack.c
@@ -699,6 +699,7 @@ static void arizona_start_hpdet_acc_id(struct arizona_priv *info)
snd_soc_jack_report(info->jack, SND_JACK_HEADPHONE,
SND_JACK_LINEOUT | SND_JACK_HEADPHONE);
+ pm_runtime_put_autosuspend(arizona->dev);
info->hpdet_active = false;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0182/1257] iio: accel: kxcjk-1013: Disable autosuspend on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0181/1257] ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id() Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0183/1257] iio: accel: mma9551: disable " Greg Kroah-Hartman
` (816 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Joshua Crofts,
Srinivas Pandruvada, Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 1de1206a42741adfb72ca8b37dc71a6bc80cb074 ]
kxcjk1013_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.
The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.
Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.
This issue was found by manual code inspection.
Fixes: 124e1b1d0924 ("iio: accel: kxcjk-1013: support runtime pm")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/kxcjk-1013.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index 8994c9e8e048d..b3d753bd94761 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -1547,6 +1547,7 @@ static void kxcjk1013_remove(struct i2c_client *client)
iio_device_unregister(indio_dev);
+ pm_runtime_dont_use_autosuspend(&client->dev);
pm_runtime_disable(&client->dev);
pm_runtime_set_suspended(&client->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0183/1257] iio: accel: mma9551: disable autosuspend on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0182/1257] iio: accel: kxcjk-1013: Disable autosuspend on remove Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0184/1257] iio: accel: mma9553: " Greg Kroah-Hartman
` (815 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Joshua Crofts,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 8061720f6be1811478914f8b6143778d70f6033f ]
mma9551_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.
The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.
Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.
This issue was found by manual code inspection.
Fixes: 6da93a6710a3 ("iio: accel: mma9551: Add runtime pm support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/mma9551.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/accel/mma9551.c b/drivers/iio/accel/mma9551.c
index 7e01427fd9c4d..182f488edab1c 100644
--- a/drivers/iio/accel/mma9551.c
+++ b/drivers/iio/accel/mma9551.c
@@ -500,6 +500,7 @@ static void mma9551_remove(struct i2c_client *client)
iio_device_unregister(indio_dev);
+ pm_runtime_dont_use_autosuspend(&client->dev);
pm_runtime_disable(&client->dev);
pm_runtime_set_suspended(&client->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0184/1257] iio: accel: mma9553: disable autosuspend on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0183/1257] iio: accel: mma9551: disable " Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0185/1257] iio: adc: at91-sama5d2: " Greg Kroah-Hartman
` (814 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Joshua Crofts,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 4dda1f9d25fb889649e81bbf015809daa512a049 ]
mma9553_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.
The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.
Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.
This issue was found by manual code inspection.
Fixes: 40cb761306d6 ("iio: add driver for Freescale MMA9553")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/mma9553.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/accel/mma9553.c b/drivers/iio/accel/mma9553.c
index 8e7aaac89d473..5a36d415a8372 100644
--- a/drivers/iio/accel/mma9553.c
+++ b/drivers/iio/accel/mma9553.c
@@ -1136,6 +1136,7 @@ static void mma9553_remove(struct i2c_client *client)
iio_device_unregister(indio_dev);
+ pm_runtime_dont_use_autosuspend(&client->dev);
pm_runtime_disable(&client->dev);
pm_runtime_set_suspended(&client->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0185/1257] iio: adc: at91-sama5d2: disable autosuspend on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0184/1257] iio: accel: mma9553: " Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0186/1257] md/raid5: track disks array size to fix extra_page leak on error paths Greg Kroah-Hartman
` (813 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Joshua Crofts,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 022996906e70c6bc9a7968ee663ebbe314fe1524 ]
at91_adc_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.
The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.
Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.
This issue was found by manual code inspection.
Fixes: 75d7556ac0e4 ("iio: adc: at91-sama5d2_adc: add runtime pm support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/at91-sama5d2_adc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
index e8a5285bb6d4f..e68632e628c71 100644
--- a/drivers/iio/adc/at91-sama5d2_adc.c
+++ b/drivers/iio/adc/at91-sama5d2_adc.c
@@ -2487,6 +2487,7 @@ static void at91_adc_remove(struct platform_device *pdev)
pm_runtime_disable(st->dev);
pm_runtime_set_suspended(st->dev);
+ pm_runtime_dont_use_autosuspend(st->dev);
clk_disable_unprepare(st->per_clk);
regulator_disable(st->vref);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0186/1257] md/raid5: track disks array size to fix extra_page leak on error paths
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0185/1257] iio: adc: at91-sama5d2: " Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0187/1257] md/raid5: fix NULL pointer dereference in raid5_free_percpu Greg Kroah-Hartman
` (812 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cao Guanghui, Yu Kuai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cao Guanghui <caoguanghui@kylinos.cn>
[ Upstream commit 5028ceee173bfcf844469cfb0d1c151d3f6d0296 ]
free_conf() iterates conf->pool_size entries to free extra_page
allocations, but pool_size may not reflect the actual size of the
conf->disks array. Two scenarios cause a mismatch:
1. setup_conf() early abort: pool_size is 0 (not yet set by
grow_stripes) but conf->disks has max_disks entries with
extra_page allocated. The loop iterates 0 times, leaking all
pages.
2. resize_stripes() Step 4 failure: conf->disks was replaced with
a newsize-entry array in Step 3, but pool_size is only updated
on success. The loop iterates pool_size (old, smaller value)
times, leaking (newsize - pool_size) pages.
Add a dedicated disks_cnt field to track the actual number of
entries in conf->disks. Set it immediately after each allocation
or replacement (in setup_conf and resize_stripes Step 3, where the
array is safely stalled with no concurrent access), and use it in
free_conf() instead of pool_size.
This leaves pool_size untouched, preserving the check_reshape()
retry behavior that depends on pool_size only being updated on
full success.
Fixes: d7bd398e97f2 ("md/r5cache: handle alloc_page failure")
Cc: stable@vger.kernel.org
Signed-off-by: Cao Guanghui <caoguanghui@kylinos.cn>
Link: https://patch.msgid.link/20260827080341.112296-1-ghuicao@163.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid5.c | 5 +++--
drivers/md/raid5.h | 1 +
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index b91545ce090de..e5838bf516e38 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2642,6 +2642,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
} else {
kfree(conf->disks);
conf->disks = ndisks;
+ conf->disks_cnt = newsize;
}
} else
err = -ENOMEM;
@@ -7552,7 +7553,7 @@ static void free_conf(struct r5conf *conf)
free_thread_groups(conf);
shrink_stripes(conf);
raid5_free_percpu(conf);
- for (i = 0; i < conf->pool_size; i++)
+ for (i = 0; i < conf->disks_cnt; i++)
if (conf->disks[i].extra_page)
put_page(conf->disks[i].extra_page);
kfree(conf->disks);
@@ -7733,7 +7734,7 @@ static struct r5conf *setup_conf(struct mddev *mddev)
if (!conf->disks)
goto abort;
-
+ conf->disks_cnt = max_disks;
for (i = 0; i < max_disks; i++) {
conf->disks[i].extra_page = alloc_page(GFP_KERNEL);
if (!conf->disks[i].extra_page)
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index cb5feae04db27..94b3e2c947ba9 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -667,6 +667,7 @@ struct r5conf {
unsigned long cache_state;
struct shrinker *shrinker;
int pool_size; /* number of disks in stripeheads in pool */
+ int disks_cnt; /* number of entries in disks[] array */
spinlock_t device_lock;
struct disk_info *disks;
struct bio_set bio_split;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0187/1257] md/raid5: fix NULL pointer dereference in raid5_free_percpu
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0186/1257] md/raid5: track disks array size to fix extra_page leak on error paths Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0188/1257] md/raid5: validate payload size before calculating payload_len Greg Kroah-Hartman
` (811 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cao Guanghui, Yu Kuai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cao Guanghui <caoguanghui@kylinos.cn>
[ Upstream commit 41742e35268d6a45161b187f51f42bc2ade14d0d ]
If cpuhp_state_add_instance() fails in raid5_alloc_percpu() (e.g., the
startup callback raid456_cpu_up_prepare fails due to an allocation
failure), conf->node is never added to the cpuhp instance list and
its pprev remains NULL (from kzalloc initialization).
When setup_conf() then jumps to abort, free_conf() calls
raid5_free_percpu(), which checks conf->percpu (non-NULL, since it was
allocated before the cpuhp failure) and proceeds to call
cpuhp_state_remove_instance(). This calls hlist_del() on the unhashed
node, which dereferences node->pprev (NULL), causing a kernel panic.
Guard the removal with hlist_unhashed_lockless() so that the cpuhp
instance is only removed if it was actually added. The lockless variant
uses READ_ONCE() for the pprev read, which is safe here because the
actual removal is synchronized by cpuhp_state_mutex inside
cpuhp_state_remove_instance().
Fixes: 29c6d1bbd7a2 ("md/raid5: Convert to hotplug state machine")
Cc: stable@vger.kernel.org
Signed-off-by: Cao Guanghui <caoguanghui@kylinos.cn>
Link: https://patch.msgid.link/20260827080341.112296-2-ghuicao@163.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid5.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e5838bf516e38..bc5f4b048eeda 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7539,7 +7539,8 @@ static void raid5_free_percpu(struct r5conf *conf)
if (!conf->percpu)
return;
- cpuhp_state_remove_instance(CPUHP_MD_RAID5_PREPARE, &conf->node);
+ if (!hlist_unhashed_lockless(&conf->node))
+ cpuhp_state_remove_instance(CPUHP_MD_RAID5_PREPARE, &conf->node);
free_percpu(conf->percpu);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0188/1257] md/raid5: validate payload size before calculating payload_len
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0187/1257] md/raid5: fix NULL pointer dereference in raid5_free_percpu Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0189/1257] drm/panic: Do not use un-escaped URL as format string Greg Kroah-Hartman
` (810 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junrui Luo, Martin Wilck, Yu Kuai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Wilck <martin.wilck@suse.com>
[ Upstream commit 38c795105992bbaa3418dd39cbff7348ad17537c ]
Commit b0cc3ae97e89 ("md/raid5: validate payload size before accessing
journal metadata") introduced a bounds check to verify that a given payload
fits into the current metadata block. In order to calculate the payload
size, it has to access the members payload->header.type and payload->size,
the offset of which may already be past the end of the metadata block,
because the loop condition only checks that the first byte of the payload
is inside, and the payload entries have variable sizes. Later on,
payload->checksum[0] and payload->checksum[1] are accessed without
verifying that payload->size is large enough.
Add another check to make sure that payload->size can be safely
accessed, and make sure that the checksum fields are accessible.
This issue has been found by AI (gemma4, Gemini) during a backport
review.
Cc: Junrui Luo <moonafterrain@outlook.com>
Cc: stable@vger.kernel.org
Fixes: b0cc3ae97e89 ("md/raid5: validate payload size before accessing journal metadata")
Signed-off-by: Martin Wilck <mwilck@suse.com>
Link: https://patch.msgid.link/20260907155103.2325511-1-mwilck@suse.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid5-cache.c | 34 ++++++++++++++++++++++++++--------
1 file changed, 26 insertions(+), 8 deletions(-)
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 7b7546bfa21fb..62460e231f025 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -2001,27 +2001,36 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log,
if (!page)
return -ENOMEM;
- while (mb_offset < le32_to_cpu(mb->meta_size)) {
+ while (mb_offset + sizeof(struct r5l_payload_header) <= le32_to_cpu(mb->meta_size)) {
+ u32 payload_size;
sector_t payload_len;
payload = (void *)mb + mb_offset;
payload_flush = (void *)mb + mb_offset;
if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_DATA) {
+ if (mb_offset + sizeof(struct r5l_payload_data_parity)
+ > le32_to_cpu(mb->meta_size))
+ goto mismatch;
+ payload_size = le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9);
payload_len = sizeof(struct r5l_payload_data_parity) +
- (sector_t)sizeof(__le32) *
- (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
- if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
+ (sector_t)sizeof(__le32) * payload_size;
+ if (mb_offset + payload_len > le32_to_cpu(mb->meta_size) ||
+ payload_size < 1)
goto mismatch;
if (r5l_recovery_verify_data_checksum(
log, ctx, page, log_offset,
payload->checksum[0]) < 0)
goto mismatch;
} else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_PARITY) {
+ if (mb_offset + sizeof(struct r5l_payload_data_parity)
+ > le32_to_cpu(mb->meta_size))
+ goto mismatch;
+ payload_size = le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9);
payload_len = sizeof(struct r5l_payload_data_parity) +
- (sector_t)sizeof(__le32) *
- (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
- if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
+ (sector_t)sizeof(__le32) * payload_size;
+ if (mb_offset + payload_len > le32_to_cpu(mb->meta_size) ||
+ payload_size < conf->max_degraded)
goto mismatch;
if (r5l_recovery_verify_data_checksum(
log, ctx, page, log_offset,
@@ -2035,6 +2044,9 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log,
payload->checksum[1]) < 0)
goto mismatch;
} else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {
+ if (mb_offset + sizeof(struct r5l_payload_flush)
+ > le32_to_cpu(mb->meta_size))
+ goto mismatch;
payload_len = sizeof(struct r5l_payload_flush) +
(sector_t)le32_to_cpu(payload_flush->size);
if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
@@ -2096,7 +2108,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
mb_offset = sizeof(struct r5l_meta_block);
log_offset = r5l_ring_add(log, ctx->pos, BLOCK_SECTORS);
- while (mb_offset < le32_to_cpu(mb->meta_size)) {
+ while (mb_offset + sizeof(struct r5l_payload_header) < le32_to_cpu(mb->meta_size)) {
sector_t payload_len;
int dd;
@@ -2106,6 +2118,9 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {
int i, count;
+ if (mb_offset + sizeof(struct r5l_payload_flush) >
+ le32_to_cpu(mb->meta_size))
+ return -EINVAL;
payload_len = sizeof(struct r5l_payload_flush) +
(sector_t)le32_to_cpu(payload_flush->size);
if (mb_offset + payload_len >
@@ -2130,6 +2145,9 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
}
/* DATA or PARITY payload */
+ if (mb_offset + sizeof(struct r5l_payload_data_parity) >
+ le32_to_cpu(mb->meta_size))
+ return -EINVAL;
payload_len = sizeof(struct r5l_payload_data_parity) +
(sector_t)sizeof(__le32) *
(le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0189/1257] drm/panic: Do not use un-escaped URL as format string
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0188/1257] md/raid5: validate payload size before calculating payload_len Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0190/1257] drm/panic: Test address from kmap op for NULL Greg Kroah-Hartman
` (809 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Jocelyn Falempe,
Javier Martinez Canillas, dri-devel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 6596aae25585b183ebd528206bde6f12efaf8db1 ]
Replace the direct use of DRM_PANIC_SCREEN_QR_CODE_URL in snprintf()
with a %s conversion specifier. Avoids a possible vulnerabilty from
a crafted URL string.
As the attacker needs to control the kernel at the Kconfig level, the
potential for an exploit is likely low.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Fixes: cb5164ac43d0 ("drm/panic: Add a QR code panic screen")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.12+
Link: https://patch.msgid.link/20260911124540.279841-2-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index e576c4791861d..ba21df4be3380 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -658,7 +658,8 @@ static int drm_panic_get_qr_code_url(u8 **qr_image)
char *kmsg;
int max_qr_data_size, url_len;
- url_len = snprintf(url, sizeof(url), CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL "?a=%s&v=%s&z=",
+ url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=",
+ CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
utsname()->machine, utsname()->release);
max_qr_data_size = drm_panic_qr_max_data_size(panic_qr_version, url_len);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0190/1257] drm/panic: Test address from kmap op for NULL
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0189/1257] drm/panic: Do not use un-escaped URL as format string Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0191/1257] media: i2c: cvs: Get the wake IRQ without claiming the GPIO Greg Kroah-Hartman
` (808 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann,
Javier Martinez Canillas, Jocelyn Falempe, dri-devel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 6a6304ec3ceee879e3a2545b217eb11c8b7870e5 ]
Do nothing if kmap_local_page_try_from_panic() returns NULL. This is
not likely to hapen, as the previous page from the same memory area
has been mapped successfully.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 23437509a694 ("drm/panic: Fix 24bit pixel crossing page boundaries")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.18+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20260911124540.279841-3-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panic.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index ba21df4be3380..d28ce8878e055 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -178,6 +178,8 @@ static void drm_panic_write_pixel24_xpage(void *vaddr, struct page *next_page,
u8 *p = vaddr + offset;
vaddr2 = kmap_local_page_try_from_panic(next_page);
+ if (!vaddr2)
+ return;
*p++ = color & 0xff;
color >>= 8;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0191/1257] media: i2c: cvs: Get the wake IRQ without claiming the GPIO
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0190/1257] drm/panic: Test address from kmap op for NULL Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0192/1257] media: imx219: Account rate_factor in setting upper exposure limit Greg Kroah-Hartman
` (807 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, jan p. springer, Junjie Cao,
Manuel Knitza, Sakari Ailus, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <junjie.cao@intel.com>
[ Upstream commit ed447e2b1da9bfe7d076e12cde496f3f689f7fdd ]
The wake line is only used as an IRQ source, yet the driver requests
it with devm_gpiod_get(). On the Dell XPS 14 DA14260 (Panther Lake)
that request lands on the pin the four CS35L57 amplifiers read their
speaker ID from. Each amplifier's _CRS carries
GpioIo (Shared, PullNone, 0, 0, IoRestrictionInputOnly,
"\_SB.GPI1", 0, ResourceConsumer,,) {20}
and INTC10E1 builds its _CRS at runtime from pad numbers kept in NVS:
a GpioInt (Edge, ActiveLow, Shared) first, then an Exclusive
output-only GpioIo for reset and two lines on the USB GPIO expander.
The driver maps index 0 to "wake". While it holds the line, cs35l56
fails and does not retry:
cs35l56 sdw:0:2:01fa:3557:01:2: error -EBUSY: Failed to get spk-id-gpios
All four fail and no card is registered. Fedora 7.1.13 is the first
Fedora kernel with the driver enabled; 7.1.12 on the same board
creates the card, and 7.2.4 creates it again with intel_cvs
blacklisted. Where ipu-bridge does not expose the CSI endpoints, CSI
init returns -EPROBE_DEFER and every retry claims the line again for
the length of the handshake, which is how 7.1 fails as well.
Take the IRQ from the GpioInt entry with acpi_dev_gpio_irq_get_by(),
as the I2C core does for client->irq; this also applies the trigger
type from _CRS. The vendor driver in intel/vision-drivers does the
same. The driver binds as a platform device too, hence the explicit
lookup. A DKMS build of the patched driver on a DA14260 running
7.2.4 binds with all four amplifiers probing and the camera working
(third link).
Fixes: 8e2b43d2c10b ("media: i2c: cvs: Add driver of Intel Computer Vision Sensing Controller(CVS)")
Cc: stable@vger.kernel.org
Reported-by: jan p. springer <regnirpsj@gmail.com>
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2529031
Link: https://github.com/thesofproject/sof/issues/11152
Link: https://github.com/omacom/omarchy-pkgs/pull/419
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Tested-by: Manuel Knitza <manuel.knitza@googlemail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/cvs/core.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/media/i2c/cvs/core.c b/drivers/media/i2c/cvs/core.c
index d4a3b9c3bab1e..8d857bbd8ab51 100644
--- a/drivers/media/i2c/cvs/core.c
+++ b/drivers/media/i2c/cvs/core.c
@@ -725,8 +725,6 @@ static int cvs_core_probe(struct device *dev, struct i2c_client *i2c)
}
if (ctx->res == ICVS_FULLCAP) {
- struct gpio_desc *wake;
-
ctx->rst = devm_gpiod_get(dev, "rst", GPIOD_OUT_HIGH);
if (IS_ERR(ctx->rst)) {
ret = dev_err_probe(dev, PTR_ERR(ctx->rst),
@@ -734,14 +732,12 @@ static int cvs_core_probe(struct device *dev, struct i2c_client *i2c)
goto err_put_ipu;
}
- wake = devm_gpiod_get(dev, "wake", GPIOD_IN);
- if (IS_ERR(wake)) {
- ret = dev_err_probe(dev, PTR_ERR(wake),
- "failed to get wake GPIO\n");
- goto err_put_ipu;
- }
-
- ctx->irq = gpiod_to_irq(wake);
+ /*
+ * Do not request the line: another device's _CRS may list
+ * the same pin, and its driver would then fail with -EBUSY.
+ */
+ ctx->irq = acpi_dev_gpio_irq_get_by(ACPI_COMPANION(dev),
+ "wake", 0);
if (ctx->irq < 0) {
ret = dev_err_probe(dev, ctx->irq,
"failed to get wake IRQ\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0192/1257] media: imx219: Account rate_factor in setting upper exposure limit
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0191/1257] media: i2c: cvs: Get the wake IRQ without claiming the GPIO Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0193/1257] media: imx219: Account for rate_factor in control steps Greg Kroah-Hartman
` (806 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Dave Stevenson,
Laurent Pinchart, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit db111b66f2db7f3f79d9359f4a9762e832d6fde9 ]
The rate_factor multiplier is used to multiply a few values in the
sensor's timing configuration and the exposure time is one of them. This
also needs to be taken into account in exposure time margin: multiply it
by rate_factor so that sensor's exposure time margin is respected.
Fixes: f513997119f4 ("media: i2c: imx219: Scale the pixel rate for analog binning")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/imx219.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
index 9571f3622d2d4..5184523de8bed 100644
--- a/drivers/media/i2c/imx219.c
+++ b/drivers/media/i2c/imx219.c
@@ -466,7 +466,8 @@ static int imx219_set_ctrl(struct v4l2_ctrl *ctrl)
int exposure_max, exposure_def;
/* Update max exposure while meeting expected vblanking */
- exposure_max = format->height + ctrl->val - IMX219_EXPOSURE_OFFSET;
+ exposure_max = format->height + ctrl->val -
+ IMX219_EXPOSURE_OFFSET * rate_factor;
exposure_def = (exposure_max < IMX219_EXPOSURE_DEFAULT) ?
exposure_max : IMX219_EXPOSURE_DEFAULT;
ret = __v4l2_ctrl_modify_range(imx219->exposure,
@@ -893,6 +894,7 @@ static int imx219_set_pad_format(struct v4l2_subdev *sd,
crop->top = (IMX219_NATIVE_HEIGHT - crop->height) / 2;
if (fmt->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+ int rate_factor = imx219_get_rate_factor(state);
int exposure_max;
int exposure_def;
int llp_min;
@@ -911,7 +913,8 @@ static int imx219_set_pad_format(struct v4l2_subdev *sd,
return ret;
/* Update max exposure while meeting expected vblanking */
- exposure_max = mode->fll_def - IMX219_EXPOSURE_OFFSET;
+ exposure_max = mode->fll_def -
+ IMX219_EXPOSURE_OFFSET * rate_factor;
exposure_def = (exposure_max < IMX219_EXPOSURE_DEFAULT) ?
exposure_max : IMX219_EXPOSURE_DEFAULT;
ret = __v4l2_ctrl_modify_range(imx219->exposure,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0193/1257] media: imx219: Account for rate_factor in control steps
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0192/1257] media: imx219: Account rate_factor in setting upper exposure limit Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0194/1257] media: imx219: The horizontal blanking step is 8 Greg Kroah-Hartman
` (805 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Dave Stevenson,
Laurent Pinchart, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 57043aef0a04bd96d97881422590e71c1e4c45b1 ]
The controls that are divided by the rate_factor before writing them to
the registers have the step of the value of the rate_factor. Take this
into account when the control's range is modified. The controls are
created in a configuration where rate_factor is always 1, hence there's no
need to change the code adding new controls.
Fixes: f513997119f4 ("media: i2c: imx219: Scale the pixel rate for analog binning")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/imx219.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
index 5184523de8bed..b1f29037af742 100644
--- a/drivers/media/i2c/imx219.c
+++ b/drivers/media/i2c/imx219.c
@@ -340,13 +340,13 @@ static const struct imx219_mode supported_modes[] = {
/* 2x2 binned 60fps mode */
.width = 1640,
.height = 1232,
- .fll_def = 1707,
+ .fll_def = 1706,
},
{
/* 640x480 60fps mode */
.width = 640,
.height = 480,
- .fll_def = 1707,
+ .fll_def = 1706,
},
};
@@ -473,8 +473,7 @@ static int imx219_set_ctrl(struct v4l2_ctrl *ctrl)
ret = __v4l2_ctrl_modify_range(imx219->exposure,
imx219->exposure->minimum,
exposure_max,
- imx219->exposure->step,
- exposure_def);
+ rate_factor, exposure_def);
if (ret)
return ret;
@@ -902,7 +901,8 @@ static int imx219_set_pad_format(struct v4l2_subdev *sd,
/* Update limits and set FPS to default */
ret = __v4l2_ctrl_modify_range(imx219->vblank, IMX219_VBLANK_MIN,
- IMX219_FLL_MAX - mode->height, 1,
+ IMX219_FLL_MAX - mode->height,
+ rate_factor,
mode->fll_def - mode->height);
if (ret)
return ret;
@@ -920,8 +920,7 @@ static int imx219_set_pad_format(struct v4l2_subdev *sd,
ret = __v4l2_ctrl_modify_range(imx219->exposure,
imx219->exposure->minimum,
exposure_max,
- imx219->exposure->step,
- exposure_def);
+ rate_factor, exposure_def);
if (ret)
return ret;
@@ -946,8 +945,7 @@ static int imx219_set_pad_format(struct v4l2_subdev *sd,
return ret;
/* Scale the pixel rate based on the mode specific factor */
- pixel_rate = imx219_get_pixel_rate(imx219) *
- imx219_get_rate_factor(state);
+ pixel_rate = imx219_get_pixel_rate(imx219) * rate_factor;
ret = __v4l2_ctrl_modify_range(imx219->pixel_rate, pixel_rate,
pixel_rate, 1, pixel_rate);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0194/1257] media: imx219: The horizontal blanking step is 8
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0193/1257] media: imx219: Account for rate_factor in control steps Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0195/1257] spi: spi-qpic-snand: publish the ECC context to snandc->qspi Greg Kroah-Hartman
` (804 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Dave Stevenson,
Laurent Pinchart, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 47576c541e9b473841742bd0686d4940f5c93564 ]
The step for the LINE_LENGTH_A register on imx219 is 8. Take this into
account in creating and modifying the horizontal blanking control. The
minimum line length in pixels as well as the horizontal blanking values
are already divisible by 8.
Fixes: cd5e2fd89923 ("media: i2c: imx219: make HBLANK r/w to allow longer exposures")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/imx219.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
index b1f29037af742..05717b1e32244 100644
--- a/drivers/media/i2c/imx219.c
+++ b/drivers/media/i2c/imx219.c
@@ -78,6 +78,7 @@
#define IMX219_LLP_MIN 0x0d78
#define IMX219_BINNED_LLP_MIN 0x0de8
#define IMX219_LLP_MAX 0x7ff0
+#define IMX219_LLP_STEP 8
#define IMX219_REG_X_ADD_STA_A CCI_REG16(0x0164)
#define IMX219_REG_X_ADD_END_A CCI_REG16(0x0166)
@@ -593,7 +594,8 @@ static int imx219_init_controls(struct imx219 *imx219)
imx219->hblank = v4l2_ctrl_new_std(ctrl_hdlr, &imx219_ctrl_ops,
V4L2_CID_HBLANK,
IMX219_LLP_MIN - mode->width,
- IMX219_LLP_MAX - mode->width, 1,
+ IMX219_LLP_MAX - mode->width,
+ IMX219_LLP_STEP,
IMX219_LLP_MIN - mode->width);
exposure_max = mode->fll_def - IMX219_EXPOSURE_OFFSET;
exposure_def = (exposure_max < IMX219_EXPOSURE_DEFAULT) ?
@@ -935,7 +937,8 @@ static int imx219_set_pad_format(struct v4l2_subdev *sd,
IMX219_BINNED_LLP_MIN : IMX219_LLP_MIN;
ret = __v4l2_ctrl_modify_range(imx219->hblank,
llp_min - mode->width,
- IMX219_LLP_MAX - mode->width, 1,
+ IMX219_LLP_MAX - mode->width,
+ IMX219_LLP_STEP,
llp_min - mode->width);
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0195/1257] spi: spi-qpic-snand: publish the ECC context to snandc->qspi
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0194/1257] media: imx219: The horizontal blanking step is 8 Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0196/1257] cpufreq: conservative: Restrict deferred downscaling to low load Greg Kroah-Hartman
` (803 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gabor Juhos, Johan Alvarado,
Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Alvarado <contact@c127.dev>
[ Upstream commit f94c9b68bb5fdbef9f841da493d5305ff634ebb5 ]
qcom_spi_ooblayout_ecc() and qcom_spi_ooblayout_free() read the ECC
configuration through snandc->qspi->ecc. qcom_spi_probe() points it at a
zeroed scratch struct and only qcom_spi_ecc_prepare_io_req_pipelined(),
which runs on page I/O, ever updates it. qcom_spi_ecc_init_ctx_pipelined()
installs the ooblayout but does not publish the context it just
allocated, and qcom_spi_ecc_cleanup_ctx_pipelined() frees that context
without clearing the pointer.
spinand_init() calls mtd_ooblayout_count_freebytes() right after the ECC
context is created and before any page I/O, so the ooblayout always runs
against a pointer that does not describe the current context:
- On a first probe it reads the zeroed struct from qcom_spi_probe(),
so steps, bytes and bbm_size are 0. The count then returns 0 rather
than an error, so the probe continues with mtd->oobavail set to 0.
- On a probe retry it reads the ecc_cfg the previous attempt freed.
A retry is easy to hit. On IPQ5018 with the qcom,smem-part parser the
partition parse returns -EPROBE_DEFER until SMEM has probed, so the
first spi-nand probe defers. It defers inside
mtd_device_parse_register(), after mtd_otp_nvmem_add() has already read
the factory OTP - that read goes through prepare_io_req and leaves
snandc->qspi->ecc pointing at the context that spinand_cleanup() then
frees. The second probe allocates a new context, never publishes it, and
computes the OOB layout from the freed one. Once the slab has been
reused, qecc->steps holds garbage and
oobregion->length = qecc->steps * 4;
goes negative. qcom_spi_ooblayout_free() only reports -ERANGE for
section 1 and later, so mtd_ooblayout_count_bytes() sums the regions and
returns that negative length as the byte count. The -512 below is
steps * 4 with steps == -128. It is a byte count that happens to
collide with -ERESTARTSYS, not an error the driver returned.
spinand_init() takes it as an error, and because it is not
-EPROBE_DEFER the driver core never retries and the NAND never appears:
spi-nand spi0.0: ESMT SPI NAND was found.
spi-nand spi0.0: probe with driver spi-nand failed with error -512
UBI error: cannot open mtd rootfs, error -2
Waiting for root device /dev/ubiblock0_1...
On a Mercusys MR80X (IPQ5018, ESMT F50D1G41LB) about half of the boots
failed to mount the rootfs, the outcome depending on whether the freed
memory had been overwritten yet.
Publish the context when it is created and clear the pointer when it is
destroyed. Clearing leaves snandc->qspi->ecc NULL after cleanup, which
is safe: the mtd is unregistered before cleanup_ctx runs, so no
ooblayout callback can follow.
Fixes: 7304d1909080 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface")
Cc: stable@vger.kernel.org
Tested-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Johan Alvarado <contact@c127.dev>
Link: https://patch.msgid.link/20260911184416.109790-2-contact@c127.dev
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-qpic-snand.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/spi/spi-qpic-snand.c b/drivers/spi/spi-qpic-snand.c
index 05efe6313b7fe..ae4a3f2a35e1c 100644
--- a/drivers/spi/spi-qpic-snand.c
+++ b/drivers/spi/spi-qpic-snand.c
@@ -411,6 +411,8 @@ static int qcom_spi_ecc_init_ctx_pipelined(struct nand_device *nand)
dev_dbg(snandc->dev, "ECC strength: %u bits per %u bytes\n",
ecc_cfg->strength, ecc_cfg->step_size);
+ snandc->qspi->ecc = ecc_cfg;
+
return 0;
err_free_ecc_cfg:
@@ -427,6 +429,7 @@ static void qcom_spi_ecc_cleanup_ctx_pipelined(struct nand_device *nand)
kfree(snandc->qspi->oob_buf);
snandc->qspi->oob_buf = NULL;
+ snandc->qspi->ecc = NULL;
kfree(ecc_cfg);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0196/1257] cpufreq: conservative: Restrict deferred downscaling to low load
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0195/1257] spi: spi-qpic-snand: publish the ECC context to snandc->qspi Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0197/1257] nilfs2: force clear dirty state when restoring from the shadow map Greg Kroah-Hartman
` (802 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luo Haiyang, Run Zhang, Zhongqiu Han,
Shengming Hu, Rafael J. Wysocki, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengming Hu <hu.shengming@zte.com.cn>
[ Upstream commit 0fa55c5539173bceaeb400c69b1974aaa0cdb8dc ]
For a shared cpufreq policy, dbs_update() derives the load used for the
frequency decision from the maximum load among its CPUs, but it may
also record deferred idle periods accumulated by an idle CPU in the
policy.
Consequently, a single update can contain both a high decision load
from one CPU and multiple deferred idle periods from another CPU. The
conservative governor applies the deferred down steps before evaluating
the decision load. If that load subsequently triggers an up step, the
deferred down steps can outweigh the single up step and produce a net
frequency reduction.
This was observed on a policy shared by CPUs 2 and 3. A CPU-bound
SCHED_EXT task kept CPU 2 fully utilized while CPU 3 remained idle.
On this system, SCHED_EXT generated update-util callbacks less
frequently than CFS, resulting in sparse DBS updates such as:
load=100 idle_periods=7 interval=59 ms
load=100 idle_periods=4 interval=39 ms
load=100 idle_periods=2 interval=19 ms
load=100 idle_periods=7 interval=59 ms
With the default 5% frequency step and a 2.6 GHz policy maximum, seven
deferred periods reduce the requested frequency by seven 130 MHz steps
before the high decision load adds only one step. Repeated updates
therefore keep the policy near 530 MHz even though CPU 2 is fully
utilized.
There are two load values relevant to this behavior:
* sample_load is calculated from the busy and elapsed time of the
current sample.
* decision_load is returned by dbs_update() for the governor's
frequency decision. After a long idle interval, it may reuse
prev_load to improve the response to a waking task and can therefore
differ from sample_load.
The problem is that idle_periods is derived from accumulated idle time
and is applied independently of whether the current sample load is in
the conservative governor's downscaling region. A high sample load and
multiple deferred idle periods can therefore coexist, particularly
when updates are sparse.
As suggested by Zhongqiu Han, calculate the sample load separately from
the decision load. If no time has elapsed, use prev_load for the sample
load as the existing load calculation does, since no load can be
calculated for that interval.
Record the maximum sample load for the policy and apply deferred down
steps only when it is below down_threshold. This makes deferred
downscaling follow the same threshold that the conservative governor
normally uses to determine whether the policy load is low enough to
reduce the frequency.
The existing code applies deferred down steps whenever idle_periods is
valid, regardless of the sample load. When the decision load is in the
hold region, the locally adjusted frequency is not submitted unless
another frequency-update branch is taken. Thus, when the sample and
decision loads are the same and both are in the hold region, this
change does not alter the requested frequency.
The difference becomes visible when the decision load causes a
frequency update. In particular, if it exceeds up_threshold, the
governor applies a single up step after the deferred down steps and
submits the resulting request. Multiple deferred down steps can then
outweigh that up step and cause a frequency reduction even when the
sample load is above down_threshold.
With this change, deferred down steps are skipped whenever the maximum
sample load is at or above down_threshold, keeping deferred downscaling
consistent with the conservative governor's threshold semantics. The
requested frequency may therefore be higher than with the existing
behavior when deferred idle periods are present and the decision load
causes a frequency update. This is intentional, because the lower
request previously resulted from applying deferred downscaling while
the sampled policy load was outside the governor's downscaling region.
Accelerated deferred downscaling remains available when the policy
sample load is below down_threshold, including after a workload has
completed and the policy has become idle.
Fixes: 00bfe05889e9 ("cpufreq: conservative: Decrease frequency faster for deferred updates")
Cc: All applicable <stable@vger.kernel.org>
Reviewed-by: Luo Haiyang <luo.haiyang@zte.com.cn>
Reviewed-by: Run Zhang <zhang.run@zte.com.cn>
Suggested-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
Link: https://patch.msgid.link/20260916140926740-DCokXh6dAgtqDn1EWdCh@zte.com.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/cpufreq_conservative.c | 8 ++++---
drivers/cpufreq/cpufreq_governor.c | 29 +++++++++++++++++++-------
drivers/cpufreq/cpufreq_governor.h | 2 ++
3 files changed, 29 insertions(+), 10 deletions(-)
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 0b32ae28ec857..02bfd46543e99 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -85,10 +85,12 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
freq_step = get_freq_step(cs_tuners, policy);
/*
- * Decrease requested_freq one freq_step for each idle period that
- * we didn't update the frequency.
+ * Apply deferred down steps only when the policy sample load is
+ * below down_threshold. Otherwise, multiple deferred down steps may
+ * cause a net frequency decrease outside the downscaling region.
*/
- if (policy_dbs->idle_periods < UINT_MAX) {
+ if (policy_dbs->max_sample_load < cs_tuners->down_threshold &&
+ policy_dbs->idle_periods < UINT_MAX) {
unsigned int freq_steps = policy_dbs->idle_periods * freq_step;
if (requested_freq > policy->min + freq_steps)
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index 710d93ec89b53..f3bd3dbe7c419 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -124,7 +124,8 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
struct policy_dbs_info *policy_dbs = policy->governor_data;
struct dbs_data *dbs_data = policy_dbs->dbs_data;
unsigned int ignore_nice = dbs_data->ignore_nice_load;
- unsigned int max_load = 0, idle_periods = UINT_MAX;
+ unsigned int max_load = 0, max_sample_load = 0;
+ unsigned int idle_periods = UINT_MAX;
unsigned int sampling_rate, io_busy, j;
u64 cur_nice;
@@ -147,7 +148,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
struct cpu_dbs_info *j_cdbs = &per_cpu(cpu_dbs, j);
u64 update_time, cur_idle_time;
unsigned int idle_time, time_elapsed;
- unsigned int load;
+ unsigned int load, sample_load;
cur_idle_time = get_cpu_idle_time(j, &update_time, io_busy);
@@ -186,6 +187,20 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
j_cdbs->prev_cpu_nice = cur_nice;
+ /*
+ * Compute the sample load separately from the prev_load value
+ * that may be reused after a long idle interval. The conservative
+ * governor uses it to decide whether to apply deferred down steps.
+ * If no time has elapsed, retain the existing behavior and use
+ * prev_load.
+ */
+ if (unlikely(!time_elapsed))
+ sample_load = j_cdbs->prev_load;
+ else if (time_elapsed > idle_time)
+ sample_load = 100 * (time_elapsed - idle_time) / time_elapsed;
+ else
+ sample_load = 0;
+
if (unlikely(!time_elapsed)) {
/*
* That can only happen when this function is called
@@ -220,11 +235,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
load = j_cdbs->prev_load;
j_cdbs->prev_load = 0;
} else {
- if (time_elapsed > idle_time)
- load = 100 * (time_elapsed - idle_time) / time_elapsed;
- else
- load = 0;
-
+ load = sample_load;
j_cdbs->prev_load = load;
}
@@ -237,9 +248,13 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
if (load > max_load)
max_load = load;
+
+ if (sample_load > max_sample_load)
+ max_sample_load = sample_load;
}
policy_dbs->idle_periods = idle_periods;
+ policy_dbs->max_sample_load = max_sample_load;
return max_load;
}
diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
index 73b8ed7cfaae7..806d8fb4dff1d 100644
--- a/drivers/cpufreq/cpufreq_governor.h
+++ b/drivers/cpufreq/cpufreq_governor.h
@@ -95,6 +95,8 @@ struct policy_dbs_info {
/* Multiplier for increasing sample delay temporarily. */
unsigned int rate_mult;
unsigned int idle_periods; /* For conservative */
+ /* Maximum load from the current policy sample. */
+ unsigned int max_sample_load;
/* Status indicators */
bool is_shared; /* This object is used by multiple CPUs */
bool work_in_progress; /* Work is being queued up or in progress */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0197/1257] nilfs2: force clear dirty state when restoring from the shadow map
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0196/1257] cpufreq: conservative: Restrict deferred downscaling to low load Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0198/1257] regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling() Greg Kroah-Hartman
` (801 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryusuke Konishi, Jiaming Zhang,
Viacheslav Dubeyko, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaming Zhang <r772577952@gmail.com>
[ Upstream commit cb6702e63e0a16afd83875294e5ce53becdd1b1f ]
When garbage collection fails, nilfs2 rolls the DAT metadata file's page
cache back to a shadow copy taken before GC started.
nilfs_clear_dirty_pages() drops the dirty state of the folios in the DAT
cache, then nilfs_copy_back_pages() overwrites them with the saved
contents and warns if one is still dirty:
/* overwrite existing folio in the destination cache */
WARN_ON(folio_test_dirty(dfolio));
nilfs_clear_dirty_pages() used to clear the dirty state unconditionally,
which is safe here because the rollback runs with the log writer
stopped, so nothing else can dirty the cache while it runs. The same
helper is also used when writeback finds dirty folios after the
filesystem has degraded to read-only, where it does run concurrently
with the log writer, so commit ca76bb226bf4 ("nilfs2: do not force clear
folio if buffer is referenced") made nilfs_clear_folio_dirty() skip a
folio if any of its buffer heads is busy. The rollback caller shares
that helper, so its clearing step can now return with a folio still
dirty.
A DAT folio can hold a busy buffer head without anyone modifying the
folio: nilfs_mdt_read_block() submits read-ahead for the blocks
following the one it was asked for and waits only for the first, so the
read-ahead buffers are still locked when it returns. With a block size
smaller than the page size, a locked read-ahead buffer can share a folio
with a block that GC dirtied and keep the whole folio dirty past the
clearing step.
Add a force flag to nilfs_clear_dirty_pages() and
nilfs_clear_folio_dirty() that skips the busy buffer check, and set it
in the two calls from nilfs_mdt_restore_from_shadow_map(). The
read-only fallback callers keep passing false, so that commit still
protects them and the WARN_ON() is left alone.
Fixes: ca76bb226bf4 ("nilfs2: do not force clear folio if buffer is referenced")
Closes: https://lore.kernel.org/lkml/CANypQFZSYrtcshnUzOPiqatyLd-M8_OReOewQoAi_V5yY0dTtg@mail.gmail.com/
Cc: stable@vger.kernel.org
Suggested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/inode.c | 2 +-
fs/nilfs2/mdt.c | 6 +++---
fs/nilfs2/page.c | 50 +++++++++++++++++++++++++++--------------------
fs/nilfs2/page.h | 4 ++--
4 files changed, 35 insertions(+), 27 deletions(-)
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 34e6096069ad6..64437aed83903 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -163,7 +163,7 @@ static int nilfs_writepages(struct address_space *mapping,
int err = 0;
if (sb_rdonly(inode->i_sb)) {
- nilfs_clear_dirty_pages(mapping);
+ nilfs_clear_dirty_pages(mapping, false);
return -EROFS;
}
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index 2a435349fd219..b50c88b651839 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -405,7 +405,7 @@ static int nilfs_mdt_write_folio(struct folio *folio,
* have dirty folios that try to be flushed in background.
* So, here we simply discard this dirty folio.
*/
- nilfs_clear_folio_dirty(folio);
+ nilfs_clear_folio_dirty(folio, false);
folio_unlock(folio);
return -EROFS;
}
@@ -648,10 +648,10 @@ void nilfs_mdt_restore_from_shadow_map(struct inode *inode)
if (mi->mi_palloc_cache)
nilfs_palloc_clear_cache(inode);
- nilfs_clear_dirty_pages(inode->i_mapping);
+ nilfs_clear_dirty_pages(inode->i_mapping, true);
nilfs_copy_back_pages(inode->i_mapping, shadow->inode->i_mapping);
- nilfs_clear_dirty_pages(ii->i_assoc_inode->i_mapping);
+ nilfs_clear_dirty_pages(ii->i_assoc_inode->i_mapping, true);
nilfs_copy_back_pages(ii->i_assoc_inode->i_mapping,
NILFS_I(shadow->inode)->i_assoc_inode->i_mapping);
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index cf4f1c6798f5e..857926da9f21d 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -369,8 +369,9 @@ void nilfs_copy_back_pages(struct address_space *dmap,
/**
* nilfs_clear_dirty_pages - discard dirty pages in address space
* @mapping: address space with dirty pages for discarding
+ * @force: whether to clear the dirty state regardless of busy buffer heads
*/
-void nilfs_clear_dirty_pages(struct address_space *mapping)
+void nilfs_clear_dirty_pages(struct address_space *mapping, bool force)
{
struct folio_batch fbatch;
unsigned int i;
@@ -391,7 +392,7 @@ void nilfs_clear_dirty_pages(struct address_space *mapping)
* was acquired. Skip processing in that case.
*/
if (likely(folio->mapping == mapping))
- nilfs_clear_folio_dirty(folio);
+ nilfs_clear_folio_dirty(folio, force);
folio_unlock(folio);
}
@@ -403,13 +404,16 @@ void nilfs_clear_dirty_pages(struct address_space *mapping)
/**
* nilfs_clear_folio_dirty - discard dirty folio
* @folio: dirty folio that will be discarded
+ * @force: whether to clear the states regardless of busy buffer heads
*
* nilfs_clear_folio_dirty() clears working states including dirty state for
- * the folio and its buffers. If the folio has buffers, clear only if it is
- * confirmed that none of the buffer heads are busy (none have valid
- * references and none are locked).
+ * the folio and its buffers. If the folio has buffers and force is false,
+ * clear only if it is confirmed that none of the buffer heads are busy (none
+ * have valid references and none are locked). If force is true, the states
+ * are cleared unconditionally, the caller should guarantee that the folio is
+ * not being modified concurrently.
*/
-void nilfs_clear_folio_dirty(struct folio *folio)
+void nilfs_clear_folio_dirty(struct folio *folio, bool force)
{
struct buffer_head *bh, *head;
@@ -422,24 +426,28 @@ void nilfs_clear_folio_dirty(struct folio *folio)
BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) |
BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) |
BIT(BH_Delay));
- bool busy, invalidated = false;
+
+ if (!force) {
+ bool busy, invalidated = false;
recheck_buffers:
- busy = false;
- bh = head;
- do {
- if (atomic_read(&bh->b_count) | buffer_locked(bh)) {
- busy = true;
- break;
+ busy = false;
+ bh = head;
+ do {
+ if (atomic_read(&bh->b_count) |
+ buffer_locked(bh)) {
+ busy = true;
+ break;
+ }
+ } while (bh = bh->b_this_page, bh != head);
+
+ if (busy) {
+ if (invalidated)
+ return;
+ invalidate_bh_lrus();
+ invalidated = true;
+ goto recheck_buffers;
}
- } while (bh = bh->b_this_page, bh != head);
-
- if (busy) {
- if (invalidated)
- return;
- invalidate_bh_lrus();
- invalidated = true;
- goto recheck_buffers;
}
bh = head;
diff --git a/fs/nilfs2/page.h b/fs/nilfs2/page.h
index 136cd1c143c9c..c3ba3468af5cb 100644
--- a/fs/nilfs2/page.h
+++ b/fs/nilfs2/page.h
@@ -41,8 +41,8 @@ void nilfs_folio_bug(struct folio *);
int nilfs_copy_dirty_pages(struct address_space *, struct address_space *);
void nilfs_copy_back_pages(struct address_space *, struct address_space *);
-void nilfs_clear_folio_dirty(struct folio *folio);
-void nilfs_clear_dirty_pages(struct address_space *mapping);
+void nilfs_clear_folio_dirty(struct folio *folio, bool force);
+void nilfs_clear_dirty_pages(struct address_space *mapping, bool force);
unsigned int nilfs_page_count_clean_buffers(struct folio *folio,
unsigned int from, unsigned int to);
unsigned long nilfs_find_uncommitted_extent(struct inode *inode,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0198/1257] regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0197/1257] nilfs2: force clear dirty state when restoring from the shadow map Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0199/1257] regulator: core: Fix rdev reference leak in regulator_resolve_supply() Greg Kroah-Hartman
` (800 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit c41b69e9f76fd9632662714c1d37860468e8d773 ]
of_parse_coupled_regulator() returns the coupled regulator with its
device reference incremented, but regulator_resolve_coupling() returns
without dropping it when the coupled regulator belongs to a different
coupler, leaking the reference.
Fixes: d8ca7d184b33 ("regulator: core: Introduce API for regulators coupling customization")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917142535.2156720-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 6a4008f387b5e..e813aeaa64ef5 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5861,6 +5861,7 @@ static void regulator_resolve_coupling(struct regulator_dev *rdev)
if (c_rdev->coupling_desc.coupler != coupler) {
rdev_err(rdev, "coupler mismatch with %s\n",
rdev_get_name(c_rdev));
+ put_device(&c_rdev->dev);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0199/1257] regulator: core: Fix rdev reference leak in regulator_resolve_supply()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0198/1257] regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling() Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0200/1257] PCI: Skip Target Speed quirk on clamped ports with no link Greg Kroah-Hartman
` (799 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 195bbe5e1c29aa1349655a6162958149c1176034 ]
regulator_resolve_supply() takes a reference on the looked-up regulator
with regulator_dev_lookup(), but when the supply resolves to the
regulator itself that reference is never dropped: it leaks on the early
return and is lost as well when r is replaced with the dummy regulator.
Release the reference before handling the self-referent case.
Fixes: 4b639e254d3d ("regulator: avoid resolve_supply() infinite recursion")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917142810.2156816-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index e813aeaa64ef5..811a890b88311 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -2239,6 +2239,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
if (r == rdev) {
dev_err(dev, "Supply for %s (%s) resolved to itself\n",
rdev->desc->name, rdev->supply_name);
+ put_device(&rdev->dev);
if (!have_full_constraints()) {
ret = -EINVAL;
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0200/1257] PCI: Skip Target Speed quirk on clamped ports with no link
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0199/1257] regulator: core: Fix rdev reference leak in regulator_resolve_supply() Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0201/1257] crypto: zynqmp-sha - fix NULL pointer dereference in init_tfm Greg Kroah-Hartman
` (798 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Wild, Maciej W. Rozycki,
Bjorn Helgaas, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
[ Upstream commit ff8a969f7dc8e79ea6113abcfa983e070b2b585a ]
Since commit 72780f796468 ("PCI: Always lift 2.5GT/s restriction in PCIe
failed link retraining") the Target Speed quirk lifts a firmware-imposed
2.5GT/s restriction on any downstream port, without checking whether the
link is up. Where nothing is plugged in, the retraining that follows can
never complete, so each attempt costs PCIE_LINK_RETRAIN_TIMEOUT_MS. The
quirk makes two of them -- the initial one and the restore on the error
path -- adding a fixed 2 s to every boot.
On an MSI PRO Z690-A WIFI DDR4 (Intel 600 Series PCH) with one empty x1
slot, running v7.2-rc5:
0.541 pci 0000:00:1c.0: removing 2.5GT/s downstream link speed restriction
1.541 pci 0000:00:1c.0: retraining failed
2.541 pci 0000:00:1c.2: [8086:7aba] type 01 class 0x060400
Where the Link Speed has already been clamped at 2.5GT/s and no link has
been established there is nothing worth doing, which is what the kerneldoc
for the quirk already describes: the restriction is to be lifted where
firmware arranged it "and the port reports its link already being up".
Bail out early in that case, before either the ASM2824 workaround or the
removal of the restriction is considered.
Ports whose link is up are unaffected, and so is the ASM2824 workaround,
which is reached with the Target Link Speed not clamped.
With this applied the quirk returns without touching the port: both
messages are gone, enumeration proceeds from 0000:00:1c.0 to 0000:00:1c.2
in 1 ms rather than 2 s, and the systemd "kernel" boot phase goes from
3.011 s to 1.036 s.
Fixes: 72780f796468 ("PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining")
Reported-by: Andreas Wild <andiwild@gmail.com>
Closes: https://lore.kernel.org/lkml/20260801092152.5643-1-andiwild@gmail.com/
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221801
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Andreas Wild <andiwild@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Andreas Wild <andiwild@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260801201244.4421-1-andiwild@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 1aa87a3ef9ede..866493aceef0c 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -108,7 +108,11 @@ int pcie_failed_link_retrain(struct pci_dev *dev)
pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta);
pcie_capability_read_word(dev, PCI_EXP_LNKCTL2, &oldlnkctl2);
- if (!(lnksta & PCI_EXP_LNKSTA_DLLLA) && pcie_lbms_seen(dev, lnksta)) {
+ if (lnksta & PCI_EXP_LNKSTA_DLLLA) {
+ ;
+ } else if (PCIE_LNKCTL2_TLS2SPEED(oldlnkctl2) == PCIE_SPEED_2_5GT) {
+ return ret;
+ } else if (pcie_lbms_seen(dev, lnksta)) {
pci_info(dev, "broken device, retraining non-functional downstream link at 2.5GT/s\n");
ret = pcie_set_target_speed(dev, PCIE_SPEED_2_5GT, false);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0201/1257] crypto: zynqmp-sha - fix NULL pointer dereference in init_tfm
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0200/1257] PCI: Skip Target Speed quirk on clamped ports with no link Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0202/1257] crypto: xilinx - clear AES key buffer before freeing it Greg Kroah-Hartman
` (797 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit 016f22d2268e02df705868110fe4e402b51bfffc ]
zynqmp_sha_init_tfm() checks crypto_shash_statesize(tfm_ctx->fbk_tfm)
before assigning the fallback transform to it, which dereferences a NULL
pointer since the transform context is zero-initialized. Use the local
fallback_tfm pointer for the size check instead.
Fixes: c1dd353d18e5 ("crypto: zynqmp-sha - Make descsize an algorithm attribute")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/xilinx/zynqmp-sha.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/xilinx/zynqmp-sha.c b/drivers/crypto/xilinx/zynqmp-sha.c
index 5813017b6b79d..cd051e1f42753 100644
--- a/drivers/crypto/xilinx/zynqmp-sha.c
+++ b/drivers/crypto/xilinx/zynqmp-sha.c
@@ -59,7 +59,7 @@ static int zynqmp_sha_init_tfm(struct crypto_shash *hash)
return PTR_ERR(fallback_tfm);
if (crypto_shash_descsize(hash) <
- crypto_shash_statesize(tfm_ctx->fbk_tfm)) {
+ crypto_shash_statesize(fallback_tfm)) {
crypto_free_shash(fallback_tfm);
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0202/1257] crypto: xilinx - clear AES key buffer before freeing it
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0201/1257] crypto: zynqmp-sha - fix NULL pointer dereference in init_tfm Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0203/1257] crypto: omap-des - fix crypto engine cleanup Greg Kroah-Hartman
` (796 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Thomas Huth,
Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit 1e4d31c4eb86982319245d8973473a621a256842 ]
In xilinx_aes_aead_exit(), the AES key buffer is freed without being
cleared, which allows key material to remain in memory. Use
kfree_sensitive() to clear the buffer before freeing it.
Fixes: c315cb0005be ("crypto: xilinx - Change coherent DMA to streaming DMA API")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/xilinx/zynqmp-aes-gcm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/xilinx/zynqmp-aes-gcm.c b/drivers/crypto/xilinx/zynqmp-aes-gcm.c
index d54c268dfe34a..ebee37dddb1f0 100644
--- a/drivers/crypto/xilinx/zynqmp-aes-gcm.c
+++ b/drivers/crypto/xilinx/zynqmp-aes-gcm.c
@@ -766,7 +766,7 @@ static void xilinx_aes_aead_exit(struct crypto_aead *aead)
struct xilinx_aead_tfm_ctx *tfm_ctx = crypto_tfm_ctx(tfm);
dma_unmap_single(tfm_ctx->dev, tfm_ctx->key_dma_addr, AES_KEYSIZE_256, DMA_TO_DEVICE);
- kfree(tfm_ctx->key);
+ kfree_sensitive(tfm_ctx->key);
if (tfm_ctx->fbk_cipher) {
crypto_free_aead(tfm_ctx->fbk_cipher);
tfm_ctx->fbk_cipher = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0203/1257] crypto: omap-des - fix crypto engine cleanup
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0202/1257] crypto: xilinx - clear AES key buffer before freeing it Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0204/1257] crypto: omap-sham " Greg Kroah-Hartman
` (795 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 5d69ed4cd4f9c68ff9a6ebb2e8a1079223a4ec6e ]
omap_des_probe() allocates and starts a crypto engine, but the remove
path does not call the matching crypto_engine_exit(). The probe failure
path already performs this cleanup.
crypto_engine_alloc_init() creates a kthread worker for processing
requests. Without crypto_engine_exit() during driver removal, the
worker is left running after the device is removed.
Call crypto_engine_exit() after unregistering the algorithms and before
tearing down the remaining request handling resources. This stops the
engine and destroys its worker.
This issue was found by manual code inspection.
Fixes: f1b77aaca85a ("crypto: omap-des - Integrate with the crypto engine framework")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/omap-des.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
index 3b7104cb4487b..4b5a8d13f505e 100644
--- a/drivers/crypto/omap-des.c
+++ b/drivers/crypto/omap-des.c
@@ -1082,6 +1082,8 @@ static void omap_des_remove(struct platform_device *pdev)
omap_des_unregister_algs(dd->pdata);
+ crypto_engine_exit(dd->engine);
+
cancel_work_sync(&dd->done_task);
omap_des_dma_cleanup(dd);
pm_runtime_disable(dd->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0204/1257] crypto: omap-sham - fix crypto engine cleanup
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0203/1257] crypto: omap-des - fix crypto engine cleanup Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0205/1257] ACPI: CPPC: Propagate errors from cross-CPU FFH calls Greg Kroah-Hartman
` (794 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit be51ea091c6563158531e8c74e040552fdb1e28c ]
omap_sham_probe() allocates and starts a crypto engine, but the remove
path does not call the matching crypto_engine_exit(). The probe failure
path already performs this cleanup.
crypto_engine_alloc_init() creates a kthread worker for processing
requests. Without crypto_engine_exit() during driver removal, the
worker is left running after the device is removed.
Call crypto_engine_exit() after unregistering the algorithms and before
tearing down the remaining request handling resources. This stops the
engine and destroys its worker.
This issue was found by manual code inspection.
Fixes: 133c3d434d91 ("crypto: omap-sham - convert to use crypto engine")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/omap-sham.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
index 6d2dd0b88f151..207fc7680c8f8 100644
--- a/drivers/crypto/omap-sham.c
+++ b/drivers/crypto/omap-sham.c
@@ -2129,6 +2129,7 @@ static void omap_sham_remove(struct platform_device *pdev)
list_del(&dd->list);
spin_unlock_bh(&sham.lock);
omap_sham_unregister_algs(dd->pdata);
+ crypto_engine_exit(dd->engine);
cancel_work_sync(&dd->done_task);
pm_runtime_dont_use_autosuspend(&pdev->dev);
pm_runtime_disable(&pdev->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0205/1257] ACPI: CPPC: Propagate errors from cross-CPU FFH calls
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0204/1257] crypto: omap-sham " Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0206/1257] cpufreq: CPPC: Create the FIE worker before enabling PCC callbacks Greg Kroah-Hartman
` (793 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Loehle, Sumit Gupta,
Rafael J. Wysocki, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Loehle <christian.loehle@arm.com>
[ Upstream commit 36e96b469da24868f727b4cd168d7cf01cbd163d ]
The arm64 and RISC-V CPPC FFH accessors ignore the return value of
smp_call_function_single(). If the target CPU is offline, the call can
return -ENXIO without running the callback. The accessors then consume
callback output which was never initialized and may report success.
CPU offlining leaves the CPU's CPPC sysfs attributes present. On arm64,
the AMU feature mask does not exclude an offline CPU, so a paired counter
read can expose uninitialized stack values through feedback_ctrs. RISC-V
has the same problem in both SBI and CSR reads, and its write paths also
inspect an uninitialized callback status after a failed cross-CPU call.
Return the SMP call error before using callback output. The arm64 single
and paired counter readers already check the helper's return value. For
RISC-V, also check the callback status before copying a read value: an
unsupported CSR sets the error but does not initialize the value.
Fixes: 68c5debcc06d ("arm64: implement CPPC FFH support using AMUs")
Fixes: 30f3ffbee86b ("ACPI: RISC-V: Add CPPC driver")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Christian Loehle <christian.loehle@arm.com>
Tested-by: Sumit Gupta <sumitg@nvidia.com>
Link: https://patch.msgid.link/20260916162805.1039247-18-christian.loehle@arm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/topology.c | 2 +-
drivers/acpi/riscv/cppc.c | 26 ++++++++++++++++++++------
2 files changed, 21 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c
index 806373aac3dbf..b8baba2811666 100644
--- a/arch/arm64/kernel/topology.c
+++ b/arch/arm64/kernel/topology.c
@@ -426,7 +426,7 @@ int counters_read_on_cpu(int cpu, smp_call_func_t func, void *val)
return -EPERM;
func(val);
} else {
- smp_call_function_single(cpu, func, val, 1);
+ return smp_call_function_single(cpu, func, val, 1);
}
return 0;
diff --git a/drivers/acpi/riscv/cppc.c b/drivers/acpi/riscv/cppc.c
index 42c1a90524707..4ea4ddedd91f1 100644
--- a/drivers/acpi/riscv/cppc.c
+++ b/drivers/acpi/riscv/cppc.c
@@ -97,6 +97,7 @@ bool cpc_ffh_supported(void)
int cpc_read_ffh(int cpu, struct cpc_reg *reg, u64 *val)
{
struct sbi_cppc_data data;
+ int ret;
if (WARN_ON_ONCE(irqs_disabled()))
return -EPERM;
@@ -107,19 +108,27 @@ int cpc_read_ffh(int cpu, struct cpc_reg *reg, u64 *val)
data.reg = FFH_CPPC_SBI_REG(reg->address);
- smp_call_function_single(cpu, sbi_cppc_read, &data, 1);
+ ret = smp_call_function_single(cpu, sbi_cppc_read, &data, 1);
+ if (ret)
+ return ret;
+ if (data.ret.error)
+ return sbi_err_map_linux_errno(data.ret.error);
*val = data.ret.value;
- return (data.ret.error) ? sbi_err_map_linux_errno(data.ret.error) : 0;
+ return 0;
} else if (FFH_CPPC_TYPE(reg->address) == FFH_CPPC_CSR) {
data.reg = FFH_CPPC_CSR_NUM(reg->address);
- smp_call_function_single(cpu, cppc_ffh_csr_read, &data, 1);
+ ret = smp_call_function_single(cpu, cppc_ffh_csr_read, &data, 1);
+ if (ret)
+ return ret;
+ if (data.ret.error)
+ return data.ret.error;
*val = data.ret.value;
- return data.ret.error;
+ return 0;
}
return -EINVAL;
@@ -128,6 +137,7 @@ int cpc_read_ffh(int cpu, struct cpc_reg *reg, u64 *val)
int cpc_write_ffh(int cpu, struct cpc_reg *reg, u64 val)
{
struct sbi_cppc_data data;
+ int ret;
if (WARN_ON_ONCE(irqs_disabled()))
return -EPERM;
@@ -139,14 +149,18 @@ int cpc_write_ffh(int cpu, struct cpc_reg *reg, u64 val)
data.reg = FFH_CPPC_SBI_REG(reg->address);
data.val = val;
- smp_call_function_single(cpu, sbi_cppc_write, &data, 1);
+ ret = smp_call_function_single(cpu, sbi_cppc_write, &data, 1);
+ if (ret)
+ return ret;
return (data.ret.error) ? sbi_err_map_linux_errno(data.ret.error) : 0;
} else if (FFH_CPPC_TYPE(reg->address) == FFH_CPPC_CSR) {
data.reg = FFH_CPPC_CSR_NUM(reg->address);
data.val = val;
- smp_call_function_single(cpu, cppc_ffh_csr_write, &data, 1);
+ ret = smp_call_function_single(cpu, cppc_ffh_csr_write, &data, 1);
+ if (ret)
+ return ret;
return data.ret.error;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0206/1257] cpufreq: CPPC: Create the FIE worker before enabling PCC callbacks
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0205/1257] ACPI: CPPC: Propagate errors from cross-CPU FFH calls Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0207/1257] ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect() Greg Kroah-Hartman
` (792 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Loehle, Sumit Gupta,
Rafael J. Wysocki, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Loehle <christian.loehle@arm.com>
[ Upstream commit 995e7d4680706e47154adb68f0b682485ea8d873 ]
cppc_freq_invariance_init() creates the PCC worker only if an online CPU
currently has PCC counters. A shared policy can also initialize an offline
PCC member. When that CPU comes online, its callback queues work through
the missing kworker_fie and dereferences NULL. A later hot-added PCC policy
can encounter the same missing worker.
Create the worker when policy initialization encounters PCC counters,
before initializing their work and publishing any callbacks. Serialize
creation and reuse the worker until driver teardown. This covers offline
policy members and later PCC policies without creating an unused deadline
worker on direct-counter-only systems.
If worker allocation or scheduling setup fails, leave FIE unregistered for
that policy. Keep the global FIE setting unchanged so direct-counter
policies remain independent of worker setup and existing policies still
drain their initialized work during teardown. Publish kworker_fie only
after successful setup, allowing a later policy initialization to retry.
Fixes: 997c021abc6e ("cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Christian Loehle <christian.loehle@arm.com>
Tested-by: Sumit Gupta <sumitg@nvidia.com>
Link: https://patch.msgid.link/20260916162805.1039247-21-christian.loehle@arm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/cppc_cpufreq.c | 39 ++++++++++++++++++++--------------
1 file changed, 23 insertions(+), 16 deletions(-)
diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
index 80893844353ca..5f20c4a7ba2f2 100644
--- a/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -18,6 +18,7 @@
#include <linux/cpufreq.h>
#include <linux/irq_work.h>
#include <linux/kthread.h>
+#include <linux/mutex.h>
#include <linux/time.h>
#include <linux/vmalloc.h>
#include <uapi/linux/sched/types.h>
@@ -49,10 +50,12 @@ struct cppc_freq_invariance {
static DEFINE_PER_CPU(struct cppc_freq_invariance, cppc_freq_inv);
static struct kthread_worker *kworker_fie;
+static DEFINE_MUTEX(cppc_fie_lock);
static int cppc_perf_from_fbctrs(u64 reference_perf,
struct cppc_perf_fb_ctrs *fb_ctrs_t0,
struct cppc_perf_fb_ctrs *fb_ctrs_t1);
+static int cppc_fie_kworker_init(void);
/**
* __cppc_scale_freq_tick - CPPC arch_freq_scale updater for frequency invariance
@@ -161,6 +164,9 @@ static void cppc_cpufreq_cpu_fie_init(struct cpufreq_policy *policy)
cppc_fi->cpu = cpu;
cppc_fi->cpu_data = policy->driver_data;
if (cppc_perf_ctrs_in_pcc_cpu(cpu)) {
+ if (cppc_fie_kworker_init())
+ return;
+
kthread_init_work(&cppc_fi->work, cppc_scale_freq_workfn);
init_irq_work(&cppc_fi->irq_work, cppc_irq_work);
sftd = &cppc_sftd_pcc;
@@ -211,8 +217,9 @@ static void cppc_cpufreq_cpu_fie_exit(struct cpufreq_policy *policy)
}
}
-static void cppc_fie_kworker_init(void)
+static int cppc_fie_kworker_init(void)
{
+ struct kthread_worker *worker;
struct sched_attr attr = {
.size = sizeof(struct sched_attr),
.sched_policy = SCHED_DEADLINE,
@@ -228,23 +235,28 @@ static void cppc_fie_kworker_init(void)
};
int ret;
- kworker_fie = kthread_run_worker(0, "cppc_fie");
- if (IS_ERR(kworker_fie)) {
+ guard(mutex)(&cppc_fie_lock);
+
+ if (kworker_fie)
+ return 0;
+
+ worker = kthread_run_worker(0, "cppc_fie");
+ if (IS_ERR(worker)) {
pr_warn("%s: failed to create kworker_fie: %ld\n", __func__,
- PTR_ERR(kworker_fie));
- fie_disabled = FIE_DISABLED;
- kworker_fie = NULL;
- return;
+ PTR_ERR(worker));
+ return PTR_ERR(worker);
}
- ret = sched_setattr_nocheck(kworker_fie->task, &attr);
+ ret = sched_setattr_nocheck(worker->task, &attr);
if (ret) {
pr_warn("%s: failed to set SCHED_DEADLINE: %d\n", __func__,
ret);
- kthread_destroy_worker(kworker_fie);
- fie_disabled = FIE_DISABLED;
- kworker_fie = NULL;
+ kthread_destroy_worker(worker);
+ return ret;
}
+
+ kworker_fie = worker;
+ return 0;
}
static void __init cppc_freq_invariance_init(void)
@@ -259,11 +271,6 @@ static void __init cppc_freq_invariance_init(void)
fie_disabled = FIE_ENABLED;
}
}
-
- if (fie_disabled || !perf_ctrs_in_pcc)
- return;
-
- cppc_fie_kworker_init();
}
static void cppc_freq_invariance_exit(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0207/1257] ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0206/1257] cpufreq: CPPC: Create the FIE worker before enabling PCC callbacks Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0208/1257] fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs Greg Kroah-Hartman
` (791 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Charles Keepax,
Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit b2c0e5bf750e33b0e1dcdfbb2df8103a06c7caab ]
wm8994_mic_detect() resumes the component before configuring the MICBIAS
pins, but the default case of the micbias switch returns -EINVAL right
after taking that reference, skipping the pm_runtime_put() on the
success path. This leaks a runtime PM reference on every call with an
invalid micbias.
Release the reference before returning -EINVAL.
Fixes: f5a2cda4f1db ("ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260917165130.2163278-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wm8994.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 0d1b4b1fcecda..58cfdd60d8ab1 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -3532,6 +3532,7 @@ int wm8994_mic_detect(struct snd_soc_component *component, struct snd_soc_jack *
break;
default:
dev_warn(component->dev, "Invalid MICBIAS %d\n", micbias);
+ pm_runtime_put(component->dev);
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0208/1257] fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0207/1257] ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect() Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0209/1257] regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable() Greg Kroah-Hartman
` (790 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Xu Yilun, Xu Yilun,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit ac02245b0ca28388ba16273f2fa683c90da2e5dc ]
The fpga_mgr_lock() comment lists of_fpga_mgr_put() as a source of a
manager pointer. The helper which obtains that pointer is
of_fpga_mgr_get(). Correct the reference.
Fixes: ebf877a51ad7 ("fpga: mgr: separate getting/locking FPGA manager")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260912100937.86316-1-kmehltretter@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/fpga/fpga-mgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/fpga/fpga-mgr.c b/drivers/fpga/fpga-mgr.c
index 2672070ced026..5a0b7780b3358 100644
--- a/drivers/fpga/fpga-mgr.c
+++ b/drivers/fpga/fpga-mgr.c
@@ -744,7 +744,7 @@ EXPORT_SYMBOL_GPL(fpga_mgr_put);
* @mgr: fpga manager
*
* Given a pointer to FPGA Manager (from fpga_mgr_get() or
- * of_fpga_mgr_put()) attempt to get the mutex. The user should call
+ * of_fpga_mgr_get()) attempt to get the mutex. The user should call
* fpga_mgr_lock() and verify that it returns 0 before attempting to
* program the FPGA. Likewise, the user should call fpga_mgr_unlock
* when done programming the FPGA.
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0209/1257] regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0208/1257] fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0210/1257] iio: dac: mcp47feb02: initialize dac_data field in channel data struct at probe Greg Kroah-Hartman
` (789 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, ChiYuan Huang,
Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit e0d673e5a5c4084f0da90c06ed3b0bc45e47d679 ]
In rt6190_out_enable(), pm_runtime_get_sync() is called at the start of
the function. However, if any subsequent regmap or regulator operation
fails, the function returns directly without dropping the runtime PM
reference, causing a runtime PM reference leak.
Add an error handling path with pm_runtime_put() to keep the reference
count balanced on failure.
Fixes: e6999e7cca7e ("regulator: rt6190: Add support for Richtek RT6190 regulator")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: ChiYuan Huang <cy_huang@richtek.com>
Link: https://patch.msgid.link/20260916072541.1968033-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/rt6190-regulator.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/regulator/rt6190-regulator.c b/drivers/regulator/rt6190-regulator.c
index f2cd9540038d9..21ced348a2cfe 100644
--- a/drivers/regulator/rt6190-regulator.c
+++ b/drivers/regulator/rt6190-regulator.c
@@ -108,19 +108,27 @@ static int rt6190_out_enable(struct regulator_dev *rdev)
ret = regmap_raw_read(regmap, RT6190_REG_OUTV, out_cfg,
sizeof(out_cfg));
if (ret)
- return ret;
+ goto err_pm_put;
ret = regulator_enable_regmap(rdev);
if (ret)
- return ret;
+ goto err_pm_put;
ret = regmap_raw_write(regmap, RT6190_REG_OUTV, out_cfg,
sizeof(out_cfg));
if (ret)
- return ret;
+ goto err_pm_put;
+
+ ret = regmap_update_bits(regmap, RT6190_REG_SET5, RT6190_ENGCP_MASK,
+ RT6190_ENGCP_MASK);
+ if (ret)
+ goto err_pm_put;
+
+ return 0;
- return regmap_update_bits(regmap, RT6190_REG_SET5, RT6190_ENGCP_MASK,
- RT6190_ENGCP_MASK);
+err_pm_put:
+ pm_runtime_put(data->dev);
+ return ret;
}
static int rt6190_out_disable(struct regulator_dev *rdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0210/1257] iio: dac: mcp47feb02: initialize dac_data field in channel data struct at probe
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0209/1257] regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable() Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0211/1257] iio: dac: mcp47feb02: Fix gain field initialization for active channels Greg Kroah-Hartman
` (788 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ariana Lazar,
Andy Shevchenko, Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ariana Lazar <ariana.lazar@microchip.com>
[ Upstream commit fc8d14d75345cb6f43d836be6b32cbc714c19b6b ]
Prevent operations which use cache from overwriting default hardware values
with zeros by reading active DAC registers during probe to correctly
initialize the channel struct DAC values.
Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260804134616.1D8A21F00A3E@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Ariana Lazar <ariana.lazar@microchip.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/dac/mcp47feb02.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/dac/mcp47feb02.c b/drivers/iio/dac/mcp47feb02.c
index 8640b0ef4433d..6a3875e1d6a2c 100644
--- a/drivers/iio/dac/mcp47feb02.c
+++ b/drivers/iio/dac/mcp47feb02.c
@@ -1019,7 +1019,12 @@ static int mcp47feb02_init_ctrl_regs(struct mcp47feb02_data *data)
gain_ch = gain_ch & MCP47FEB02_GAIN_BITS_MASK;
for_each_set_bit(i, &data->active_channels_mask, data->phys_channels) {
struct device *dev = regmap_get_device(data->regmap);
- unsigned int pd_tmp;
+ unsigned int pd_tmp, dac_val;
+
+ ret = regmap_read(data->regmap, REG_ADDR(i), &dac_val);
+ if (ret)
+ return ret;
+ data->chdata[i].dac_data = dac_val;
data->chdata[i].ref_mode = (vref_ch >> (2 * i)) & MCP47FEB02_DAC_CTRL_MASK;
data->chdata[i].use_2x_gain = (gain_ch >> i) & MCP47FEB02_GAIN_BIT_MASK;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0211/1257] iio: dac: mcp47feb02: Fix gain field initialization for active channels
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0210/1257] iio: dac: mcp47feb02: initialize dac_data field in channel data struct at probe Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0212/1257] iio: dac: mcp47feb02: Return len when disabling EEPROM store Greg Kroah-Hartman
` (787 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ariana Lazar,
Andy Shevchenko, Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ariana Lazar <ariana.lazar@microchip.com>
[ Upstream commit 29491c675c2babb9a4a8cf9b33b38347e4565dee ]
As per MCP47FXBX48 Datasheet, in the format of the Gain Control and System
Status Register each DAC channel has one bit to control its gain,
starting at bit 8, while bits 0-7 contain status or unimplemented bits.
The previous formula didn't initialize correctly all channels, being
replaced by using field_get() with the already defined macro used in write
operations where needed in the rest of the driver implementation.
DAC_GAIN_MASK(i) extracts the gain control bit for each active channel
correctly in one step.
Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260804134616.1D8A21F00A3E@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Ariana Lazar <ariana.lazar@microchip.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/dac/mcp47feb02.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/iio/dac/mcp47feb02.c b/drivers/iio/dac/mcp47feb02.c
index 6a3875e1d6a2c..1b1a4972f7719 100644
--- a/drivers/iio/dac/mcp47feb02.c
+++ b/drivers/iio/dac/mcp47feb02.c
@@ -36,7 +36,6 @@
#define MCP47FEB02_DAC_CTRL_MASK GENMASK(1, 0)
#define MCP47FEB02_GAIN_CTRL_STATUS_REG_ADDR 0x50
-#define MCP47FEB02_GAIN_BIT_MASK BIT(0)
#define MCP47FEB02_GAIN_BIT_STATUS_EEWA_MASK BIT(6)
#define MCP47FEB02_GAIN_BITS_MASK GENMASK(15, 8)
@@ -1016,7 +1015,6 @@ static int mcp47feb02_init_ctrl_regs(struct mcp47feb02_data *data)
if (ret)
return ret;
- gain_ch = gain_ch & MCP47FEB02_GAIN_BITS_MASK;
for_each_set_bit(i, &data->active_channels_mask, data->phys_channels) {
struct device *dev = regmap_get_device(data->regmap);
unsigned int pd_tmp, dac_val;
@@ -1027,7 +1025,7 @@ static int mcp47feb02_init_ctrl_regs(struct mcp47feb02_data *data)
data->chdata[i].dac_data = dac_val;
data->chdata[i].ref_mode = (vref_ch >> (2 * i)) & MCP47FEB02_DAC_CTRL_MASK;
- data->chdata[i].use_2x_gain = (gain_ch >> i) & MCP47FEB02_GAIN_BIT_MASK;
+ data->chdata[i].use_2x_gain = field_get(DAC_GAIN_MASK(i), gain_ch);
/*
* Inform the user that the current voltage reference read from the volatile
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0212/1257] iio: dac: mcp47feb02: Return len when disabling EEPROM store
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0211/1257] iio: dac: mcp47feb02: Fix gain field initialization for active channels Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0213/1257] iio: dac: mcp47feb02: Increase EEPROM Programming Write Cycle Time Greg Kroah-Hartman
` (786 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ariana Lazar,
Andy Shevchenko, Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ariana Lazar <ariana.lazar@microchip.com>
[ Upstream commit 6d96f5a03ebdcc664f5d2fe0a170ca0ea513e3a5 ]
When state is false, return the number of bytes (len) the buffer has
instead of 0 to properly signal that the input buffer was fully consumed,
preventing unnecessary write retries.
Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260804134616.1D8A21F00A3E@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Ariana Lazar <ariana.lazar@microchip.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/dac/mcp47feb02.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/dac/mcp47feb02.c b/drivers/iio/dac/mcp47feb02.c
index 1b1a4972f7719..fdc266ba1536f 100644
--- a/drivers/iio/dac/mcp47feb02.c
+++ b/drivers/iio/dac/mcp47feb02.c
@@ -467,7 +467,7 @@ static ssize_t store_eeprom_store(struct device *dev, struct device_attribute *a
return ret;
if (!state)
- return 0;
+ return len;
/*
* Verify DAC Wiper and DAC Configuration are unlocked. If both are disabled,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0213/1257] iio: dac: mcp47feb02: Increase EEPROM Programming Write Cycle Time
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0212/1257] iio: dac: mcp47feb02: Return len when disabling EEPROM store Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0214/1257] iio: accel: adis16201: fix channel order for buffer mode Greg Kroah-Hartman
` (785 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ariana Lazar,
Andy Shevchenko, Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ariana Lazar <ariana.lazar@microchip.com>
[ Upstream commit 77f5e4bd63db9be9978a6d2ac821a249a3d5fd82 ]
Increase the EEPROM write polling timeout to prevent -ETIMEDOUT errors and
incomplete nonvolatile write cycle, according to the time specified in the
datasheets (11-16 ms).
Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260819125300.6B9211F000E9@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Ariana Lazar <ariana.lazar@microchip.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/dac/mcp47feb02.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/dac/mcp47feb02.c b/drivers/iio/dac/mcp47feb02.c
index fdc266ba1536f..7758e37080958 100644
--- a/drivers/iio/dac/mcp47feb02.c
+++ b/drivers/iio/dac/mcp47feb02.c
@@ -447,7 +447,7 @@ static int mcp47feb02_write_to_eeprom(struct mcp47feb02_data *data, unsigned int
ret = regmap_read_poll_timeout(data->regmap, MCP47FEB02_GAIN_CTRL_STATUS_REG_ADDR,
eewa_val,
!(eewa_val & MCP47FEB02_GAIN_BIT_STATUS_EEWA_MASK),
- USEC_PER_MSEC, USEC_PER_MSEC * 5);
+ 1 * USEC_PER_MSEC, 150 * USEC_PER_MSEC);
if (ret)
return ret;
@@ -507,7 +507,7 @@ static ssize_t store_eeprom_store(struct device *dev, struct device_attribute *a
ret = regmap_read_poll_timeout(data->regmap, MCP47FEB02_GAIN_CTRL_STATUS_REG_ADDR, eewa_val,
!(eewa_val & MCP47FEB02_GAIN_BIT_STATUS_EEWA_MASK),
- USEC_PER_MSEC, USEC_PER_MSEC * 5);
+ 1 * USEC_PER_MSEC, 150 * USEC_PER_MSEC);
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0214/1257] iio: accel: adis16201: fix channel order for buffer mode
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0213/1257] iio: dac: mcp47feb02: Increase EEPROM Programming Write Cycle Time Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0215/1257] iio: imu: inv_icm42600: force accel odr change when switching power mode Greg Kroah-Hartman
` (784 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shehryar Ahmad, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shehryar Ahmad <shehryar.amd@gmail.com>
[ Upstream commit a4b9f1137b76faab6891ce0bd3f5c02dda7c392d ]
Reshuffle adis16201_channels to ascending scan_index order to avoid data
corruption during IIO core demultiplexing since the ADIS driver builds
the buffer in channel array order, while the IIO core demultiplexes it
in scan_index order.
This changes the raw buffer byte layout for existing adis16201 users
reading buffered data directly.
Fixes: 591298e54cea ("Staging: iio: accel: adis16201: Move adis16201 driver out of staging")
Cc: stable@vger.kernel.org
Signed-off-by: Shehryar Ahmad <shehryar.amd@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/adis16201.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/iio/accel/adis16201.c b/drivers/iio/accel/adis16201.c
index ba0f97944c6d5..834714fb94a50 100644
--- a/drivers/iio/accel/adis16201.c
+++ b/drivers/iio/accel/adis16201.c
@@ -202,19 +202,19 @@ static int adis16201_write_raw(struct iio_dev *indio_dev,
}
static const struct iio_chan_spec adis16201_channels[] = {
- ADIS_SUPPLY_CHAN(ADIS16201_SUPPLY_OUT_REG, ADIS16201_SCAN_SUPPLY, 0,
- 12),
- ADIS_TEMP_CHAN(ADIS16201_TEMP_OUT_REG, ADIS16201_SCAN_TEMP, 0, 12),
ADIS_ACCEL_CHAN(X, ADIS16201_XACCL_OUT_REG, ADIS16201_SCAN_ACC_X,
BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14),
ADIS_ACCEL_CHAN(Y, ADIS16201_YACCL_OUT_REG, ADIS16201_SCAN_ACC_Y,
BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14),
- ADIS_AUX_ADC_CHAN(ADIS16201_AUX_ADC_REG, ADIS16201_SCAN_AUX_ADC, 0, 12),
ADIS_INCLI_CHAN(X, ADIS16201_XINCL_OUT_REG, ADIS16201_SCAN_INCLI_X,
BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 12),
ADIS_INCLI_CHAN(Y, ADIS16201_YINCL_OUT_REG, ADIS16201_SCAN_INCLI_Y,
BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 12),
- IIO_CHAN_SOFT_TIMESTAMP(7)
+ ADIS_SUPPLY_CHAN(ADIS16201_SUPPLY_OUT_REG, ADIS16201_SCAN_SUPPLY, 0,
+ 12),
+ ADIS_AUX_ADC_CHAN(ADIS16201_AUX_ADC_REG, ADIS16201_SCAN_AUX_ADC, 0, 12),
+ ADIS_TEMP_CHAN(ADIS16201_TEMP_OUT_REG, ADIS16201_SCAN_TEMP, 0, 12),
+ IIO_CHAN_SOFT_TIMESTAMP(7),
};
static const struct iio_info adis16201_info = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0215/1257] iio: imu: inv_icm42600: force accel odr change when switching power mode
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0214/1257] iio: accel: adis16201: fix channel order for buffer mode Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0216/1257] iio: light: apds9306: fix default sampling frequency definition Greg Kroah-Hartman
` (783 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit d52047d84963e5cf7c8ad502e0adf003fb0669de ]
When accel must switch from low-power mode to low-noise due to a change in
ODR, there is an hardware bug that sometimes prevent the ODR change flag
to be set in the FIFO header. If this happens, the driver is stuck waiting
for the ODR change flag that is never happening.
Fix this by using accel_force_odr flag set when switching mode for forcing
apply of ODR change. Do the apply after parsing FIFO data to let the flag
do the job if it is here.
Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 +
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 9 ++++++++-
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 2 ++
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 9 +++++++++
4 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600.h b/drivers/iio/imu/inv_icm42600/inv_icm42600.h
index b55d993f02643..15fc8395da527 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600.h
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600.h
@@ -179,6 +179,7 @@ struct inv_icm42600_state {
struct {
s64 gyro;
s64 accel;
+ bool accel_force_odr;
} timestamp;
struct inv_icm42600_apex apex;
struct inv_icm42600_fifo fifo;
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
index b2ad1bd202b4f..aea9bbc188da2 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -1228,9 +1228,11 @@ int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev)
return size;
/* update odr */
- if (odr & INV_ICM42600_SENSOR_ACCEL)
+ if (odr & INV_ICM42600_SENSOR_ACCEL) {
inv_sensors_timestamp_apply_odr(ts, st->fifo.period,
st->fifo.nb.total, no);
+ st->timestamp.accel_force_odr = false;
+ }
/* skip packet if no accel data or data is invalid */
if (accel == NULL || !inv_icm42600_fifo_is_data_valid(accel))
@@ -1243,5 +1245,10 @@ int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev)
iio_push_to_buffers_with_timestamp(indio_dev, &buffer, ts_val);
}
+ if (st->timestamp.accel_force_odr) {
+ inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
+ st->timestamp.accel_force_odr = false;
+ }
+
return 0;
}
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
index 998d312f7bde3..c871981d2dadd 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
@@ -399,6 +399,8 @@ static int inv_icm42600_buffer_postdisable(struct iio_dev *indio_dev)
mutex_lock(&st->lock);
inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
+ if (sensor == INV_ICM42600_SENSOR_ACCEL)
+ st->timestamp.accel_force_odr = false;
ret = inv_icm42600_buffer_set_fifo_en(st, st->fifo.en & ~sensor);
if (ret)
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
index dc97d8a274e36..e28f012e62b1a 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
@@ -324,6 +324,15 @@ int inv_icm42600_set_accel_conf(struct inv_icm42600_state *st,
break;
}
+ /*
+ * If we change mode from low-power to low-noise because of odr,
+ * we need to force odr change.
+ */
+ if (oldconf->mode == INV_ICM42600_SENSOR_MODE_LOW_POWER &&
+ conf->mode == INV_ICM42600_SENSOR_MODE_LOW_NOISE &&
+ conf->odr != oldconf->odr)
+ st->timestamp.accel_force_odr = true;
+
/* set ACCEL_CONFIG0 register (accel fullscale & odr) */
if (conf->fs != oldconf->fs || conf->odr != oldconf->odr) {
val = INV_ICM42600_ACCEL_CONFIG0_FS(conf->fs) |
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0216/1257] iio: light: apds9306: fix default sampling frequency definition
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0215/1257] iio: imu: inv_icm42600: force accel odr change when switching power mode Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0217/1257] ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0 Greg Kroah-Hartman
` (782 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Tsz Shan Chan,
Subhajit Ghosh, Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tsz Shan Chan <tsz.chan.dev@gmail.com>
[ Upstream commit a1c005f6336aa41f23552e66ea1b98b9ee493a86 ]
APDS9306_SAMP_FREQ_10HZ is defined as 0.
According to the datasheet (Broadcom AV02-4755EN, page 11,
ALS_MEAS_RATE), bits[2:0] set the measurement rate:
- 000: 25ms (40Hz)
- 001: 20ms (20Hz)
- 010: 100ms (10Hz)
Change APDS9306_SAMP_FREQ_10HZ from 0 to 2 to write the correct value
for 10Hz.
Datasheet: https://docs.broadcom.com/doc/AV02-4755EN
Fixes: 620d1e6c7a3f ("iio: light: Add support for APDS9306 Light Sensor")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Tsz Shan Chan <tchan@jacques.com.au>
Acked-by: Subhajit Ghosh <subhajit.ghosh@tweaklogic.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/apds9306.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/light/apds9306.c b/drivers/iio/light/apds9306.c
index f681b02e49225..7dd41136734f5 100644
--- a/drivers/iio/light/apds9306.c
+++ b/drivers/iio/light/apds9306.c
@@ -61,7 +61,7 @@
#define APDS9306_NUM_REPEAT_RATES 7
#define APDS9306_INT_SRC_CLEAR 0
#define APDS9306_INT_SRC_ALS 1
-#define APDS9306_SAMP_FREQ_10HZ 0
+#define APDS9306_SAMP_FREQ_10HZ 2
/**
* struct part_id_gts_multiplier - Part no. and corresponding gts multiplier
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0217/1257] ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0216/1257] iio: light: apds9306: fix default sampling frequency definition Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0218/1257] PCI: pciehp: Make pciehp_poll_mode parameter read-only Greg Kroah-Hartman
` (781 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Peng, Damien Le Moal,
Niklas Cassel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Peng <benquike@gmail.com>
[ Upstream commit 3bab8c7e0c6ba187a47163a1f71477213a278c48 ]
When an ATA_12, ATA_16, or ATA_32 pass-through command with a
multi-sector PIO command opcode (ATA_CMD_READ_MULTI,
ATA_CMD_WRITE_MULTI, ATA_CMD_READ_MULTI_EXT, ATA_CMD_WRITE_MULTI_EXT, or
ATA_CMD_WRITE_MULTI_FUA_EXT) is submitted via SG_IO on a device where
multiple-sector mode is not configured (dev->multi_count == 0),
ata_scsi_pass_thru() currently logs a warning and still dispatches the
taskfile. When the DRQ interrupt fires, ata_pio_sectors() triggers
WARN_ON_ONCE(qc->dev->multi_count == 0) and computes
nsect = min((qc->nbytes - qc->curbytes) / qc->sect_size, 0) = 0, failing
to transfer any sectors:
ata1.00: invalid multi_count 1 ignored
WARNING: drivers/ata/libata-sff.c:666 at ata_pio_sectors+0x27d/0x300
Call Trace:
<IRQ>
ata_sff_hsm_move+0x211/0x22e0
__ata_sff_port_intr+0x1c8/0x520
ata_bmdma_port_intr+0xa1/0x5b0
ata_bmdma_interrupt+0x1f5/0x550
Per ACS-3 section 7.12.7.21, if IDENTIFY DEVICE word 59 bit 8 is cleared
to zero (multi_count == 0) and a READ MULTIPLE or WRITE MULTIPLE command
is received without a preceding successful SET MULTIPLE MODE command, the
device returns command aborted (ABRT). Per the SAT specification, an ABRT
error translates to the ABORTED COMMAND sense key with NO ADDITIONAL SENSE
INFORMATION (0x00, 0x00).
Fail multi-sector taskfile commands in ata_scsi_pass_thru() with
ata_scsi_set_sense(dev, scmd, ABORTED_COMMAND, 0, 0) when
dev->multi_count == 0.
Fixes: 1dce589c38c3 ("libata passthru: support PIO multi commands")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260921032556.1160734-1-benquike@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-scsi.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index fb5517d51095d..b86ac50f16b9e 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3517,6 +3517,11 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
if (is_multi_taskfile(tf)) {
unsigned int multi_count = 1 << (cdb[1] >> 5);
+ if (!dev->multi_count) {
+ ata_scsi_set_sense(dev, scmd, ABORTED_COMMAND, 0, 0);
+ return 1;
+ }
+
/* compare the passed through multi_count
* with the cached multi_count of libata
*/
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0218/1257] PCI: pciehp: Make pciehp_poll_mode parameter read-only
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0217/1257] ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0 Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0219/1257] i3c: master: Fix out-of-bounds read in DMA bounce buffer setup Greg Kroah-Hartman
` (780 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Bjorn Helgaas,
Lukas Wunner, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 5ab17178fca6026d329cb6ced33c30f3b7d3e50a ]
pciehp_request_irq() and pciehp_free_irq() select different resources based
on the global pciehp_poll_mode parameter. The parameter is currently
writable through sysfs, so changing it while a controller is active can
make teardown try to stop a nonexistent polling thread or call free_irq()
for an IRQ that was not requested.
Keep the parameter available for boot and module configuration, but prevent
runtime changes to the registration mode.
Reproducer:
Boot an x86_64 guest in QEMU with a native PCIe hotplug root port and an
e1000 device, using these device options:
-device pcie-root-port,id=rp1,chassis=1,slot=1 -device e1000,bus=rp1
Pass "pcie_ports=native pciehp.pciehp_poll_mode=1" to the guest kernel. As
root in the guest, replace the device name below with a bound pciehp
service device and run:
# dev=0000:00:1c.0:pcie004
# driver=/sys/bus/pci_express/drivers/pciehp
# echo 0 > /sys/module/pciehp/parameters/poll_mode
# echo "$dev" > "$driver/unbind"
# dmesg | grep 'Trying to free already-free IRQ'
The unfixed kernel accepts the runtime mode change and reports the warning
when the service device is removed. The fixed kernel rejects the write and
removes the device without the warning. The mode change is a deliberate
privileged test action and is not expected during ordinary operation.
Assisted-by: LLM Codex
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Link: https://patch.msgid.link/20260921142608.270312-1-runyu.xiao@seu.edu.cn
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/hotplug/pciehp_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index 2cafd3b26f344..5ce32dc7e178f 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -38,7 +38,7 @@ int pciehp_poll_time;
* not really modular, but the easiest way to keep compat with existing
* bootargs behaviour is to continue using module_param here.
*/
-module_param(pciehp_poll_mode, bool, 0644);
+module_param(pciehp_poll_mode, bool, 0444);
module_param(pciehp_poll_time, int, 0644);
MODULE_PARM_DESC(pciehp_poll_mode, "Using polling mechanism for hot-plug events or not");
MODULE_PARM_DESC(pciehp_poll_time, "Polling mechanism frequency, in seconds");
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0219/1257] i3c: master: Fix out-of-bounds read in DMA bounce buffer setup
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0218/1257] PCI: pciehp: Make pciehp_poll_mode parameter read-only Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0220/1257] i3c: mipi-i3c-hci: Bounce short reads irrespective of the IOMMU Greg Kroah-Hartman
` (779 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Frank Li,
Alexandre Belloni, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 35b028b25451e17d63b2cd36a11a86c5e18df1b9 ]
When a bounce buffer is required for DMA_TO_DEVICE transfers,
i3c_master_dma_map_single() rounds the DMA mapping length up to a
cache-line boundary:
map_len = ALIGN(len, cache_line_size());
It then allocates the bounce buffer with:
kmemdup(buf, map_len, GFP_KERNEL);
kmemdup() copies the full allocation size, causing it to read map_len
bytes from buf even though only len bytes are valid. This results in an
out-of-bounds read of up to cache_line_size() - 1 bytes past the end of
the caller's buffer.
Fix the issue by allocating the bounce buffer with kzalloc() and copying
only len bytes from the original buffer. The remaining bytes up to
map_len stay zero-filled, avoiding both the out-of-bounds read and
exposure of unrelated memory contents to the DMA engine.
Fixes: f8d9e56aeb87 ("i3c: master: Add helpers for DMA mapping and bounce buffer handling")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260920151248.46936-2-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index afcd7a21a3e66..f9a6c8560fabf 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -2216,12 +2216,11 @@ struct i3c_dma *i3c_master_dma_map_single(struct device *dev, void *buf,
if (force_bounce) {
dma_xfer->map_len = ALIGN(len, cache_line_size());
- if (dir == DMA_FROM_DEVICE)
- bounce = kzalloc(dma_xfer->map_len, GFP_KERNEL);
- else
- bounce = kmemdup(buf, dma_xfer->map_len, GFP_KERNEL);
+ bounce = kzalloc(dma_xfer->map_len, GFP_KERNEL);
if (!bounce)
return NULL;
+ if (dir != DMA_FROM_DEVICE)
+ memcpy(bounce, buf, len);
dma_buf = bounce;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0220/1257] i3c: mipi-i3c-hci: Bounce short reads irrespective of the IOMMU
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0219/1257] i3c: master: Fix out-of-bounds read in DMA bounce buffer setup Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0221/1257] i3c: mipi-i3c-hci-pci: Set drvdata before creating LTR sysfs attribute Greg Kroah-Hartman
` (778 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Frank Li,
Alexandre Belloni, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit b1a25e8e143ef880450e6399fb0733b66a1c29f0 ]
The controller writes whole DWORDs, so a read whose length is not a
multiple of 4 overwrites up to 3 bytes past the end of the destination
buffer. That is a property of the controller, not of the IOMMU, but the
bounce buffer that works around it was used only when the device was
IOMMU mapped. Everywhere else the buffer is left unprotected.
Drop the device_iommu_mapped() condition.
The overrun is easily seen with CONFIG_SLUB_DEBUG=y and kernel command
line options intel_iommu=off slub_debug=FZPU, which reports it as a
kmalloc redzone overwrite, like:
[kmalloc Redzone overwritten] 0xffff8a354561570e-0xffff8a354561570f @offset=1806. First byte 0x15 instead of 0xcc
=============================================================================
BUG kmalloc-8 (Not tainted): Object corrupt
Allocated in i3c_master_retrieve_dev_info+0xc1/0x760 age=40 cpu=6 pid=1
...
Freed in i3c_master_enec_disec_locked+0xeb/0x140 age=40 cpu=6 pid=1
...
WARNING: mm/slub.c:1233 at object_err+0x1c1/0x1cf, CPU#6: swapper/0/1
...
Fixes: 9e23897bca62 ("i3c: mipi-i3c-hci: Use physical device pointer with DMA API")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260920151248.46936-3-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
index 7c2b204741304..5b195978f3762 100644
--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
@@ -428,7 +428,7 @@ static void hci_dma_unmap_xfer(struct i3c_hci *hci,
static struct i3c_dma *hci_dma_map_xfer(struct device *dev, struct hci_xfer *xfer)
{
enum dma_data_direction dir = xfer->rnw ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
- bool need_bounce = device_iommu_mapped(dev) && xfer->rnw && (xfer->data_len & 3);
+ bool need_bounce = xfer->rnw && (xfer->data_len & 3);
return i3c_master_dma_map_single(dev, xfer->data, xfer->data_len, need_bounce, dir);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0221/1257] i3c: mipi-i3c-hci-pci: Set drvdata before creating LTR sysfs attribute
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0220/1257] i3c: mipi-i3c-hci: Bounce short reads irrespective of the IOMMU Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0222/1257] signalfd: dont dequeue the forced fatal signals Greg Kroah-Hartman
` (777 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Frank Li,
Alexandre Belloni, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 2bc2b1b89f65b5b75ffae0cf3d67d2415611004c ]
intel_i3c_init() creates the pm_qos_latency_tolerance_us sysfs attribute
before probe calls pci_set_drvdata(). A userspace write to the attribute
can therefore invoke intel_ltr_set(), which uses pci_get_drvdata(),
before drvdata has been initialized.
Move pci_set_drvdata() before hci->info->init() so drvdata is available
before the sysfs attribute becomes accessible.
Fixes: 884a33131f2a ("i3c: mipi-i3c-hci-pci: Add LTR support for Intel controllers")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260920151248.46936-4-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c b/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
index ab595661db1e8..af9595009b03a 100644
--- a/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
+++ b/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
@@ -445,6 +445,8 @@ static int mipi_i3c_hci_pci_probe(struct pci_dev *pci,
if (ret < 0)
return ret;
+ pci_set_drvdata(pci, hci);
+
hci->info = (const struct mipi_i3c_hci_pci_info *)id->driver_data;
ret = hci->info->init ? hci->info->init(hci) : 0;
@@ -455,8 +457,6 @@ static int mipi_i3c_hci_pci_probe(struct pci_dev *pci,
if (ret)
goto err_exit;
- pci_set_drvdata(pci, hci);
-
mipi_i3c_hci_pci_rpm_allow(&pci->dev);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0222/1257] signalfd: dont dequeue the forced fatal signals
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0221/1257] i3c: mipi-i3c-hci-pci: Set drvdata before creating LTR sysfs attribute Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0223/1257] seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted Greg Kroah-Hartman
` (776 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+0a4c46806941297fecb9,
Kusaram Devineni, Oleg Nesterov, Kees Cook, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
[ Upstream commit d72e0fb3b00c6a1146bcfd7186ad9f6f609ba236 ]
These signals should act like SIGKILL, in that userspace must never dequeue
them. But as Kusaram explains, io_uring-driven signalfd_read_iter() called
from get_signal() -> task_work_run() paths can do this before get_signal()
has a chance to dequeue such a signal and notice SA_IMMUTABLE.
Change signalfd_poll() and signalfd_dequeue() to add pending SA_IMMUTABLE
signals to ctx->sigmask.
TODO: we should probably change force_sig_info_to_task(HANDLER_EXIT) to
make fatal_signal_pending() true, or add a fatal_or_forced_signal_pending()
helper. Then signalfd_dequeue() could just return -EINTR in this case.
This also makes sense for get_signal(), which could prioritize a fatal
signal sent by (say) force_sig_seccomp(force_coredump => true), just like
it already prioritizes SIGKILL.
Cc: stable@kernel.org
Reported-by: syzbot+0a4c46806941297fecb9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0a4c46806941297fecb9
Tested-by: syzbot+0a4c46806941297fecb9@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/69d122fd.050a0220.2dbe29.001c.GAE@google.com/
Suggested-by: Kusaram Devineni <kusaram@devineni.in>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Link: https://patch.msgid.link/adO3HG8bvwRPcmte@redhat.com
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/signalfd.c | 28 ++++++++++++++++++++++------
1 file changed, 22 insertions(+), 6 deletions(-)
diff --git a/fs/signalfd.c b/fs/signalfd.c
index dff53745e3524..22bc0870a824d 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -48,17 +48,30 @@ static int signalfd_release(struct inode *inode, struct file *file)
return 0;
}
+static void refine_sigmask(struct signalfd_ctx *ctx, sigset_t *sigmask)
+{
+ struct k_sigaction *k = current->sighand->action;
+ int n;
+
+ *sigmask = ctx->sigmask;
+ for (n = 1; n <= _NSIG; ++n, ++k) {
+ if (k->sa.sa_flags & SA_IMMUTABLE)
+ sigaddset(sigmask, n);
+ }
+}
+
static __poll_t signalfd_poll(struct file *file, poll_table *wait)
{
struct signalfd_ctx *ctx = file->private_data;
__poll_t events = 0;
+ sigset_t sigmask;
poll_wait(file, ¤t->sighand->signalfd_wqh, wait);
spin_lock_irq(¤t->sighand->siglock);
- if (next_signal(¤t->pending, &ctx->sigmask) ||
- next_signal(¤t->signal->shared_pending,
- &ctx->sigmask))
+ refine_sigmask(ctx, &sigmask);
+ if (next_signal(¤t->pending, &sigmask) ||
+ next_signal(¤t->signal->shared_pending, &sigmask))
events |= EPOLLIN;
spin_unlock_irq(¤t->sighand->siglock);
@@ -155,11 +168,13 @@ static ssize_t signalfd_dequeue(struct signalfd_ctx *ctx, kernel_siginfo_t *info
int nonblock)
{
enum pid_type type;
- ssize_t ret;
DECLARE_WAITQUEUE(wait, current);
+ sigset_t sigmask;
+ ssize_t ret;
spin_lock_irq(¤t->sighand->siglock);
- ret = dequeue_signal(&ctx->sigmask, info, &type);
+ refine_sigmask(ctx, &sigmask);
+ ret = dequeue_signal(&sigmask, info, &type);
switch (ret) {
case 0:
if (!nonblock)
@@ -174,7 +189,7 @@ static ssize_t signalfd_dequeue(struct signalfd_ctx *ctx, kernel_siginfo_t *info
add_wait_queue(¤t->sighand->signalfd_wqh, &wait);
for (;;) {
set_current_state(TASK_INTERRUPTIBLE);
- ret = dequeue_signal(&ctx->sigmask, info, &type);
+ ret = dequeue_signal(&sigmask, info, &type);
if (ret != 0)
break;
if (signal_pending(current)) {
@@ -184,6 +199,7 @@ static ssize_t signalfd_dequeue(struct signalfd_ctx *ctx, kernel_siginfo_t *info
spin_unlock_irq(¤t->sighand->siglock);
schedule();
spin_lock_irq(¤t->sighand->siglock);
+ refine_sigmask(ctx, &sigmask);
}
spin_unlock_irq(¤t->sighand->siglock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0223/1257] seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0222/1257] signalfd: dont dequeue the forced fatal signals Greg Kroah-Hartman
@ 2026-11-07 13:41 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0224/1257] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error Greg Kroah-Hartman
` (775 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Hui Peng, Kees Cook,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Peng <benquike@gmail.com>
[ Upstream commit 832b9b176be06a20747a267db6bc0010a24b74f4 ]
In seccomp_notify_addfd(), when SECCOMP_ADDFD_FLAG_SEND is set in
addfd.flags, knotif->state is optimistically transitioned from
SECCOMP_NOTIFY_SENT to SECCOMP_NOTIFY_REPLIED before waking the tracee
and waiting on kaddfd.completion:
if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) {
knotif->state = SECCOMP_NOTIFY_REPLIED;
...
}
If wait_for_completion_interruptible(&kaddfd.completion) is interrupted
by a signal before the tracee dequeues the kaddfd request
(!list_empty(&kaddfd.list)), seccomp_notify_addfd() removes kaddfd from
knotif->addfd and returns -EINTR to the supervisor without having
installed the file descriptor.
However, knotif->state is left as SECCOMP_NOTIFY_REPLIED (with
knotif->error == 0 and knotif->val == 0). This causes two problems:
1. When the tracee runs in do_user_notif(), it checks
if (knotif.state != SECCOMP_NOTIFY_REPLIED) after calling
seccomp_handle_addfd(). Because knotif->state is already
SECCOMP_NOTIFY_REPLIED, the tracee exits the notification wait loop
prematurely and returns 0 from the trapped syscall without the file
descriptor ever having been installed.
2. If the supervisor retries SECCOMP_IOCTL_NOTIF_ADDFD or
SECCOMP_IOCTL_NOTIF_SEND before the tracee runs, it fails with
-EINPROGRESS because knotif->state is no longer SECCOMP_NOTIFY_SENT.
Fix this by restoring knotif->state back to SECCOMP_NOTIFY_SENT if
SECCOMP_ADDFD_FLAG_SEND was set and kaddfd was not consumed before the
interrupted wait. Also add a seccomp_bpf selftest
(user_notification_addfd_send_interrupted) covering this race.
Tested in QEMU against Linux 7.3.0-rc3 using the
user_notification_addfd_send_interrupted selftest added in this patch
(./seccomp_bpf -t user_notification_addfd_send_interrupted): on the
unfixed kernel the test fails because the retry ioctl(listener,
SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) returns -EINPROGRESS (-1) and the
tracee prematurely exits do_user_notif() with return value 0 instead of
FD 42, whereas with this patch applied the test passes.
Fixes: 0ae71c7720e3 ("seccomp: Support atomic "addfd + send reply"")
Cc: stable@vger.kernel.org
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
Link: https://patch.msgid.link/20260922023204.2504832-1-benquike@gmail.com
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/seccomp.c | 7 +-
tools/testing/selftests/seccomp/seccomp_bpf.c | 179 ++++++++++++++++++
2 files changed, 184 insertions(+), 2 deletions(-)
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 86cf4460d69ea..94c7ba80a8f74 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1808,10 +1808,13 @@ static long seccomp_notify_addfd(struct seccomp_filter *filter,
* We need to check again if the addfd request has been handled,
* and if not, we will remove it from the queue.
*/
- if (list_empty(&kaddfd.list))
+ if (list_empty(&kaddfd.list)) {
ret = kaddfd.ret;
- else
+ } else {
list_del(&kaddfd.list);
+ if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND)
+ knotif->state = SECCOMP_NOTIFY_SENT;
+ }
out_unlock:
mutex_unlock(&filter->notify_lock);
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 0622bc2acad40..891383a161d0b 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -4368,6 +4368,185 @@ TEST(user_notification_addfd_rlimit)
close(memfd);
}
+/* Just take a signal and do nothing else. */
+static void empty_handler(int signo)
+{
+}
+
+/*
+ * Verify that when SECCOMP_IOCTL_NOTIF_ADDFD with SECCOMP_ADDFD_FLAG_SEND is
+ * interrupted by a signal before the tracee dequeues the addfd request,
+ * knotif->state is restored from SECCOMP_NOTIFY_REPLIED back to
+ * SECCOMP_NOTIFY_SENT so that:
+ * 1. The woken tracee sees knotif->state == SECCOMP_NOTIFY_SENT in
+ * do_user_notif() and goes back to sleep instead of prematurely
+ * returning 0 from the trapped syscall without the FD installed.
+ * 2. The supervisor can retry SECCOMP_IOCTL_NOTIF_ADDFD (or
+ * SECCOMP_IOCTL_NOTIF_SEND) instead of failing with -EINPROGRESS.
+ *
+ * To deterministically hit the race window where the supervisor sleeps in
+ * wait_for_completion_interruptible(&kaddfd.completion) after waking the
+ * tracee (complete(&knotif->ready)) but before the tracee runs
+ * seccomp_handle_addfd(), pin all processes to a single CPU and enforce a
+ * strict 3-tier scheduling priority hierarchy on that CPU:
+ * - Supervisor: SCHED_FIFO priority 99 (highest)
+ * - Signal helper (sig_pid): SCHED_FIFO priority 50 (middle)
+ * - Tracee (pid): SCHED_IDLE (lowest)
+ */
+TEST(user_notification_addfd_send_interrupted)
+{
+ /*
+ * Save parent_pid before user_notif_syscall(__NR_getppid, ...) installs
+ * the seccomp filter on the calling process; children inherit that
+ * filter, so sig_pid must not call getppid().
+ */
+ pid_t tracee_pid, sig_pid, parent_pid = getpid();
+ long ret;
+ int status, listener, memfd, err;
+ struct seccomp_notif_addfd addfd = {};
+ struct seccomp_notif req = {};
+ struct sigaction sa = {};
+ struct sched_param sp_zero = { .sched_priority = 0 };
+ struct sched_param sp_fifo_high = { .sched_priority = 99 };
+ struct sched_param sp_fifo_mid = { .sched_priority = 50 };
+ struct timespec delay = { .tv_nsec = 15000000 };
+ cpu_set_t cpuset;
+ int cpu;
+
+ /* Pin the supervisor (and its future child processes) to one CPU. */
+ cpu = sched_getcpu();
+ if (cpu >= 0) {
+ CPU_ZERO(&cpuset);
+ CPU_SET(cpu, &cpuset);
+ sched_setaffinity(0, sizeof(cpuset), &cpuset);
+ }
+
+ sa.sa_handler = empty_handler;
+ ASSERT_EQ(sigaction(SIGUSR1, &sa, NULL), 0);
+
+ memfd = memfd_create("test", 0);
+ ASSERT_GE(memfd, 0);
+
+ ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+ ASSERT_EQ(0, ret) {
+ TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
+ }
+
+ /*
+ * Follow the convention of other user_notification_* tests in this
+ * file by trapping __NR_getppid: because the filter is installed on
+ * the supervisor before fork(), the trapped syscall must be a
+ * side-effect-free syscall that the supervisor itself never invokes.
+ * Even though getppid() does not normally return an FD,
+ * SECCOMP_ADDFD_FLAG_SEND replaces the trapped syscall's return value
+ * with the newly installed FD number (42).
+ */
+ listener = user_notif_syscall(__NR_getppid,
+ SECCOMP_FILTER_FLAG_NEW_LISTENER);
+ ASSERT_GE(listener, 0);
+
+ tracee_pid = fork();
+ ASSERT_GE(tracee_pid, 0);
+
+ if (tracee_pid == 0) {
+ /*
+ * Tracee: invoke __NR_getppid as a dummy trigger syscall to
+ * trap into do_user_notif(). Verify that the syscall returns
+ * the injected FD number (42) and that FD 42 is open.
+ */
+ ret = syscall(__NR_getppid);
+ exit(ret != 42 || fcntl(42, F_GETFD) < 0);
+ }
+
+ /* Wait for the tracee to trap in do_user_notif(). */
+ ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
+
+ /*
+ * Demote the tracee to SCHED_IDLE and promote the supervisor to
+ * SCHED_FIFO(99) on the same CPU.
+ */
+ ASSERT_EQ(sched_setscheduler(tracee_pid, SCHED_IDLE, &sp_zero), 0);
+ if (sched_setscheduler(0, SCHED_FIFO, &sp_fifo_high) != 0) {
+ kill(tracee_pid, SIGKILL);
+ waitpid(tracee_pid, NULL, 0);
+ SKIP(return, "SCHED_FIFO requires CAP_SYS_NICE");
+ }
+
+ addfd.srcfd = memfd;
+ addfd.newfd_flags = O_CLOEXEC;
+ addfd.newfd = 42;
+ addfd.id = req.id;
+ addfd.flags = SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND;
+
+ /*
+ * Fork a signal helper on the same CPU and set it to SCHED_FIFO(50).
+ * Because the supervisor is currently running at SCHED_FIFO(99) on
+ * this CPU, sig_pid is queued on the runqueue but cannot run until the
+ * supervisor blocks inside the kernel.
+ *
+ * When the supervisor invokes ioctl(SECCOMP_IOCTL_NOTIF_ADDFD) below:
+ * 1. seccomp_notify_addfd() sets knotif->state = SECCOMP_NOTIFY_REPLIED,
+ * wakes the tracee (SCHED_IDLE), and blocks in
+ * wait_for_completion_interruptible(&kaddfd.completion).
+ * 2. The CPU scheduler immediately runs sig_pid (SCHED_FIFO 50)
+ * ahead of the woken tracee (SCHED_IDLE).
+ * 3. sig_pid sends SIGUSR1 to parent_pid, waking the supervisor
+ * (SCHED_FIFO 99), which immediately preempts sig_pid, aborts the
+ * wait with -ERESTARTSYS (-EINTR), removes kaddfd from
+ * knotif->addfd, and restores knotif->state = SECCOMP_NOTIFY_SENT
+ * before the tracee has executed a single instruction.
+ */
+ sig_pid = fork();
+ if (sig_pid < 0) {
+ sched_setscheduler(0, SCHED_OTHER, &sp_zero);
+ kill(tracee_pid, SIGKILL);
+ waitpid(tracee_pid, NULL, 0);
+ }
+ ASSERT_GE(sig_pid, 0);
+ if (sig_pid == 0) {
+ if (sched_setscheduler(0, SCHED_FIFO, &sp_fifo_mid) != 0)
+ _exit(1);
+ kill(parent_pid, SIGUSR1);
+ _exit(0);
+ }
+
+ ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
+ err = errno;
+
+ /*
+ * Restore normal scheduling ASAP so the supervisor does not remain
+ * SCHED_FIFO on a single-CPU machine/VM/CI, then sleep briefly so the
+ * woken tracee runs in do_user_notif(). With knotif->state restored to
+ * SECCOMP_NOTIFY_SENT, the tracee must loop back to sleep waiting for
+ * the notification reply rather than returning 0 from __NR_getppid.
+ */
+ ASSERT_EQ(sched_setscheduler(0, SCHED_OTHER, &sp_zero), 0);
+ ASSERT_EQ(sched_setscheduler(tracee_pid, SCHED_OTHER, &sp_zero), 0);
+
+ EXPECT_EQ(ret, -1);
+ EXPECT_EQ(err, EINTR);
+ EXPECT_EQ(waitpid(sig_pid, &status, 0), sig_pid);
+ EXPECT_EQ(true, WIFEXITED(status));
+ EXPECT_EQ(0, WEXITSTATUS(status));
+
+ nanosleep(&delay, NULL);
+
+ /*
+ * Retry SECCOMP_IOCTL_NOTIF_ADDFD. Because knotif->state is
+ * SECCOMP_NOTIFY_SENT, the retry succeeds (returns 42) instead of
+ * failing with -EINPROGRESS, installs FD 42 into the tracee, and wakes
+ * the tracee to complete the syscall with return value 42.
+ */
+ EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), 42);
+
+ EXPECT_EQ(waitpid(tracee_pid, &status, 0), tracee_pid);
+ EXPECT_EQ(true, WIFEXITED(status));
+ EXPECT_EQ(0, WEXITSTATUS(status));
+
+ close(listener);
+ close(memfd);
+}
+
#ifndef SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP
#define SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP (1UL << 0)
#define SECCOMP_IOCTL_NOTIF_SET_FLAGS SECCOMP_IOW(4, __u64)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0224/1257] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2026-11-07 13:41 ` [PATCH 7.3 0223/1257] seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0225/1257] leds: ktd2692: Pass context to regulator cleanup Greg Kroah-Hartman
` (774 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Cong Nguyen, Frank Li,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Nguyen <congnt264@gmail.com>
[ Upstream commit 07643be7b1eff94f7a49e142c1e92a1029d3db21 ]
device_run() allocates an ipu_image_convert_run object and, on the
success path, hands it to the IPU image conversion core via
ipu_image_convert_queue(); the run object is then freed asynchronously
by the completion callback ipu_ic_pp_complete().
However, if ipu_image_convert_queue() fails, the core never takes
ownership of the run object and the completion callback is never
invoked. The "err" label finishes the mem2mem job and reports the
buffers as errored, but never frees the run object that was just
allocated, leaking it on every queue failure.
Free the run object in the error path. There is no risk of a double
free: the completion callback only runs after the object was
successfully queued, which is mutually exclusive with reaching the
error path. It is also safe for the earlier "goto err" on allocation
failure, since run is NULL there and kfree(NULL) is a no-op.
Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
Cc: stable@kernel.org
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/imx/imx-media-csc-scaler.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c
index 00fcdd4d04873..359d973d297f7 100644
--- a/drivers/staging/media/imx/imx-media-csc-scaler.c
+++ b/drivers/staging/media/imx/imx-media-csc-scaler.c
@@ -147,6 +147,7 @@ static void device_run(void *_ctx)
v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_ERROR);
v4l2_m2m_buf_done(dst_buf, VB2_BUF_STATE_ERROR);
v4l2_m2m_job_finish(priv->m2m_dev, ctx->fh.m2m_ctx);
+ kfree(run);
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0225/1257] leds: ktd2692: Pass context to regulator cleanup
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0224/1257] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0226/1257] media: ene_ir: Ensure teardown is done in the correct order Greg Kroah-Hartman
` (773 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Lee Jones,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit c73e9f04445f361d5f19ca2edfde742ce18348ef ]
regulator_disable_action() retrieves the driver context from device
driver data. However, ktd2692_parse_dt() registers the action before
ktd2692_probe() stores the context with platform_set_drvdata().
If devm_add_action_or_reset() cannot allocate the action, it invokes the
callback immediately. A later probe failure also invokes it during
managed-resource unwinding. Both paths dereference a NULL context.
Pass the already allocated context directly to the action and retain the
device pointer in it for error reporting. The context is allocated before
the action is registered, so reverse-order devres unwinding keeps it alive
through the callback.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: ee78b9360e14 ("leds: ktd2692: Fix an error handling path")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260910194525.99654-1-mhun512@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/flash/leds-ktd2692.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/leds/flash/leds-ktd2692.c b/drivers/leds/flash/leds-ktd2692.c
index 22fbfccd48735..43d4d55503ab5 100644
--- a/drivers/leds/flash/leds-ktd2692.c
+++ b/drivers/leds/flash/leds-ktd2692.c
@@ -69,6 +69,8 @@ static const struct expresswire_timing ktd2692_timing = {
};
struct ktd2692_context {
+ struct device *dev;
+
/* Common ExpressWire properties (ctrl GPIO and timing) */
struct expresswire_common_props props;
@@ -196,13 +198,12 @@ static void ktd2692_setup(struct ktd2692_context *led)
static void regulator_disable_action(void *_data)
{
- struct device *dev = _data;
- struct ktd2692_context *led = dev_get_drvdata(dev);
+ struct ktd2692_context *led = _data;
int ret;
ret = regulator_disable(led->regulator);
if (ret)
- dev_err(dev, "Failed to disable supply: %d\n", ret);
+ dev_err(led->dev, "Failed to disable supply: %d\n", ret);
}
static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev,
@@ -233,7 +234,7 @@ static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev,
dev_err(dev, "Failed to enable supply: %d\n", ret);
} else {
ret = devm_add_action_or_reset(dev,
- regulator_disable_action, dev);
+ regulator_disable_action, led);
if (ret)
return ret;
}
@@ -290,6 +291,7 @@ static int ktd2692_probe(struct platform_device *pdev)
if (!led)
return -ENOMEM;
+ led->dev = &pdev->dev;
fled_cdev = &led->fled_cdev;
led_cdev = &fled_cdev->led_cdev;
led->props.timing = ktd2692_timing;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0226/1257] media: ene_ir: Ensure teardown is done in the correct order
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0225/1257] leds: ktd2692: Pass context to regulator cleanup Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0227/1257] media: serial_ir: Fix race condition where timer can be re-armed Greg Kroah-Hartman
` (772 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit ae6cfbad7ca346b78f4cdac38438bbfaed8c18a0 ]
The timer can be re-armed from the irq, so ensure that the timers are
deleted after the irq and that we only free the rc device once we are
sure that the irq has been silenced.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/ene_ir.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
index 6f7dccc965e7f..f98d76277b62a 100644
--- a/drivers/media/rc/ene_ir.c
+++ b/drivers/media/rc/ene_ir.c
@@ -1103,15 +1103,15 @@ static void ene_remove(struct pnp_dev *pnp_dev)
unsigned long flags;
rc_unregister_device(dev->rdev);
- timer_delete_sync(&dev->tx_sim_timer);
spin_lock_irqsave(&dev->hw_lock, flags);
ene_rx_disable(dev);
ene_rx_restore_hw_buffer(dev);
spin_unlock_irqrestore(&dev->hw_lock, flags);
- rc_free_device(dev->rdev);
free_irq(dev->irq, dev);
+ timer_delete_sync(&dev->tx_sim_timer);
release_region(dev->hw_io, ENE_IO_SIZE);
+ rc_free_device(dev->rdev);
kfree(dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0227/1257] media: serial_ir: Fix race condition where timer can be re-armed
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0226/1257] media: ene_ir: Ensure teardown is done in the correct order Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0228/1257] media: ir_toy: Validate the maximum tx carrier Greg Kroah-Hartman
` (771 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit d74ac4016ba64cb3b20f395511d0b18025ca0ba9 ]
Ensure the timer cannot be re-armed.
Fixes: 2940c7e49775 ("[media] serial_ir: generate timeout")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/serial_ir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
index 992fff82b5245..f6702b3df9a03 100644
--- a/drivers/media/rc/serial_ir.c
+++ b/drivers/media/rc/serial_ir.c
@@ -798,7 +798,7 @@ static int __init serial_ir_init_module(void)
static void __exit serial_ir_exit_module(void)
{
- timer_delete_sync(&serial_ir.timeout_timer);
+ timer_shutdown_sync(&serial_ir.timeout_timer);
serial_ir_exit();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0228/1257] media: ir_toy: Validate the maximum tx carrier
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0227/1257] media: serial_ir: Fix race condition where timer can be re-armed Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0229/1257] media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse() Greg Kroah-Hartman
` (770 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 27303392aa87b61692faadec8b00e0ca66bf98dd ]
Reject any carrier the hardware cannot generate. This also fixes
a divide by zero if a carrier of U32_MAX/16 is set.
Fixes: 8bff1386d62d ("media: ir_toy: allow tx carrier to be set")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/ir_toy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c
index ee645882dd5a6..0819cd5cfa98b 100644
--- a/drivers/media/rc/ir_toy.c
+++ b/drivers/media/rc/ir_toy.c
@@ -373,7 +373,7 @@ static int irtoy_tx_carrier(struct rc_dev *rc, uint32_t carrier)
u8 buf[3];
int err;
- if (carrier < 11800)
+ if (carrier < 11800 || carrier > 3000000)
return -EINVAL;
buf[0] = 0x06;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0229/1257] media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0228/1257] media: ir_toy: Validate the maximum tx carrier Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0230/1257] ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv() Greg Kroah-Hartman
` (769 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Young, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 05d9c515cf13056875abbf73adb4a19dd7ba32eb ]
If an excesively high carrier is set, meson_irtx_prepare_pulse() will
cause a divide by zero if tb_us is 0. Prevent such a carrier from being
set.
Fixes: 49be1c78d575 ("media: rc: introduce Meson IR TX driver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/meson-ir-tx.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index 1ab898069e67f..a0d07da09f67a 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -219,6 +219,9 @@ static int meson_irtx_set_carrier(struct rc_dev *rc, u32 carrier)
if (carrier == 0)
return -EINVAL;
+ if (!DIV_ROUND_CLOSEST(USEC_PER_SEC, carrier))
+ return -EINVAL;
+
ir->carrier = carrier;
meson_irtx_set_mod(ir);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0230/1257] ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0229/1257] media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse() Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0231/1257] arm64: dts: ti: k3-am62a: Fix MMC0_CLK register address Greg Kroah-Hartman
` (768 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Sen Wang, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit ba593d662183de74d2b733b4c6e8cd26f04f0a65 ]
In __davinci_mcasp_set_clkdiv(), pm_runtime_get_sync() is called at the
entry of the function. If an invalid div_id is provided, the function
hits the default switch case and directly returns -EINVAL without calling
pm_runtime_put(), resulting in a runtime PM reference leak.
Add pm_runtime_put() in the default case before returning -EINVAL.
Fixes: 4ed8c9b737b6 ("ASoC: McASP: add support for clock dividers")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Tested-by: Sen Wang <sen@ti.com>
Link: https://patch.msgid.link/20260916073136.1971673-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/ti/davinci-mcasp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c
index 79239131b6598..d3c9797c03dd8 100644
--- a/sound/soc/ti/davinci-mcasp.c
+++ b/sound/soc/ti/davinci-mcasp.c
@@ -799,6 +799,7 @@ static int __davinci_mcasp_set_clkdiv(struct davinci_mcasp *mcasp, int div_id,
break;
default:
+ pm_runtime_put(mcasp->dev);
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0231/1257] arm64: dts: ti: k3-am62a: Fix MMC0_CLK register address
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0230/1257] ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv() Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0232/1257] arm64: dts: ti: k3-am62a7-sk: Set eMMC clock pin as OUTPUT Greg Kroah-Hartman
` (767 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Udit Kumar, Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 9852f2badc438de82b6828c11c80ef0a656f1d4d ]
MMC0_CLKLB and MMC0_CLK have incorrectly swapped register addresses
as per datasheet [0]. Set the correct MMC0_CLK address and drop the
unneeded MMC0_CLKLB pin configuration.
[0] https://www.ti.com/lit/gpn/am62a7 Rev. E: Table 5-1. Pin Attributes
Fixes: e041ec6e86e7 ("arm64: dts: ti: k3-am62a7-sk: Enable eMMC support")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Udit Kumar <u-kumar1@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-2-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
index d3b3675e7a8fc..b04636cab71c7 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -328,8 +328,7 @@ AM62AX_IOPAD(0x0b4, PIN_INPUT_PULLUP, 1) /* (K24) GPMC0_CSn3.I2C2_SDA */
main_mmc0_pins_default: main-mmc0-default-pins {
pinctrl-single,pins = <
AM62AX_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
- AM62AX_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLKLB */
- AM62AX_IOPAD(0x21c, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+ AM62AX_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
AM62AX_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
AM62AX_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
AM62AX_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0232/1257] arm64: dts: ti: k3-am62a7-sk: Set eMMC clock pin as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0231/1257] arm64: dts: ti: k3-am62a: Fix MMC0_CLK register address Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0233/1257] arm64: dts: ti: k3-am62a7-sk: Set SD " Greg Kroah-Hartman
` (766 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit aa7d5b1efa75e58c9d440dfd720205045fe6a806 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruj16 Rev. C: Table 12-257. MMCSDi I/O Signals
Fixes: e041ec6e86e7 ("arm64: dts: ti: k3-am62a7-sk: Enable eMMC support")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-4-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
index b04636cab71c7..f6778f9798d40 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -328,7 +328,7 @@ AM62AX_IOPAD(0x0b4, PIN_INPUT_PULLUP, 1) /* (K24) GPMC0_CSn3.I2C2_SDA */
main_mmc0_pins_default: main-mmc0-default-pins {
pinctrl-single,pins = <
AM62AX_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
- AM62AX_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+ AM62AX_IOPAD(0x218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
AM62AX_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
AM62AX_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
AM62AX_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0233/1257] arm64: dts: ti: k3-am62a7-sk: Set SD clock pin as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0232/1257] arm64: dts: ti: k3-am62a7-sk: Set eMMC clock pin as OUTPUT Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0234/1257] arm64: dts: ti: k3-am62a-phycore-som: Set eMMC " Greg Kroah-Hartman
` (765 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit cfad4f39124b218c2cbbbe17e742971abc9ac8b4 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruj16 Rev. C: Table 12-257. MMCSDi I/O Signals
Fixes: 38c4a08c820c ("arm64: dts: ti: Add support for AM62A7-SK")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-5-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
index f6778f9798d40..e63c5200a2370 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -344,7 +344,7 @@ AM62AX_IOPAD(0x1f8, PIN_INPUT_PULLUP, 0) /* (AC2) MMC0_DAT7 */
main_mmc1_pins_default: main-mmc1-default-pins {
pinctrl-single,pins = <
AM62AX_IOPAD(0x23c, PIN_INPUT, 0) /* (A21) MMC1_CMD */
- AM62AX_IOPAD(0x234, PIN_INPUT, 0) /* (B22) MMC1_CLK */
+ AM62AX_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22) MMC1_CLK */
AM62AX_IOPAD(0x230, PIN_INPUT, 0) /* (A22) MMC1_DAT0 */
AM62AX_IOPAD(0x22c, PIN_INPUT, 0) /* (B21) MMC1_DAT1 */
AM62AX_IOPAD(0x228, PIN_INPUT, 0) /* (C21) MMC1_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0234/1257] arm64: dts: ti: k3-am62a-phycore-som: Set eMMC clock pin as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0233/1257] arm64: dts: ti: k3-am62a7-sk: Set SD " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0235/1257] arm64: dts: ti: k3-am62-lp-sk: Set eMMC clock pins " Greg Kroah-Hartman
` (764 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Wadim Egorov, Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 4834050197f205a649e36661ca150e6ac8295008 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruj16 Rev. C: Table 12-257. MMCSDi I/O Signals
Fixes: d69383885576 ("arm64: dts: ti: Add basic support for phyBOARD-Lyra-AM62Ax")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20260909214743.899477-6-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
index de4048a3564bc..5ad93be3d3363 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
@@ -120,7 +120,7 @@ AM62AX_IOPAD(0x15c, PIN_INPUT, 0) /* (V13) MDIO0_MDIO */
main_mmc0_pins_default: main-mmc0-default-pins {
pinctrl-single,pins = <
AM62AX_IOPAD(0x220, PIN_INPUT_PULLUP, 0) /* (Y6) MMC0_CMD */
- AM62AX_IOPAD(0x218, PIN_INPUT_PULLDOWN, 0) /* (AB7) MMC0_CLK */
+ AM62AX_IOPAD(0x218, PIN_OUTPUT_PULLDOWN, 0) /* (AB7) MMC0_CLK */
AM62AX_IOPAD(0x214, PIN_INPUT_PULLUP, 0) /* (AA6) MMC0_DAT0 */
AM62AX_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AB6) MMC0_DAT1 */
AM62AX_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (Y7) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0235/1257] arm64: dts: ti: k3-am62-lp-sk: Set eMMC clock pins as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0234/1257] arm64: dts: ti: k3-am62a-phycore-som: Set eMMC " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0236/1257] arm64: dts: ti: k3-am62-pocketbeagle2: Set SD clock pin " Greg Kroah-Hartman
` (763 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 156f4c2208c8e5e04002402494de28c21c0afcbc ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: e6a51ffabfc1 ("arm64: ti: dts: Add support for AM62x LP SK")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-7-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts b/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts
index dfd65c00f5b95..7fd508f4eddf1 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts
@@ -86,7 +86,7 @@ main_mmc0_pins_default: main-mmc0-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (V3) MMC0_CMD */
- AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (Y1) MMC0_CLK */
+ AM62X_IOPAD(0x218, PIN_OUTPUT, 0) /* (Y1) MMC0_CLK */
AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (V2) MMC0_DAT0 */
AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (V1) MMC0_DAT1 */
AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (W2) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0236/1257] arm64: dts: ti: k3-am62-pocketbeagle2: Set SD clock pin as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0235/1257] arm64: dts: ti: k3-am62-lp-sk: Set eMMC clock pins " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0237/1257] arm64: dts: ti: k3-am625-beagleplay: Set MMC clock pins " Greg Kroah-Hartman
` (762 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 843c4d171975059eaa1436c8403d9a29f677a75c ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: 92d8c028aa92 ("arm64: dts: ti: Add k3-am62-pocketbeagle2")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-8-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
index 7a4cffc27bda3..1c691629d4ad0 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
@@ -235,7 +235,7 @@ AM62X_IOPAD(0x0020, PIN_OUTPUT, 3) /* (J25) OSPI0_D5.UART6_TXD */
main_mmc1_pins_default: main-mmc1-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x23c, PIN_INPUT, 0) /* (A21/C18) MMC1_CMD */
- AM62X_IOPAD(0x234, PIN_INPUT, 0) /* (B22/A20) MMC1_CLK */
+ AM62X_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22/A20) MMC1_CLK */
AM62X_IOPAD(0x230, PIN_INPUT, 0) /* (A22/A19) MMC1_DAT0 */
AM62X_IOPAD(0x22c, PIN_INPUT, 0) /* (B21/B19) MMC1_DAT1 */
AM62X_IOPAD(0x228, PIN_INPUT, 0) /* (C21/B20) MMC1_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0237/1257] arm64: dts: ti: k3-am625-beagleplay: Set MMC clock pins as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0236/1257] arm64: dts: ti: k3-am62-pocketbeagle2: Set SD clock pin " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0238/1257] arm64: dts: ti: k3-am62x-sk-common: Set SD clock pin " Greg Kroah-Hartman
` (761 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit c074abebc76f0e59d13dea499f582806c6a3d94d ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: f5a731f0787f ("arm64: dts: ti: Add k3-am625-beagleplay")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-9-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
index c468b9c5fc09a..898e4ca3fd87e 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
+++ b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
@@ -323,7 +323,7 @@ emmc_pins_default: emmc-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x0220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
- AM62X_IOPAD(0x0218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+ AM62X_IOPAD(0x0218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
AM62X_IOPAD(0x0214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
AM62X_IOPAD(0x0210, PIN_INPUT, 0) /* (AA1) MMC0_DAT1 */
AM62X_IOPAD(0x020c, PIN_INPUT, 0) /* (AA3) MMC0_DAT2 */
@@ -346,7 +346,7 @@ sd_pins_default: sd-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x023c, PIN_INPUT, 0) /* (A21) MMC1_CMD */
- AM62X_IOPAD(0x0234, PIN_INPUT, 0) /* (B22) MMC1_CLK */
+ AM62X_IOPAD(0x0234, PIN_OUTPUT, 0) /* (B22) MMC1_CLK */
AM62X_IOPAD(0x0230, PIN_INPUT, 0) /* (A22) MMC1_DAT0 */
AM62X_IOPAD(0x022c, PIN_INPUT, 0) /* (B21) MMC1_DAT1 */
AM62X_IOPAD(0x0228, PIN_INPUT, 0) /* (C21) MMC1_DAT2 */
@@ -358,7 +358,7 @@ AM62X_IOPAD(0x0240, PIN_INPUT, 7) /* (D17) MMC1_SDCD.GPIO1_48 */
wifi_pins_default: wifi-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x0120, PIN_INPUT, 0) /* (C24) MMC2_CMD */
- AM62X_IOPAD(0x0118, PIN_INPUT, 0) /* (D25) MMC2_CLK */
+ AM62X_IOPAD(0x0118, PIN_OUTPUT, 0) /* (D25) MMC2_CLK */
AM62X_IOPAD(0x0114, PIN_INPUT, 0) /* (B24) MMC2_DAT0 */
AM62X_IOPAD(0x0110, PIN_INPUT, 0) /* (C25) MMC2_DAT1 */
AM62X_IOPAD(0x010c, PIN_INPUT, 0) /* (E23) MMC2_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0238/1257] arm64: dts: ti: k3-am62x-sk-common: Set SD clock pin as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0237/1257] arm64: dts: ti: k3-am625-beagleplay: Set MMC clock pins " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0239/1257] arm64: dts: ti: k3-am625-sk-common: Set eMMC " Greg Kroah-Hartman
` (760 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 1e2e5016bda94b2bcd86258b5eb77fe3006639a0 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: d19a66ae488a ("arm64: dts: ti: k3-am625-sk: Enable on board peripherals")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-10-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
index ab9e58c2d225e..d2f41e2ed6239 100644
--- a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
@@ -194,7 +194,7 @@ main_mmc1_pins_default: main-mmc1-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x23c, PIN_INPUT, 0) /* (A21/C18) MMC1_CMD */
- AM62X_IOPAD(0x234, PIN_INPUT, 0) /* (B22/A20) MMC1_CLK */
+ AM62X_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22/A20) MMC1_CLK */
AM62X_IOPAD(0x230, PIN_INPUT, 0) /* (A22/A19) MMC1_DAT0 */
AM62X_IOPAD(0x22c, PIN_INPUT, 0) /* (B21/B19) MMC1_DAT1 */
AM62X_IOPAD(0x228, PIN_INPUT, 0) /* (C21/B20) MMC1_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0239/1257] arm64: dts: ti: k3-am625-sk-common: Set eMMC clock pin as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0238/1257] arm64: dts: ti: k3-am62x-sk-common: Set SD clock pin " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0240/1257] arm64: dts: ti: k3-am62-phycore-som: " Greg Kroah-Hartman
` (759 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 8ef8a0e38d1377c6d51c06f95c64d87641b2c717 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: d19a66ae488a ("arm64: dts: ti: k3-am625-sk: Enable on board peripherals")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-11-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi b/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi
index 9c83626826453..085b067d96fbb 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi
@@ -98,7 +98,7 @@ main_mmc0_pins_default: main-mmc0-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
- AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+ AM62X_IOPAD(0x218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0240/1257] arm64: dts: ti: k3-am62-phycore-som: Set eMMC clock pin as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0239/1257] arm64: dts: ti: k3-am625-sk-common: Set eMMC " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0241/1257] arm64: dts: ti: k3-am625-tqma62xx: Set MMC clock pins " Greg Kroah-Hartman
` (758 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Wadim Egorov, Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit a3c2b6c52e02d58941c0b91bfba052788aeff890 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: 3443c1c4ed61 ("arm64: dts: ti: Add basic support for phyBOARD-Lyra-AM625")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20260909214743.899477-12-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
index 3baa653257bb6..ce3e5165bd310 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
@@ -153,7 +153,7 @@ AM62X_IOPAD(0x15c, PIN_INPUT, 0) /* (AB22) MDIO0_MDIO */
main_mmc0_pins_default: main-mmc0-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x220, PIN_INPUT_PULLUP, 0) /* (Y3) MMC0_CMD */
- AM62X_IOPAD(0x218, PIN_INPUT_PULLDOWN, 0) /* (AB1) MMC0_CLK */
+ AM62X_IOPAD(0x218, PIN_OUTPUT_PULLDOWN, 0) /* (AB1) MMC0_CLK */
AM62X_IOPAD(0x214, PIN_INPUT_PULLUP, 0) /* (AA2) MMC0_DAT0 */
AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0241/1257] arm64: dts: ti: k3-am625-tqma62xx: Set MMC clock pins as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0240/1257] arm64: dts: ti: k3-am62-phycore-som: " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0242/1257] arm64: dts: ti: k3-am625-var-som-symphony: Set SD " Greg Kroah-Hartman
` (757 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit f9a93fe78d8737860a8fb786d17c9dff20782b7d ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: 5b36d8c72c91 ("arm64: dts: ti: Add TQ-Systems TQMa62xx SoM and MBa62xx carrier board Device Trees")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-13-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am625-tqma62xx-mba62xx.dts | 4 ++--
arch/arm64/boot/dts/ti/k3-am625-tqma62xx.dtsi | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am625-tqma62xx-mba62xx.dts b/arch/arm64/boot/dts/ti/k3-am625-tqma62xx-mba62xx.dts
index efc00d2a860a7..3859512c42628 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-tqma62xx-mba62xx.dts
+++ b/arch/arm64/boot/dts/ti/k3-am625-tqma62xx-mba62xx.dts
@@ -735,7 +735,7 @@ main_mmc1_pins: main-mmc1-pins {
/* (A21) MMC1_CMD */
AM62X_IOPAD(0x23c, PIN_INPUT, 0)
/* (B22) MMC1_CLK */
- AM62X_IOPAD(0x234, PIN_INPUT, 0)
+ AM62X_IOPAD(0x234, PIN_OUTPUT, 0)
/* (A22) MMC1_DAT0 */
AM62X_IOPAD(0x230, PIN_INPUT, 0)
/* (B21) MMC1_DAT1 */
@@ -755,7 +755,7 @@ main_mmc2_pins: main-mmc2-pins {
/* (C24) MMC2_CMD */
AM62X_IOPAD(0x120, PIN_INPUT, 0)
/* (D25) MMC2_CLK */
- AM62X_IOPAD(0x118, PIN_INPUT, 0)
+ AM62X_IOPAD(0x118, PIN_OUTPUT, 0)
/* (B24) MMC2_DAT0 */
AM62X_IOPAD(0x114, PIN_INPUT, 0)
/* (C25) MMC2_DAT1 */
diff --git a/arch/arm64/boot/dts/ti/k3-am625-tqma62xx.dtsi b/arch/arm64/boot/dts/ti/k3-am625-tqma62xx.dtsi
index 72288678cd01f..a200a2afe16fa 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-tqma62xx.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am625-tqma62xx.dtsi
@@ -299,7 +299,7 @@ main_mmc0_pins: main-mmc0-pins {
/* (Y3) MMC0_CMD */
AM62X_IOPAD(0x220, PIN_INPUT, 0)
/* (AB1) MMC0_CLK */
- AM62X_IOPAD(0x218, PIN_INPUT, 0)
+ AM62X_IOPAD(0x218, PIN_OUTPUT, 0)
/* (AA2) MMC0_DAT0 */
AM62X_IOPAD(0x214, PIN_INPUT, 0)
/* (AA1) MMC0_DAT1 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0242/1257] arm64: dts: ti: k3-am625-var-som-symphony: Set SD clock pins as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0241/1257] arm64: dts: ti: k3-am625-tqma62xx: Set MMC clock pins " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0243/1257] arm64: dts: ti: k3-am625-var-som: Set MMC " Greg Kroah-Hartman
` (756 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Stefano Radaelli,
Moteen Shah, Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit dbe55d5f2930b27e9a3ce71f0c9b1bb0ad91a012 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: acb4cd35dbd2 ("arm64: dts: ti: var-som-am62: Add support for Variscite Symphony Board")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Stefano Radaelli <stefano.r@variscite.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-14-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am625-var-som-symphony.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am625-var-som-symphony.dts b/arch/arm64/boot/dts/ti/k3-am625-var-som-symphony.dts
index 7951d7ec952b5..082bf81143dcb 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-var-som-symphony.dts
+++ b/arch/arm64/boot/dts/ti/k3-am625-var-som-symphony.dts
@@ -391,7 +391,7 @@ pinctrl_mmc1: main-mmc1-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x23c, PIN_INPUT, 0) /* (A21) MMC1_CMD */
- AM62X_IOPAD(0x234, PIN_INPUT, 0) /* (B22) MMC1_CLK */
+ AM62X_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22) MMC1_CLK */
AM62X_IOPAD(0x230, PIN_INPUT, 0) /* (A22) MMC1_DAT0 */
AM62X_IOPAD(0x22c, PIN_INPUT, 0) /* (B21) MMC1_DAT1 */
AM62X_IOPAD(0x228, PIN_INPUT, 0) /* (C21) MMC1_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0243/1257] arm64: dts: ti: k3-am625-var-som: Set MMC clock pins as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0242/1257] arm64: dts: ti: k3-am625-var-som-symphony: Set SD " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0244/1257] arm64: dts: ti: k3-am62x-phyboard-lyra: Set SD clock pin " Greg Kroah-Hartman
` (755 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Stefano Radaelli,
Moteen Shah, Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit b489fa1808ea807c4467def7947c83d896dfc355 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: 887d9e03c487 ("arm64: dts: ti: Add support for Variscite VAR-SOM-AM62")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Stefano Radaelli <stefano.r@variscite.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-15-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am625-var-som.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am625-var-som.dtsi b/arch/arm64/boot/dts/ti/k3-am625-var-som.dtsi
index c2daa56c35e17..c23b6a90b8b13 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-var-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am625-var-som.dtsi
@@ -277,7 +277,7 @@ pinctrl_mmc0: main-mmc0-default-pins {
bootph-all;
pinctrl-single,pins = <
AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
- AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+ AM62X_IOPAD(0x218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
AM62X_IOPAD(0x210, PIN_INPUT, 0) /* (AA1) MMC0_DAT1 */
AM62X_IOPAD(0x20c, PIN_INPUT, 0) /* (AA3) MMC0_DAT2 */
@@ -292,7 +292,7 @@ AM62X_IOPAD(0x1f8, PIN_INPUT, 0) /* (AC2) MMC0_DAT7 */
pinctrl_mmc2: main-mmc2-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x120, PIN_INPUT_PULLUP, 0) /* (C24) MMC2_CMD */
- AM62X_IOPAD(0x118, PIN_INPUT_PULLDOWN, 0) /* (D25) MMC2_CLK */
+ AM62X_IOPAD(0x118, PIN_OUTPUT_PULLDOWN, 0) /* (D25) MMC2_CLK */
AM62X_IOPAD(0x114, PIN_INPUT_PULLUP, 0) /* (B24) MMC2_DAT0 */
AM62X_IOPAD(0x110, PIN_INPUT_PULLUP, 0) /* (C25) MMC2_DAT1 */
AM62X_IOPAD(0x10c, PIN_INPUT_PULLUP, 0) /* (E23) MMC2_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0244/1257] arm64: dts: ti: k3-am62x-phyboard-lyra: Set SD clock pin as OUTPUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0243/1257] arm64: dts: ti: k3-am625-var-som: Set MMC " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0245/1257] arm64: dts: ti: k3-am62p5-verdin: build zinnia dtbs Greg Kroah-Hartman
` (754 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Judith Mendez, Moteen Shah,
Wadim Egorov, Nishanth Menon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <jm@ti.com>
[ Upstream commit 1d62ef8d47b535d31fb9cf38e5c36eb55b0189a4 ]
MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.
[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals
Fixes: f1b3adade045 ("arm64: dts: ti: Add am62x-phyboard-lyra carrier board")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20260909214743.899477-16-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi b/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi
index d6e70ee15938e..c9b3e0518faf5 100644
--- a/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi
@@ -227,7 +227,7 @@ AM62X_IOPAD(0x068, PIN_INPUT, 3) /* (R21) GPMC0_AD11.MCASP2_AXR3 */
main_mmc1_pins_default: main-mmc1-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x23c, PIN_INPUT_PULLUP, 0) /* (A21) MMC1_CMD */
- AM62X_IOPAD(0x234, PIN_INPUT_PULLDOWN, 0) /* (B22) MMC1_CLK */
+ AM62X_IOPAD(0x234, PIN_OUTPUT_PULLDOWN, 0) /* (B22) MMC1_CLK */
AM62X_IOPAD(0x230, PIN_INPUT_PULLUP, 0) /* (A22) MMC1_DAT0 */
AM62X_IOPAD(0x22c, PIN_INPUT_PULLUP, 0) /* (B21) MMC1_DAT1 */
AM62X_IOPAD(0x228, PIN_INPUT_PULLUP, 0) /* (C21) MMC1_DAT2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0245/1257] arm64: dts: ti: k3-am62p5-verdin: build zinnia dtbs
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0244/1257] arm64: dts: ti: k3-am62x-phyboard-lyra: Set SD clock pin " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0246/1257] drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable() Greg Kroah-Hartman
` (753 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Nishanth Menon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 237fda81c2b4984c2212f0d3f510405aad8b25db ]
Add the zinnia dtbs to the Makefile, they were forgotten when zinnia
support was added and were therefore never built.
Fixes: 71c2a8124527 ("arm64: dts: ti: k3-am62p-verdin: Add Zinnia")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://patch.msgid.link/20260914174651.6195-1-francesco@dolcini.it
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/Makefile | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/ti/Makefile b/arch/arm64/boot/dts/ti/Makefile
index 795978e962ee8..ec03d594f23a6 100644
--- a/arch/arm64/boot/dts/ti/Makefile
+++ b/arch/arm64/boot/dts/ti/Makefile
@@ -91,6 +91,7 @@ dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-nonwifi-dev.dtb
dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-nonwifi-ivy.dtb
dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-nonwifi-mallow.dtb
dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-nonwifi-yavia.dtb
+dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-nonwifi-zinnia.dtb
dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-ov5640-24mhz.dtbo
dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-ov5640.dtbo
dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-wifi-dahlia.dtb
@@ -98,6 +99,7 @@ dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-wifi-dev.dtb
dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-wifi-ivy.dtb
dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-wifi-mallow.dtb
dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-wifi-yavia.dtb
+dtb-$(CONFIG_ARCH_K3) += k3-am62p5-verdin-wifi-zinnia.dtb
# Common overlays for SK-AM62* family of boards
dtb-$(CONFIG_ARCH_K3) += k3-am62x-sk-csi2-ov5640.dtbo
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0246/1257] drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0245/1257] arm64: dts: ti: k3-am62p5-verdin: build zinnia dtbs Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0247/1257] cpufreq/amd-pstate: Skip auto_sel write when it already matches the mode Greg Kroah-Hartman
` (752 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Liviu Dudau,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 73ef663c75688168e31dbe9c585b939be410a945 ]
malidp_crtc_atomic_enable() resumes the device with
pm_runtime_get_sync() and returns early when the resume fails. The
runtime PM usage count is incremented by pm_runtime_get_sync() even
when the resume fails, so returning without dropping the reference
leaks it and, once the error has been hit, prevents the device from
ever suspending again.
Drop the runtime PM reference with pm_runtime_put_noidle() on the
resume failure path before returning.
Fixes: 85f6421889ec ("drm: mali-dp: Enable power management for the device.")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Acked-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20260916102112.2018372-1-vulab@iscas.ac.cn
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/arm/malidp_crtc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/arm/malidp_crtc.c b/drivers/gpu/drm/arm/malidp_crtc.c
index ebe8e10787772..af62bc1027648 100644
--- a/drivers/gpu/drm/arm/malidp_crtc.c
+++ b/drivers/gpu/drm/arm/malidp_crtc.c
@@ -56,6 +56,7 @@ static void malidp_crtc_atomic_enable(struct drm_crtc *crtc,
if (err < 0) {
DRM_DEBUG_DRIVER("Failed to enable runtime power management: %d\n", err);
+ pm_runtime_put_noidle(crtc->dev->dev);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0247/1257] cpufreq/amd-pstate: Skip auto_sel write when it already matches the mode
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0246/1257] drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable() Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0248/1257] nilfs2: fix checkpoint root lifetime on sysfs errors Greg Kroah-Hartman
` (751 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, K Prateek Nayak, LFRon, Wentao Guan,
Mario Limonciello, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit b400642c5e93863ec17ea15fcbd3efc81c299531 ]
Since commit 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active
mode on shared memory systems"), shmem_init_perf() programs
AUTONOMOUS_SELECTION_ENABLE unconditionally, including in active mode.
Platforms that exclusively support autonomous selection report this field
as an Integer of 1, as required by the ACPI specification, instead of as a
register descriptor. cppc_get_reg_val() reads such a field back
successfully, but cppc_set_reg_val() rejects the write with -EOPNOTSUPP
because the entry is not an ACPI_TYPE_BUFFER.
shmem_init_perf() propagates that error, so every amd_pstate_epp_cpu_init()
fails, cpufreq_register_driver() ends up with an empty policy list and
returns -ENODEV, and amd-pstate refuses to load at all:
amd_pstate: failed to set auto_sel, ret: -95
amd_pstate: Failed to initialize CPU 0: -95
...
amd_pstate: failed to register with return -19
Skip the write when the register already holds the value the requested mode
needs. Active and guided mode are fixed on these platforms, which report
auto_sel as 1, while passive mode still fails to load on a platform that
cannot disable autonomous selection, exactly as it did before the
offending commit.
Fixes: 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems")
Cc: stable@vger.kernel.org
Reviewed-by: K Prateek Nayak <kprateek.nayak@amd.com>
Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Tested-by: LFRon <ronforever@outlook.com>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Link: https://lore.kernel.org/r/20260918090909.86544-1-guanwentao@uniontech.com
Signed-off-by: Mario Limonciello <superm1@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/amd-pstate.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c
index 8bfd46d60843d..6e00d200920aa 100644
--- a/drivers/cpufreq/amd-pstate.c
+++ b/drivers/cpufreq/amd-pstate.c
@@ -524,8 +524,10 @@ static int shmem_init_perf(struct amd_cpudata *cpudata)
return 0;
}
- ret = cppc_set_auto_sel(cpudata->cpu,
- (cppc_state == AMD_PSTATE_PASSIVE) ? 0 : 1);
+ if ((cppc_state != AMD_PSTATE_PASSIVE) == auto_sel)
+ return 0;
+
+ ret = cppc_set_auto_sel(cpudata->cpu, !auto_sel);
if (ret)
pr_warn("failed to set auto_sel, ret: %d\n", ret);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0248/1257] nilfs2: fix checkpoint root lifetime on sysfs errors
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0247/1257] cpufreq/amd-pstate: Skip auto_sel write when it already matches the mode Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0249/1257] EDAC/i10nm: Fix mdev reference leak in i10nm_get_ddr_munits() Greg Kroah-Hartman
` (750 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Ryusuke Konishi,
Viacheslav Dubeyko, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
[ Upstream commit 2cb947450e0e5a88bb6bb5fca6dbfda1910e74b0 ]
nilfs_find_or_create_root() links a new checkpoint root into the
checkpoint tree and drops ns_cptree_lock before creating the root's
sysfs group. If nilfs_sysfs_create_snapshot_group() then fails, the
root is freed while it is still reachable from ns_cptree, so a
concurrent nilfs_lookup_root() can dereference freed memory.
nilfs_sysfs_create_snapshot_group() allocates memory and creates sysfs
nodes and may sleep, so it cannot run under the ns_cptree_lock spinlock.
Reorder the creation path so that the sysfs group is set up before the
root is published: initialize the root, create its sysfs group outside
the lock, and only then take ns_cptree_lock to link it into the tree.
On sysfs failure the root was never visible and is freed directly; in
the unlikely case a root with the same checkpoint number is already
present, the sysfs group of the new root is removed before it is freed.
Concurrent insertions are already serialized by ns_snapshot_mount_mutex,
so only the race against nilfs_lookup_root() needs to be closed.
Because kobject_put() does not guarantee that the embedded kobject's
release callback has run by the time it returns
(CONFIG_DEBUG_KOBJECT_RELEASE defers it), the container must not be
freed until the release completes. Keep that wait_for_completion() of
snapshot_kobj_unregister inside the sysfs helpers, so both the creation
error path and nilfs_sysfs_delete_snapshot_group() wait for the release
before their callers free the root.
Fixes: dd70edbde262 ("nilfs2: integrate sysfs support into driver")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 5 ++++-
fs/nilfs2/the_nilfs.c | 34 +++++++++++++++++++++-------------
2 files changed, 25 insertions(+), 14 deletions(-)
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index bc52afbfc5c73..5bb74a45ad1ed 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -195,8 +195,10 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root)
"%llu", root->cno);
}
- if (err)
+ if (err) {
kobject_put(&root->snapshot_kobj);
+ wait_for_completion(&root->snapshot_kobj_unregister);
+ }
return err;
}
@@ -204,6 +206,7 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root)
void nilfs_sysfs_delete_snapshot_group(struct nilfs_root *root)
{
kobject_put(&root->snapshot_kobj);
+ wait_for_completion(&root->snapshot_kobj_unregister);
}
/************************************************************************
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index f3805e7aabeb5..38c6d4afefba9 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -887,6 +887,26 @@ nilfs_find_or_create_root(struct the_nilfs *nilfs, __u64 cno)
if (!new)
return NULL;
+ new->cno = cno;
+ new->ifile = NULL;
+ new->nilfs = nilfs;
+ refcount_set(&new->count, 1);
+ atomic64_set(&new->inodes_count, 0);
+ atomic64_set(&new->blocks_count, 0);
+
+ /*
+ * Register the sysfs group before publishing the root in the
+ * checkpoint tree. nilfs_sysfs_create_snapshot_group() can sleep,
+ * so it must run outside ns_cptree_lock; creating it first also
+ * ensures a concurrent nilfs_lookup_root() can never observe a root
+ * whose sysfs registration later fails and gets freed.
+ */
+ err = nilfs_sysfs_create_snapshot_group(new);
+ if (err) {
+ kfree(new);
+ return NULL;
+ }
+
spin_lock(&nilfs->ns_cptree_lock);
p = &nilfs->ns_cptree.rb_node;
@@ -903,29 +923,17 @@ nilfs_find_or_create_root(struct the_nilfs *nilfs, __u64 cno)
} else {
refcount_inc(&root->count);
spin_unlock(&nilfs->ns_cptree_lock);
+ nilfs_sysfs_delete_snapshot_group(new);
kfree(new);
return root;
}
}
- new->cno = cno;
- new->ifile = NULL;
- new->nilfs = nilfs;
- refcount_set(&new->count, 1);
- atomic64_set(&new->inodes_count, 0);
- atomic64_set(&new->blocks_count, 0);
-
rb_link_node(&new->rb_node, parent, p);
rb_insert_color(&new->rb_node, &nilfs->ns_cptree);
spin_unlock(&nilfs->ns_cptree_lock);
- err = nilfs_sysfs_create_snapshot_group(new);
- if (err) {
- kfree(new);
- new = NULL;
- }
-
return new;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0249/1257] EDAC/i10nm: Fix mdev reference leak in i10nm_get_ddr_munits()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0248/1257] nilfs2: fix checkpoint root lifetime on sysfs errors Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0250/1257] md: validate bblog_size when loading v1.x badblocks metadata Greg Kroah-Hartman
` (749 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Tony Luck, Qiuxu Zhuo,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit f0d8c34b3b5e845113581d7d3b24ddaa61bce1f0 ]
In i10nm_get_ddr_munits(), get_ddr_munit() returns a PCI device with
its reference count incremented. If ioremap() fails to map the MMIO
space of the memory controller, the function returns -ENODEV without
putting the reference held by mdev, leaking it.
Put the device reference before returning on the ioremap failure path.
[Tony: Dropped the Cc: stable tag]
Fixes: c545f5e41225 ("EDAC/i10nm: Skip the absent memory controllers")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Qiuxu Zhuo <qzhuo@nvidia.com>
Link: https://patch.msgid.link/20260916091251.1997522-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/edac/i10nm_base.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
index fa1853f252b06..12e1949fcf44f 100644
--- a/drivers/edac/i10nm_base.c
+++ b/drivers/edac/i10nm_base.c
@@ -634,6 +634,7 @@ static int i10nm_get_ddr_munits(void)
mbase = ioremap(base + off, size);
if (!mbase) {
+ pci_dev_put(mdev);
i10nm_printk(KERN_ERR, "Failed to ioremap 0x%llx\n",
base + off);
return -ENODEV;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0250/1257] md: validate bblog_size when loading v1.x badblocks metadata
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0249/1257] EDAC/i10nm: Fix mdev reference leak in i10nm_get_ddr_munits() Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0251/1257] crypto: qat - fix error source for QAT GEN6 transmit interface faults Greg Kroah-Hartman
` (748 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuchao Zhang, Yu Kuai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchao Zhang <ndaugoing@gmail.com>
[ Upstream commit ae5f89b23cb88667cfa1273b42d6a551db9c651e ]
In super_1_load(), when the on-disk feature_map does not have
MD_FEATURE_BAD_BLOCKS set but sb->bblog_offset is non-zero,
rdev->badblocks.shift is initialized to 0 without validating
sb->bblog_size. The same field is validated in the
MD_FEATURE_BAD_BLOCKS branch ("sectors > (PAGE_SIZE / 512)"), but this
branch bypasses that check.
A forged on-disk superblock (malicious storage device or crafted
image) can therefore carry an oversized sb->bblog_size. When bad
blocks are later recorded, super_1_sync() sets bb->size from
sb->bblog_size and md_write_metadata() issues a bio larger than the
single rdev->bb_page, reading beyond the page and leaking kernel
memory contents to disk.
sb->bblog_size is never modified by the kernel between load and sync,
and the MD_FEATURE_BAD_BLOCKS branch already validates it, so checking
it in this branch is sufficient to cover both paths.
Fix this by rejecting an oversized sb->bblog_size with -EINVAL,
matching the existing check in the MD_FEATURE_BAD_BLOCKS branch.
Fixes: 2699b67223ac ("md: load/store badblock list from v1.x metadata")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchao Zhang <ndaugoing@gmail.com>
Link: https://patch.msgid.link/20260922044606.30774-1-ndaugoing@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63cb3d..1caa92b40f9a7 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1934,8 +1934,11 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
if (!badblocks_set(&rdev->badblocks, sector, count, 1))
return -EINVAL;
}
- } else if (sb->bblog_offset != 0)
+ } else if (sb->bblog_offset != 0) {
+ if (le16_to_cpu(sb->bblog_size) > (PAGE_SIZE / 512))
+ return -EINVAL;
rdev->badblocks.shift = 0;
+ }
if ((le32_to_cpu(sb->feature_map) &
(MD_FEATURE_PPL | MD_FEATURE_MULTIPLE_PPLS))) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0251/1257] crypto: qat - fix error source for QAT GEN6 transmit interface faults
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0250/1257] md: validate bblog_size when loading v1.x badblocks metadata Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0252/1257] crypto: amlogic - Fix IRQ handler return value and fallthrough logic Greg Kroah-Hartman
` (747 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suman Kumar Chakraborty,
Giovanni Cabiddu, Ahsan Atta, Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com>
[ Upstream commit eeaf1ccd4c05d9c6ad67345862b36670e8e4dfc2 ]
TI_CD_PAR_STS faults were being decoded under ERRSOU1, which is
incorrect for QAT GEN6 devices. They are actually raised on ERRSOU3.
Move the handling of TI_CD_PAR_STS faults as part of the ERRSOU3 logic
and split the status bits by their actual source:
- Bits 0-18 (TI_INT_ERR_DEVHALT) handled when a DEVHALT is signalled
and are counted once as ADF_RAS_FATAL.
- Bit 19 (TIMISCSTS) handled separately and counted as ADF_RAS_UNCORR.
Previously, a TI_INT_ERR_DEVHALT fault also incremented ADF_RAS_UNCORR
in addition to ADF_RAS_FATAL. Since a DEVHALT is already fatal, remove
the redundant increment.
Bits 20-25 of TI_CD_PAR_STS are unused/reserved on QAT GEN6. Remove them
from the mask.
Cc: stable@vger.kernel.org
Fixes: 7f3401d0a506 ("crypto: qat - enable RAS support for GEN6 devices")
Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../intel/qat/qat_common/adf_gen6_ras.c | 20 +++++++++++++---
.../intel/qat/qat_common/adf_gen6_ras.h | 24 ++++++++++---------
2 files changed, 30 insertions(+), 14 deletions(-)
diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c
index 967253082a984..902c4b1a23e3b 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c
@@ -323,14 +323,26 @@ static void adf_handle_ti_cd_par_sts(struct adf_accel_dev *accel_dev, void __iom
u32 ti_cd_par_sts;
ti_cd_par_sts = ADF_CSR_RD(csr, ADF_GEN6_TI_CD_PAR_STS);
- ti_cd_par_sts &= ADF_GEN6_TI_CD_PAR_STS_MASK;
+ ti_cd_par_sts &= ADF_GEN6_TI_CD_PAR_STS_TI_INT_ERR_DEVHALT_MASK;
if (ti_cd_par_sts) {
dev_err(&GET_DEV(accel_dev), "TI CD parity error: %#x\n", ti_cd_par_sts);
- ADF_RAS_ERR_CTR_INC(accel_dev->ras_errors, ADF_RAS_UNCORR);
ADF_CSR_WR(csr, ADF_GEN6_TI_CD_PAR_STS, ti_cd_par_sts);
}
}
+static void adf_handle_ti_misc_cd_par_sts(struct adf_accel_dev *accel_dev, void __iomem *csr)
+{
+ u32 ti_misc_cd_par_sts;
+
+ ti_misc_cd_par_sts = ADF_CSR_RD(csr, ADF_GEN6_TI_CD_PAR_STS);
+ ti_misc_cd_par_sts &= ADF_GEN6_TI_CD_PAR_STS_TI_MISC_MASK;
+ if (ti_misc_cd_par_sts) {
+ dev_err(&GET_DEV(accel_dev), "TI MISC CD parity error: %#x\n", ti_misc_cd_par_sts);
+ ADF_RAS_ERR_CTR_INC(accel_dev->ras_errors, ADF_RAS_UNCORR);
+ ADF_CSR_WR(csr, ADF_GEN6_TI_CD_PAR_STS, ti_misc_cd_par_sts);
+ }
+}
+
static void adf_handle_ti_trnsb_par_sts(struct adf_accel_dev *accel_dev, void __iomem *csr)
{
u32 ti_trnsb_par_sts;
@@ -367,7 +379,6 @@ static void adf_handle_ti_err(struct adf_accel_dev *accel_dev, void __iomem *csr
adf_handle_ti_ci_par_sts(accel_dev, csr);
adf_handle_ti_pullfub_par_sts(accel_dev, csr);
adf_handle_ti_pushfub_par_sts(accel_dev, csr);
- adf_handle_ti_cd_par_sts(accel_dev, csr);
adf_handle_ti_trnsb_par_sts(accel_dev, csr);
adf_handle_iosfp_cmd_parerr(accel_dev, csr);
}
@@ -591,6 +602,8 @@ static void adf_handle_timiscsts(struct adf_accel_dev *accel_dev, void __iomem *
if (!(errsou & ADF_GEN6_ERRSOU3_TIMISCSTS_BIT))
return;
+ adf_handle_ti_misc_cd_par_sts(accel_dev, csr);
+
timiscsts = ADF_CSR_RD(csr, ADF_GEN6_TIMISCSTS);
if (timiscsts) {
dev_err(&GET_DEV(accel_dev), "Fatal error in transmit interface: %#x\n",
@@ -730,6 +743,7 @@ static void adf_handle_ti_int_err_devhalt(struct adf_accel_dev *accel_dev, void
if (!(errsou & ADF_GEN6_ERRSOU3_TI_INT_ERR_DEVHALT_BIT))
return;
+ adf_handle_ti_cd_par_sts(accel_dev, csr);
dev_err(&GET_DEV(accel_dev), "DEVHALT due to a TI internal memory error\n");
ADF_RAS_ERR_CTR_INC(accel_dev->ras_errors, ADF_RAS_FATAL);
}
diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h
index 66ced271d1733..11f7b2986f567 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h
+++ b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h
@@ -170,23 +170,25 @@ struct adf_ras_ops;
#define ADF_GEN6_TI_CD_PAR_ERR_MASK 0x500638
/*
- * TI CD parity status mask
+ * TI CD parity status mask - TI_INT_ERR_DEVHALT bits
* BIT(0) - BIT(15) - CtxMdRam[0:15]_sts parity status
* BIT(16) - Leaf2ClusterRam_sts parity status
* BIT(17) - BIT(18) - Ring2LeafRam[0:1]_sts parity status
- * BIT(19) - VirtualQ_sts parity status
- * BIT(20) - DtRdQ_sts parity status
- * BIT(21) - DtWrQ_sts parity status
- * BIT(22) - RiCmdQ_sts parity status
- * BIT(23) - BypassQ_sts parity status
- * BIT(24) - DtRdQ_sc_sts parity status
- * BIT(25) - DtWrQ_sc_sts parity status
*/
-#define ADF_GEN6_TI_CD_PAR_STS_MASK \
+#define ADF_GEN6_TI_CD_PAR_STS_TI_INT_ERR_DEVHALT_MASK \
(BIT(0) | BIT(1) | BIT(2) | BIT(3) | BIT(4) | BIT(5) | BIT(6) | \
BIT(7) | BIT(8) | BIT(9) | BIT(10) | BIT(11) | BIT(12) | BIT(13) | \
- BIT(14) | BIT(15) | BIT(16) | BIT(17) | BIT(18) | BIT(19) | BIT(20) | \
- BIT(21) | BIT(22) | BIT(23) | BIT(24) | BIT(25))
+ BIT(14) | BIT(15) | BIT(16) | BIT(17) | BIT(18))
+
+/*
+ * TI CD parity status mask - TIMISCSTS bit
+ * BIT(19) - VirtualQ_sts parity status
+ */
+#define ADF_GEN6_TI_CD_PAR_STS_TI_MISC_MASK BIT(19)
+
+#define ADF_GEN6_TI_CD_PAR_STS_MASK \
+ (ADF_GEN6_TI_CD_PAR_STS_TI_INT_ERR_DEVHALT_MASK | \
+ ADF_GEN6_TI_CD_PAR_STS_TI_MISC_MASK)
/* TI TRNSB parity status */
#define ADF_GEN6_TI_TRNSB_PAR_STS 0x500648
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0252/1257] crypto: amlogic - Fix IRQ handler return value and fallthrough logic
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0251/1257] crypto: qat - fix error source for QAT GEN6 transmit interface faults Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0253/1257] crypto: hisilicon/hpre - fix pointer dereference before length check Greg Kroah-Hartman
` (746 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mohamad Raizudeen, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
[ Upstream commit 4b8ae2732070c5669adee2d5d3bb97b14af53a63 ]
In meson_irq_handler(), when an interrupt matches a flow but the status
register is empty, the driver prints an error but doesn't return. It
falls through the loop and incorrectly prints an `unknown irq` message.
Fix this by returning immediately. For empty status registers, return
IRQ_NONE instead of IRQ_HANDLED to avoid masking spurious interrupts and
allow the kernel to detect interrupt storms. Also use
dev_err_ratelimited() to prevent console lockups during an interrupt
storm.
Additionally, the handler returned IRQ_HANDLED for genuinely unknown
interrupts. Return IRQ_NONE instead for unhandled interrupts.
Cc: stable@vger.kernel.org
Fixes: 48fe583fe5417 ("crypto: amlogic - Add crypto accelerator for amlogic GXL")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/amlogic/amlogic-gxl-core.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/amlogic/amlogic-gxl-core.c b/drivers/crypto/amlogic/amlogic-gxl-core.c
index 169c6eeb51e51..09d3ccd92b80d 100644
--- a/drivers/crypto/amlogic/amlogic-gxl-core.c
+++ b/drivers/crypto/amlogic/amlogic-gxl-core.c
@@ -37,12 +37,13 @@ static irqreturn_t meson_irq_handler(int irq, void *data)
complete(&mc->chanlist[flow].complete);
return IRQ_HANDLED;
}
- dev_err(mc->dev, "%s %d Got irq for flow %d but ctrl is empty\n", __func__, irq, flow);
+ dev_err_ratelimited(mc->dev, "%s %d Got irq for flow %d but ctrl is empty\n", __func__, irq, flow);
+ return IRQ_NONE;
}
}
- dev_err(mc->dev, "%s %d from unknown irq\n", __func__, irq);
- return IRQ_HANDLED;
+ dev_err_ratelimited(mc->dev, "%s %d from unknown irq\n", __func__, irq);
+ return IRQ_NONE;
}
static struct meson_alg_template mc_algs[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0253/1257] crypto: hisilicon/hpre - fix pointer dereference before length check
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0252/1257] crypto: amlogic - Fix IRQ handler return value and fallthrough logic Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0254/1257] crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer Greg Kroah-Hartman
` (745 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weili Qian, Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <qianweili@huawei.com>
[ Upstream commit 9770bb7d335f8f8db01e99168bbdd9ce2cb6238c ]
In hpre_rsa_drop_leading_zeros(), the loop condition dereferences *ptr
before checking *len, causing an out-of-bounds read when *len is zero.
Swap to while (*len && !**ptr) to test length first.
Fixes: c8b4b477079d ("crypto: hisilicon - add HiSilicon HPRE accelerator")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index 09077abbf6ade..7894211b99727 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -720,7 +720,7 @@ static void hpre_dh_exit_tfm(struct crypto_kpp *tfm)
static void hpre_rsa_drop_leading_zeros(const char **ptr, size_t *len)
{
- while (!**ptr && *len) {
+ while (*len && !**ptr) {
(*ptr)++;
(*len)--;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0254/1257] crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0253/1257] crypto: hisilicon/hpre - fix pointer dereference before length check Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0255/1257] crypto: hisilicon/hpre - fix ECDH destination DMA mapping Greg Kroah-Hartman
` (744 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weili Qian, Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <qianweili@huawei.com>
[ Upstream commit 232804a5ed70a8ace32c46d341d438aeba54bc67 ]
hpre_ecdh_msg_request_set() returns -EINVAL when the output buffer
is too small, after setting req->dst_len to the required size.
-EINVAL is misleading because the caller can retry with a larger
buffer. Return -EOVERFLOW as other kpp implementations do.
Fixes: 05e7b906aa7c ("crypto: hisilicon/hpre - add 'ECDH' algorithm")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index 7894211b99727..bad9fe5d8c3c2 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -1452,7 +1452,7 @@ static int hpre_ecdh_msg_request_set(struct hpre_ctx *ctx,
if (req->dst_len < ctx->key_sz << 1) {
req->dst_len = ctx->key_sz << 1;
- return -EINVAL;
+ return -EOVERFLOW;
}
tmp = kpp_request_ctx(req);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0255/1257] crypto: hisilicon/hpre - fix ECDH destination DMA mapping
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0254/1257] crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0256/1257] crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent Greg Kroah-Hartman
` (743 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weili Qian, Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <qianweili@huawei.com>
[ Upstream commit 12d8edda8cdb41d18c4891851e25bf58be6be995 ]
hpre_ecdh_dst_data_init() rejects valid requests whose output length
does not equal ctx->key_sz << 1, and maps the user buffer using the
user-provided len instead of the hardware transfer size. Drop the
redundant length check and use ctx->key_sz << 1 for dma_map_single()
so the whole hardware output is mapped.
Fixes: 05e7b906aa7c ("crypto: hisilicon/hpre - add 'ECDH' algorithm")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index bad9fe5d8c3c2..64294b3a48f15 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -1512,13 +1512,13 @@ static int hpre_ecdh_dst_data_init(struct hpre_asym_request *hpre_req,
struct device *dev = ctx->dev;
dma_addr_t dma;
- if (unlikely(!data || !sg_is_last(data) || len != ctx->key_sz << 1)) {
- dev_err(dev, "data or data length is illegal!\n");
+ if (unlikely(!data || !sg_is_last(data))) {
+ dev_err(dev, "data is illegal!\n");
return -EINVAL;
}
hpre_req->dst = NULL;
- dma = dma_map_single(dev, sg_virt(data), len, DMA_FROM_DEVICE);
+ dma = dma_map_single(dev, sg_virt(data), ctx->key_sz << 1, DMA_FROM_DEVICE);
if (unlikely(dma_mapping_error(dev, dma))) {
dev_err(dev, "dma map data err!\n");
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0256/1257] crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0255/1257] crypto: hisilicon/hpre - fix ECDH destination DMA mapping Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0257/1257] crypto: qat - zero the VF migration state buffer on save Greg Kroah-Hartman
` (742 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weili Qian, Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <qianweili@huawei.com>
[ Upstream commit 40ec9605cb195e065470f8f23ef94b1b541411a3 ]
The HPRE driver hard-codes GFP_ATOMIC for RSA/DH and GFP_KERNEL for
ECDH. This may cause "scheduling while atomic" in atomic context or
unnecessary allocation failures under memory pressure.
Select GFP flags dynamically based on CRYPTO_TFM_REQ_MAY_SLEEP and
store them in hpre_asym_request::flags. The areq field is a union of
rsa/dh/ecdh request pointers; reading base.flags through any union
member other than the one that was written would be type-punning, so
a dedicated flags field avoids that.
Fixes: 98dfa9343f37 ("crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index 64294b3a48f15..0861f06da8eea 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -138,6 +138,7 @@ struct hpre_asym_request {
int err;
hpre_cb cb;
struct timespec64 req_time;
+ u32 flags;
};
static inline unsigned int hpre_align_sz(void)
@@ -186,6 +187,7 @@ static int hpre_prepare_dma_buf(struct hpre_asym_request *hpre_req,
struct scatterlist *data, unsigned int len,
int is_src, dma_addr_t *tmp)
{
+ gfp_t gfp = hpre_req->flags & CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL : GFP_ATOMIC;
struct hpre_ctx *ctx = hpre_req->ctx;
struct device *dev = ctx->dev;
void *ptr;
@@ -195,7 +197,7 @@ static int hpre_prepare_dma_buf(struct hpre_asym_request *hpre_req,
if (unlikely(shift < 0))
return -EINVAL;
- ptr = dma_alloc_coherent(dev, ctx->key_sz, tmp, GFP_ATOMIC);
+ ptr = dma_alloc_coherent(dev, ctx->key_sz, tmp, gfp);
if (unlikely(!ptr))
return -ENOMEM;
@@ -419,6 +421,7 @@ static int hpre_msg_request_set(struct hpre_ctx *ctx, void *req, bool is_rsa)
h_req = PTR_ALIGN(tmp, hpre_align_sz());
h_req->cb = hpre_rsa_cb;
h_req->areq.rsa = akreq;
+ h_req->flags = akreq->base.flags;
msg = &h_req->req;
memset(msg, 0, sizeof(*msg));
} else {
@@ -433,6 +436,7 @@ static int hpre_msg_request_set(struct hpre_ctx *ctx, void *req, bool is_rsa)
h_req = PTR_ALIGN(tmp, hpre_align_sz());
h_req->cb = hpre_dh_cb;
h_req->areq.dh = kreq;
+ h_req->flags = kreq->base.flags;
msg = &h_req->req;
memset(msg, 0, sizeof(*msg));
msg->key = cpu_to_le64(ctx->dh.dma_xa_p);
@@ -1459,6 +1463,7 @@ static int hpre_ecdh_msg_request_set(struct hpre_ctx *ctx,
h_req = PTR_ALIGN(tmp, hpre_align_sz());
h_req->cb = hpre_ecdh_cb;
h_req->areq.ecdh = req;
+ h_req->flags = req->base.flags;
msg = &h_req->req;
memset(msg, 0, sizeof(*msg));
msg->in = cpu_to_le64(DMA_MAPPING_ERROR);
@@ -1477,6 +1482,7 @@ static int hpre_ecdh_msg_request_set(struct hpre_ctx *ctx,
static int hpre_ecdh_src_data_init(struct hpre_asym_request *hpre_req,
struct scatterlist *data, unsigned int len)
{
+ gfp_t gfp = hpre_req->flags & CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL : GFP_ATOMIC;
struct hpre_sqe *msg = &hpre_req->req;
struct hpre_ctx *ctx = hpre_req->ctx;
struct device *dev = ctx->dev;
@@ -1490,7 +1496,7 @@ static int hpre_ecdh_src_data_init(struct hpre_asym_request *hpre_req,
if (unlikely(shift < 0))
return -EINVAL;
- ptr = dma_alloc_coherent(dev, ctx->key_sz << 2, &dma, GFP_KERNEL);
+ ptr = dma_alloc_coherent(dev, ctx->key_sz << 2, &dma, gfp);
if (unlikely(!ptr))
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0257/1257] crypto: qat - zero the VF migration state buffer on save
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0256/1257] crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0258/1257] media: cec: extron: clear response tail before dispatch Greg Kroah-Hartman
` (741 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 5d504e65516dde8c88117378292e9c78f3d2cf58 ]
The QAT VF migration state buffer is allocated with kmalloc(), while
qat_vf_save_state() exposes all state_size bytes to userspace. The state
manager writes only the serialized sections, leaving the unused tail
unchanged. The first save can therefore disclose stale heap contents,
and subsequent saves can disclose data left by an earlier migration.
Zero the whole buffer before writing the setup data. Once the setup data
is present, preserve it and zero the remaining state area before each
state save.
Fixes: f0bbfc391aa7 ("crypto: qat - implement interface for live migration")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c b/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
index bf2bae78a40d5..d8b961b2f2f7f 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
@@ -837,6 +837,9 @@ static int adf_gen4_vfmig_save_state(struct qat_mig_dev *mdev)
return ret;
}
+ memset(mdev->state + mdev->setup_size, 0,
+ mdev->state_size - mdev->setup_size);
+
adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state + mdev->setup_size,
mdev->state_size - mdev->setup_size);
if (!adf_mstate_preamble_add(vfmig->mstate_mgr))
@@ -934,6 +937,8 @@ static int adf_gen4_vfmig_save_setup(struct qat_mig_dev *mdev)
if (mdev->setup_size)
return 0;
+ memset(mdev->state, 0, mdev->state_size);
+
adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state, mdev->state_size);
if (!adf_mstate_preamble_add(vfmig->mstate_mgr))
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0258/1257] media: cec: extron: clear response tail before dispatch
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0257/1257] crypto: qat - zero the VF migration state buffer on save Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0259/1257] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions Greg Kroah-Hartman
` (740 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <hppiscas@163.com>
[ Upstream commit a601427f03e015e3d4d2ba44cfa6e0de144983b9 ]
The serial receive buffer is reused between responses. Terminating a
short response with one NUL leaves bytes from the previous response
behind it, while the dispatcher also checks fixed offsets beyond some
prefixes. Those checks can consume stale tail bytes.
Clear up to ten bytes at the end of each completed response, limited by
the remaining array capacity. This includes the terminator and covers
the dispatcher's fixed-offset tests without adding a separate length
condition to every prefix branch.
The issue was found by our static-analysis tool.
Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver")
Cc: stable@vger.kernel.org
Assisted-by: gpt 5
Signed-off-by: Pengpeng Hou <hppiscas@163.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
index 3c6ce6f3d93e7..1f8ed7ff31e52 100644
--- a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
+++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
@@ -847,7 +847,9 @@ static irqreturn_t extron_interrupt(struct serio *serio, unsigned char data,
return IRQ_HANDLED;
memcpy(extron->data, extron->buf, extron->idx);
extron->len = extron->idx;
- extron->data[extron->len] = 0;
+ /* Keep fixed-offset response tests from using stale tail bytes. */
+ memset(extron->data + extron->len, 0,
+ min_t(size_t, 10, sizeof(extron->data) - extron->len));
if (debug)
dev_info(extron->dev, "received %s\n", extron->data);
extron->idx = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0259/1257] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0258/1257] media: cec: extron: clear response tail before dispatch Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0260/1257] media: adv748x: Fix endpoint reference leaks on probe failure Greg Kroah-Hartman
` (739 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+cf896de36144391bcde1,
Hans Verkuil, Rohinthan P, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohinthan P <rokinthanp03@gmail.com>
[ Upstream commit 9ff738f93084351ed6e818d4d58679a9e9083a8d ]
The V4L2 control framework is designed to allow drivers to instantiate
controls and clusters without checking for errors after each call,
checking hdl->error only once at the end.
However, if allocating the master control (controls[0]) fails, e.g. due to
memory allocation failure, v4l2_ctrl_cluster() triggers a WARNING:
ncontrols == 0 || controls[0] == NULL
WARNING: drivers/media/v4l2-core/v4l2-ctrls-core.c:2525 at v4l2_ctrl_cluster
Additionally, v4l2_ctrl_auto_cluster() attempts to dereference
master->minimum without checking if controls[0] is NULL, leading to a
NULL pointer dereference when master control creation fails.
Update both v4l2_ctrl_cluster() and v4l2_ctrl_auto_cluster() to silently
return if controls[0] is NULL, preserving the design that control
creation errors are caught at the end when the driver checks hdl->error.
Also update function documentation in include/media/v4l2-ctrls.h.
Fixes: 71c689dc2e73 ("media: v4l2-ctrls: split up into four source files")
Cc: stable@vger.kernel.org
Reported-by: syzbot+cf896de36144391bcde1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cf896de36144391bcde1
Suggested-by: Hans Verkuil <hverkuil@kernel.org>
Signed-off-by: Rohinthan P <rokinthanp03@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[hverkuil: simplified the v4l2_ctrl_auto_cluster code a bit]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-ctrls-core.c | 12 ++++++++++--
include/media/v4l2-ctrls.h | 6 ++++++
2 files changed, 16 insertions(+), 2 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
index 47fb60b1f0c07..6e751a043a210 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -2561,7 +2561,10 @@ void v4l2_ctrl_cluster(unsigned ncontrols, struct v4l2_ctrl **controls)
int i;
/* The first control is the master control and it must not be NULL */
- if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
+ if (WARN_ON(ncontrols == 0))
+ return;
+
+ if (!controls[0])
return;
for (i = 0; i < ncontrols; i++) {
@@ -2583,8 +2586,13 @@ void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl **controls,
u32 flag = 0;
int i;
+ if (WARN_ON(ncontrols <= 1))
+ return;
+
+ if (!master)
+ return;
+
v4l2_ctrl_cluster(ncontrols, controls);
- WARN_ON(ncontrols <= 1);
WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
master->is_auto = true;
diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
index 327976b14d50b..cec9217d97ac6 100644
--- a/include/media/v4l2-ctrls.h
+++ b/include/media/v4l2-ctrls.h
@@ -834,6 +834,9 @@ bool v4l2_ctrl_radio_filter(const struct v4l2_ctrl *ctrl);
*
* @ncontrols: The number of controls in this cluster.
* @controls: The cluster control array of size @ncontrols.
+ *
+ * If controls[0] is NULL, then this function does nothing and just
+ * returns.
*/
void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl **controls);
@@ -845,6 +848,9 @@ void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl **controls);
* @ncontrols: The number of controls in this cluster.
* @controls: The cluster control array of size @ncontrols. The first control
* must be the 'auto' control (e.g. autogain, autoexposure, etc.)
+ *
+ * If controls[0] is NULL, then this function does nothing and just
+ * returns.
* @manual_val: The value for the first control in the cluster that equals the
* manual setting.
* @set_volatile: If true, then all controls except the first auto control will
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0260/1257] media: adv748x: Fix endpoint reference leaks on probe failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0259/1257] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0261/1257] media: marvell: manage the MMP camera clock provider Greg Kroah-Hartman
` (738 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Ruoyu Wang,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 359db09cf055497075a668b192f4578a0ed00955 ]
adv748x_parse_dt() takes an extra reference for every endpoint saved in
state->endpoints. If parsing later fails, adv748x_probe() skips
adv748x_dt_cleanup(), so the saved references remain held. A CSI-2 lane
parsing error also returns from for_each_endpoint_of_node() without
dropping the iterator's reference.
Save the endpoint reference only after lane parsing succeeds. Drop the
iterator reference before returning a lane parsing error and route all
parse failures through the endpoint cleanup path to release any saved
references. This retains the endpoints only for a successful probe.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 6a18865da8e3 ("media: i2c: adv748x: store number of CSI-2 lanes described in device tree")
Fixes: eccf442ce156 ("media: i2c: adv748x: Support probing a single output")
Cc: stable@vger.kernel.org
Suggested-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/adv748x/adv748x-core.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/media/i2c/adv748x/adv748x-core.c b/drivers/media/i2c/adv748x/adv748x-core.c
index 3eb6d5e8f0826..70594d0018048 100644
--- a/drivers/media/i2c/adv748x/adv748x-core.c
+++ b/drivers/media/i2c/adv748x/adv748x-core.c
@@ -675,9 +675,6 @@ static int adv748x_parse_dt(struct adv748x_state *state)
continue;
}
- of_node_get(ep_np);
- state->endpoints[ep.port] = ep_np;
-
/*
* At least one input endpoint and one output endpoint shall
* be defined.
@@ -689,8 +686,13 @@ static int adv748x_parse_dt(struct adv748x_state *state)
/* Store number of CSI-2 lanes used for TXA and TXB. */
ret = adv748x_parse_csi2_lanes(state, ep.port, ep_np);
- if (ret)
+ if (ret) {
+ of_node_put(ep_np);
return ret;
+ }
+
+ of_node_get(ep_np);
+ state->endpoints[ep.port] = ep_np;
}
return in_found && out_found ? 0 : -ENODEV;
@@ -739,7 +741,7 @@ static int adv748x_probe(struct i2c_client *client)
ret = adv748x_parse_dt(state);
if (ret) {
adv_err(state, "Failed to parse device tree");
- goto err_free_mutex;
+ goto err_cleanup_dt;
}
/* Configure IO Regmap region */
@@ -809,7 +811,6 @@ static int adv748x_probe(struct i2c_client *client)
adv748x_unregister_clients(state);
err_cleanup_dt:
adv748x_dt_cleanup(state);
-err_free_mutex:
mutex_destroy(&state->mutex);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0261/1257] media: marvell: manage the MMP camera clock provider
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0260/1257] media: adv748x: Fix endpoint reference leaks on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0262/1257] media: go7007: unregister the I2C adapter on USB probe failure Greg Kroah-Hartman
` (737 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 9887716132d6c3c58cc67841dfb441c5a4a0d209 ]
mmpcam_probe() registers an OF clock provider before requesting the IRQ.
Neither a later probe failure nor driver removal unregisters that provider,
although the underlying clock is registered with devm_clk_register().
This leaves the provider referring to a clock whose lifetime has ended.
Use devm_of_clk_add_hw_provider() with the existing mclk_hw so the provider
is unregistered before the managed clock and camera storage are released.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 81a409bfd551 ("media: marvell-ccic: provide a clock for the sensor")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:GPT-5.6
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/marvell/mmp-driver.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/marvell/mmp-driver.c b/drivers/media/platform/marvell/mmp-driver.c
index d3da7ebb4a2be..4c31b62751a12 100644
--- a/drivers/media/platform/marvell/mmp-driver.c
+++ b/drivers/media/platform/marvell/mmp-driver.c
@@ -25,6 +25,7 @@
#include <linux/list.h>
#include <linux/pm.h>
#include <linux/clk.h>
+#include <linux/clk-provider.h>
#include "mcam-core.h"
@@ -269,8 +270,8 @@ static int mmpcam_probe(struct platform_device *pdev)
/*
* Add OF clock provider.
*/
- ret = of_clk_add_provider(pdev->dev.of_node, of_clk_src_simple_get,
- mcam->mclk);
+ ret = devm_of_clk_add_hw_provider(&pdev->dev, of_clk_hw_simple_get,
+ &mcam->mclk_hw);
if (ret) {
dev_err(&pdev->dev, "can't add DT clock provider\n");
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0262/1257] media: go7007: unregister the I2C adapter on USB probe failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0261/1257] media: marvell: manage the MMP camera clock provider Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0263/1257] media: cx18: Disable PCI device on " Greg Kroah-Hartman
` (736 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 14165cd16fa7c233aec6a407b56b304e7a283911 ]
USB probe failures after I2C adapter registration free the backing
go7007 structure without unregistering the adapter.
If i2c_adapter_online is set, unregister the adapter before releasing
USB resources so that I2C client removal can still use its callbacks.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: 59aea928d57f ("[media] go7007: don't continue if firmware can't be loaded")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Assisted-by: OpenAI:GPT-5.6
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/go7007/go7007-usb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index 867548d655b3f..dc5b8750a110b 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1326,6 +1326,8 @@ static int go7007_usb_probe(struct usb_interface *intf,
return 0;
allocfail:
+ if (go->i2c_adapter_online)
+ i2c_del_adapter(&go->i2c_adapter);
go7007_usb_release(go);
kfree(go);
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0263/1257] media: cx18: Disable PCI device on probe failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0262/1257] media: go7007: unregister the I2C adapter on USB probe failure Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0264/1257] media: tw68: balance PCI enable on cleanup Greg Kroah-Hartman
` (735 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 2aefbc29765641e1e1a26b96cee194ac7d34ff49 ]
cx18_setup_pci() enables the PCI device but does not disable it when
DMA mask setup or the memory-region reservation fails. Later probe
failure paths release the region without balancing the enable either.
Unwind the enable inside cx18_setup_pci() when that helper fails after
enabling the device. Once setup succeeds, disable it in the probe
cleanup after releasing the memory region. Setup failures skip that
cleanup, so each successful enable is balanced exactly once.
Keep the existing error codes and normal removal path unchanged.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Assisted-by: OpenAI:GPT-5.6
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx18/cx18-driver.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c
index 214fac7af61e5..ac90ce6cd0445 100644
--- a/drivers/media/pci/cx18/cx18-driver.c
+++ b/drivers/media/pci/cx18/cx18-driver.c
@@ -805,12 +805,12 @@ static int cx18_setup_pci(struct cx18 *cx, struct pci_dev *pci_dev,
}
if (dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(32))) {
CX18_ERR("No suitable DMA available, card %d\n", cx->instance);
- return -EIO;
+ goto err_disable_device;
}
if (!request_mem_region(cx->base_addr, CX18_MEM_SIZE, "cx18 encoder")) {
CX18_ERR("Cannot request encoder memory region, card %d\n",
cx->instance);
- return -EIO;
+ goto err_disable_device;
}
/* Enable bus mastering and memory mapped IO for the CX23418 */
@@ -834,6 +834,10 @@ static int cx18_setup_pci(struct cx18 *cx, struct pci_dev *pci_dev,
cx->pci_dev->irq, pci_latency, (u64)cx->base_addr);
return 0;
+
+err_disable_device:
+ pci_disable_device(pci_dev);
+ return -EIO;
}
static void cx18_init_subdevs(struct cx18 *cx)
@@ -1120,6 +1124,7 @@ static int cx18_probe(struct pci_dev *pci_dev,
cx18_iounmap(cx);
free_mem:
release_mem_region(cx->base_addr, CX18_MEM_SIZE);
+ pci_disable_device(pci_dev);
free_workqueues:
destroy_workqueue(cx->in_work_queue);
err:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0264/1257] media: tw68: balance PCI enable on cleanup
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0263/1257] media: cx18: Disable PCI device on " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0265/1257] media: adv7180: Initialize mutex before ancillary clients Greg Kroah-Hartman
` (734 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit fc02261fdca3ea95e4dcb6b38ab77f0f197c3750 ]
tw68_initdev() leaves the PCI device enabled after a later probe failure
or tw68_finidev(). Use pcim_enable_device() to balance the enable reference
when the driver is detached or probe fails.
The managed disable runs after the managed IRQ has been released.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: e15d1c12c587 ("[media] tw68: refactor and cleanup the tw68 driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/tw68/tw68-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/pci/tw68/tw68-core.c b/drivers/media/pci/tw68/tw68-core.c
index 509d7ddec1505..7abb1bcff55f9 100644
--- a/drivers/media/pci/tw68/tw68-core.c
+++ b/drivers/media/pci/tw68/tw68-core.c
@@ -228,7 +228,7 @@ static int tw68_initdev(struct pci_dev *pci_dev,
/* pci init */
dev->pci = pci_dev;
- if (pci_enable_device(pci_dev)) {
+ if (pcim_enable_device(pci_dev)) {
err = -EIO;
goto fail1;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0265/1257] media: adv7180: Initialize mutex before ancillary clients
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0264/1257] media: tw68: balance PCI enable on cleanup Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0266/1257] media: au0828: Fix media device leak in au0828_usb_probe() Greg Kroah-Hartman
` (733 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 9d46d17a65e86010b1f5604e5cf61ce1e197f77a ]
The VPP ancillary-client error path unregisters the CSI client before
destroying state->mutex. For I2P variants, the failure can occur before
mutex_init(), so cleanup destroys an uninitialized mutex.
Initialize the mutex immediately after allocating the driver state, before
creating any ancillary clients. This keeps every cleanup path matched with
a completed mutex initialization.
A QEMU x86_64 test using an i2c-stub bus instantiated an ADV7280 client
at address 0x21 and occupied its VPP ancillary address 0x42. This forced
i2c_new_ancillary_device() to return -EBUSY. An instrumentation oracle
observed an uninitialized mutex on the buggy kernel and an initialized
mutex on the fixed kernel. The failure was deliberately injected to
exercise the error path; no natural crash was observed.
Fixes: 851a54effbd8 ("[media] adv7180: Add I2P support")
Cc: stable@vger.kernel.org
Assisted-by: LLM Codex
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/adv7180.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
index a1c7f68225b45..8c2cf3f539781 100644
--- a/drivers/media/i2c/adv7180.c
+++ b/drivers/media/i2c/adv7180.c
@@ -1454,6 +1454,7 @@ static int adv7180_probe(struct i2c_client *client)
if (state == NULL)
return -ENOMEM;
+ mutex_init(&state->mutex);
state->client = client;
state->field = V4L2_FIELD_ALTERNATE;
state->chip_info = i2c_get_match_data(client);
@@ -1497,7 +1498,6 @@ static int adv7180_probe(struct i2c_client *client)
}
state->irq = client->irq;
- mutex_init(&state->mutex);
state->curr_norm = V4L2_STD_NTSC;
state->input = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0266/1257] media: au0828: Fix media device leak in au0828_usb_probe()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0265/1257] media: adv7180: Initialize mutex before ancillary clients Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0267/1257] media: vpif_capture: Fix i2c adapter reference leak in vpif_probe() Greg Kroah-Hartman
` (732 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 7b7a69c91c0537d48150942d9707614a4fdd3766 ]
au0828_media_device_init() takes a reference to a media device with
media_device_usb_allocate(). When au0828_v4l2_device_register()
fails right after, the error path only unregisters the entities and
frees au0828_dev, so that reference is never released.
Release it with media_device_delete() on that path.
Fixes: 812658d88d26 ("media: change au0828 to use Media Device Allocator API")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/au0828/au0828-core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
index 445cbeb7abaee..c3826b3b8a2eb 100644
--- a/drivers/media/usb/au0828/au0828-core.c
+++ b/drivers/media/usb/au0828/au0828-core.c
@@ -697,6 +697,10 @@ static int au0828_usb_probe(struct usb_interface *interface,
retval = au0828_v4l2_device_register(interface, dev);
if (retval) {
au0828_usb_v4l2_media_release(dev);
+#ifdef CONFIG_MEDIA_CONTROLLER
+ media_device_delete(dev->media_dev, KBUILD_MODNAME,
+ THIS_MODULE);
+#endif
mutex_unlock(&dev->lock);
kfree(dev);
return retval;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0267/1257] media: vpif_capture: Fix i2c adapter reference leak in vpif_probe()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0266/1257] media: au0828: Fix media device leak in au0828_usb_probe() Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0268/1257] media: vpif_display: " Greg Kroah-Hartman
` (731 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit b00fbdad64d4ea7d594bc67988c1722fe5b3be50 ]
vpif_probe() takes a reference to the i2c adapter with
i2c_get_adapter() and passes it to v4l2_i2c_new_subdev_board(),
which does not consume it, but the reference is never released, so
it is leaked both when the probe succeeds and when it fails after
the adapter has been acquired.
Release the reference with i2c_put_adapter() on the success path
and in the probe_subdev_out cleanup, and initialise i2c_adap so
that the cleanup is a no-op when the adapter was never acquired.
Fixes: 6ffefff5a9e7 ("V4L/DVB (12906c): V4L : vpif capture driver for DM6467")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/ti/davinci/vpif_capture.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/ti/davinci/vpif_capture.c b/drivers/media/platform/ti/davinci/vpif_capture.c
index 91cb6223561a8..397f3115af5b7 100644
--- a/drivers/media/platform/ti/davinci/vpif_capture.c
+++ b/drivers/media/platform/ti/davinci/vpif_capture.c
@@ -1602,7 +1602,7 @@ vpif_capture_get_pdata(struct platform_device *pdev,
static int vpif_probe(struct platform_device *pdev)
{
struct vpif_subdev_info *subdevdata;
- struct i2c_adapter *i2c_adap;
+ struct i2c_adapter *i2c_adap = NULL;
int subdev_count;
int res_idx = 0;
int i, err;
@@ -1692,9 +1692,12 @@ static int vpif_probe(struct platform_device *pdev)
}
}
+ i2c_put_adapter(i2c_adap);
+
return 0;
probe_subdev_out:
+ i2c_put_adapter(i2c_adap);
v4l2_async_nf_cleanup(&vpif_obj.notifier);
/* free sub devices memory */
kfree(vpif_obj.sd);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0268/1257] media: vpif_display: Fix i2c adapter reference leak in vpif_probe()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0267/1257] media: vpif_capture: Fix i2c adapter reference leak in vpif_probe() Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0269/1257] media: synopsys: hdmirx: fetch colordepth before calculating pixelclock Greg Kroah-Hartman
` (730 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit f5863ea3f99265e5e297e3dcf0f47432fee2b8ac ]
vpif_probe() takes a reference to the i2c adapter with
i2c_get_adapter() and passes it to v4l2_i2c_new_subdev_board(),
which does not consume it, but the reference is never released, so
it is leaked both when the probe succeeds and when it fails after
the adapter has been acquired.
Release the reference with i2c_put_adapter() on the success path and
in the probe_subdev_out cleanup.
Fixes: e7332e3a552f ("V4L/DVB (12176): davinci/vpif_display: Add VPIF display driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/ti/davinci/vpif_display.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/ti/davinci/vpif_display.c b/drivers/media/platform/ti/davinci/vpif_display.c
index 08877ae1513a8..8bea1de6ccc82 100644
--- a/drivers/media/platform/ti/davinci/vpif_display.c
+++ b/drivers/media/platform/ti/davinci/vpif_display.c
@@ -1289,9 +1289,12 @@ static int vpif_probe(struct platform_device *pdev)
if (err)
goto probe_subdev_out;
+ i2c_put_adapter(i2c_adap);
+
return 0;
probe_subdev_out:
+ i2c_put_adapter(i2c_adap);
kfree(vpif_obj.sd);
vpif_unregister:
v4l2_device_unregister(&vpif_obj.v4l2_dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0269/1257] media: synopsys: hdmirx: fetch colordepth before calculating pixelclock
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0268/1257] media: vpif_display: " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0270/1257] media: i2c: ov5647: fix power cleanup on remove Greg Kroah-Hartman
` (729 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lucas Sinn, Sascha Hauer,
Dmitry Osipenko, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Sinn <lucas.sinn@wolfvision.net>
[ Upstream commit e8554ac860356f1f4cd9bce454271dce1ed35fc1 ]
hdmirx_get_detected_timings() divides the TMDS clock by
hdmirx_dev->color_depth, but nothing on its own path ever sets it. The
only producer is hdmirx_get_colordepth(), reached solely from
hdmirx_format_change() at the tail of hdmirx_wait_signal_lock().
VIDIOC_QUERY_DV_TIMINGS does not come through there. It only refuses to
proceed while signal_not_lock() is true, and that reads the lock state
straight out of the hardware, so it can already be false while the work
ending in hdmirx_format_change() has yet to run. Query the timings in
that window, on the first lock after a boot, and color_depth is still
zero from devm_kzalloc().
The division does not fault. do_div() is plain C on 64 bit and arm64
compiles it to udiv, which returns zero for a zero divisor. What comes
out is a pixelclock of zero, and a stitched output frame.
Read the colordepth where it is used instead.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Lucas Sinn <lucas.sinn@wolfvision.net>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Fixes: 7b59b132ad43 ("media: platform: synopsys: Add support for HDMI input driver")
Cc: stable@vger.kernel.org
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/synopsys/hdmirx/snps_hdmirx.c | 71 ++++++++++---------
1 file changed, 36 insertions(+), 35 deletions(-)
diff --git a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
index e84d4418c530e..3b9d78e69aac3 100644
--- a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
+++ b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
@@ -156,7 +156,6 @@ struct snps_hdmirx_dev {
int num_clks;
u32 edid_blocks_written;
u32 cur_fmt_fourcc;
- u32 color_depth;
spinlock_t rst_lock; /* to lock register access */
u8 edid[EDID_NUM_BLOCKS_MAX * EDID_BLOCK_SIZE];
};
@@ -380,6 +379,38 @@ static void hdmirx_toggle_polarity(struct snps_hdmirx_dev *hdmirx_dev)
VPROC_HSYNC_POL_OVR_EN, 0);
}
+static u32 hdmirx_get_colordepth(struct snps_hdmirx_dev *hdmirx_dev)
+{
+ struct v4l2_device *v4l2_dev = &hdmirx_dev->v4l2_dev;
+ u32 val, color_depth_reg, color_depth;
+
+ val = hdmirx_readl(hdmirx_dev, DMA_STATUS11);
+ color_depth_reg = (val & HDMIRX_COLOR_DEPTH_MASK) >> 3;
+
+ switch (color_depth_reg) {
+ case 0x4:
+ color_depth = 24;
+ break;
+ case 0x5:
+ color_depth = 30;
+ break;
+ case 0x6:
+ color_depth = 36;
+ break;
+ case 0x7:
+ color_depth = 48;
+ break;
+ default:
+ color_depth = 24;
+ break;
+ }
+
+ v4l2_dbg(1, debug, v4l2_dev, "%s: color_depth: %d, reg_val:%d\n",
+ __func__, color_depth, color_depth_reg);
+
+ return color_depth;
+}
+
/*
* When querying DV timings during preview, if the DMA's timing is stable,
* we retrieve the timings directly from the DMA. However, if the current
@@ -393,7 +424,7 @@ static int hdmirx_get_detected_timings(struct snps_hdmirx_dev *hdmirx_dev,
struct v4l2_bt_timings *bt = &timings->bt;
u32 val, tmdsqpclk_freq, pix_clk;
unsigned int num_retries = 0;
- u32 field_type, deframer_st;
+ u32 field_type, deframer_st, color_depth;
u64 tmp_data, tmds_clk;
bool is_dvi_mode;
int ret;
@@ -414,10 +445,11 @@ static int hdmirx_get_detected_timings(struct snps_hdmirx_dev *hdmirx_dev,
deframer_st = hdmirx_readl(hdmirx_dev, DEFRAMER_STATUS);
is_dvi_mode = !(deframer_st & OPMODE_STS_MASK);
+ color_depth = hdmirx_get_colordepth(hdmirx_dev);
tmdsqpclk_freq = hdmirx_readl(hdmirx_dev, CMU_TMDSQPCLK_FREQ);
tmds_clk = tmdsqpclk_freq * 4 * 1000;
tmp_data = tmds_clk * 24;
- do_div(tmp_data, hdmirx_dev->color_depth);
+ do_div(tmp_data, color_depth);
pix_clk = tmp_data;
bt->pixelclock = pix_clk;
@@ -429,7 +461,7 @@ static int hdmirx_get_detected_timings(struct snps_hdmirx_dev *hdmirx_dev,
v4l2_dbg(2, debug, v4l2_dev, "tmds_clk:%llu, pix_clk:%d\n", tmds_clk, pix_clk);
v4l2_dbg(1, debug, v4l2_dev, "interlace:%d, fmt:%d, color:%d, mode:%s\n",
bt->interlaced, hdmirx_dev->pix_fmt,
- hdmirx_dev->color_depth,
+ color_depth,
is_dvi_mode ? "dvi" : "hdmi");
v4l2_dbg(2, debug, v4l2_dev, "deframer_st:%#x\n", deframer_st);
@@ -988,36 +1020,6 @@ static void hdmirx_controller_init(struct snps_hdmirx_dev *hdmirx_dev)
VS_REMAPFILTER_EN_QST | VS_FILTER_ORDER_QST(0x3));
}
-static void hdmirx_get_colordepth(struct snps_hdmirx_dev *hdmirx_dev)
-{
- struct v4l2_device *v4l2_dev = &hdmirx_dev->v4l2_dev;
- u32 val, color_depth_reg;
-
- val = hdmirx_readl(hdmirx_dev, DMA_STATUS11);
- color_depth_reg = (val & HDMIRX_COLOR_DEPTH_MASK) >> 3;
-
- switch (color_depth_reg) {
- case 0x4:
- hdmirx_dev->color_depth = 24;
- break;
- case 0x5:
- hdmirx_dev->color_depth = 30;
- break;
- case 0x6:
- hdmirx_dev->color_depth = 36;
- break;
- case 0x7:
- hdmirx_dev->color_depth = 48;
- break;
- default:
- hdmirx_dev->color_depth = 24;
- break;
- }
-
- v4l2_dbg(1, debug, v4l2_dev, "%s: color_depth: %d, reg_val:%d\n",
- __func__, hdmirx_dev->color_depth, color_depth_reg);
-}
-
static void hdmirx_get_pix_fmt(struct snps_hdmirx_dev *hdmirx_dev)
{
struct v4l2_device *v4l2_dev = &hdmirx_dev->v4l2_dev;
@@ -1128,7 +1130,6 @@ static void hdmirx_format_change(struct snps_hdmirx_dev *hdmirx_dev)
};
hdmirx_get_pix_fmt(hdmirx_dev);
- hdmirx_get_colordepth(hdmirx_dev);
hdmirx_get_avi_infoframe(hdmirx_dev);
v4l2_dbg(1, debug, v4l2_dev, "%s: queue res_chg_event\n", __func__);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0270/1257] media: i2c: ov5647: fix power cleanup on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0269/1257] media: synopsys: hdmirx: fetch colordepth before calculating pixelclock Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0271/1257] media: atmel-isi: release unregistered video device " Greg Kroah-Hartman
` (728 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Dave Stevenson,
Sakari Ailus, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 6e81cfc38548109021ab761b94ecdd01f8753154 ]
ov5647_remove() disables runtime PM without powering off the sensor if
it is still runtime active. pm_runtime_disable() does not invoke the
runtime suspend callback, so the sensor can remain powered on.
If the device is not already runtime suspended, call ov5647_power_off()
and mark the runtime PM state as suspended.
This issue was found by manual code inspection.
Fixes: 089b7c70f0d8 ("media: ov5647: Use pm_runtime infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov5647.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index 3facf92b3841e..3b3e5653a0c61 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -1271,6 +1271,10 @@ static void ov5647_remove(struct i2c_client *client)
v4l2_ctrl_handler_free(&sensor->ctrls);
v4l2_device_unregister_subdev(sd);
pm_runtime_disable(&client->dev);
+ if (!pm_runtime_status_suspended(&client->dev)) {
+ ov5647_power_off(&client->dev);
+ pm_runtime_set_suspended(&client->dev);
+ }
}
static const struct dev_pm_ops ov5647_pm_ops = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0271/1257] media: atmel-isi: release unregistered video device on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0270/1257] media: i2c: ov5647: fix power cleanup on remove Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0272/1257] ASoC: fsl_xcvr: free IRQ before canceling reset work Greg Kroah-Hartman
` (727 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Eugen Hristev,
Sakari Ailus, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit c0a6d78dad3af1def80f04df82bfd70456ec406c ]
atmel_isi_probe() allocates the video device before registering the
V4L2 async notifier. The video device is registered later from the
notifier complete callback once the remote subdevice has been bound.
The remove path relies on the notifier unbind callback to unregister
the video device. However, if the remote subdevice is never bound, or
the complete callback fails before video_register_device() succeeds,
the video device remains unregistered. In that case the unbind path
does not release the object allocated by video_device_alloc(), and the
remove path leaks it.
Only unregister the video device from the unbind callback when it has
actually been registered, and clear the driver pointer afterwards.
After unregistering and cleaning up the notifier, release the video
device directly if the pointer is still present. This covers devices
that were allocated but never registered while avoiding a second
release of successfully registered devices.
This issue was found by manual code inspection.
Fixes: d12c9088c0b2a ("[media] atmel-isi: remove dependency of the soc-camera framework")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/atmel/atmel-isi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/atmel/atmel-isi.c b/drivers/media/platform/atmel/atmel-isi.c
index a05a744cbb756..6a7e240c5b180 100644
--- a/drivers/media/platform/atmel/atmel-isi.c
+++ b/drivers/media/platform/atmel/atmel-isi.c
@@ -1121,10 +1121,13 @@ static void isi_graph_notify_unbind(struct v4l2_async_notifier *notifier,
{
struct atmel_isi *isi = notifier_to_isi(notifier);
+ if (!video_is_registered(isi->vdev))
+ return;
+
dev_dbg(isi->dev, "Removing %s\n", video_device_node_name(isi->vdev));
- /* Checks internally if vdev have been init or not */
video_unregister_device(isi->vdev);
+ isi->vdev = NULL;
}
static int isi_graph_notify_bound(struct v4l2_async_notifier *notifier,
@@ -1323,6 +1326,8 @@ static void atmel_isi_remove(struct platform_device *pdev)
pm_runtime_disable(&pdev->dev);
v4l2_async_nf_unregister(&isi->notifier);
v4l2_async_nf_cleanup(&isi->notifier);
+ if (isi->vdev)
+ video_device_release(isi->vdev);
v4l2_device_unregister(&isi->v4l2_dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0272/1257] ASoC: fsl_xcvr: free IRQ before canceling reset work
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0271/1257] media: atmel-isi: release unregistered video device " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0273/1257] memory: stm32_omm: fix child clock leak on set_amcr() error path Greg Kroah-Hartman
` (726 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Shengjiu Wang, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 83701fdb2d8d644c547773791da48d6ecb3a5e1d ]
irq0_isr() schedules work_rst on a preamble error, and reset_rx_work()
touches regmap. remove() cancels that work while the IRQ is still
registered, so the handler can queue it again during teardown. The IRQ
is also requested before INIT_WORK() and spin_lock_init(). Probe
failure does not call remove(), so freeing the IRQ leaves queued work
running, and an earlier interrupt schedules uninitialized work.
Initialize the lock and devm_work_autocancel() before the IRQ. Failed
probe then frees the IRQ and cancels the work. Unbind frees the IRQ
before cancel_work_sync() and pm_runtime_disable().
Fixes: 1e5d0f106164 ("ASoC: fsl_xcvr: reset RX dpath after wrong preamble")
Cc: stable@vger.kernel.org # 6.13+
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Shengjiu Wang <shengjiu.wang@gmail.com>
Link: https://patch.msgid.link/20260923054017.93553-1-mhun512@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_xcvr.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
index 9828272043511..29929dfcce2a6 100644
--- a/sound/soc/fsl/fsl_xcvr.c
+++ b/sound/soc/fsl/fsl_xcvr.c
@@ -3,6 +3,7 @@
#include <linux/bitrev.h>
#include <linux/clk.h>
+#include <linux/devm-helpers.h>
#include <linux/firmware.h>
#include <linux/interrupt.h>
#include <linux/module.h>
@@ -57,6 +58,7 @@ struct fsl_xcvr {
struct snd_aes_iec958 tx_iec958;
u8 cap_ds[FSL_XCVR_CAPDS_SIZE];
struct work_struct work_rst;
+ int irq;
spinlock_t lock; /* Protect hw_reset and trigger */
struct snd_pcm_hw_constraint_list spdif_constr_rates;
u32 spdif_constr_rates_list[SPDIF_NUM_RATES];
@@ -1617,7 +1619,7 @@ static int fsl_xcvr_probe(struct platform_device *pdev)
struct fsl_xcvr *xcvr;
struct resource *rx_res, *tx_res;
void __iomem *regs;
- int ret, irq;
+ int ret;
xcvr = devm_kzalloc(dev, sizeof(*xcvr), GFP_KERNEL);
if (!xcvr)
@@ -1705,12 +1707,22 @@ static int fsl_xcvr_probe(struct platform_device *pdev)
return dev_err_probe(dev, PTR_ERR(xcvr->reset),
"failed to get XCVR reset control\n");
+ /*
+ * irq0_isr() schedules work_rst. Prepare the work and its lock
+ * before the IRQ, and register the cancel action first so a failed
+ * probe frees the IRQ and then cancels any queued work.
+ */
+ spin_lock_init(&xcvr->lock);
+ ret = devm_work_autocancel(dev, &xcvr->work_rst, reset_rx_work);
+ if (ret)
+ return ret;
+
/* get IRQs */
- irq = platform_get_irq(pdev, 0);
- if (irq < 0)
- return irq;
+ xcvr->irq = platform_get_irq(pdev, 0);
+ if (xcvr->irq < 0)
+ return xcvr->irq;
- ret = devm_request_irq(dev, irq, irq0_isr, 0, pdev->name, xcvr);
+ ret = devm_request_irq(dev, xcvr->irq, irq0_isr, 0, pdev->name, xcvr);
if (ret)
return dev_err_probe(dev, ret, "failed to claim IRQ0\n");
@@ -1751,8 +1763,6 @@ static int fsl_xcvr_probe(struct platform_device *pdev)
fsl_xcvr_comp.name);
}
- INIT_WORK(&xcvr->work_rst, reset_rx_work);
- spin_lock_init(&xcvr->lock);
return ret;
}
@@ -1760,6 +1770,8 @@ static void fsl_xcvr_remove(struct platform_device *pdev)
{
struct fsl_xcvr *xcvr = dev_get_drvdata(&pdev->dev);
+ /* Free the IRQ first so irq0_isr() cannot requeue work_rst. */
+ devm_free_irq(&pdev->dev, xcvr->irq, xcvr);
cancel_work_sync(&xcvr->work_rst);
pm_runtime_disable(&pdev->dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0273/1257] memory: stm32_omm: fix child clock leak on set_amcr() error path
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0272/1257] ASoC: fsl_xcvr: free IRQ before canceling reset work Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0274/1257] arm64: dts: freescale: imx8mm-verdin-ivy: fix DIGI_1/DIGI_2 gpio-line-names Greg Kroah-Hartman
` (725 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diego Fernando Mancera Gomez,
Krzysztof Kozlowski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
[ Upstream commit a22355280361d2a376a2020059a2bae11e6cea10 ]
When the mux is enabled, stm32_omm_configure() enables the two OSPI
child clocks via stm32_omm_toggle_child_clock(dev, true); they are meant
to stay enabled for the device's lifetime and are disabled again in
stm32_omm_remove() and on the devm_of_platform_populate() error path.
However, if the subsequent stm32_omm_set_amcr() call fails, the function
jumps to the "error:" label which only calls pm_runtime_put_sync_suspend()
before returning, leaving the two child clocks enabled. As this happens
during probe, the error is propagated and .remove() is never called, so
the clock enable references are leaked. devm_clk_bulk_get() only releases
the clock handles on unwind, it does not undo clk_prepare_enable().
Disable the child clocks on the set_amcr() error path, mirroring the
cleanup already done on the devm_of_platform_populate() failure path.
Fixes: 8181d061dcff ("memory: Add STM32 Octo Memory Manager driver")
Cc: stable@vger.kernel.org
Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
Link: https://patch.msgid.link/20260917235925.44185-1-diegomancera.dev@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/stm32_omm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/memory/stm32_omm.c b/drivers/memory/stm32_omm.c
index 84eb23c824f5b..3599683ab04ac 100644
--- a/drivers/memory/stm32_omm.c
+++ b/drivers/memory/stm32_omm.c
@@ -274,6 +274,8 @@ static int stm32_omm_configure(struct device *dev)
writel_relaxed(omm->cr, omm->io_base + OMM_CR);
ret = stm32_omm_set_amcr(dev, true);
+ if (ret && (mux & CR_MUXEN))
+ stm32_omm_toggle_child_clock(dev, false);
error:
pm_runtime_put_sync_suspend(dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0274/1257] arm64: dts: freescale: imx8mm-verdin-ivy: fix DIGI_1/DIGI_2 gpio-line-names
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0273/1257] memory: stm32_omm: fix child clock leak on set_amcr() error path Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0275/1257] arm64: dts: freescale: imx8mp-verdin-ivy: " Greg Kroah-Hartman
` (724 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Frank Li,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 28cec01a2be2cf1e20aabd435f250f665ce24c8e ]
gpio3's gpio-line-names names the two Ivy digital inputs "DIG_1" and
"DIG_2", while the official Ivy Carrier Board datasheet (Section 2.10,
Table 12) names them DIGI_1 and DIGI_2, matching the
k3-am62-verdin-ivy.dtsi variant for the same carrier board pins.
GPIO line names are meant to be stable across the whole Verdin family
and its carrier boards, so userspace GPIO tooling that looks up a line
by name works the same regardless of which Verdin SoM is fitted on
Ivy.
Fixes: adca46171ff7 ("arm64: dts: freescale: imx8mm-verdin: Add Ivy carrier board")
Cc: stable@vger.kernel.org
Link: https://docs.toradex.com/116799-ivy_carrier_board_datasheet.pdf
Assisted-by: LLM
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi
index 29075ff5eda63..b64751aa31d50 100644
--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi
@@ -270,8 +270,8 @@ &gpio3 {
"",
"",
"",
- "DIG_1", /* SODIMM 56 */
- "DIG_2", /* SODIMM 58 */
+ "DIGI_1", /* SODIMM 56 */
+ "DIGI_2", /* SODIMM 58 */
"REL1", /* SODIMM 60 */
"REL2", /* SODIMM 62 */
"", /* 10 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0275/1257] arm64: dts: freescale: imx8mp-verdin-ivy: fix DIGI_1/DIGI_2 gpio-line-names
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0274/1257] arm64: dts: freescale: imx8mm-verdin-ivy: fix DIGI_1/DIGI_2 gpio-line-names Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0276/1257] arm64: dts: freescale: imx95-aquila: fix gpio-line-names padding Greg Kroah-Hartman
` (723 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Frank Li,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit cb45264c27fad31f7c58fbb1a5c2f7ec16018dae ]
gpio3's gpio-line-names names the two Ivy digital inputs "DIG_1" and
"DIG_2", while the official Ivy Carrier Board datasheet (Section 2.10,
Table 12) names them DIGI_1 and DIGI_2, matching the
k3-am62-verdin-ivy.dtsi variant for the same carrier board pins.
GPIO line names are meant to be stable across the whole Verdin family
and its carrier boards, so userspace GPIO tooling that looks up a line
by name works the same regardless of which Verdin SoM is fitted on
Ivy.
Fixes: b98948b04295 ("arm64: dts: freescale: imx8mp-verdin: Add Ivy carrier board")
Cc: stable@vger.kernel.org
Link: https://docs.toradex.com/116799-ivy_carrier_board_datasheet.pdf
Assisted-by: LLM
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi
index db1b4ee7728c0..bf021e85cfc94 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi
@@ -333,8 +333,8 @@ &gpio3 {
"",
"",
"",
- "DIG_1", /* SODIMM 56 */
- "DIG_2", /* SODIMM 58 */
+ "DIGI_1", /* SODIMM 56 */
+ "DIGI_2", /* SODIMM 58 */
"REL1", /* SODIMM 60 */
"REL2", /* SODIMM 62 */
"", /* 10 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0276/1257] arm64: dts: freescale: imx95-aquila: fix gpio-line-names padding
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0275/1257] arm64: dts: freescale: imx8mp-verdin-ivy: " Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0277/1257] arm64: dts: freescale: imx8mp-toradex-smarc: fix SMARC_SLEEP# gpio-line-names typo Greg Kroah-Hartman
` (722 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Frank Li,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 66a5b2bf9d217668ae683eecfaba38bcd61cfe94 ]
som_gpio_expander_1's gpio-line-names use "AQUILA_C1".."AQUILA_C4"
instead of the zero-padded "AQUILA_C01".."AQUILA_C04" used by every
other Cxx entry in this file and by k3-am69-aquila.dtsi, a different
board implementing the same Aquila Family Specification. The
zero-padded form is the official pin naming per the Aquila Family
Specification and the Aquila iMX95 module datasheet.
GPIO line names are meant to be stable across the whole Aquila
family, so userspace GPIO tooling that looks up a line by name works
the same on any Aquila SoM.
Fixes: d5c082ba23db ("arm64: dts: freescale: add Aquila iMX95 support")
Cc: stable@vger.kernel.org
Link: https://docs.toradex.com/116801-aquila_family_specification.pdf
Link: https://docs.toradex.com/117671-aquila_imx95_datasheet.pdf
Assisted-by: LLM
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx95-aquila.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx95-aquila.dtsi b/arch/arm64/boot/dts/freescale/imx95-aquila.dtsi
index 69dc962a24a1d..4a809e1a840e4 100644
--- a/arch/arm64/boot/dts/freescale/imx95-aquila.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx95-aquila.dtsi
@@ -406,10 +406,10 @@ som_gpio_expander_1: gpio@21 {
#gpio-cells = <2>;
gpio-controller;
gpio-line-names =
- "AQUILA_C1", /* 0 */
- "AQUILA_C2",
- "AQUILA_C3",
- "AQUILA_C4",
+ "AQUILA_C01", /* 0 */
+ "AQUILA_C02",
+ "AQUILA_C03",
+ "AQUILA_C04",
"AQUILA_C36",
"AQUILA_B74",
"AQUILA_B75",
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0277/1257] arm64: dts: freescale: imx8mp-toradex-smarc: fix SMARC_SLEEP# gpio-line-names typo
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0276/1257] arm64: dts: freescale: imx95-aquila: fix gpio-line-names padding Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0278/1257] arm64: dts: freescale: imx8mp-verdin-yavia: fix external GPIOs Greg Kroah-Hartman
` (721 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Frank Li,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 90bc5a53c7f0733ec37a5c041b4e1aefa3d8d965 ]
gpio3's gpio-line-names has "SLEEP#" instead of "SMARC_SLEEP#" for the
SMARC SLEEP# connector signal, while the gpio-keys node driven by the
very same GPIO line already labels it "SMARC_SLEEP#", and the imx95
Toradex SMARC variant names the equivalent line "SMARC_SLEEP#" too.
GPIO line names are meant to be stable across the whole Toradex SMARC
family, using the official SMARC-connector signal names from the
SMARC specification and the SoM datasheet's pin assignment table, so
userspace GPIO tooling that looks up a line by name works the same on
any Toradex SMARC board.
Fixes: 97dc91c04558 ("arm64: dts: freescale: add Toradex SMARC iMX8MP")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi
index 0348da385f239..eb8b9db7e3cd7 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi
@@ -323,7 +323,7 @@ &gpio3 {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_lvds_dsi_sel>;
gpio-line-names = "ETH_0_INT#", /* 0 */
- "SLEEP#",
+ "SMARC_SLEEP#",
"",
"",
"",
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0278/1257] arm64: dts: freescale: imx8mp-verdin-yavia: fix external GPIOs
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0277/1257] arm64: dts: freescale: imx8mp-toradex-smarc: fix SMARC_SLEEP# gpio-line-names typo Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0279/1257] arm64: dts: freescale: imx95-toradex-smarc: enable Wi-Fi SD interface Greg Kroah-Hartman
` (720 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Frank Li,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit f377ac5999a5d045168ddd25d204691c6653c06a ]
pinctrl_gpios_ext_yavia (SODIMM 64/66) is defined but never applied to
gpio3, so those pins stay at their NAND reset function instead of GPIO.
Fix SODIMM 64 to the correct pad, MX8MP_IOMUXC_NAND_READY_B (GPIO3_IO16).
Fixes: b694fbe2ff40 ("arm64: dts: imx8mp-verdin: Add yavia carrier board")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi
index f3d28e23ba6c6..2a90f312fb275 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi
@@ -117,6 +117,11 @@ &flexcan1 {
status = "okay";
};
+&gpio3 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpios_ext_yavia>;
+};
+
&gpio4 {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_ctrl_sleep_moci>;
@@ -266,7 +271,7 @@ MX8MP_IOMUXC_NAND_DATA03__GPIO3_IO09 0x106 /* SODIMM 62 */
pinctrl_gpios_ext_yavia: gpiosextyaviagrp {
fsl,pins = <
- MX8MP_IOMUXC_NAND_CE1_B__GPIO3_IO02 0x106 /* SODIMM 64 */
+ MX8MP_IOMUXC_NAND_READY_B__GPIO3_IO16 0x106 /* SODIMM 64 */
MX8MP_IOMUXC_NAND_DQS__GPIO3_IO14 0x106 /* SODIMM 66 */
>;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0279/1257] arm64: dts: freescale: imx95-toradex-smarc: enable Wi-Fi SD interface
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0278/1257] arm64: dts: freescale: imx8mp-verdin-yavia: fix external GPIOs Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0280/1257] clk: qcom: gcc-ipq5018: mark gpll0_main clock as critical Greg Kroah-Hartman
` (719 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Frank Li,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit b91cb164517d6cfbccd8bedad11827d8ea3bcb97 ]
Enable usdhc3, used for the on-module u-blox MAYA-W260 Wi-Fi/BT module,
it was left disabled by mistake in the initial commit.
Fixes: 90bbe88e0ea6 ("arm64: dts: freescale: add Toradex SMARC iMX95")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi b/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi
index a6c5398a81e3c..4c102f2132148 100644
--- a/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi
@@ -839,6 +839,7 @@ &usdhc3 {
keep-power-in-suspend;
non-removable;
vmmc-supply = <®_wifi_en>;
+ status = "okay";
};
&scmi_bbm {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0280/1257] clk: qcom: gcc-ipq5018: mark gpll0_main clock as critical
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0279/1257] arm64: dts: freescale: imx95-toradex-smarc: enable Wi-Fi SD interface Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0281/1257] drm/panel: ebbg-ft8719: Set prepare_prev_first Greg Kroah-Hartman
` (718 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gabor Juhos, Konrad Dybcio,
Mieczyslaw Nalewaj, Stanislaw Pal, Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <j4g8y7@gmail.com>
[ Upstream commit 33f9cb56cc28d002511e471be74f8ff241984178 ]
On IPQ5018, the APCS core clock feeds the CPUs. It can use
different clocks as its parent, but during system boot it
utilizes GPLL0.
Under some cicumstances, the 'gpll0_main' clock is getting
disabled during kernel start which results in a system hang
then the hardware watchdog restarts the board after a while.
This can happen when a driver gets a clock in its probe function,
then releases it either directly or by devres cleanup on probe
failure.
For example, since v6.18 the kernel often fails to boot on the
TP-Link Archer AX55 v1 board by using the in-tree dts. In the
failing configuration, the 'ipq-cmn-pll' driver is built into
the kernel and the problem is caused by the pm_runtim_put()
call in the ipq_cmn_pll_clk_probe() function. Due to this call,
runtime pm disables the 'gcc_cmn_blk_ahb_clk' clock asynchronously
which results in disabling 'gpll0_main' as well.
Mark the clock as critical in order to avoid such hangs.
Cc: stable@vger.kernel.org
Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Tested-by: Stanislaw Pal <kuncy7@gmail.com>
Link: https://lore.kernel.org/r/20260918-ipq5018-mark-gpll0_main-critical-v1-1-fbe8f27a0106@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-ipq5018.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c
index 594dae3bac4c1..46da652956fb0 100644
--- a/drivers/clk/qcom/gcc-ipq5018.c
+++ b/drivers/clk/qcom/gcc-ipq5018.c
@@ -68,6 +68,15 @@ static struct clk_alpha_pll gpll0_main = {
.parent_data = gcc_xo_data,
.num_parents = ARRAY_SIZE(gcc_xo_data),
.ops = &clk_alpha_pll_stromer_ops,
+ /*
+ * During system boot, this PLL feeds the CPUs.
+ * Mark it as critical to ensure that CCF does
+ * not disable it, even if there are no active
+ * consumers. This is needed to avoid a system
+ * hang caused by turning off the clock driving
+ * the CPUs.
+ */
+ .flags = CLK_IS_CRITICAL,
},
},
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0281/1257] drm/panel: ebbg-ft8719: Set prepare_prev_first
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0280/1257] clk: qcom: gcc-ipq5018: mark gpll0_main clock as critical Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0282/1257] mfd: da903x: Cancel IRQ work during teardown Greg Kroah-Hartman
` (717 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Casey Connolly, Marco Mattiolo,
Neil Armstrong, David Heidelberg, Linus Walleij, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Connolly <casey.connolly@linaro.org>
[ Upstream commit 4eeeac9d7c3600a6cae75b2a7bc9c5b67530923c ]
This corrects the host initialisation sequence so that we can send
DSI/DCS commands in prepare().
Cc: stable@vger.kernel.org
Fixes: b00de0e237da ("drm/panel: introduce ebbg,ft8719 panel")
Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
Tested-by: Marco Mattiolo <marco.mattiolo@hotmail.it>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260908-ebbg-ft8719-fixups-v2-1-5454ae1f5581@ixit.cz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-ebbg-ft8719.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/panel/panel-ebbg-ft8719.c b/drivers/gpu/drm/panel/panel-ebbg-ft8719.c
index fb9f9f42be4f2..1ab09c50a6306 100644
--- a/drivers/gpu/drm/panel/panel-ebbg-ft8719.c
+++ b/drivers/gpu/drm/panel/panel-ebbg-ft8719.c
@@ -198,6 +198,8 @@ static int ebbg_ft8719_probe(struct mipi_dsi_device *dsi)
dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST |
MIPI_DSI_CLOCK_NON_CONTINUOUS;
+ ctx->panel.prepare_prev_first = true;
+
ret = drm_panel_of_backlight(&ctx->panel);
if (ret)
return dev_err_probe(dev, ret, "Failed to get backlight\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0282/1257] mfd: da903x: Cancel IRQ work during teardown
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0281/1257] drm/panel: ebbg-ft8719: Set prepare_prev_first Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0283/1257] mfd: Fix MAX77705 dependency on regmap Greg Kroah-Hartman
` (716 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Hongyan Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <getshell@seu.edu.cn>
[ Upstream commit fd2258999ecdc7164ef0cda2d4102e4558a5660f ]
The IRQ handler disables the IRQ and schedules irq_work. Releasing the
IRQ does not drain that work, which can continue to use the devm-allocated
chip and notifier state.
Manage both IRQ-work cancellation and subdevice removal with devres.
Register the subdevice-removal action before requesting the IRQ, then add
the IRQ-work action after the request. This avoids leaving a live IRQ
without work cancellation if action registration fails. Devres cleanup
then disables the IRQ and drains the work before releasing the IRQ and
removing child devices. Register both actions before creating the children
so partial probe failures use the same ordering.
This issue was found by the author's in-house static analysis tool.
The patch was reviewed by the author against the latest mainline tree.
Fixes: 26b8f5e1e2d1 ("mfd: add base support for Dialog DA9030/DA9034 PMICs")
Cc: stable@vger.kernel.org
Suggested-by: Lee Jones <lee@kernel.org>
Assisted-by: Codex:GPT-5
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Link: https://patch.msgid.link/20260814153019.1114-1-getshell@seu.edu.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/da903x.c | 34 +++++++++++++++++++++++++---------
1 file changed, 25 insertions(+), 9 deletions(-)
diff --git a/drivers/mfd/da903x.c b/drivers/mfd/da903x.c
index e86b39de3303a..e4ad48e1f139b 100644
--- a/drivers/mfd/da903x.c
+++ b/drivers/mfd/da903x.c
@@ -421,6 +421,14 @@ static irqreturn_t da903x_irq_handler(int irq, void *data)
return IRQ_HANDLED;
}
+static void da903x_cancel_irq_work(void *data)
+{
+ struct da903x_chip *chip = data;
+
+ disable_irq(chip->client->irq);
+ cancel_work_sync(&chip->irq_work);
+}
+
static const struct da903x_chip_ops da903x_ops[] = {
[0] = {
.init_chip = da9030_init_chip,
@@ -456,6 +464,13 @@ static int da903x_remove_subdevs(struct da903x_chip *chip)
return device_for_each_child(chip->dev, NULL, __remove_subdev);
}
+static void da903x_remove_subdevs_action(void *data)
+{
+ struct da903x_chip *chip = data;
+
+ da903x_remove_subdevs(chip);
+}
+
static int da903x_add_subdevs(struct da903x_chip *chip,
struct da903x_platform_data *pdata)
{
@@ -484,7 +499,6 @@ static int da903x_add_subdevs(struct da903x_chip *chip,
return 0;
failed:
- da903x_remove_subdevs(chip);
return ret;
}
@@ -520,6 +534,11 @@ static int da903x_probe(struct i2c_client *client)
chip->ops->mask_events(chip, chip->events_mask);
chip->ops->read_events(chip, &tmp);
+ ret = devm_add_action_or_reset(&client->dev,
+ da903x_remove_subdevs_action, chip);
+ if (ret)
+ return ret;
+
ret = devm_request_irq(&client->dev, client->irq, da903x_irq_handler,
IRQF_TRIGGER_FALLING,
"da903x", chip);
@@ -529,14 +548,12 @@ static int da903x_probe(struct i2c_client *client)
return ret;
}
- return da903x_add_subdevs(chip, pdata);
-}
-
-static void da903x_remove(struct i2c_client *client)
-{
- struct da903x_chip *chip = i2c_get_clientdata(client);
+ ret = devm_add_action_or_reset(&client->dev, da903x_cancel_irq_work,
+ chip);
+ if (ret)
+ return ret;
- da903x_remove_subdevs(chip);
+ return da903x_add_subdevs(chip, pdata);
}
static struct i2c_driver da903x_driver = {
@@ -544,7 +561,6 @@ static struct i2c_driver da903x_driver = {
.name = "da903x",
},
.probe = da903x_probe,
- .remove = da903x_remove,
.id_table = da903x_id_table,
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0283/1257] mfd: Fix MAX77705 dependency on regmap
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0282/1257] mfd: da903x: Cancel IRQ work during teardown Greg Kroah-Hartman
@ 2026-11-07 13:42 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0284/1257] mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set" Greg Kroah-Hartman
` (715 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg, Lee Jones,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
[ Upstream commit 2fdae2d590a0a5ad4cd60bf8e7a6ecba7265f268 ]
The max77705 uses devm_regmap_add_irq_chip(), so add REGMAP_IRQ
and REGMAP_I2C to what the core driver selects in order to provide
these APIs.
This fixes a build error:
drivers/mfd/max77705.o: in function `max77705_i2c_probe':
max77705.c:(.text+0x250): undefined reference to `devm_regmap_add_irq_chip'
Cc: stable@vger.kernel.org
Fixes: c8d50f029748 ("mfd: Add new driver for MAX77705 PMIC")
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260827-deps-reg-max77705-v1-1-c83a74d3d428@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/Kconfig | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index e4fd4572472f9..857ca3bb0d5bf 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -1006,6 +1006,8 @@ config MFD_MAX77705
depends on I2C
select MFD_CORE
select MFD_SIMPLE_MFD_I2C
+ select REGMAP_I2C
+ select REGMAP_IRQ
help
Say yes here to add support for Maxim Integrated MAX77705 PMIC.
This is a Power Management IC with Charger, safe LDOs, Flash, Haptic
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0284/1257] mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set"
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2026-11-07 13:42 ` [PATCH 7.3 0283/1257] mfd: Fix MAX77705 dependency on regmap Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0285/1257] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral Greg Kroah-Hartman
` (714 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg, Lee Jones,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
[ Upstream commit b296be1dc008fe3a536341afae01f66bb302e67f ]
The wcd934x MFD parent (a slim_device) never initializes its
dma_mask/coherent_dma_mask. When the DT-aware children pass through
of_dma_configure() this triggers the "DMA mask not set" warning for
each child.
Cc: stable@vger.kernel.org
Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
Assisted-by: tencent:hy3
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260903-wcd-dma-v2-1-189cff560a28@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/wcd934x.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 3c3080e8c8cf7..7bea64fc09562 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -2,6 +2,7 @@
// Copyright (c) 2019, Linaro Limited
#include <linux/clk.h>
+#include <linux/dma-mapping.h>
#include <linux/gpio/consumer.h>
#include <linux/interrupt.h>
#include <linux/kernel.h>
@@ -217,6 +218,11 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
struct gpio_desc *reset_gpio;
int ret;
+ ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
+ if (ret)
+ return dev_err_probe(dev, ret,
+ "Failed to set DMA mask\n");
+
ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
if (!ddata)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0285/1257] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0284/1257] mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set" Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0286/1257] mfd: twl-core: Unregister the auxiliary platform device on unbind Greg Kroah-Hartman
` (713 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, David Heidelberg, Lee Jones,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
[ Upstream commit dcf0e640b553d33512fbcaedb909c32ba9636a64 ]
ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the
of_irq_get() error path has passed it to the error print since the
driver was added, while it is still NULL.
This used to be harmless with dev_err(), which copes with a NULL device
and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a
deferred IRQ reaches device_set_deferred_probe_reason() ->
dev_driver_string(), which dereferences the NULL pointer and crashes
during probe. Use dev, which is already valid at this point.
Cc: stable@vger.kernel.org
Fixes: 0f1b1b899521 ("mfd: wcd934x: Simplify with dev_err_probe()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/mfd/20260903145651.AC1311F00ACA@smtp.kernel.org/
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260903-wcd-dma-v3-1-d3920c6563c4@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/wcd934x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 7bea64fc09562..d57796933d873 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -229,7 +229,7 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
ddata->irq = of_irq_get(np, 0);
if (ddata->irq < 0)
- return dev_err_probe(ddata->dev, ddata->irq,
+ return dev_err_probe(dev, ddata->irq,
"Failed to get IRQ\n");
ddata->extclk = devm_clk_get(dev, "extclk");
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0286/1257] mfd: twl-core: Unregister the auxiliary platform device on unbind
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0285/1257] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0287/1257] hwmon: (k10temp) Stop matching Hygon devices Greg Kroah-Hartman
` (712 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Lee Jones,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 3c5c55d979ddcb0765ce531bc7ba173c87c8712a ]
twl_probe() registers a standalone platform device named "twl", but keeps
its pointer only in a local variable. Probe errors unregister the device,
while successful probe leaves no way for twl_remove() to release it. The
platform device therefore remains registered after the I2C driver unbinds.
Register a managed action on the I2C device immediately after adding the
platform device. This unregisters it on probe failure and driver unbind,
and also handles failure to register the action itself. Remove the manual
error-path unregister to avoid releasing the device twice.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: defa6be1c821 ("mfd: Fix compile for twl-core.c by removing cpu_is_omap usage")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:GPT-5.6
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260913205013.54777-1-mhun512@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/twl-core.c | 23 +++++++++++++++--------
1 file changed, 15 insertions(+), 8 deletions(-)
diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index c024a28b057e3..128cd3f6c60c4 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -719,6 +719,11 @@ static const struct mfd_cell twl6032_cells[] = {
{ .name = "twl6032-clk" },
};
+static void twl_unregister_device(void *data)
+{
+ platform_device_unregister(data);
+}
+
/* NOTE: This driver only handles a single twl4030/tps659x0 chip */
static int
twl_probe(struct i2c_client *client)
@@ -754,17 +759,22 @@ twl_probe(struct i2c_client *client)
return status;
}
+ status = devm_add_action_or_reset(&client->dev, twl_unregister_device,
+ pdev);
+ if (status)
+ return status;
+
if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
dev_dbg(&client->dev, "can't talk I2C?\n");
status = -EIO;
- goto free;
+ goto out;
}
twl_priv = devm_kzalloc(&client->dev, sizeof(struct twl_private),
GFP_KERNEL);
if (!twl_priv) {
status = -ENOMEM;
- goto free;
+ goto out;
}
if ((id->driver_data) & TWL6030_CLASS) {
@@ -784,7 +794,7 @@ twl_probe(struct i2c_client *client)
GFP_KERNEL);
if (!twl_priv->twl_modules) {
status = -ENOMEM;
- goto free;
+ goto out;
}
for (i = 0; i < num_slaves; i++) {
@@ -880,7 +890,7 @@ twl_probe(struct i2c_client *client)
status = devm_mfd_add_devices(&client->dev, PLATFORM_DEVID_NONE,
cells, num_cells, NULL, 0, NULL);
if (status < 0)
- goto free;
+ goto out;
if (of_device_is_system_power_controller(node)) {
if (!pm_power_off)
@@ -896,10 +906,7 @@ twl_probe(struct i2c_client *client)
fail:
if (status < 0)
twl_remove(client);
-free:
- if (status < 0)
- platform_device_unregister(pdev);
-
+out:
return status;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0287/1257] hwmon: (k10temp) Stop matching Hygon devices
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0286/1257] mfd: twl-core: Unregister the auxiliary platform device on unbind Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0288/1257] perf loongarch: Fix discarded const qualifier in _get_field() Greg Kroah-Hartman
` (711 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lin Wang, Guenter Roeck, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Wang <wanglin@open-hieco.net>
[ Upstream commit 08e6615c909b2504a5862764f3a7fca00c7ab066 ]
k10temp matches the Hygon F3 device, but derives the node passed to
amd_smn_read() from the F3 PCI slot using the AMD fixed-slot mapping
(slot - 0x18). Hygon PCI slots do not encode DF node identity, and
their SMN roots are grouped by socket.
The derived node number therefore cannot identify a valid Hygon SMN
target or provide usable temperature monitoring. Removing the match
does not disable a working monitoring path.
Remove the Hygon PCI match and Family 0x18 branch. Hygon temperature
monitoring will use the Hygon node and SMN interfaces in a separate
series.
Fixes: d93217d84c6c ("hwmon: (k10temp) Add Hygon Dhyana support")
Cc: stable@vger.kernel.org
Signed-off-by: Lin Wang <wanglin@open-hieco.net>
Link: https://patch.msgid.link/20260921055603.25112-6-wanglin@open-hieco.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/hwmon/k10temp.rst | 8 +++-----
drivers/hwmon/k10temp.c | 5 ++---
2 files changed, 5 insertions(+), 8 deletions(-)
diff --git a/Documentation/hwmon/k10temp.rst b/Documentation/hwmon/k10temp.rst
index 91b99adc6c487..9680c4f3383c3 100644
--- a/Documentation/hwmon/k10temp.rst
+++ b/Documentation/hwmon/k10temp.rst
@@ -28,8 +28,6 @@ Supported chips:
* AMD Family 17h processors: "Zen", "Zen 2"
-* AMD Family 18h processors: "Hygon Dhyana"
-
* AMD Family 19h processors: "Zen 3"
Prefix: 'k10temp'
@@ -128,7 +126,7 @@ it.
Models from 17h family report relative temperature, the driver aims to
compensate and report the real temperature.
-On Family 17h and Family 18h CPUs, additional temperature sensors may report
-Core Complex Die (CCD) temperatures. Up to 8 such temperatures are reported
-as temp{3..10}_input, labeled Tccd{1..8}. Actual support depends on the CPU
+On Family 17h CPUs, additional temperature sensors may report Core Complex
+Die (CCD) temperatures. Up to 8 such temperatures are reported as
+temp{3..10}_input, labeled Tccd{1..8}. Actual support depends on the CPU
variant.
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index 3e7e63edc6a30..e0a7211a513ca 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -64,7 +64,7 @@ MODULE_PARM_DESC(force, "force loading on processors with erratum 319");
#define F15H_M60H_HARDWARE_TEMP_CTRL_OFFSET 0xd8200c64
#define F15H_M60H_REPORTED_TEMP_CTRL_OFFSET 0xd8200ca4
-/* Common for Zen CPU families (Family 17h and 18h and 19h and 1Ah) */
+/* Common for Zen CPU families (Family 17h, 19h and 1Ah) */
#define ZEN_REPORTED_TEMP_CTRL_BASE 0x00059800
#define ZEN_CCD_TEMP(offset, x) (ZEN_REPORTED_TEMP_CTRL_BASE + \
@@ -475,7 +475,7 @@ static int k10temp_probe(struct pci_dev *pdev, const struct pci_device_id *id)
data->read_tempreg = read_tempreg_pci;
}
- if (boot_cpu_data.x86 == 0x17 || boot_cpu_data.x86 == 0x18) {
+ if (boot_cpu_data.x86 == 0x17) {
switch (boot_cpu_data.x86_model) {
case 0x1: /* Zen */
case 0x8: /* Zen+ */
@@ -583,7 +583,6 @@ static const struct pci_device_id k10temp_id_table[] = {
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) },
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
- { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
{}
};
MODULE_DEVICE_TABLE(pci, k10temp_id_table);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0288/1257] perf loongarch: Fix discarded const qualifier in _get_field()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0287/1257] hwmon: (k10temp) Stop matching Hygon devices Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0289/1257] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode() Greg Kroah-Hartman
` (710 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Huacai Chen,
Namhyung Kim, Bibo Mao, Huacai Chen, Arnaldo Carvalho de Melo,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit ed1293302f811fa709897d4a90ad78592938e4aa ]
When building perf on LoongArch, the following compilation errors occur:
CC arch/loongarch/util/header.o
arch/loongarch/util/header.c: In function '_get_field':
arch/loongarch/util/header.c:31:15: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
31 | line2 = strrchr(line, ' ');
| ^
arch/loongarch/util/header.c:36:12: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
36 | nl = strrchr(line, '\n');
| ^
cc1: all warnings being treated as errors
Declare 'line2' and 'nl' as const char * to ensure type safety. In modern
glibc versions, strrchr() returns a 'const char *' if the input string is
const.
This is similar to commit 7378b6656aa4 ("perf riscv: Fix discarded const
qualifier in _get_field()").
Fixes: 492ac37fa38faf52 ("perf kvm: Add kvm-stat for loongarch64")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Acked-by: Huacai Chen <chenhuacai@loongson.cn>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Bibo Mao <maobibo@loongson.cn>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--git a/tools/perf/arch/loongarch/util/header.c b/tools/perf/arch/loongarch/util/header.c
index 0c6d823334a21..46f53a74f71e8 100644
--- a/tools/perf/arch/loongarch/util/header.c
+++ b/tools/perf/arch/loongarch/util/header.c
@@ -26,7 +26,7 @@
static char *_get_field(const char *line)
{
- char *line2, *nl;
+ const char *line2, *nl;
line2 = strrchr(line, ' ');
if (!line2)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0289/1257] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0288/1257] perf loongarch: Fix discarded const qualifier in _get_field() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0290/1257] kobject: fix out-of-bounds access in kobject_action_type() Greg Kroah-Hartman
` (709 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+6646318bbcf419411bc5,
Ryusuke Konishi, Viacheslav Dubeyko, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
[ Upstream commit ff1227f70eead8704ecfec69259fb4c041f92cda ]
Syzbot reported a deadlock between nilfs_evict_inode(), executed via
an asynchronous workqueue (kworker) as:
process_one_work()
process_scheduled_works()
nilfs_iput_work_func()
nilfs_dispose_list()
iput()
iput_final()
evict()
s_op->evict_inode()
nilfs_evict_inode()
and find_inode(), called via
nilfs_mkdir()
nilfs_new_inode()
nilfs_insert_inode_locked()
insert_inode_locked4()
inode_insert5()
find_inode()
When an inode is deleted (i_nlink == 0), nilfs_evict_inode() clears its
ifile bitmap entry and then synchronously triggers the log writer via
nilfs_transaction_commit() if IS_SYNC(inode) is true.
If a concurrent directory creation via nilfs_new_inode() attempts to
allocate the same newly freed inode number, however, find_inode() called
just before inserting it into the inode hash, blocks waiting for the old
inode's evict() to complete.
Meanwhile, the synchronous log writer invoked from nilfs_evict_inode()
tries to acquire a write lock on 'ns_segctor_sem' which is read locked
by the caller of nilfs_new_inode() (in this case, nilfs_mkdir()),
resulting in a deadlock.
The synchronous log writer invocation from nilfs_evict_inode() is a
legacy artifact; it is no longer necessary because the call itself
(triggered by iput()) is now handled asynchronously with a kworker
if i_nlink == 0. It merely increases the risk of deadlock.
Fix this deadlock by removing the synchronous log writer trigger from
nilfs_evict_inode().
Reported-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6646318bbcf419411bc5
Fixes: 7ef3ff2fea8b ("nilfs2: fix deadlock of segment constructor over I_SYNC flag")
Tested-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/inode.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 64437aed83903..33490e8063ebd 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -895,13 +895,7 @@ void nilfs_evict_inode(struct inode *inode)
nilfs_clear_inode(inode);
- if (IS_SYNC(inode))
- nilfs_set_transaction_flag(NILFS_TI_SYNC);
nilfs_transaction_commit(sb);
- /*
- * May construct a logical segment and may fail in sync mode.
- * But delete_inode has no return value.
- */
}
int nilfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0290/1257] kobject: fix out-of-bounds access in kobject_action_type()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0289/1257] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0291/1257] ASoC: Intel: atom: Fix platform device leak on probe failure Greg Kroah-Hartman
` (708 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jiacheng Xu,
Vishal Moola (Fractile), Danilo Krummrich, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiacheng Xu <stitch@zju.edu.cn>
[ Upstream commit d516455c940555566642b975d1835c67f08136b3 ]
kobject_action_type() compares the input against each known action
using strncmp() and then indexes the action string using count_first
to check for an exact-length match.
An embedded NUL can make strncmp() return zero even when count_first
exceeds the length of the action string. For example, the five-byte
input "add\0X" makes the parser access kobject_actions[KOBJ_ADD][5],
which is beyond the end of the "add" string.
Check the action string length with strlen() instead of indexing it
with the input-derived offset. This rejects malformed action strings
containing embedded NUL bytes with -EINVAL instead of invoking
undefined behavior.
Cc: stable@kernel.org
Fixes: 60a96a59569b ("Driver core: accept all valid action-strings in uevent-trigger")
Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
Reviewed-by: Vishal Moola (Fractile) <vishal.moola@gmail.com>
Link: https://patch.msgid.link/20260920053726.22626-1-stitch@zju.edu.cn
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/kobject_uevent.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index 6ecd39e4b7048..84853e096811b 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -83,7 +83,7 @@ static int kobject_action_type(const char *buf, size_t count,
for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
if (strncmp(kobject_actions[action], buf, count_first) != 0)
continue;
- if (kobject_actions[action][count_first] != '\0')
+ if (strlen(kobject_actions[action]) != count_first)
continue;
if (args)
*args = args_start;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0291/1257] ASoC: Intel: atom: Fix platform device leak on probe failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0290/1257] kobject: fix out-of-bounds access in kobject_action_type() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0292/1257] ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls Greg Kroah-Hartman
` (707 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit dcc36d766dc82bc57cd730915d484119befcfca8 ]
sst_acpi_probe() registers platform devices for the SST platform and
machine board using platform_device_register_data(), but does not
unregister them when later probe steps fail.
Fixes: caf94ed8629a ("ASoC: Intel: bytcr_rt5640: fixup DAI codec_name with HID")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260924134932.1590967-1-lgs201920130244@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/atom/sst/sst_acpi.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/sound/soc/intel/atom/sst/sst_acpi.c b/sound/soc/intel/atom/sst/sst_acpi.c
index 73624e1b138a6..de1ad168008bd 100644
--- a/sound/soc/intel/atom/sst/sst_acpi.c
+++ b/sound/soc/intel/atom/sst/sst_acpi.c
@@ -254,6 +254,11 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
return 0;
}
+static void sst_unregister_platform_device(void *data)
+{
+ platform_device_unregister(data);
+}
+
static int sst_acpi_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -342,7 +347,10 @@ static int sst_acpi_probe(struct platform_device *pdev)
pdata->platform);
return PTR_ERR(plat_dev);
}
-
+ ret = devm_add_action_or_reset(dev, sst_unregister_platform_device,
+ plat_dev);
+ if (ret)
+ return ret;
/*
* Create platform device for sst machine driver,
* pass machine info as pdata
@@ -355,6 +363,10 @@ static int sst_acpi_probe(struct platform_device *pdev)
return PTR_ERR(mdev);
}
+ ret = devm_add_action_or_reset(dev, sst_unregister_platform_device,
+ mdev);
+ if (ret)
+ return ret;
/* Fill sst platform data */
ctx->pdata = pdata;
strscpy(ctx->firmware_name, mach->fw_filename);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0292/1257] ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0291/1257] ASoC: Intel: atom: Fix platform device leak on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0293/1257] clk: mvebu: ap-cpu-clk: Assign .num before accessing .hws Greg Kroah-Hartman
` (706 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Junjie Cao, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <junjie.cao@intel.com>
[ Upstream commit 0bc42544a4a06e8d76eb412d2b1414db910a311d ]
rt712_sdca_dmic_set_gain_get() and rt712_sdca_dmic_set_gain_put() take
the component drvdata as struct rt712_sdca_priv, but this driver stores
a struct rt712_sdca_dmic_priv.
regmap and mbq_regmap are at the same offsets in both structs, so the
register accesses work. slave is not: rt712_sdca_priv has dmic_component
in front of it, so its slave overlays rt712_sdca_dmic_priv's params,
which this driver never writes. When regmap_write() fails in the put
handler, dev_err() is called with &NULL->dev (RSI below):
rt712-sdca-dmic sdw:0:3:025d:1713:01: Defer on undeferrable control: 40800f13
BUG: kernel NULL pointer dereference, address: 0000000000000058
RIP: 0010:__dev_printk+0x10/0x70
RDX: ffffcdac45f83cd0 RSI: 0000000000000008 RDI: ffffffffa09cb5cb
Call Trace:
_dev_err+0x7f/0x99
rt712_sdca_dmic_set_gain_put.cold+0x20/0x25 [snd_soc_rt712_sdca_dmic]
snd_ctl_elem_write+0x19a/0x1f0 [snd]
snd_ctl_ioctl+0x658/0x8a0 [snd]
Seen on a Dell Precision 5690 running 7.2.5-200.fc44, with alsactl
writing the control during boot. Compile-tested only.
Fixes: 63a511284c9e ("ASoC: rt712-sdca: Add RT712 SDCA driver for Mic topology")
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2532834
Cc: stable@vger.kernel.org
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Link: https://patch.msgid.link/20260920024232.710189-1-junjie.cao@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/rt712-sdca-dmic.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/rt712-sdca-dmic.c b/sound/soc/codecs/rt712-sdca-dmic.c
index a9f3aa4e143ae..882390890738e 100644
--- a/sound/soc/codecs/rt712-sdca-dmic.c
+++ b/sound/soc/codecs/rt712-sdca-dmic.c
@@ -246,7 +246,7 @@ static int rt712_sdca_dmic_set_gain_get(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_value *ucontrol)
{
struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
- struct rt712_sdca_priv *rt712 = snd_soc_component_get_drvdata(component);
+ struct rt712_sdca_dmic_priv *rt712 = snd_soc_component_get_drvdata(component);
struct rt712_sdca_dmic_kctrl_priv *p =
(struct rt712_sdca_dmic_kctrl_priv *)kcontrol->private_value;
unsigned int regvalue, ctl, i;
@@ -277,7 +277,7 @@ static int rt712_sdca_dmic_set_gain_put(struct snd_kcontrol *kcontrol,
struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
struct rt712_sdca_dmic_kctrl_priv *p =
(struct rt712_sdca_dmic_kctrl_priv *)kcontrol->private_value;
- struct rt712_sdca_priv *rt712 = snd_soc_component_get_drvdata(component);
+ struct rt712_sdca_dmic_priv *rt712 = snd_soc_component_get_drvdata(component);
unsigned int gain_val[4];
unsigned int i, adc_vol_flag = 0, changed = 0;
unsigned int regvalue[4];
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0293/1257] clk: mvebu: ap-cpu-clk: Assign .num before accessing .hws
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0292/1257] ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0294/1257] KVM: arm64: ptdump: Check the page tables arent freed when accessing Greg Kroah-Hartman
` (705 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aamir Ahmed, Brian Masney,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aamir Ahmed <elb12345@hotmail.co.uk>
[ Upstream commit b4243850393f2f24e21b9f4b2c56233e60c904b4 ]
Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
__counted_by") annotated the hws member of 'struct clk_hw_onecell_data'
with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)
about the number of elements in .hws[], so that it can warn when .hws[]
is accessed out of bounds. As noted in that change, the __counted_by
member must be initialized with the number of elements before the first
array access happens, otherwise there will be a warning from each access
prior to the initialization because the number of elements is zero.
This occurs in ap_cpu_clock_probe(), which reads .hws[] to skip clusters
that have already been set up and writes it inside the CPU node loop,
but only assigns .num after the loop. With CONFIG_UBSAN_BOUNDS and a
compiler that implements __counted_by (GCC 15.1+ or Clang 20.1+), this
triggers an array-index-out-of-bounds report during probe of the AP806
and AP807 CPU clocks, and with CONFIG_UBSAN_TRAP the first access traps.
Initialize .num with nclusters, the number of elements .hws[] was
allocated with, right after the allocation. For the in-tree AP806 and
AP807 device trees, which list the CPU nodes in ascending order, this is
exactly the value the old assignment produced. It is also the correct
value for any other node order, since of_clk_hw_onecell_get() rejects
indices at or beyond .num.
Cc: stable@vger.kernel.org
Fixes: f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by")
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/mvebu/ap-cpu-clk.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/mvebu/ap-cpu-clk.c b/drivers/clk/mvebu/ap-cpu-clk.c
index 1e44ace7d9519..ed3ca59e0ee97 100644
--- a/drivers/clk/mvebu/ap-cpu-clk.c
+++ b/drivers/clk/mvebu/ap-cpu-clk.c
@@ -284,6 +284,8 @@ static int ap_cpu_clock_probe(struct platform_device *pdev)
if (!ap_cpu_data)
return -ENOMEM;
+ ap_cpu_data->num = nclusters;
+
for_each_of_cpu_node(dn) {
char *clk_name = "cpu-cluster-0";
struct clk_init_data init;
@@ -333,8 +335,6 @@ static int ap_cpu_clock_probe(struct platform_device *pdev)
ap_cpu_data->hws[cluster_index] = &ap_cpu_clk[cluster_index].hw;
}
- ap_cpu_data->num = cluster_index + 1;
-
ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, ap_cpu_data);
if (ret)
dev_err(dev, "failed to register OF clock provider\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0294/1257] KVM: arm64: ptdump: Check the page tables arent freed when accessing
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0293/1257] clk: mvebu: ap-cpu-clk: Assign .num before accessing .hws Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0295/1257] KVM: arm64: ptdump: Fix shadow ptdump sleep-in-atomic-context problem Greg Kroah-Hartman
` (704 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko AI, Vincent Donnefort,
Itaru Kitayama, Wei-Lin Chang, Marc Zyngier, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei-Lin Chang <weilin.chang@arm.com>
[ Upstream commit 7d7199bdf77a3a6ed74d0037133f435a7febe97c ]
An open debugfs file keeps the KVM structure alive, but does not prevent
mmu notifier release from freeing the stage-2 page tables when the VMM’s
address space is torn down. Therefore page tables belonging to the mmus
could have been freed when a thread opens or reads the ptdump files.
Take the mmu_lock and check mmu->pgt is still alive before accessing the
page tables.
Also for the ipa_range file and stage2_levels file, switch from keeping
the pointer to the page tables to keeping the pointer to the mmu.
Fixes: 7c4f73548ed1 ("KVM: arm64: Register ptdump with debugfs on guest creation")
Reported-by: Sashiko AI <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/kvmarm/20260623144054.B91D21F000E9@smtp.kernel.org/
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Tested-by: Vincent Donnefort <vdonnefort@google.com>
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Signed-off-by: Wei-Lin Chang <weilin.chang@arm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260924094951.727352-2-weilin.chang@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/ptdump.c | 43 +++++++++++++++++++++++++++++++----------
1 file changed, 33 insertions(+), 10 deletions(-)
diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
index 69899797dbad8..b5a0584260e8b 100644
--- a/arch/arm64/kvm/ptdump.c
+++ b/arch/arm64/kvm/ptdump.c
@@ -115,15 +115,28 @@ static int kvm_ptdump_build_levels(struct ptdump_pg_level *level, u32 start_lvl)
static struct kvm_ptdump_guest_state *kvm_ptdump_parser_create(struct kvm_s2_mmu *mmu)
{
+ struct kvm *kvm = kvm_s2_mmu_to_kvm(mmu);
struct kvm_ptdump_guest_state *st;
- struct kvm_pgtable *pgtable = mmu->pgt;
+ s8 start_level;
int ret;
+ /*
+ * We only need the pgt start level to initialize the ptdump, get it
+ * while holding the mmu_lock. It's fine if the pgt gets freed
+ * afterwards, we'll check again when doing the actual dump.
+ */
+ scoped_guard(read_lock, &kvm->mmu_lock) {
+ if (mmu->pgt)
+ start_level = mmu->pgt->start_level;
+ else
+ return ERR_PTR(-ENOENT);
+ }
+
st = kzalloc_obj(struct kvm_ptdump_guest_state, GFP_KERNEL_ACCOUNT);
if (!st)
return ERR_PTR(-ENOMEM);
- ret = kvm_ptdump_build_levels(&st->level[0], pgtable->start_level);
+ ret = kvm_ptdump_build_levels(&st->level[0], start_level);
if (ret) {
kfree(st);
return ERR_PTR(ret);
@@ -149,6 +162,9 @@ static int kvm_ptdump_guest_show(struct seq_file *m, void *unused)
};
guard(write_lock)(&kvm->mmu_lock);
+ if (!mmu->pgt)
+ return 0;
+
st->parser_state = (struct ptdump_pg_state) {
.marker = &st->ipa_marker[0],
.end_address = BIT(mmu->pgt->ia_bits),
@@ -211,17 +227,27 @@ static const struct file_operations kvm_ptdump_guest_fops = {
static int kvm_pgtable_range_show(struct seq_file *m, void *unused)
{
- struct kvm_pgtable *pgtable = m->private;
+ struct kvm_s2_mmu *mmu = m->private;
+ struct kvm *kvm = kvm_s2_mmu_to_kvm(mmu);
+
+ guard(read_lock)(&kvm->mmu_lock);
+
+ if (mmu->pgt)
+ seq_printf(m, "%2u\n", mmu->pgt->ia_bits);
- seq_printf(m, "%2u\n", pgtable->ia_bits);
return 0;
}
static int kvm_pgtable_levels_show(struct seq_file *m, void *unused)
{
- struct kvm_pgtable *pgtable = m->private;
+ struct kvm_s2_mmu *mmu = m->private;
+ struct kvm *kvm = kvm_s2_mmu_to_kvm(mmu);
+
+ guard(read_lock)(&kvm->mmu_lock);
+
+ if (mmu->pgt)
+ seq_printf(m, "%1d\n", KVM_PGTABLE_MAX_LEVELS - mmu->pgt->start_level);
- seq_printf(m, "%1d\n", KVM_PGTABLE_MAX_LEVELS - pgtable->start_level);
return 0;
}
@@ -230,15 +256,12 @@ static int kvm_pgtable_debugfs_open(struct inode *m, struct file *file,
{
struct kvm_s2_mmu *mmu = m->i_private;
struct kvm *kvm = kvm_s2_mmu_to_kvm(mmu);
- struct kvm_pgtable *pgtable;
int ret;
if (!kvm_get_kvm_safe(kvm))
return -ENOENT;
- pgtable = mmu->pgt;
-
- ret = single_open(file, show, pgtable);
+ ret = single_open(file, show, mmu);
if (ret < 0)
kvm_put_kvm(kvm);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0295/1257] KVM: arm64: ptdump: Fix shadow ptdump sleep-in-atomic-context problem
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0294/1257] KVM: arm64: ptdump: Check the page tables arent freed when accessing Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0296/1257] regulator: core: Fix coupled regulators reference leak on removal Greg Kroah-Hartman
` (703 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Itaru Kitayama, Wei-Lin Chang,
Marc Zyngier, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei-Lin Chang <weilin.chang@arm.com>
[ Upstream commit b1cc219eb21ab5f31fe4caa32be8057159e42db5 ]
Previously we exposed shadow page tables by creating a debugfs ptdump
file whenever a nested mmu instance gets bound to a new context, and
deleting the debugfs file whose context was getting unbound.
This turned out to be buggy, as the instance<->context binding process
is done with the mmu_lock held, and debugfs creation/deletion can sleep.
Change the approach and create a shadow ptdump file for each nested mmu
instead during kvm_vcpu_init_nested(), in a sleepable context. The files
will be named nested_mmu<index>, and reading it will return the nested
context's VTTBR, VTCR, and s2 enabled or not before dumping the shadow
page tables, given the nested mmu is valid.
Fixes: 19e15dc73f0f ("KVM: arm64: nv: Expose shadow page tables in debugfs")
Reported-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Closes: https://lore.kernel.org/kvmarm/aiuF0KSvvv-ZozI1@sm-arm-grace07/
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Signed-off-by: Wei-Lin Chang <weilin.chang@arm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260924094951.727352-3-weilin.chang@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/kvm_mmu.h | 6 ++----
arch/arm64/kvm/nested.c | 9 ++++-----
arch/arm64/kvm/ptdump.c | 32 +++++++++++++++-----------------
3 files changed, 21 insertions(+), 26 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 6eae7e7e2a684..ac2b0637692ad 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -392,12 +392,10 @@ static inline bool kvm_supports_cacheable_pfnmap(void)
#ifdef CONFIG_PTDUMP_STAGE2_DEBUGFS
void kvm_s2_ptdump_create_debugfs(struct kvm *kvm);
-void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu);
-void kvm_nested_s2_ptdump_remove_debugfs(struct kvm_s2_mmu *mmu);
+void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu, int idx);
#else
static inline void kvm_s2_ptdump_create_debugfs(struct kvm *kvm) {}
-static inline void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu) {}
-static inline void kvm_nested_s2_ptdump_remove_debugfs(struct kvm_s2_mmu *mmu) {}
+static inline void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu, int idx) {}
#endif /* CONFIG_PTDUMP_STAGE2_DEBUGFS */
#endif /* __ASSEMBLER__ */
diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
index b191365d97cc2..41253fe45941c 100644
--- a/arch/arm64/kvm/nested.c
+++ b/arch/arm64/kvm/nested.c
@@ -124,6 +124,9 @@ int kvm_vcpu_init_nested(struct kvm_vcpu *vcpu)
return ret;
}
+ for (i = 0; i < S2_MMU_PER_VCPU; i++)
+ kvm_nested_s2_ptdump_create_debugfs(&tmp[i], i + kvm->arch.nested_mmus_size);
+
guard(write_lock)(&kvm->mmu_lock);
for (i = 0; i < S2_MMU_PER_VCPU; i++)
@@ -837,10 +840,8 @@ static struct kvm_s2_mmu *get_s2_mmu_nested(struct kvm_vcpu *vcpu)
kvm->arch.nested_mmus_next = (i + 1) % kvm->arch.nested_mmus_size;
/* Make sure we don't forget to do the laundry */
- if (kvm_s2_mmu_valid(s2_mmu)) {
- kvm_nested_s2_ptdump_remove_debugfs(s2_mmu);
+ if (kvm_s2_mmu_valid(s2_mmu))
s2_mmu->pending_unmap = true;
- }
/*
* The virtual VMID (modulo CnP) will be used as a key when matching
@@ -854,8 +855,6 @@ static struct kvm_s2_mmu *get_s2_mmu_nested(struct kvm_vcpu *vcpu)
s2_mmu->tlb_vtcr = vcpu_read_sys_reg(vcpu, VTCR_EL2);
s2_mmu->nested_stage2_enabled = vcpu_read_sys_reg(vcpu, HCR_EL2) & HCR_VM;
- kvm_nested_s2_ptdump_create_debugfs(s2_mmu);
-
out:
atomic_inc(&s2_mmu->refcnt);
diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
index b5a0584260e8b..7829fe376385b 100644
--- a/arch/arm64/kvm/ptdump.c
+++ b/arch/arm64/kvm/ptdump.c
@@ -17,7 +17,7 @@
#define MARKERS_LEN 2
#define KVM_PGTABLE_MAX_LEVELS (KVM_PGTABLE_LAST_LEVEL + 1)
-#define S2FNAMESZ sizeof("0x0123456789abcdef-0x0123456789abcdef-s2-disabled")
+#define S2FNAMESZ sizeof("nested_mmu0000")
struct kvm_ptdump_guest_state {
struct kvm_s2_mmu *mmu;
@@ -173,6 +173,15 @@ static int kvm_ptdump_guest_show(struct seq_file *m, void *unused)
.seq = m,
};
+ if (kvm_is_nested_s2_mmu(kvm, mmu)) {
+ if (kvm_s2_mmu_valid(mmu))
+ seq_printf(m, "VTCR: 0x%016llx VTTBR: 0x%016llx s2: %s\n",
+ mmu->tlb_vtcr, mmu->tlb_vttbr,
+ mmu->nested_stage2_enabled ? "enabled" : "disabled");
+ else
+ return 0;
+ }
+
ret = kvm_pgtable_walk(mmu->pgt, 0, BIT(mmu->pgt->ia_bits), &walker);
if (ret)
return ret;
@@ -299,26 +308,15 @@ static const struct file_operations kvm_pgtable_levels_fops = {
.release = kvm_pgtable_debugfs_close,
};
-void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu)
+void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu, int idx)
{
- struct dentry *dent;
char file_name[S2FNAMESZ];
- snprintf(file_name, sizeof(file_name), "0x%016llx-0x%016llx-s2-%sabled",
- mmu->tlb_vttbr,
- mmu->tlb_vtcr,
- mmu->nested_stage2_enabled ? "en" : "dis");
-
- dent = debugfs_create_file(file_name, 0400,
- mmu->arch->debugfs_nv_dentry, mmu,
- &kvm_ptdump_guest_fops);
+ snprintf(file_name, sizeof(file_name), "nested_mmu%d", idx);
- mmu->shadow_pt_debugfs_dentry = dent;
-}
-
-void kvm_nested_s2_ptdump_remove_debugfs(struct kvm_s2_mmu *mmu)
-{
- debugfs_remove(mmu->shadow_pt_debugfs_dentry);
+ debugfs_create_file(file_name, 0400,
+ mmu->arch->debugfs_nv_dentry, mmu,
+ &kvm_ptdump_guest_fops);
}
void kvm_s2_ptdump_create_debugfs(struct kvm *kvm)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0296/1257] regulator: core: Fix coupled regulators reference leak on removal
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0295/1257] KVM: arm64: ptdump: Fix shadow ptdump sleep-in-atomic-context problem Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0297/1257] hwmon: (lm95245) Fix negative temperature conversion Greg Kroah-Hartman
` (702 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit b9205f0837ca91a0bbe6aa9002207656840c1406 ]
of_parse_coupled_regulator() returns the coupled regulator with its
device reference incremented and regulator_resolve_coupling() stores it
in coupling_desc.coupled_rdevs[]. regulator_remove_coupling() clears
those pointers without dropping the references, so they are leaked when
the couple is torn down.
Release the reference of each coupled regulator while removing the
coupling.
Fixes: d3d64537c339 ("regulator: core: Resolve coupled regulators")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917143052.2156903-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 811a890b88311..e20f00c364efe 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5909,6 +5909,8 @@ static void regulator_remove_coupling(struct regulator_dev *rdev)
c_desc->coupled_rdevs[i] = NULL;
c_desc->n_resolved--;
+
+ put_device(&c_rdev->dev);
}
if (coupler && coupler->detach_regulator) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0297/1257] hwmon: (lm95245) Fix negative temperature conversion
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0296/1257] regulator: core: Fix coupled regulators reference leak on removal Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0298/1257] hwmon: (lm70) Fix rounding of negative temperatures Greg Kroah-Hartman
` (701 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ridham Khurana, Guenter Roeck,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ridham Khurana <khurana.ridham222@gmail.com>
[ Upstream commit f58c16056f8585ebafb0f1f5d90c23085443a4b9 ]
temp_from_reg_signed() uses only the high byte when the sign bit is set
and drops the fractional bits in the low byte. Writing -500 to
temp2_offset stores 0xff80 (-0.5 degrees C) in the offset registers,
but reading temp2_offset back returns -1000.
Negative temp1_input and temp2_input values are rounded down to the
next whole degree the same way. The chip reports -0.125 degrees C as
0xffe0, which the driver returns as -1000.
Treat the register pair as a single 16-bit two's complement value.
Fixes: fffd80ccc1e6 ("hwmon: LM95245 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ridham Khurana <khurana.ridham222@gmail.com>
Link: https://patch.msgid.link/20260923172551.1593798-1-khurana.ridham222@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/lm95245.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/hwmon/lm95245.c b/drivers/hwmon/lm95245.c
index 11553391f54b1..925574b8b0ca4 100644
--- a/drivers/hwmon/lm95245.c
+++ b/drivers/hwmon/lm95245.c
@@ -96,9 +96,9 @@ static int temp_from_reg_unsigned(u8 val_h, u8 val_l)
static int temp_from_reg_signed(u8 val_h, u8 val_l)
{
- if (val_h & 0x80)
- return (val_h - 0x100) * 1000;
- return temp_from_reg_unsigned(val_h, val_l);
+ s16 val_hl = (val_h << 8) | val_l;
+
+ return val_hl * 1000 / 256;
}
static int lm95245_read_conversion_rate(struct lm95245_data *data)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0298/1257] hwmon: (lm70) Fix rounding of negative temperatures
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0297/1257] hwmon: (lm95245) Fix negative temperature conversion Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0299/1257] fuse: dont shorten the folio descriptor at LLONG_MAX Greg Kroah-Hartman
` (700 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ridham Khurana, Guenter Roeck,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ridham Khurana <khurana.ridham222@gmail.com>
[ Upstream commit eddb0aaacce4baa9d8176eb2f4bd9e99e867f8fc ]
temp1_input_show() drops the low bits of the temperature register by
dividing the raw value (raw / 32 on the LM70). These bits are not part
of the temperature: the LM70, LM71, LM74 and TMP122/TMP124 always
return some of them as 1, and the TMP125 fills them with copies of the
temperature LSB. Division rounds toward zero, so a negative temperature
with any of these bits set is reported one LSB too high.
For example, the TMP122 returns 0xffff for -0.0625 degrees C, which the
driver reports as 0. The LM70 returns 0xf39f for -25 degrees C, which
the driver reports as -24750.
Use an arithmetic right shift instead, which drops the low bits and
rounds down.
Fixes: e1a8e913f97e ("[PATCH] lm70: New hardware monitoring driver")
Fixes: a86e94dc946d ("hwmon: (lm70) Add support for LM71 and LM74")
Fixes: cd929672a9ef ("hwmon: (lm70) Add ti,tmp125 support")
Cc: stable@vger.kernel.org
Signed-off-by: Ridham Khurana <khurana.ridham222@gmail.com>
Link: https://patch.msgid.link/20260924205326.1739229-1-khurana.ridham222@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/lm70.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/hwmon/lm70.c b/drivers/hwmon/lm70.c
index 8b525725fef4f..b29bac7a4cc14 100644
--- a/drivers/hwmon/lm70.c
+++ b/drivers/hwmon/lm70.c
@@ -96,21 +96,21 @@ static ssize_t temp1_input_show(struct device *dev,
*/
switch (p_lm70->chip) {
case LM70_CHIP_LM70:
- val = ((int)raw / 32) * 250;
+ val = ((int)raw >> 5) * 250;
break;
case LM70_CHIP_TMP121:
case LM70_CHIP_TMP122:
case LM70_CHIP_LM74:
- val = ((int)raw / 8) * 625 / 10;
+ val = ((int)raw >> 3) * 625 / 10;
break;
case LM70_CHIP_LM71:
- val = ((int)raw / 4) * 3125 / 100;
+ val = ((int)raw >> 2) * 3125 / 100;
break;
case LM70_CHIP_TMP125:
- val = (sign_extend32(raw, 14) / 32) * 250;
+ val = (sign_extend32(raw, 14) >> 5) * 250;
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0299/1257] fuse: dont shorten the folio descriptor at LLONG_MAX
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0298/1257] hwmon: (lm70) Fix rounding of negative temperatures Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0300/1257] fuse: dont drop destination page cache on a zero byte copy reply Greg Kroah-Hartman
` (699 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Joanne Koong,
Miklos Szeredi, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <joannelkoong@gmail.com>
[ Upstream commit 4c72635f913850512d5fa74bf3eb7db3670398cf ]
fuse_send_readpages() and fuse_do_readfolio() both decrement the folio
descriptor length when handling the overflow case where a read would
exceed LLONG_MAX after incrementing the file position by the number of
bytes that need to be read in.
Shortening it is unnecessary (and for the virtio-fs paths, a bug), and
with fuse using iomap for handling reads, shortening it is buggy.
For fuse_send_readpages(), ap->descs[] is also what fuse_readpages_end()
reports back to iomap_finish_folio_read(). iomap accounted the full
length when the range was submitted, so the lengths reported on
completion have to add up to what was submitted. Reporting one byte less
leaves ifs->read_bytes_pending nonzero, folio_end_read() is never called,
and the folio stays locked.
This is currently reachable on fuseblk mounts configured with block
sizes smaller than the page size.
Fix this by leaving the descriptor length untouched. The reply will then
be one byte shorter than what the descriptor lengths add up to, and the
last byte will be zeroed in fuse_copy_folios().
This also fixes a bug in virtio-fs that existed before any iomap changes
were added to fuse. For virtio-fs, data there arrives by DMA rather than
through fuse_copy_folios(), so the only zeroing is in
virtio_fs_request_complete(), which compares the reply size against the
descriptor length. With the descriptor length shortened, the two are
equal and nothing gets zeroed, which means the unrequested byte is left
holding whatever was in the folio, when the folio is marked uptodate.
This is both in the fuse_do_readfolio() and fuse_send_readpages() paths.
This dates back to commit 2f1398291bf3 ("fuse: don't overflow LLONG_MAX
with end offset").
Fixes: 4ea907108a5c ("fuse: use iomap for readahead")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/file.c | 38 +++++++++++++++++++++++++++++---------
1 file changed, 29 insertions(+), 9 deletions(-)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 9a36d0329e221..b52f5b45646c9 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -864,18 +864,29 @@ static int fuse_do_readfolio(struct file *file, struct folio *folio,
attr_ver = fuse_get_attr_version(fm->fc);
- /* Don't overflow end offset */
- if (pos + (desc.length - 1) == LLONG_MAX)
- desc.length--;
+ /*
+ * Don't overflow end offset.
+ *
+ * Ask the server for len - 1 bytes. desc.length still holds the full
+ * length. When the reply comes back, it will be one byte shorter than
+ * desc.length and fuse_copy_folios() will zero that last byte.
+ *
+ * For this reason, desc.length must not be decremented too. The caller
+ * reports the full length to iomap_finish_folio_read(), which marks
+ * every block it covers uptodate. Shortening the descriptor would
+ * suppress zeroing and leave the last byte holding stale data.
+ */
+ if (pos + (len - 1) == LLONG_MAX)
+ len--;
- fuse_read_args_fill(&ia, file, pos, desc.length, FUSE_READ);
+ fuse_read_args_fill(&ia, file, pos, len, FUSE_READ);
res = fuse_simple_request(fm, &ia.ap.args);
if (res < 0)
return res;
/*
* Short read means EOF. If file size is larger, truncate it
*/
- if (res < desc.length)
+ if (res < len)
fuse_short_read(inode, attr_ver, res, &ia.ap);
return 0;
@@ -1068,11 +1079,20 @@ static void fuse_send_readpages(struct fuse_io_args *ia, struct file *file,
ap->args.page_zeroing = true;
ap->args.page_replace = true;
- /* Don't overflow end offset */
- if (pos + (count - 1) == LLONG_MAX) {
+ /*
+ * Don't overflow end offset.
+ *
+ * Ask the server for count - 1 bytes. The reply is then one byte
+ * shorter than what the descriptor lengths add up to, so
+ * fuse_copy_folios() zeroes the last byte when it walks the folios.
+ *
+ * ap->descs[] must not be decremented here. It is what
+ * fuse_readpages_end() reports back to iomap_finish_folio_read(), and
+ * iomap has already accounted the full descriptor length, so shortening
+ * it would leave ifs->read_bytes_pending nonzero and the folio locked.
+ */
+ if (pos + (count - 1) == LLONG_MAX)
count--;
- ap->descs[ap->num_folios - 1].length--;
- }
WARN_ON((loff_t) (pos + count) < 0);
fuse_read_args_fill(ia, file, pos, count, FUSE_READ);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0300/1257] fuse: dont drop destination page cache on a zero byte copy reply
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0299/1257] fuse: dont shorten the folio descriptor at LLONG_MAX Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0301/1257] platform/x86/intel/pmt: Block mmap when callback is present Greg Kroah-Hartman
` (698 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joanne Koong, Miklos Szeredi,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <joannelkoong@gmail.com>
[ Upstream commit f7585e1ce3418ec282485854b3d8d31c6a961e37 ]
__fuse_copy_file_range() clears the destination page cache after the
server replies:
truncate_inode_pages_range(inode_out->i_mapping,
ALIGN_DOWN(pos_out, PAGE_SIZE),
ALIGN(pos_out + bytes_copied, PAGE_SIZE) - 1);
A server may legitimately reply that it copied nothing, eg if the source
file turns out to be shorter than the size the kernel has cached for it.
If pos_out is 0 as well, the end of the range is ALIGN(0, PAGE_SIZE) - 1,
which is -1. lend is a uoff_t and truncate_inode_pages_range() takes -1
as its end of file sentinel, so rather than clearing nothing it drops
every folio in the destination mapping.
That is not only a cache drop. truncate_cleanup_folio() calls
folio_cancel_dirty(), and fuse_writeback_range() only wrote back
[pos_out, pos_out + len - 1], so dirty data elsewhere in the destination
file is discarded without ever reaching the server.
Skip the call when the server copied nothing, since there is nothing
stale to clear in that case.
Fixes: 9b46418c40fe ("fuse: copy_file_range should truncate cache")
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/file.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index b52f5b45646c9..0f2c9404af74a 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -3058,9 +3058,11 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
goto out;
}
- truncate_inode_pages_range(inode_out->i_mapping,
- ALIGN_DOWN(pos_out, PAGE_SIZE),
- ALIGN(pos_out + bytes_copied, PAGE_SIZE) - 1);
+ if (bytes_copied)
+ truncate_inode_pages_range(inode_out->i_mapping,
+ ALIGN_DOWN(pos_out, PAGE_SIZE),
+ ALIGN(pos_out + bytes_copied,
+ PAGE_SIZE) - 1);
file_update_time(file_out);
fuse_write_update_attr(inode_out, pos_out + bytes_copied, bytes_copied);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0301/1257] platform/x86/intel/pmt: Block mmap when callback is present
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0300/1257] fuse: dont drop destination page cache on a zero byte copy reply Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0302/1257] mtd: rawnand: nuvoton: fix clock cleanup on probe failure Greg Kroah-Hartman
` (697 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael J. Ruhl, Ilpo Järvinen,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael J. Ruhl <michael.j.ruhl@intel.com>
[ Upstream commit 0d4cd92b41dd33a3112959f9be86002ff309de73 ]
With the introduction of the .read_telem() callback, control
for access to a devices data area must be done by the callback
owner.
This means that an area cannot be mmap-ed with the default PMT
handler.
If the .read_telem() callback is present, do not support mmap.
Fixes: 045a513040cc ("platform/x86/intel/pmt: Use PMT callbacks")
Cc: stable@vger.kernel.org
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Link: https://patch.msgid.link/20260910135954.1586360-2-michael.j.ruhl@intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/pmt/class.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel/pmt/class.c b/drivers/platform/x86/intel/pmt/class.c
index d0ab8e33c62a6..c25892a511804 100644
--- a/drivers/platform/x86/intel/pmt/class.c
+++ b/drivers/platform/x86/intel/pmt/class.c
@@ -417,7 +417,14 @@ static int intel_pmt_dev_register(struct intel_pmt_entry *entry,
sysfs_bin_attr_init(&entry->pmt_bin_attr);
entry->pmt_bin_attr.attr.name = ns->name;
entry->pmt_bin_attr.attr.mode = 0440;
- entry->pmt_bin_attr.mmap = intel_pmt_mmap;
+
+ /*
+ * The read_telem callback controls access to the memory area. Block
+ * usage if the read_telem callback is present.
+ */
+ if (!(entry->cb && entry->cb->read_telem))
+ entry->pmt_bin_attr.mmap = intel_pmt_mmap;
+
entry->pmt_bin_attr.read = intel_pmt_read;
entry->pmt_bin_attr.size = entry->size;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0302/1257] mtd: rawnand: nuvoton: fix clock cleanup on probe failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0301/1257] platform/x86/intel/pmt: Block mmap when callback is present Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0303/1257] mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init() Greg Kroah-Hartman
` (696 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 8a485a40f45a19c5fcafb5cbee7387c2762af7c4 ]
ma35_nand_probe() gets and enables the NAND clock with
devm_clk_get_enabled(), but the ma35_nand_chips_init() failure path
also calls clk_disable() before returning.
devm_clk_get_enabled() registers a managed cleanup that calls
clk_disable_unprepare() on probe failure and driver removal. Calling
clk_disable() explicitly first drops the clock enable count, so the
managed cleanup attempts to disable the clock again and triggers the
clock framework warning for an already disabled clock.
Remove the redundant clk_disable() and let the managed clock cleanup
handle the clock state.
This issue was found by manual code inspection.
Fixes: 5abb5d414d55 ("mtd: rawnand: nuvoton: add new driver for the Nuvoton MA35 SoC")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c b/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c
index 1a285cd8fad62..f659d3a6b9ef4 100644
--- a/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c
+++ b/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c
@@ -993,7 +993,6 @@ static int ma35_nand_probe(struct platform_device *pdev)
ret = ma35_nand_chips_init(&pdev->dev, nand);
if (ret) {
dev_err(&pdev->dev, "failed to init NAND chips\n");
- clk_disable(nand->clk);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0303/1257] mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0302/1257] mtd: rawnand: nuvoton: fix clock cleanup on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0304/1257] mtd: maps: pci: balance PCI enable on cleanup Greg Kroah-Hartman
` (695 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 94edcda45d888c3bb1310de11e10e4537c166f00 ]
atmel_nand_controller_init() takes a reference to the MCK clock with
of_clk_get() and keeps it in nc->mck for the lifetime of the
controller. If the "atmel,smc" phandle is missing or the SMC regmap
cannot be obtained afterwards, the error path jumps to out_release_dma
which only releases the DMA channel, so the clock reference is leaked.
The callers return the error directly and never run
atmel_nand_controller_cleanup(), where the clock is normally put.
Release the reference on those error paths. The path on which
of_clk_get() itself fails keeps jumping to out_release_dma, as nc->mck
only holds an error pointer there.
Fixes: f9ce2eddf176 ("mtd: nand: atmel: Add ->setup_data_interface() hooks")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/atmel/nand-controller.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index 8a19408abb635..0bdbcbb50d94c 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -2085,7 +2085,7 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
if (!np) {
dev_err(dev, "Missing or invalid atmel,smc property\n");
ret = -EINVAL;
- goto out_release_dma;
+ goto out_put_mck;
}
nc->smc = syscon_node_to_regmap(np);
@@ -2093,11 +2093,13 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
if (IS_ERR(nc->smc)) {
ret = PTR_ERR(nc->smc);
dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret);
- goto out_release_dma;
+ goto out_put_mck;
}
return 0;
+out_put_mck:
+ clk_put(nc->mck);
out_release_dma:
if (nc->dmac)
dma_release_channel(nc->dmac);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0304/1257] mtd: maps: pci: balance PCI enable on cleanup
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0303/1257] mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0305/1257] mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device Greg Kroah-Hartman
` (694 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Miquel Raynal, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 3be16e5d4990bf96309ac5ba35cb369c6015bce7 ]
mtd_pci_probe() leaves the PCI device enabled on later probe failure and
mtd_pci_remove() does not disable it either. Use pcim_enable_device() to
release the enable reference after the existing map and region cleanup.
The imbalance is already present in the initial Git import.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/maps/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/maps/pci.c b/drivers/mtd/maps/pci.c
index 34041cc8f173a..f13a1f520d043 100644
--- a/drivers/mtd/maps/pci.c
+++ b/drivers/mtd/maps/pci.c
@@ -250,7 +250,7 @@ static int mtd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
struct mtd_info *mtd = NULL;
int err;
- err = pci_enable_device(dev);
+ err = pcim_enable_device(dev);
if (err)
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0305/1257] mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0304/1257] mtd: maps: pci: balance PCI enable on cleanup Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0306/1257] mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one() Greg Kroah-Hartman
` (693 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Orgad Shaneh, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Orgad Shaneh <orgads@gmail.com>
[ Upstream commit cfc5ebc9540e29f8f96db88bbfa261139e5afedb ]
The Write to Buffer command takes the number of words to program minus
one, and do_write_buffer() sends that count as a single bus word:
map_write(map, CMD(words - 1), cmd_adr);
CMD() replicates the value into every device lane, so each device reads
the count off its own data lines - eight of them on an x8 part. A count
that does not fit in eight bits is truncated there, which limits one
Write to Buffer to 256 words on an x8 device, however large a buffer the
chip advertises in its CFI query.
The M29EW on a Cavium Octeon CN6335 board (an x16 part strapped to x8)
advertises MaxBufWriteSize = 512 bytes, so cfi_amdstd_write_buffers()
split the data into 512-byte chunks and do_write_buffer() sent a count of
511. The chip saw 511 & 0xff = 255, expected 256 bytes, and aborted the
program when the 257th arrived. Chunks below 256 bytes - the leading
partial chunk of a write - completed normally, so only the full-size ones
failed:
MTD do_write_buffer_wait(): software timeout, address:0x03278bff.
jffs2: Write of 4164 bytes at 0x02c789b4 failed. returned -5, retlen 68
jffs2: No space for garbage collection. Aborting GC thread
Clamp MaxBufWriteSize for x8 devices in the write-buffer fixup, and
recompute mtd->writebufsize, which cfi_cmdset_0002_setup() derives from
MaxBufWriteSize before the fixups run.
The clamp deliberately keys off the device width rather than the part,
even though the driver already recognises this one in is_m29ew(): the
ceiling comes from the width of a device's data bus, not from the chip,
so any x8 device advertising a larger buffer is told a count it cannot
receive. The M29EW is only where it was found.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/chips/cfi_cmdset_0002.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 517db2f2707f4..100cab95a17b1 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -283,6 +283,21 @@ static void fixup_use_write_buffers(struct mtd_info *mtd)
pr_debug("Using buffer write method\n");
mtd->_write = cfi_amdstd_write_buffers;
}
+
+ /*
+ * The word count of the Write to Buffer command is a single bus
+ * word per device, so an x8 device can be told to program at most
+ * 256 bytes however large a buffer it advertises - including when
+ * several of them are interleaved on a wider bus, where CMD()
+ * replicates the count into each device's lane and it is truncated
+ * there.
+ */
+ if (cfi->device_type == CFI_DEVICETYPE_X8 &&
+ cfi->cfiq->MaxBufWriteSize > 8) {
+ cfi->cfiq->MaxBufWriteSize = 8;
+ mtd->writebufsize = cfi_interleave(cfi) <<
+ cfi->cfiq->MaxBufWriteSize;
+ }
}
#endif /* !FORCE_WORD_WRITE */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0306/1257] mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0305/1257] mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0307/1257] mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx() Greg Kroah-Hartman
` (692 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 1a122f5fecbabd47b81b1be3f0934f57b78aad42 ]
init_amd76xrom() obtains the PCI device with pci_get_device() and
hands the reference over to amd76xrom_init_one(), which stores it in
window->pdev. When reserving the ROM window fails, that function
returns -EBUSY directly instead of going through amd76xrom_cleanup(),
so the reference is neither released nor cleared.
Drop the reference and clear window->pdev on that path.
Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/maps/amd76xrom.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/mtd/maps/amd76xrom.c b/drivers/mtd/maps/amd76xrom.c
index 457e6ab7f3fb1..0c3e0eb08b8d8 100644
--- a/drivers/mtd/maps/amd76xrom.c
+++ b/drivers/mtd/maps/amd76xrom.c
@@ -152,6 +152,8 @@ static int amd76xrom_init_one(struct pci_dev *pdev,
printk(KERN_ERR MOD_NAME
" %s(): Unable to register resource %pR - kernel bug?\n",
__func__, &window->rsrc);
+ pci_dev_put(window->pdev);
+ window->pdev = NULL;
return -EBUSY;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0307/1257] mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0306/1257] mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0308/1257] mtd: maps: l440gx: Fix double put of the PM device " Greg Kroah-Hartman
` (691 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 521ad948e04934b2d70ae899bc016bbb38802e90 ]
init_l440gx() takes a single reference on the PIIX4 ISA bridge with
pci_get_device() and drops it again right after the lookups, before
the flash window is set up. The pci_assign_resource() failure path
then calls pci_dev_put() on the same device a second time, releasing a
reference that is no longer owned and underflowing the reference count.
Remove the extra pci_dev_put().
Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/maps/l440gx.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/mtd/maps/l440gx.c b/drivers/mtd/maps/l440gx.c
index 832b880d1aaf8..85cd273ce0654 100644
--- a/drivers/mtd/maps/l440gx.c
+++ b/drivers/mtd/maps/l440gx.c
@@ -110,7 +110,6 @@ static int __init init_l440gx(void)
/* Allocate the resource region */
if (pci_assign_resource(pm_dev, PIIXE_IOBASE_RESOURCE) != 0) {
- pci_dev_put(dev);
pci_dev_put(pm_dev);
printk(KERN_WARNING "Could not allocate pm iobase resource\n");
iounmap(l440gx_map.virt);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0308/1257] mtd: maps: l440gx: Fix double put of the PM device in init_l440gx()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0307/1257] mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0309/1257] mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb() Greg Kroah-Hartman
` (690 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit e6ca524ee5b2705be30ea19ce2e55122d9f9ed8f ]
The PIIX4 PM device reference taken with pci_get_device() is dropped
again before the iobase resource is allocated. If pci_assign_resource()
fails, the error path calls pci_dev_put() on pm_dev a second time,
releasing a reference that is no longer owned and underflowing the
reference count.
Remove the extra pci_dev_put().
Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/maps/l440gx.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/mtd/maps/l440gx.c b/drivers/mtd/maps/l440gx.c
index 85cd273ce0654..1df5ea5fafcac 100644
--- a/drivers/mtd/maps/l440gx.c
+++ b/drivers/mtd/maps/l440gx.c
@@ -110,7 +110,6 @@ static int __init init_l440gx(void)
/* Allocate the resource region */
if (pci_assign_resource(pm_dev, PIIXE_IOBASE_RESOURCE) != 0) {
- pci_dev_put(pm_dev);
printk(KERN_WARNING "Could not allocate pm iobase resource\n");
iounmap(l440gx_map.virt);
return -ENXIO;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0309/1257] mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0308/1257] mtd: maps: l440gx: Fix double put of the PM device " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0310/1257] mtd: Call get_wunit() on the master partition Greg Kroah-Hartman
` (689 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 62ee3da38f41bef83c1cf250f6816a0ee187674b ]
mtd_get_sb() is called with a reference to the MTD device already
taken by the caller. When sget_dev() fails, the function returns the
error without dropping that reference, so the device is never released
and its refcount never reaches zero. Every mount attempt on an MTD
device whose superblock cannot be set up leaks a reference.
Restore the put_mtd_device() that the fs_context conversion dropped on
this path.
Fixes: 0f071004109d ("mtd: Provide fs_context-aware mount_mtd() replacement")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/mtdsuper.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index c709ff7aa6b57..02eede3fe582e 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -31,8 +31,10 @@ static int mtd_get_sb(struct fs_context *fc,
int ret;
sb = sget_dev(fc, MKDEV(MTD_BLOCK_MAJOR, mtd->index));
- if (IS_ERR(sb))
+ if (IS_ERR(sb)) {
+ put_mtd_device(mtd);
return PTR_ERR(sb);
+ }
if (sb->s_root) {
/* new mountpoint for an already mounted superblock */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0310/1257] mtd: Call get_wunit() on the master partition
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0309/1257] mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0311/1257] hwmon: (coretemp) Refresh the temperature on the first read Greg Kroah-Hartman
` (688 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Weinberger, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <richard@nod.at>
[ Upstream commit 904f18430e8cce829cb9130eab7a93020e33fc89 ]
The code checks whether master has get_wunit() but still calls
it on the child. Fix this.
Fixes: 46b5889cc2c5 ("mtd: implement proper partition handling")
Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/mtdcore.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 491a27d0315fa..b170c3144ca8f 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -563,7 +563,7 @@ int mtd_pairing_info_to_wunit(struct mtd_info *mtd,
return -EINVAL;
if (master->pairing && master->pairing->get_wunit)
- return mtd->pairing->get_wunit(master, info);
+ return master->pairing->get_wunit(master, info);
return info->pair;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0311/1257] hwmon: (coretemp) Refresh the temperature on the first read
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0310/1257] mtd: Call get_wunit() on the master partition Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0312/1257] dcache: report a Tasks-RCU quiescent state in dentry_kill() Greg Kroah-Hartman
` (687 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Neri, Guenter Roeck,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
[ Upstream commit e463cd582ca125e359ad1a66cb076434c14638b2 ]
show_temp() reads the status MSR only when the cached temperature is
older than one second. Commit 5c0e64dde80f ("hwmon: (coretemp) Remove
obsolete temp_data->valid") dropped the tdata->valid check that used to
force the very first read, leaving that comparison as the only trigger.
A never-updated temp_data carries a zero timestamp, which does not look
stale on 32-bit kernels: jiffies starts 300 seconds short of wrapping,
so the comparison stays false until jiffies wraps and passes HZ. For the
first 301 seconds of uptime temp%d_input reports the zero left by the
allocator rather than the CPU temperature. 64-bit kernels are
unaffected: jiffies starts at a positive value there and does not wrap.
Backdate the timestamp when the temperature data is allocated. One jiffy
older than the caching interval is stale under either word size, and the
first refresh overwrites it.
Fixes: 5c0e64dde80f ("hwmon: (coretemp) Remove obsolete temp_data->valid")
Cc: stable@vger.kernel.org
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Link: https://patch.msgid.link/20260924-coretemp-temp-fault-v1-1-1884f0ff97d5@linux.intel.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/coretemp.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 5095eb0576805..ace51e08e72dc 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -511,6 +511,11 @@ init_temp_data(struct platform_data *pdata, unsigned int cpu, int pkg_flag)
tdata->cpu = cpu;
tdata->cpu_core_id = topology_core_id(cpu);
tdata->attr_size = MAX_CORE_ATTRS;
+ /*
+ * A zero timestamp does not look stale on 32-bit, where jiffies
+ * starts just short of wrapping. Backdate it instead.
+ */
+ tdata->last_updated = jiffies - HZ - 1;
mutex_init(&tdata->update_lock);
return tdata;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0312/1257] dcache: report a Tasks-RCU quiescent state in dentry_kill()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0311/1257] hwmon: (coretemp) Refresh the temperature on the first read Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0313/1257] ASoC: sdw_utils: clear stale RT711 device reference on exit Greg Kroah-Hartman
` (686 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Paul E. McKenney,
Christian Brauner (Amutable), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit a647a53bc89a046bee4a12a0a5627f2dfaaef807 ]
I am constantly seeing the following warning on Meta's fleet:
INFO: rcu_tasks detected stalls on tasks:
native_queued_spin_lock_slowpath
locked_inode_to_wb_and_lock_list
inode_io_list_del
evict
__dentry_kill
shrink_dentry_list
shrink_dcache_tree
d_invalidate
btrfs_delete_subvolume
btrfs_ioctl_snap_destroy
btrfs_ioctl
do_syscall_64
dentry_kill() is the common funnel for dentry teardown: dput(),
shrink_dentry_list() and shrink_dcache_tree() all reach it, once per
dentry, and its cond_resched() is the only reschedule point on that path.
cond_resched() is not an RCU-tasks quiescent state.
Use cond_resched_tasks_rcu_qs() so the teardown reports an RCU-tasks
quiescent state as it proceeds.
Fixes: 9c5f1d30199d ("dcache: move cond_resched() into the end of __dentry_kill()")
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260918-dcache-task-rcu-qa-v1-1-963ec83e6d0b@debian.org
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/dcache.c b/fs/dcache.c
index 2eb23222be549..91fbaa818baa7 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -843,7 +843,7 @@ static struct dentry *dentry_kill(struct dentry *dentry)
if (dentry->d_op && dentry->d_op->d_release)
dentry->d_op->d_release(dentry);
- cond_resched();
+ cond_resched_tasks_rcu_qs();
/* now that it's negative, ->d_parent is stable */
if (!IS_ROOT(dentry)) {
parent = dentry->d_parent;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0313/1257] ASoC: sdw_utils: clear stale RT711 device reference on exit
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0312/1257] dcache: report a Tasks-RCU quiescent state in dentry_kill() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0314/1257] ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status() Greg Kroah-Hartman
` (685 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Cemin, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Cemin <dcemin@nvidia.com>
[ Upstream commit 7c7df141dcabaa5370b5e52a9d64e2c1ea13a338 ]
asoc_sdw_rt711_exit() drops the reference held in ctx->headset_codec_dev
but leaves the pointer populated. If the card cleanup path reaches the
exit hook more than once after a failed or deferred probe, a later
invocation reuses the stale pointer and calls put_device() again,
underflowing the refcount and leading to oopses when later probe,
driver bind, or suspend paths walk the SoundWire bus after the device
reference was released. Observed as boot- and suspend-time oopses on an
arm64 platform with an RT712 headset codec, reproducible
deterministically by repeated machine-driver probe cycling with the
codec drivers unloaded.
Clear the pointer after put_device() so repeated cleanup becomes a
no-op, which also makes the existing NULL check at the top of the exit
hook effective. This matches what commit 046173b98de3 ("ASoC: sdw_utils:
fix double put_device() on aggregated amps") did for the aggregated amp
references.
Fixes: 811648340707 ("ASoC: Intel: sof_sdw: avoid oops in error handling")
Cc: stable@vger.kernel.org
Signed-off-by: David Cemin <dcemin@nvidia.com>
Link: https://patch.msgid.link/20260912182131.1156475-1-dcemin@nvidia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sdw_utils/soc_sdw_rt711.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/sdw_utils/soc_sdw_rt711.c b/sound/soc/sdw_utils/soc_sdw_rt711.c
index 3a3a66b4b7372..4707190e160c1 100644
--- a/sound/soc/sdw_utils/soc_sdw_rt711.c
+++ b/sound/soc/sdw_utils/soc_sdw_rt711.c
@@ -124,6 +124,7 @@ int asoc_sdw_rt711_exit(struct snd_soc_card *card, struct snd_soc_dai_link *dai_
device_remove_software_node(ctx->headset_codec_dev);
put_device(ctx->headset_codec_dev);
+ ctx->headset_codec_dev = NULL;
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0314/1257] ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0313/1257] ASoC: sdw_utils: clear stale RT711 device reference on exit Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0315/1257] peci: aspeed: Initialize state before requesting IRQ Greg Kroah-Hartman
` (684 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit f0cc352be29ba616e0682f66f551d3f3029886fd ]
wcd9335_slim_status() obtains the SLIM interface device with
of_slim_get_device(), which uses device_find_child() internally and
returns the device with a reference held. As the device_find_child()
documentation says: you will need to drop the reference with
put_device() after use. The reference is stored in wcd->slim_ifc_dev
and never dropped, so the SLIM interface device cannot be released.
Fix it by using devm_add_action_or_reset() or put_device() respectively.
Found by code review.
Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
Cc: stable@vger.kernel.org
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Link: https://patch.msgid.link/20260914095009.12049-1-make_ruc2021@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wcd9335.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
index 40de279a9750a..9332082092c79 100644
--- a/sound/soc/codecs/wcd9335.c
+++ b/sound/soc/codecs/wcd9335.c
@@ -5096,6 +5096,13 @@ static int wcd9335_slim_probe(struct slim_device *slim)
return 0;
}
+static void wcd9335_put_device_action(void *data)
+{
+ struct device *dev = data;
+
+ put_device(dev);
+}
+
static int wcd9335_slim_status(struct slim_device *sdev,
enum slim_device_status status)
{
@@ -5120,6 +5127,11 @@ static int wcd9335_slim_status(struct slim_device *sdev,
return -EINVAL;
}
+ ret = devm_add_action_or_reset(dev, wcd9335_put_device_action,
+ &wcd->slim_ifc_dev->dev);
+ if (ret)
+ return ret;
+
slim_get_logical_addr(wcd->slim_ifc_dev);
wcd->regmap = regmap_init_slimbus(sdev, &wcd9335_regmap_config);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0315/1257] peci: aspeed: Initialize state before requesting IRQ
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0314/1257] ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0316/1257] peci: npcm: " Greg Kroah-Hartman
` (683 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Iwona Winiarska,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 61cf765b654b76a62510269521a65e4e4a488f4c ]
The PECI interrupt handler uses the lock and completion object as soon as
the interrupt is delivered. Initialize both before registering the
handler so an early interrupt cannot access uninitialized state.
Fixes: a85e4c52086c ("peci: Add peci-aspeed controller driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Iwona Winiarska <iwona.winiarska@intel.com>
Link: https://lore.kernel.org/r/20260902142600.3580382-1-runyu.xiao@seu.edu.cn
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/peci/controller/peci-aspeed.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/peci/controller/peci-aspeed.c b/drivers/peci/controller/peci-aspeed.c
index a0c99ecf7f380..5d7f4f8fda731 100644
--- a/drivers/peci/controller/peci-aspeed.c
+++ b/drivers/peci/controller/peci-aspeed.c
@@ -529,14 +529,14 @@ static int aspeed_peci_probe(struct platform_device *pdev)
if (priv->irq < 0)
return priv->irq;
+ init_completion(&priv->xfer_complete);
+ spin_lock_init(&priv->lock);
+
ret = devm_request_irq(&pdev->dev, priv->irq, aspeed_peci_irq_handler,
0, "peci-aspeed", priv);
if (ret)
return ret;
- init_completion(&priv->xfer_complete);
- spin_lock_init(&priv->lock);
-
priv->rst = devm_reset_control_get(&pdev->dev, NULL);
if (IS_ERR(priv->rst))
return dev_err_probe(priv->dev, PTR_ERR(priv->rst),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0316/1257] peci: npcm: Initialize state before requesting IRQ
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0315/1257] peci: aspeed: Initialize state before requesting IRQ Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0317/1257] hwmon: (tmp102) Fix jiffies wraparound in conversion-ready check Greg Kroah-Hartman
` (682 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Iwona Winiarska,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 425125e6d408b5969afb99c3e95a391f1f1ad81d ]
The PECI interrupt handler uses the lock and completion object as soon as
the interrupt is delivered. Initialize both before registering the
handler so an early interrupt cannot access uninitialized state.
Fixes: 3e16184a1bd8 ("peci: Add peci-npcm controller driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Iwona Winiarska <iwona.winiarska@intel.com>
Link: https://lore.kernel.org/r/20260902152256.3591658-1-runyu.xiao@seu.edu.cn
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/peci/controller/peci-npcm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/peci/controller/peci-npcm.c b/drivers/peci/controller/peci-npcm.c
index 9318689912412..3cc4e959aff36 100644
--- a/drivers/peci/controller/peci-npcm.c
+++ b/drivers/peci/controller/peci-npcm.c
@@ -253,14 +253,14 @@ static int npcm_peci_probe(struct platform_device *pdev)
if (priv->irq < 0)
return priv->irq;
+ init_completion(&priv->xfer_complete);
+ spin_lock_init(&priv->lock);
+
ret = devm_request_irq(&pdev->dev, priv->irq, npcm_peci_irq_handler,
0, "peci-npcm-irq", priv);
if (ret)
return ret;
- init_completion(&priv->xfer_complete);
- spin_lock_init(&priv->lock);
-
ret = npcm_peci_init_ctrl(priv);
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0317/1257] hwmon: (tmp102) Fix jiffies wraparound in conversion-ready check
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0316/1257] peci: npcm: " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0318/1257] hwmon: (tmp108) " Greg Kroah-Hartman
` (681 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Verdonck, Guenter Roeck,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Verdonck <tom.verdonck@inspiral.be>
[ Upstream commit 56c1d32323e773b8b927316f8beeae9238576335 ]
tmp102 records a one-shot deadline in ->ready_time at probe (and resume)
and, on every temperature read, refuses the read with -EAGAIN while
time_before(jiffies, ready_time) is true, in order to skip the first
~35 ms conversion.
->ready_time is an unsigned long compared with time_before(), whose
signed difference is only meaningful while the two values are within
LONG_MAX jiffies of each other. Because ->ready_time is set once and
never refreshed, jiffies keeps advancing away from it, and after 2^31
jiffies the difference flips sign. On a 32-bit HZ=100 kernel that
happens ~248.5 days after boot: time_before() then permanently reports
"not ready" and the driver returns -EAGAIN on every read, without ever
touching the sensor, until the next reboot.
Store the deadline as a 64-bit jiffies value and compare it with
get_jiffies_64()/time_before64(), which does not wrap in any practical
uptime.
Fixes: 3d8f7a89a197 ("hwmon: (tmp102) Improve handling of initial read delay")
Cc: stable@vger.kernel.org
Signed-off-by: Tom Verdonck <tom.verdonck@inspiral.be>
Link: https://patch.msgid.link/2952f070f82913aea96eec25d28008d3b9058656.1790358356.git.tom.verdonck@inspiral.be
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/tmp102.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/hwmon/tmp102.c b/drivers/hwmon/tmp102.c
index 50a8b050d8da1..8c8463ddb6c45 100644
--- a/drivers/hwmon/tmp102.c
+++ b/drivers/hwmon/tmp102.c
@@ -58,7 +58,7 @@ struct tmp102 {
const char *label;
struct regmap *regmap;
u16 config_orig;
- unsigned long ready_time;
+ u64 ready_time;
u16 sample_time;
};
@@ -106,7 +106,7 @@ static int tmp102_read_temp(struct device *dev, u32 attr, long *val)
switch (attr) {
case hwmon_temp_input:
/* Is it too early to return a conversion ? */
- if (time_before(jiffies, tmp102->ready_time)) {
+ if (time_before64(get_jiffies_64(), tmp102->ready_time)) {
dev_dbg(dev, "%s: Conversion not ready yet..\n", __func__);
return -EAGAIN;
}
@@ -354,7 +354,7 @@ static int tmp102_probe(struct i2c_client *client)
* Mark that we are not ready with data until the first
* conversion is complete
*/
- tmp102->ready_time = jiffies + msecs_to_jiffies(CONVERSION_TIME_MS);
+ tmp102->ready_time = get_jiffies_64() + msecs_to_jiffies(CONVERSION_TIME_MS);
hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name,
tmp102,
@@ -387,7 +387,7 @@ static int tmp102_resume(struct device *dev)
err = regmap_update_bits(tmp102->regmap, TMP102_CONF_REG,
TMP102_CONF_SD, 0);
- tmp102->ready_time = jiffies + msecs_to_jiffies(CONVERSION_TIME_MS);
+ tmp102->ready_time = get_jiffies_64() + msecs_to_jiffies(CONVERSION_TIME_MS);
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0318/1257] hwmon: (tmp108) Fix jiffies wraparound in conversion-ready check
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0317/1257] hwmon: (tmp102) Fix jiffies wraparound in conversion-ready check Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0319/1257] MIPS: mm: align hugetlb mappings in arch_get_unmapped_area() Greg Kroah-Hartman
` (680 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Verdonck, Guenter Roeck,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Verdonck <tom.verdonck@inspiral.be>
[ Upstream commit 6b8b1d1d7bc7e579b53fc7c3293b787d68de702a ]
tmp108 records a one-shot deadline in ->ready_time at probe (and resume)
and, on every temperature read, refuses the read with -EAGAIN while
time_before(jiffies, ready_time) is true, in order to skip the initial
conversion.
->ready_time is an unsigned long compared with time_before(), whose
signed difference is only meaningful while the two values are within
LONG_MAX jiffies of each other. Because ->ready_time is set once and
never refreshed, jiffies keeps advancing away from it, and after 2^31
jiffies the difference flips sign. On a 32-bit HZ=100 kernel that
happens ~248.5 days after boot: time_before() then permanently reports
"not ready" and the driver returns -EAGAIN on every read, without ever
touching the sensor, until the next reboot. The continuous-mode path,
which sets ->ready_time to jiffies with no added conversion delay, wraps
the same way.
Store the deadline as a 64-bit jiffies value and compare it with
get_jiffies_64()/time_before64(), which does not wrap in any practical
uptime.
Fixes: 66e1c9171339 ("hwmon: Add Texas Instruments TMP108 temperature sensor driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Tom Verdonck <tom.verdonck@inspiral.be>
Link: https://patch.msgid.link/525fa49d8c50922344fa53e22be5e6133c9bbb62.1790358356.git.tom.verdonck@inspiral.be
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/tmp108.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/hwmon/tmp108.c b/drivers/hwmon/tmp108.c
index 9fa31bd66ff69..91d20a1ce1120 100644
--- a/drivers/hwmon/tmp108.c
+++ b/drivers/hwmon/tmp108.c
@@ -78,7 +78,7 @@
struct tmp108 {
struct regmap *regmap;
u16 orig_config;
- unsigned long ready_time;
+ u64 ready_time;
const struct tmp108_params *params;
};
@@ -138,7 +138,7 @@ static int tmp108_read(struct device *dev, enum hwmon_sensor_types type,
switch (attr) {
case hwmon_temp_input:
/* Is it too early to return a conversion ? */
- if (time_before(jiffies, tmp108->ready_time)) {
+ if (time_before64(get_jiffies_64(), tmp108->ready_time)) {
dev_dbg(dev, "%s: Conversion not ready yet..\n",
__func__);
return -EAGAIN;
@@ -477,7 +477,7 @@ static int tmp108_common_probe(struct device *dev, struct regmap *regmap, char *
return err;
}
- tmp108->ready_time = jiffies;
+ tmp108->ready_time = get_jiffies_64();
if ((tmp108->orig_config & TMP108_CONF_MODE_MASK) ==
TMP108_MODE_SHUTDOWN)
tmp108->ready_time +=
@@ -528,7 +528,7 @@ static int tmp108_resume(struct device *dev)
err = regmap_update_bits(tmp108->regmap, TMP108_REG_CONF,
TMP108_CONF_MODE_MASK, TMP108_MODE_CONTINUOUS);
- tmp108->ready_time = jiffies +
+ tmp108->ready_time = get_jiffies_64() +
msecs_to_jiffies(TMP108_CONVERSION_TIME_MS);
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0319/1257] MIPS: mm: align hugetlb mappings in arch_get_unmapped_area()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0318/1257] hwmon: (tmp108) " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0320/1257] MIPS: mm: do not write a huge TLB entry when the probe misses Greg Kroah-Hartman
` (679 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Orgad Shaneh, Thomas Bogendoerfer,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Orgad Shaneh <orgads@gmail.com>
[ Upstream commit 975d4a6a6d4d23a39e2f49cafcc082d937960bc4 ]
Since hugetlb mappings were made to go through the architecture's
arch_get_unmapped_area{,_topdown}(), every architecture that implements
those has to align hugetlb files itself. The generic implementation and
loongarch do it with huge_page_mask_align(); MIPS was left out.
A non-MAP_FIXED mmap() of a hugetlbfs file therefore returns an address
that is only SHMLBA aligned, and the kernel then installs 2 MB PMDs for
a VMA that starts in the middle of a PMD. The consequences on an
Octeon (CN63XX) board running a process that links libhugetlbfs with
HUGETLB_ELFMAP=R and HUGETLB_MORECORE=yes, all within a minute of
start: the neighbouring 4 KB page table is clobbered, the TLB ends up
with overlapping entries ("Caught Machine Check exception - caused by
multiple matching entries in the TLB"), process exit trips
BUG_ON(start & ~huge_page_mask(h)) in __unmap_hugepage_range(), and
freed pages leak into unrelated kernel structures (oopses in the irq
maple tree, in pte_offset_map, ...).
Do what loongarch does in commit 3109d5ff484b ("LoongArch: Set hugetlb
mmap base address aligned with pmd size"): when the file is a hugetlb
file, use its page mask as the search alignment instead of the cache
colour mask.
Fixes: 7bd3f1e1a9ae ("mm: make hugetlb mappings go through mm_get_unmapped_area_vmflags")
Cc: stable@vger.kernel.org # 6.13+
Assisted-by: Claude:claude-opus-5
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/mm/mmap.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 5d2a1225785b8..119edaa928f33 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -9,6 +9,7 @@
#include <linux/compiler.h>
#include <linux/elf-randomize.h>
#include <linux/errno.h>
+#include <linux/hugetlb.h>
#include <linux/mm.h>
#include <linux/mman.h>
#include <linux/export.h>
@@ -72,8 +73,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
}
info.length = len;
- info.align_mask = do_color_align ? (PAGE_MASK & shm_align_mask) : 0;
info.align_offset = pgoff << PAGE_SHIFT;
+ if (filp && is_file_hugepages(filp))
+ info.align_mask = huge_page_mask_align(filp);
+ else
+ info.align_mask = do_color_align ? (PAGE_MASK & shm_align_mask) : 0;
if (dir == DOWN) {
info.flags = VM_UNMAPPED_AREA_TOPDOWN;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0320/1257] MIPS: mm: do not write a huge TLB entry when the probe misses
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0319/1257] MIPS: mm: align hugetlb mappings in arch_get_unmapped_area() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0321/1257] netfilter: ctnetlink: fix inverted IPv6 address match in dump filter Greg Kroah-Hartman
` (678 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Orgad Shaneh, Thomas Bogendoerfer,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Orgad Shaneh <orgads@gmail.com>
[ Upstream commit 0cb17268887e1df5c425ea052f5146b42d126323 ]
__update_tlb() probes for the 8K pair at the address it is given and,
for a huge pmd, writes the huge entry with tlbwi at the probed index or
with tlbwr when the probe misses. That works only if the caller passes
the faulting address, so that the probe finds the 4K entry the refill
handler loaded for the faulting page and the huge entry replaces it.
update_mmu_cache_pmd() is not called that way. do_set_pmd() has always
passed the huge-aligned address, and since commit ebcfc63d6bca ("mm:
abstract THP allocation") the anonymous THP fault path does too
(map_anon_folio_pmd()). The probe then misses the stale 4K entry, which
sits at the faulting page somewhere else in the 2 MB range, tlbwr adds
a huge entry next to it, and the TLB holds two entries matching the
faulting address. Octeon raises "Machine Check exception - caused by
multiple matching entries in the TLB" on the next refill of that page;
a process on a CN63XX board died this way within a second of start, on
the first anonymous THP of its bss.
Skip the write when the probe misses. The refill and TLBL/TLBS handlers
probe the faulting address themselves and rewrite the stale entry with
the huge one (they also set the software young bit), so the entry is
installed on the next access at the cost of one exception.
Fixes: fd062c847a8c ("MIPS: TLB support for hugetlbfs.")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/mm/tlb-r4k.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index 24fe85fa169d1..78bafa317fa6f 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -332,6 +332,19 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
/* this could be a huge page */
if (pmd_leaf(*pmdp)) {
unsigned long lo;
+
+ /*
+ * The probe above only covers the 8K pair at @address, and
+ * a huge mapping is installed with the huge-aligned address
+ * while the refill that started the fault left a 4K entry
+ * for the faulting page elsewhere in the range. Writing the
+ * huge entry to a random index would leave two entries
+ * matching the faulting address; leave it to the refill and
+ * TLBL/TLBS handlers, which probe the faulting address.
+ */
+ if (idx < 0)
+ goto out;
+
write_c0_pagemask(PM_HUGE_MASK);
ptep = (pte_t *)pmdp;
lo = pte_to_entrylo(pte_val(*ptep));
@@ -339,10 +352,7 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
write_c0_entrylo1(lo + (HPAGE_SIZE >> 7));
mtc0_tlbw_hazard();
- if (idx < 0)
- tlb_write_random();
- else
- tlb_write_indexed();
+ tlb_write_indexed();
tlbw_use_hazard();
write_c0_pagemask(PM_DEFAULT_MASK);
} else
@@ -380,6 +390,9 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
tlb_write_indexed();
}
tlbw_use_hazard();
+#ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
+out:
+#endif
htw_start();
flush_micro_tlb_vm(vma);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0321/1257] netfilter: ctnetlink: fix inverted IPv6 address match in dump filter
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0320/1257] MIPS: mm: do not write a huge TLB entry when the probe misses Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0322/1257] arm64: dts: qcom: sdm845-xiaomi-beryllium: Extend the xbl_mem region Greg Kroah-Hartman
` (677 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Piotr Kubik, Pablo Neira Ayuso,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piotr Kubik <piotr@kubik.pl>
[ Upstream commit 1ae2d094b0200f687923298c0e42579273558988 ]
ctnetlink_filter_match_tuple() rejects an entry when
!ipv6_addr_cmp(filter, entry) is true. ipv6_addr_cmp() is a memcmp() and
returns 0 for equal addresses, so the condition is true exactly when the
addresses match: a CTA_FILTER dump with an IPv6 CTA_IP_SRC or CTA_IP_DST
skips every entry that matches the requested address and returns all the
others. The IPv4 branch compares with != and behaves correctly.
Observed with libnetfilter_conntrack NFCT_FILTER_DUMP_TUPLE: a dump
filtered on src 2001:db8::10 returned only the unrelated entries, and a
dump filtered on ::1 returned every entry except the ::1 ones.
conntrack-tools does not use the tuple filter for -L, which is why this
went unnoticed.
Use ipv6_addr_equal() so the IPv6 branch mirrors the IPv4 one.
Fixes: cb8aa9a3affb ("netfilter: ctnetlink: add kernel side filtering for dump")
Cc: stable@vger.kernel.org
Signed-off-by: Piotr Kubik <piotr@kubik.pl>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_netlink.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 4e5d7c7014368..e8477f792c957 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1098,13 +1098,13 @@ static int ctnetlink_filter_match_tuple(struct nf_conntrack_tuple *filter_tuple,
break;
case NFPROTO_IPV6:
if ((flags & CTA_FILTER_FLAG(CTA_IP_SRC)) &&
- !ipv6_addr_cmp(&filter_tuple->src.u3.in6,
- &ct_tuple->src.u3.in6))
+ !ipv6_addr_equal(&filter_tuple->src.u3.in6,
+ &ct_tuple->src.u3.in6))
return 0;
if ((flags & CTA_FILTER_FLAG(CTA_IP_DST)) &&
- !ipv6_addr_cmp(&filter_tuple->dst.u3.in6,
- &ct_tuple->dst.u3.in6))
+ !ipv6_addr_equal(&filter_tuple->dst.u3.in6,
+ &ct_tuple->dst.u3.in6))
return 0;
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0322/1257] arm64: dts: qcom: sdm845-xiaomi-beryllium: Extend the xbl_mem region
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0321/1257] netfilter: ctnetlink: fix inverted IPv6 address match in dump filter Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0323/1257] arm64: dts: qcom: sdm845-xiaomi-polaris: " Greg Kroah-Hartman
` (676 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
[ Upstream commit 511c4fea32708a065e03503c0e4d44f48990c530 ]
Xiaomi's Oreo-era tree still had the CAF 1 MiB region, the 2 MiB version
arrived with the Pie import. This isn't a board-layout quirk, it tracks
the firmware. The later XBL wants one extra MiB below the old region.
Cc: stable@vger.kernel.org
Fixes: 77809cf74a8c ("arm64: dts: qcom: Add support for Xiaomi Poco F1 (Beryllium)")
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260916-sdm845-xbl-mem-v1-1-6e3c88507997@ixit.cz
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
index 080f5294988d3..35babe8c5f757 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
@@ -27,6 +27,7 @@
/delete-node/ &slpi_mem;
/delete-node/ &spss_mem;
/delete-node/ &rmtfs_mem;
+/delete-node/ &xbl_mem;
/ {
chassis-type = "handset";
@@ -71,6 +72,11 @@ key-vol-up {
/* Reserved memory changes from downstream */
reserved-memory {
+ xbl-mem@85d00000 {
+ reg = <0 0x85d00000 0 0x200000>;
+ no-map;
+ };
+
tz_mem: memory@86200000 {
reg = <0 0x86200000 0 0x4900000>;
no-map;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0323/1257] arm64: dts: qcom: sdm845-xiaomi-polaris: Extend the xbl_mem region
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0322/1257] arm64: dts: qcom: sdm845-xiaomi-beryllium: Extend the xbl_mem region Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0324/1257] arm64: dts: qcom: ipq9574: Wire up USB3 PHY PIPE clock to GCC Greg Kroah-Hartman
` (675 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Heidelberg, Bjorn Andersson,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <david@ixit.cz>
[ Upstream commit 38458f12419f456b16385c118bcacd76899d99b9 ]
Xiaomi's Oreo-era tree still had the CAF 1 MiB region, the 2 MiB version
arrived with the Pie import. This isn't a board-layout quirk, it tracks
the firmware. The later XBL wants one extra MiB below the old region.
Cc: stable@vger.kernel.org
Fixes: be497abe19bf ("arm64: dts: qcom: Add support for Xiaomi Mi Mix2s")
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260916-sdm845-xbl-mem-v1-2-6e3c88507997@ixit.cz
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
index d3162e4444532..a782023d0dcb3 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
@@ -32,6 +32,7 @@
/delete-node/ &mba_region;
/delete-node/ &slpi_mem;
/delete-node/ &spss_mem;
+/delete-node/ &xbl_mem;
/ {
model = "Xiaomi Mi MIX 2S";
@@ -63,6 +64,11 @@ key-vol-up {
};
reserved-memory {
+ xbl-mem@85d00000 {
+ reg = <0 0x85d00000 0 0x200000>;
+ no-map;
+ };
+
adsp_mem: memory@8c500000 {
reg = <0 0x8c500000 0 0x1e00000>;
no-map;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0324/1257] arm64: dts: qcom: ipq9574: Wire up USB3 PHY PIPE clock to GCC
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0323/1257] arm64: dts: qcom: sdm845-xiaomi-polaris: " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0325/1257] iommu/vt-d: Avoid out-of-range shift in qi_desc_dev_iotlb_pasid() Greg Kroah-Hartman
` (674 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio,
Kathiravan Thirumoorthy, Abel Vesa, Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
[ Upstream commit 117d8d40be1ded4f35f3252efa83607a7134d5e0 ]
Connect the QMP PHY USB3 output to GCC so the USB3 PHY pipe clock can
propagate to the USB controller.
Cc: stable@vger.kernel.org
Fixes: a98bfb31f676 ("arm64: dts: qcom: ipq9574: Add USB related nodes")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-ipq_clk_changes-v1-4-d242e3d49648@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/ipq9574.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq9574.dtsi b/arch/arm64/boot/dts/qcom/ipq9574.dtsi
index 5a5bda5f21a11..dd1dcd955c952 100644
--- a/arch/arm64/boot/dts/qcom/ipq9574.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq9574.dtsi
@@ -428,7 +428,7 @@ gcc: clock-controller@1800000 {
<&pcie1_phy>,
<&pcie2_phy>,
<&pcie3_phy>,
- <0>;
+ <&usb_0_qmpphy>;
#clock-cells = <1>;
#reset-cells = <1>;
#interconnect-cells = <1>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0325/1257] iommu/vt-d: Avoid out-of-range shift in qi_desc_dev_iotlb_pasid()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0324/1257] arm64: dts: qcom: ipq9574: Wire up USB3 PHY PIPE clock to GCC Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0326/1257] fuse: fix GCC 8 build with CONFIG_PROFILE_ALL_BRANCHES Greg Kroah-Hartman
` (673 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Lu Baolu, Kevin Tian,
Joerg Roedel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <baolu.lu@linux.intel.com>
[ Upstream commit ddea230c9fc28d1f2090ceeab3d66ce2bea658e9 ]
Callers request a full Device-TLB flush by passing MAX_AGAW_PFN_WIDTH
(64 - VTD_PAGE_SHIFT == 52) as @size_order. Two expressions in
qi_desc_dev_iotlb_pasid() are not prepared for a value that large:
unsigned long mask = 1UL << (VTD_PAGE_SHIFT + size_order - 1);
...
if (!IS_ALIGNED(addr, VTD_PAGE_SIZE << size_order))
The second evaluates to 1UL << 64, which is undefined on all
architectures. On x86_64 the shift count masks to zero, IS_ALIGNED(addr,
1) is trivially true, and the alignment sanity check silently degrades
into a no-op.
The first evaluates to 1UL << 63. That is well defined on 64-bit builds,
where unsigned long is 64 bits wide, but is undefined on 32-bit ones. In
practice x86 masks the shift count to five bits, so the expression yields
1UL << 31 and ~mask becomes 0x7fffffff. That value is zero-extended when
applied to the 64-bit descriptor, so
desc->qw1 &= ~mask;
clears qw1[63:32] as well as bit 31, collapsing the ADDR field that had
just been filled with ones. Reaching that requires a scalable-mode PASID
configuration on 32-bit x86, which is not a realistic deployment, but the
construct is wrong regardless.
Compute the mask with BIT_ULL() so that it is 64-bit on every
architecture, and skip the alignment check for a full flush, where it is
both meaningless and the source of the out-of-range shift.
Note that @size_order must not be clamped below 64 - VTD_PAGE_SHIFT. With
S set, hardware derives the invalidation range from the least significant
zero bit N of ADDR and matches bits [63:N+1] of the incoming address. For
size_order 52 the descriptor sets ADDR[63:12] and clears bit 63, making
N = 63 and the comparison range empty, so everything is invalidated.
Reducing @size_order to 51 would instead leave N = 62 and cause hardware
to compare address bit 63; since callers pass an address of 0, only the
lower half of the address space would be invalidated. Bound @size_order
at 64 - VTD_PAGE_SHIFT so that a bogus caller cannot reintroduce an
out-of-range shift, without altering the full-flush encoding.
The non-PASID variant qi_desc_dev_iotlb() already uses 1ULL and is
unaffected.
Fixes: f701c9f36bcb7 ("iommu/vt-d: Factor out invalidation descriptor composition")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260623060122.3796325-1-guanghuifeng%40linux.alibaba.com
Assisted-by: Claude:claude-opus-5
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/iommu.h | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
index 23dbe6c24439f..5b3d234ae2659 100644
--- a/drivers/iommu/intel/iommu.h
+++ b/drivers/iommu/intel/iommu.h
@@ -1105,12 +1105,20 @@ static inline void qi_desc_dev_iotlb_pasid(u16 sid, u16 pfsid, u32 pasid,
unsigned int size_order,
struct qi_desc *desc)
{
- unsigned long mask = 1UL << (VTD_PAGE_SHIFT + size_order - 1);
-
desc->qw0 = QI_DEV_EIOTLB_PASID(pasid) | QI_DEV_EIOTLB_SID(sid) |
QI_DEV_EIOTLB_QDEP(qdep) | QI_DEIOTLB_TYPE |
QI_DEV_IOTLB_PFSID(pfsid);
+ /*
+ * The widest range the descriptor can express is a full flush, encoded
+ * by making bit 63 the least significant zero bit of ADDR, that is
+ * @size_order == 64 - VTD_PAGE_SHIFT. Bound @size_order there so that
+ * a caller passing something larger cannot produce an out-of-range
+ * shift below.
+ */
+ if (size_order > 64 - VTD_PAGE_SHIFT)
+ size_order = 64 - VTD_PAGE_SHIFT;
+
/*
* If S bit is 0, we only flush a single page. If S bit is set,
* The least significant zero bit indicates the invalidation address
@@ -1120,7 +1128,8 @@ static inline void qi_desc_dev_iotlb_pasid(u16 sid, u16 pfsid, u32 pasid,
* Max Invs Pending (MIP) is set to 0 for now until we have DIT in
* ECAP.
*/
- if (!IS_ALIGNED(addr, VTD_PAGE_SIZE << size_order))
+ if (size_order < 64 - VTD_PAGE_SHIFT &&
+ !IS_ALIGNED(addr, BIT_ULL(VTD_PAGE_SHIFT + size_order)))
pr_warn_ratelimited("Invalidate non-aligned address %llx, order %d\n",
addr, size_order);
@@ -1136,7 +1145,7 @@ static inline void qi_desc_dev_iotlb_pasid(u16 sid, u16 pfsid, u32 pasid,
desc->qw1 |= GENMASK_ULL(size_order + VTD_PAGE_SHIFT - 1,
VTD_PAGE_SHIFT);
/* Clear size_order bit to indicate size */
- desc->qw1 &= ~mask;
+ desc->qw1 &= ~BIT_ULL(VTD_PAGE_SHIFT + size_order - 1);
/* Set the S bit to indicate flushing more than 1 page */
desc->qw1 |= QI_DEV_EIOTLB_SIZE;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0326/1257] fuse: fix GCC 8 build with CONFIG_PROFILE_ALL_BRANCHES
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0325/1257] iommu/vt-d: Avoid out-of-range shift in qi_desc_dev_iotlb_pasid() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0327/1257] ALSA: mpu401: shut down timer before freeing MPU Greg Kroah-Hartman
` (672 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Miklos Szeredi,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 6e887377a63f670d79f3d8a107f29e745e9ddf43 ]
Commit 25307ca50b815 ("fuse: simplify logic in fuse_notify_store() and
fuse_retrieve()") introduced a loff_t cursor and used it in place of
outarg's offset field. In the min() expression this changed the second
operand from unsigned to signed.
With CONFIG_PROFILE_ALL_BRANCHES, GCC 8 does not propagate the range
established by the preceding MAX_LFS_FILESIZE check through the branch
profiling code. Consequently, min() cannot prove that the signed operand
is nonnegative and rejects the mixed-signedness comparison:
min(outarg.size, ((loff_t)((long long)(~0ULL >> 1))) - pos)
signedness error
This happens with GCC 8.1 on x86-64 and GCC 8.5 on arm and s390.
GCC 8.1 remains the minimum supported compiler.
Use umin(), which is intended for comparing an unsigned value with a
signed value that is known to be nonnegative. The preceding bounds check
guarantees that MAX_LFS_FILESIZE - pos is nonnegative, and outarg.size
bounds the result to unsigned int.
Fixes: 25307ca50b815 ("fuse: simplify logic in fuse_notify_store() and fuse_retrieve()")
Cc: stable@vger.kernel.org # v7.1
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/notify.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/fuse/notify.c b/fs/fuse/notify.c
index 1ba763705d911..fff059f8ad859 100644
--- a/fs/fuse/notify.c
+++ b/fs/fuse/notify.c
@@ -155,7 +155,7 @@ static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
nodeid = outarg.nodeid;
pos = outarg.offset;
- num = min(outarg.size, MAX_LFS_FILESIZE - pos);
+ num = umin(outarg.size, MAX_LFS_FILESIZE - pos);
down_read(&fc->killsb);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0327/1257] ALSA: mpu401: shut down timer before freeing MPU
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0326/1257] fuse: fix GCC 8 build with CONFIG_PROFILE_ALL_BRANCHES Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0328/1257] ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status() Greg Kroah-Hartman
` (671 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 9332af5220d42341bb1446a62c545c0518e990ef ]
When an MPU401 interface has no usable IRQ, the driver polls raw-MIDI
input and output with a timer. During raw-MIDI teardown, the timer callback
can already be running when snd_mpu401_uart_remove_timer() clears the last
mode bit and calls timer_delete(). That API neither waits for a running
callback nor prevents it from rearming the timer, and free_irq() does not
synchronize timer callbacks. snd_mpu401_uart_free() can therefore release
mpu while the timer callback still uses it.
Initialize the timer once when the MPU object is created and only rearm it
while a timer mode is active. Shut it down synchronously after freeing the
IRQ so an in-flight callback completes before mpu and its resources are
released.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260927093809.681726-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/drivers/mpu401/mpu401_uart.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/sound/drivers/mpu401/mpu401_uart.c b/sound/drivers/mpu401/mpu401_uart.c
index 6de03d72a9087..fcf2b686f9f5e 100644
--- a/sound/drivers/mpu401/mpu401_uart.c
+++ b/sound/drivers/mpu401/mpu401_uart.c
@@ -155,20 +155,20 @@ static void snd_mpu401_uart_timer(struct timer_list *t)
scoped_guard(spinlock_irqsave, &mpu->timer_lock) {
/*mpu->mode |= MPU401_MODE_TIMER;*/
- mod_timer(&mpu->timer, 1 + jiffies);
+ if (mpu->timer_invoked)
+ mod_timer(&mpu->timer, 1 + jiffies);
}
if (mpu->rmidi)
_snd_mpu401_uart_interrupt(mpu);
}
/*
- * initialize the timer callback if not programmed yet
+ * arm the timer if it is not already active
*/
static void snd_mpu401_uart_add_timer (struct snd_mpu401 *mpu, int input)
{
guard(spinlock_irqsave)(&mpu->timer_lock);
if (mpu->timer_invoked == 0) {
- timer_setup(&mpu->timer, snd_mpu401_uart_timer, 0);
mod_timer(&mpu->timer, 1 + jiffies);
}
mpu->timer_invoked |= input ? MPU401_MODE_INPUT_TIMER :
@@ -474,6 +474,7 @@ static void snd_mpu401_uart_free(struct snd_rawmidi *rmidi)
struct snd_mpu401 *mpu = rmidi->private_data;
if (mpu->irq >= 0)
free_irq(mpu->irq, (void *) mpu);
+ timer_shutdown_sync(&mpu->timer);
release_and_free_resource(mpu->res);
kfree(mpu);
}
@@ -528,6 +529,7 @@ int snd_mpu401_uart_new(struct snd_card *card, int device,
spin_lock_init(&mpu->input_lock);
spin_lock_init(&mpu->output_lock);
spin_lock_init(&mpu->timer_lock);
+ timer_setup(&mpu->timer, snd_mpu401_uart_timer, 0);
mpu->hardware = hardware;
mpu->irq = -1;
mpu->rmidi = rmidi;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0328/1257] ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0327/1257] ALSA: mpu401: shut down timer before freeing MPU Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0329/1257] iio: adc: ad4080: enable address ascension for chip identification Greg Kroah-Hartman
` (670 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 082723fee626532f176727b6438b666a96d5246c ]
of_slim_get_device() returns a device with an elevated reference count,
and wcd->slim_ifc_dev is intentionally kept for the codec lifetime on
success. However, all the failure paths of wcd9335_slim_status() return
without dropping that reference, leaking the SLIM interface device
whenever the register maps cannot be created or the codec fails to come
up.
Put the device on each of those error paths.
Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917164853.2163184-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wcd9335.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
index 9332082092c79..a98d1fd789251 100644
--- a/sound/soc/codecs/wcd9335.c
+++ b/sound/soc/codecs/wcd9335.c
@@ -5135,25 +5135,32 @@ static int wcd9335_slim_status(struct slim_device *sdev,
slim_get_logical_addr(wcd->slim_ifc_dev);
wcd->regmap = regmap_init_slimbus(sdev, &wcd9335_regmap_config);
- if (IS_ERR(wcd->regmap))
+ if (IS_ERR(wcd->regmap)) {
+ put_device(&wcd->slim_ifc_dev->dev);
return dev_err_probe(dev, PTR_ERR(wcd->regmap),
"Failed to allocate slim register map\n");
+ }
wcd->if_regmap = regmap_init_slimbus(wcd->slim_ifc_dev,
&wcd9335_ifc_regmap_config);
- if (IS_ERR(wcd->if_regmap))
+ if (IS_ERR(wcd->if_regmap)) {
+ put_device(&wcd->slim_ifc_dev->dev);
return dev_err_probe(dev, PTR_ERR(wcd->if_regmap),
"Failed to allocate ifc register map\n");
+ }
ret = wcd9335_bring_up(wcd);
if (ret) {
dev_err(dev, "Failed to bringup WCD9335\n");
+ put_device(&wcd->slim_ifc_dev->dev);
return ret;
}
ret = wcd9335_irq_init(wcd);
- if (ret)
+ if (ret) {
+ put_device(&wcd->slim_ifc_dev->dev);
return ret;
+ }
wcd9335_probe(wcd);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0329/1257] iio: adc: ad4080: enable address ascension for chip identification
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0328/1257] ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status() Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0330/1257] iio: amplifiers: ad8366: reject devices without match data Greg Kroah-Hartman
` (669 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antoniu Miclaus, Nuno Sá,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoniu Miclaus <antoniu.miclaus@analog.com>
[ Upstream commit c051d08d98771132868abf0cb95b6de95ab3060a ]
The two byte bulk read at AD4080_REG_PRODUCT_ID_L expects PRODUCT_ID_L
followed by PRODUCT_ID_H. After a software reset the AD408x defaults to
descending address mode, so the second byte comes from CHIP_TYPE (0x03)
instead. CHIP_TYPE reads 0x07 on all AD408x parts, so an AD4080 reports
0x0750 rather than 0x0050 and every part logs "Unrecognized CHIP_ID".
Set ADDR_ASC along with SDO_ENABLE before the read. This is the only
multi byte transfer in the driver, so no other access is affected.
Fixes: b66cddc8be72 ("iio: adc: ad4080: fix chip identification")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ad4080.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/adc/ad4080.c b/drivers/iio/adc/ad4080.c
index 04cd6628ebffb..7b3b338886b47 100644
--- a/drivers/iio/adc/ad4080.c
+++ b/drivers/iio/adc/ad4080.c
@@ -685,7 +685,8 @@ static int ad4080_setup_channel(struct ad4080_state *st, unsigned int ch)
return ret;
ret = regmap_write(st->regmap[ch], AD4080_REG_INTERFACE_CONFIG_A,
- AD4080_INTERFACE_CONFIG_A_SDO_ENABLE);
+ AD4080_INTERFACE_CONFIG_A_SDO_ENABLE |
+ AD4080_INTERFACE_CONFIG_A_ADDR_ASC);
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0330/1257] iio: amplifiers: ad8366: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0329/1257] iio: adc: ad4080: enable address ascension for chip identification Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0331/1257] iio: dac: ad5755: validate SPI " Greg Kroah-Hartman
` (668 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit a3f438368c596040efbc44aa8a65e4e5ef2f3847 ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but ad8366_probe() later dereferences the result while setting up the
IIO device.
Reject devices without match data before using the chip information.
Fixes: d5e02d0d00b9 ("iio: amplifiers: ad8366: add device tree support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/amplifiers/ad8366.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/amplifiers/ad8366.c b/drivers/iio/amplifiers/ad8366.c
index e12f8604f59f4..9adff120de1ab 100644
--- a/drivers/iio/amplifiers/ad8366.c
+++ b/drivers/iio/amplifiers/ad8366.c
@@ -326,6 +326,8 @@ static int ad8366_probe(struct spi_device *spi)
st->spi = spi;
st->info = spi_get_device_match_data(spi);
+ if (!st->info)
+ return -ENODATA;
enable_gpio = devm_gpiod_get_optional(dev, "enable", GPIOD_OUT_HIGH);
if (IS_ERR(enable_gpio))
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0331/1257] iio: dac: ad5755: validate SPI match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0330/1257] iio: amplifiers: ad8366: reject devices without match data Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0332/1257] iio: dac: mcp4821: reject devices without " Greg Kroah-Hartman
` (667 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 85e2c8ca7ac9e39a61e7fb18728918f6e966f439 ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but ad5755_probe() stores and later dereferences the result.
Validate the match data before it is used.
Fixes: 62d3fb9dcc09 ("iio: dac: ad5755: make use of of_device_id table")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/dac/ad5755.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iio/dac/ad5755.c b/drivers/iio/dac/ad5755.c
index 0828b99090990..730289dd8ef69 100644
--- a/drivers/iio/dac/ad5755.c
+++ b/drivers/iio/dac/ad5755.c
@@ -819,6 +819,9 @@ static int ad5755_probe(struct spi_device *spi)
spi_set_drvdata(spi, indio_dev);
st->chip_info = spi_get_device_match_data(spi);
+ if (!st->chip_info)
+ return -ENODATA;
+
st->spi = spi;
st->pwr_down = 0xf;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0332/1257] iio: dac: mcp4821: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0331/1257] iio: dac: ad5755: validate SPI " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0333/1257] iio: frequency: adf4377: " Greg Kroah-Hartman
` (666 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 6ac1faf4de61dcf27ffe8f2c25d96fe5f4b2886d ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but mcp4821_probe() dereferences the result while configuring the IIO
device.
Reject devices without match data before using the chip information.
Fixes: cdf3ecb0d8d0 ("iio: dac: driver for MCP4821")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/dac/mcp4821.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/dac/mcp4821.c b/drivers/iio/dac/mcp4821.c
index 8d8c00cd60e98..59defb1b5e621 100644
--- a/drivers/iio/dac/mcp4821.c
+++ b/drivers/iio/dac/mcp4821.c
@@ -255,9 +255,13 @@ static const struct iio_info mcp4821_info = {
static int mcp4821_probe(struct spi_device *spi)
{
+ const struct mcp4821_chip_info *info;
struct iio_dev *indio_dev;
struct mcp4821_state *state;
- const struct mcp4821_chip_info *info;
+
+ info = spi_get_device_match_data(spi);
+ if (!info)
+ return -ENODATA;
indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*state));
if (indio_dev == NULL)
@@ -268,7 +272,6 @@ static int mcp4821_probe(struct spi_device *spi)
/* default gain is 2x */
state->gain = 2;
- info = spi_get_device_match_data(spi);
indio_dev->name = info->name;
indio_dev->info = &mcp4821_info;
indio_dev->modes = INDIO_DIRECT_MODE;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0333/1257] iio: frequency: adf4377: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0332/1257] iio: dac: mcp4821: reject devices without " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0334/1257] iio: imu: adis16400: validate SPI " Greg Kroah-Hartman
` (665 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 2f3196d27e3bfcee0569d23a123aedcc6ddd39f1 ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but the result is later dereferenced by the property parsing and
initialization paths.
Reject devices without match data before continuing probe.
Fixes: 6140a92cd086 ("iio: frequency: adf4377: add adf4378 support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/frequency/adf4377.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iio/frequency/adf4377.c b/drivers/iio/frequency/adf4377.c
index 7385be62fa6a3..52266f83877ac 100644
--- a/drivers/iio/frequency/adf4377.c
+++ b/drivers/iio/frequency/adf4377.c
@@ -1060,6 +1060,9 @@ static int adf4377_probe(struct spi_device *spi)
st->regmap = regmap;
st->spi = spi;
st->chip_info = spi_get_device_match_data(spi);
+ if (!st->chip_info)
+ return -ENODATA;
+
mutex_init(&st->lock);
ret = adf4377_properties_parse(st);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0334/1257] iio: imu: adis16400: validate SPI match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0333/1257] iio: frequency: adf4377: " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0335/1257] iio: potentiometer: x9250: reject devices without " Greg Kroah-Hartman
` (664 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 2c01a0a1c5550b4f502c7747c06d2e57a240cd87 ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but adis16400_probe() immediately dereferences the result.
Validate the match data before it is used.
Fixes: 2ef920e0e5c0 ("iio: imu: adis16400: Use separate structures rather than an array for chip info")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/imu/adis16400.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iio/imu/adis16400.c b/drivers/iio/imu/adis16400.c
index 8f664d055e9d5..512a8da63cdcb 100644
--- a/drivers/iio/imu/adis16400.c
+++ b/drivers/iio/imu/adis16400.c
@@ -1150,6 +1150,9 @@ static int adis16400_probe(struct spi_device *spi)
/* setup the industrialio driver allocated elements */
st->variant = spi_get_device_match_data(spi);
+ if (!st->variant)
+ return -ENODATA;
+
indio_dev->name = spi_get_device_id(spi)->name;
indio_dev->channels = st->variant->channels;
indio_dev->num_channels = st->variant->num_channels;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0335/1257] iio: potentiometer: x9250: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0334/1257] iio: imu: adis16400: validate SPI " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0336/1257] iio: pressure: bmp280: validate SPI " Greg Kroah-Hartman
` (663 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit d13716e3defd5b8cec3ee2c27f4d9b7e01314067 ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but x9250_probe() later dereferences the result while naming the IIO
device.
Reject devices without match data before enabling the regulators.
Fixes: 66bfc528a6fd ("iio: potentiometer: Add support for the Renesas X9250 potentiometers")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/potentiometer/x9250.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/potentiometer/x9250.c b/drivers/iio/potentiometer/x9250.c
index 974e4447fc2cc..675b78677baa4 100644
--- a/drivers/iio/potentiometer/x9250.c
+++ b/drivers/iio/potentiometer/x9250.c
@@ -155,10 +155,15 @@ static const char *const x9250_regulator_names[] = {
static int x9250_probe(struct spi_device *spi)
{
+ const struct x9250_cfg *cfg;
struct iio_dev *indio_dev;
struct x9250 *x9250;
int ret;
+ cfg = spi_get_device_match_data(spi);
+ if (!cfg)
+ return -ENODATA;
+
ret = devm_regulator_bulk_get_enable(&spi->dev, ARRAY_SIZE(x9250_regulator_names),
x9250_regulator_names);
if (ret)
@@ -176,7 +181,7 @@ static int x9250_probe(struct spi_device *spi)
x9250 = iio_priv(indio_dev);
x9250->spi = spi;
- x9250->cfg = spi_get_device_match_data(spi);
+ x9250->cfg = cfg;
x9250->wp_gpio = devm_gpiod_get_optional(&spi->dev, "wp", GPIOD_OUT_LOW);
if (IS_ERR(x9250->wp_gpio))
return dev_err_probe(&spi->dev, PTR_ERR(x9250->wp_gpio),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0336/1257] iio: pressure: bmp280: validate SPI match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0335/1257] iio: potentiometer: x9250: reject devices without " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0337/1257] iio: adc: ad7192: reject devices without " Greg Kroah-Hartman
` (662 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 206fc54554c28d76c5d8f66091b846ef1dd88f64 ]
A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but bmp280_spi_probe() immediately dereferences the result.
Validate the match data before selecting the regmap bus.
Fixes: faac4dda9a91 ("iio: pressure: bmp280: Use spi_get_device_match_data()")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/pressure/bmp280-spi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/pressure/bmp280-spi.c b/drivers/iio/pressure/bmp280-spi.c
index a02a621b80150..95d9635f47111 100644
--- a/drivers/iio/pressure/bmp280-spi.c
+++ b/drivers/iio/pressure/bmp280-spi.c
@@ -83,6 +83,8 @@ static int bmp280_spi_probe(struct spi_device *spi)
struct regmap *regmap;
chip_info = spi_get_device_match_data(spi);
+ if (!chip_info)
+ return -ENODATA;
if (chip_info->spi_read_extra_byte)
bmp_regmap_bus = &bmp380_regmap_bus;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0337/1257] iio: adc: ad7192: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0336/1257] iio: pressure: bmp280: validate SPI " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0338/1257] iio: adc: ad7606: " Greg Kroah-Hartman
` (661 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 7f7a119a370ecf6c8d4ab9e9ee0a8cdd77afedd3 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
ad7192_probe() immediately dereferences the returned chip information
to initialize the IIO device, causing a NULL pointer dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before using the chip information.
Fixes: c3708c829a06 ("iio: adc: ad7192: Convert from of specific to fwnode property handling")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ad7192.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iio/adc/ad7192.c b/drivers/iio/adc/ad7192.c
index d8f5886fcf694..8bd8105463111 100644
--- a/drivers/iio/adc/ad7192.c
+++ b/drivers/iio/adc/ad7192.c
@@ -1406,6 +1406,9 @@ static int ad7192_probe(struct spi_device *spi)
st->int_vref_mv = ret == -ENODEV ? avdd_mv : ret / MILLI;
st->chip_info = spi_get_device_match_data(spi);
+ if (!st->chip_info)
+ return -ENODATA;
+
indio_dev->name = st->chip_info->name;
indio_dev->modes = INDIO_DIRECT_MODE;
indio_dev->info = st->chip_info->info;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0338/1257] iio: adc: ad7606: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0337/1257] iio: adc: ad7192: reject devices without " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0339/1257] iio: adc: ad7768-1: " Greg Kroah-Hartman
` (660 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 7830650d5293a0f412a869225262ca51b661e49f ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
ad7606_spi_probe() dereferences the returned bus information to pass
the chip information and bus operations to the core, causing a NULL
pointer dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before entering the core.
Fixes: bc69e9fffde4 ("iio: adc: ad7606: Add compatibility to fw_nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ad7606_spi.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/adc/ad7606_spi.c b/drivers/iio/adc/ad7606_spi.c
index 1ebdfb8580ab5..8c479fa50a237 100644
--- a/drivers/iio/adc/ad7606_spi.c
+++ b/drivers/iio/adc/ad7606_spi.c
@@ -456,7 +456,11 @@ static const struct ad7606_bus_info ad7616_bus_info = {
static int ad7606_spi_probe(struct spi_device *spi)
{
- const struct ad7606_bus_info *bus_info = spi_get_device_match_data(spi);
+ const struct ad7606_bus_info *bus_info;
+
+ bus_info = spi_get_device_match_data(spi);
+ if (!bus_info)
+ return -ENODATA;
return ad7606_probe(&spi->dev, spi->irq, NULL,
bus_info->chip_info, bus_info->bops);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0339/1257] iio: adc: ad7768-1: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0338/1257] iio: adc: ad7606: " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0340/1257] iio: adc: max11205: " Greg Kroah-Hartman
` (659 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit e29630bd463eb40e2e86fe45a565fb1d636ac822 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
ad7768_probe() later dereferences the returned chip information to
initialize the IIO channels and device name, causing a NULL pointer
dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before continuing the probe.
Fixes: fa087f5babbc ("iio: adc: ad7768-1: introduce chip info for future multidevice support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ad7768-1.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
index e9060c1bbe6fb..3972821c295a1 100644
--- a/drivers/iio/adc/ad7768-1.c
+++ b/drivers/iio/adc/ad7768-1.c
@@ -1829,6 +1829,9 @@ static int ad7768_probe(struct spi_device *spi)
}
st->chip = spi_get_device_match_data(spi);
+ if (!st->chip)
+ return -ENODATA;
+
st->spi = spi;
st->regmap = devm_regmap_init_spi(spi, &ad7768_regmap_config);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0340/1257] iio: adc: max11205: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0339/1257] iio: adc: ad7768-1: " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0341/1257] iio: adc: mcp3911: " Greg Kroah-Hartman
` (658 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit a07b5db685b2a3084240f9b4a9ee44f3b478c6e3 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
max11205_probe() immediately dereferences the returned chip information
to set the IIO device name, causing a NULL pointer dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before using the chip information.
Fixes: bf3c855be801 ("iio: adc: max11205: simplify with spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/max11205.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/adc/max11205.c b/drivers/iio/adc/max11205.c
index 63b6561dcf475..53ac2f4f383e9 100644
--- a/drivers/iio/adc/max11205.c
+++ b/drivers/iio/adc/max11205.c
@@ -117,6 +117,8 @@ static int max11205_probe(struct spi_device *spi)
ad_sd_init(&st->sd, indio_dev, spi, &max11205_sigma_delta_info);
st->chip_info = spi_get_device_match_data(spi);
+ if (!st->chip_info)
+ return -ENODATA;
indio_dev->name = st->chip_info->name;
indio_dev->modes = INDIO_DIRECT_MODE;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0341/1257] iio: adc: mcp3911: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0340/1257] iio: adc: max11205: " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0342/1257] iio: adc: ti-adc128s052: validate SPI " Greg Kroah-Hartman
` (657 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit d3410a48d5eb9dd8238099cb0ee368d12005a385 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
mcp3911_probe() stores the result and later calls through chip->config
and accesses other chip-specific fields, causing a NULL pointer
dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before continuing the probe.
Fixes: 732ad34260d3 ("iio: adc: mcp3911: add support for the whole MCP39xx family")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/mcp3911.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/adc/mcp3911.c b/drivers/iio/adc/mcp3911.c
index 797424f59f74b..90167930f9132 100644
--- a/drivers/iio/adc/mcp3911.c
+++ b/drivers/iio/adc/mcp3911.c
@@ -721,6 +721,8 @@ static int mcp3911_probe(struct spi_device *spi)
adc = iio_priv(indio_dev);
adc->spi = spi;
adc->chip = spi_get_device_match_data(spi);
+ if (!adc->chip)
+ return -ENODATA;
ret = devm_regulator_get_enable_read_voltage(dev, "vref");
if (ret < 0 && ret != -ENODEV)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0342/1257] iio: adc: ti-adc128s052: validate SPI match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0341/1257] iio: adc: mcp3911: " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0343/1257] iio: adc: ti-ads1018: reject devices without " Greg Kroah-Hartman
` (656 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 4ac257f2fd2a9cac00e748486fa003b4e1cc453e ]
SPI driver_override allows a device to bind to this driver without
matching either the firmware tables or SPI device ID table. In that
case, spi_get_device_match_data() returns NULL.
adc128_probe() also obtains the IIO device name by dereferencing the
result of spi_get_device_id(), which is NULL on the same override path.
The probe can therefore crash before it reaches the match data access.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data and use the always available SPI
modalias for the IIO device name.
Fixes: d5f0da0c6972 ("iio: adc: ti-adc128s052: Switch to use spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ti-adc128s052.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/adc/ti-adc128s052.c b/drivers/iio/adc/ti-adc128s052.c
index 1899813c1aee3..f9a995ff403e0 100644
--- a/drivers/iio/adc/ti-adc128s052.c
+++ b/drivers/iio/adc/ti-adc128s052.c
@@ -195,12 +195,14 @@ static int adc128_probe(struct spi_device *spi)
adc = iio_priv(indio_dev);
adc->spi = spi;
- indio_dev->name = spi_get_device_id(spi)->name;
+ config = spi_get_device_match_data(spi);
+ if (!config)
+ return -ENODATA;
+
+ indio_dev->name = spi->modalias;
indio_dev->modes = INDIO_DIRECT_MODE;
indio_dev->info = &adc128_info;
- config = spi_get_device_match_data(spi);
-
indio_dev->channels = config->channels;
indio_dev->num_channels = config->num_channels;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0343/1257] iio: adc: ti-ads1018: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0342/1257] iio: adc: ti-adc128s052: validate SPI " Greg Kroah-Hartman
@ 2026-11-07 13:43 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0344/1257] iio: adc: ti-ads131m02: " Greg Kroah-Hartman
` (655 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Kurt Borja,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 156898c0f91aa731821d54fff910242f60b12e17 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
ads1018_spi_probe() immediately dereferences the returned chip
information to initialize the IIO device, causing a NULL pointer
dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before allocating the IIO device.
Fixes: bf0bba486b5b ("iio: adc: Add ti-ads1018 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Reviewed-by: Kurt Borja <kuurtb@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ti-ads1018.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/adc/ti-ads1018.c b/drivers/iio/adc/ti-ads1018.c
index d9ec4a8d7ce54..8f2d03eee77b6 100644
--- a/drivers/iio/adc/ti-ads1018.c
+++ b/drivers/iio/adc/ti-ads1018.c
@@ -624,12 +624,16 @@ static int ads1018_trigger_setup(struct iio_dev *indio_dev)
static int ads1018_spi_probe(struct spi_device *spi)
{
- const struct ads1018_chip_info *info = spi_get_device_match_data(spi);
+ const struct ads1018_chip_info *info;
struct device *dev = &spi->dev;
struct iio_dev *indio_dev;
struct ads1018 *ads1018;
int ret;
+ info = spi_get_device_match_data(spi);
+ if (!info)
+ return -ENODATA;
+
indio_dev = devm_iio_device_alloc(dev, sizeof(*ads1018));
if (!indio_dev)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0344/1257] iio: adc: ti-ads131m02: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2026-11-07 13:43 ` [PATCH 7.3 0343/1257] iio: adc: ti-ads1018: reject devices without " Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0345/1257] iio: adc: ti-ads7950: validate SPI " Greg Kroah-Hartman
` (654 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 9f0e96713033e5fe5a7a232e2c3aa994a8d2862f ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
ads131m_probe() immediately dereferences the returned configuration to
initialize the IIO device, causing a NULL pointer dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before using the configuration.
Fixes: 4aa91223fd6c ("iio: adc: Add TI ADS131M0x ADC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ti-ads131m02.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/adc/ti-ads131m02.c b/drivers/iio/adc/ti-ads131m02.c
index 2f8f75c8216b2..7ecfb27fd7ef0 100644
--- a/drivers/iio/adc/ti-ads131m02.c
+++ b/drivers/iio/adc/ti-ads131m02.c
@@ -897,6 +897,8 @@ static int ads131m_probe(struct spi_device *spi)
indio_dev->info = &ads131m_info;
config = spi_get_device_match_data(spi);
+ if (!config)
+ return -ENODATA;
priv->config = config;
indio_dev->name = config->name;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0345/1257] iio: adc: ti-ads7950: validate SPI match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0344/1257] iio: adc: ti-ads131m02: " Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0346/1257] iio: accel: adxl313: reject devices without " Greg Kroah-Hartman
` (653 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 6bdeaf23ef8062f4c38c025c50e524f1e4d59647 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
ti_ads7950_probe() also obtains the IIO device name by dereferencing the
result of spi_get_device_id(), which is NULL on the same override path.
The probe can therefore crash before dereferencing the chip information.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data and use the always available SPI
modalias for the IIO device name.
Fixes: ff0843ceb1fb ("iio: adc: ti-ads7950: remove chip_info[]")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ti-ads7950.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/adc/ti-ads7950.c b/drivers/iio/adc/ti-ads7950.c
index d27c1f2885fd6..0d5708e0b831d 100644
--- a/drivers/iio/adc/ti-ads7950.c
+++ b/drivers/iio/adc/ti-ads7950.c
@@ -527,8 +527,10 @@ static int ti_ads7950_probe(struct spi_device *spi)
st->spi = spi;
info = spi_get_device_match_data(spi);
+ if (!info)
+ return -ENODATA;
- indio_dev->name = spi_get_device_id(spi)->name;
+ indio_dev->name = spi->modalias;
indio_dev->modes = INDIO_DIRECT_MODE;
indio_dev->channels = info->channels;
indio_dev->num_channels = info->num_channels;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0346/1257] iio: accel: adxl313: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0345/1257] iio: adc: ti-ads7950: validate SPI " Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0347/1257] iio: accel: adxl372: " Greg Kroah-Hartman
` (652 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit defd4c0b29f1cd17caa5feebac33fc5fdf4e1916 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
adxl313_spi_probe() dereferences chip_data to select the regmap
configuration, causing a NULL pointer dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before selecting the configuration.
Fixes: d6e3ee74d16f ("iio: accel: adxl313: simplify with spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/adxl313_spi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/accel/adxl313_spi.c b/drivers/iio/accel/adxl313_spi.c
index a61295de104f6..0f0da44461f74 100644
--- a/drivers/iio/accel/adxl313_spi.c
+++ b/drivers/iio/accel/adxl313_spi.c
@@ -79,6 +79,8 @@ static int adxl313_spi_probe(struct spi_device *spi)
return ret;
chip_data = spi_get_device_match_data(spi);
+ if (!chip_data)
+ return -ENODATA;
regmap = devm_regmap_init_spi(spi,
&adxl31x_spi_regmap_config[chip_data->type]);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0347/1257] iio: accel: adxl372: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0346/1257] iio: accel: adxl313: reject devices without " Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0348/1257] iio: accel: adxl380: " Greg Kroah-Hartman
` (651 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit c72144098fa9205e9b1d08545e7d9b54a2e0aaf3 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
adxl372_spi_probe() passes the result to adxl372_probe(), which
dereferences chip_info to set the IIO device name and capabilities,
causing a NULL pointer dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data in the SPI frontend.
Fixes: 23d742859a2d ("iio: accel: adxl372: introduce chip_info structure")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/adxl372_spi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/accel/adxl372_spi.c b/drivers/iio/accel/adxl372_spi.c
index 128e148c4e96b..d54544d6df6f4 100644
--- a/drivers/iio/accel/adxl372_spi.c
+++ b/drivers/iio/accel/adxl372_spi.c
@@ -25,6 +25,8 @@ static int adxl372_spi_probe(struct spi_device *spi)
struct regmap *regmap;
chip_info = spi_get_device_match_data(spi);
+ if (!chip_info)
+ return -ENODATA;
regmap = devm_regmap_init_spi(spi, &adxl372_spi_regmap_config);
if (IS_ERR(regmap))
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0348/1257] iio: accel: adxl380: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0347/1257] iio: accel: adxl372: " Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0349/1257] iio: accel: sca3000: " Greg Kroah-Hartman
` (650 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 9f6d174e9fa5b265e7a0a6caa0c5b579bf899702 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
adxl380_spi_probe() passes the result to adxl380_probe(), which
dereferences chip_info to set the IIO device name and operations,
causing a NULL pointer dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data in the SPI frontend.
Fixes: df36de13677a ("iio: accel: add ADXL380 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/adxl380_spi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/accel/adxl380_spi.c b/drivers/iio/accel/adxl380_spi.c
index ae8467f4e6c01..8ffb3a8690a63 100644
--- a/drivers/iio/accel/adxl380_spi.c
+++ b/drivers/iio/accel/adxl380_spi.c
@@ -25,6 +25,8 @@ static int adxl380_spi_probe(struct spi_device *spi)
struct regmap *regmap;
chip_data = spi_get_device_match_data(spi);
+ if (!chip_data)
+ return -ENODATA;
regmap = devm_regmap_init_spi(spi, &adxl380_spi_regmap_config);
if (IS_ERR(regmap))
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0349/1257] iio: accel: sca3000: reject devices without match data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0348/1257] iio: accel: adxl380: " Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0350/1257] iio: dac: mcp47feb02: Avoid unjustified probe error on missing label Greg Kroah-Hartman
` (649 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit bee629c18a9389cfbbe182df954cf49a9066b383 ]
SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.
sca3000_probe() immediately dereferences the returned chip information
to set the IIO device name and channel layout, causing a NULL pointer
dereference.
Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before using the chip information.
Fixes: d6ae9f202f61 ("iio: sca3000: simplify with spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/sca3000.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/accel/sca3000.c b/drivers/iio/accel/sca3000.c
index 8f1ac1d3305ed..acd0890c78a58 100644
--- a/drivers/iio/accel/sca3000.c
+++ b/drivers/iio/accel/sca3000.c
@@ -1462,6 +1462,8 @@ static int sca3000_probe(struct spi_device *spi)
st->us = spi;
mutex_init(&st->lock);
st->info = spi_get_device_match_data(spi);
+ if (!st->info)
+ return -ENODATA;
indio_dev->name = st->info->name;
indio_dev->info = &sca3000_info;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0350/1257] iio: dac: mcp47feb02: Avoid unjustified probe error on missing label
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0349/1257] iio: accel: sca3000: " Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0351/1257] iio: adc: stm32: fix minimum sampling time values Greg Kroah-Hartman
` (648 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ariana Lazar,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ariana Lazar <ariana.lazar@microchip.com>
[ Upstream commit bce5b7e29e72538ba61f76c6d534a58ab3838438 ]
Fix unjustified probe error on missing optional 'label' property by
replacing dev_err_probe() with dev_warn_probe(). Correct %pfw usage by
passing the child fwnode handle directly in the error message. Besides the
probe warning a read error is returned at the attempt of reading a null
label.
Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260804134616.1D8A21F00A3E@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Ariana Lazar <ariana.lazar@microchip.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/dac/mcp47feb02.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/iio/dac/mcp47feb02.c b/drivers/iio/dac/mcp47feb02.c
index 7758e37080958..baeb1be455c6f 100644
--- a/drivers/iio/dac/mcp47feb02.c
+++ b/drivers/iio/dac/mcp47feb02.c
@@ -921,7 +921,10 @@ static int mcp47feb02_read_label(struct iio_dev *indio_dev, struct iio_chan_spec
{
struct mcp47feb02_data *data = iio_priv(indio_dev);
- return sysfs_emit(label, "%s\n", data->labels[ch->address]);
+ if (data->labels[ch->address])
+ return sysfs_emit(label, "%s\n", data->labels[ch->address]);
+
+ return -ENOENT;
}
static const struct iio_info mcp47feb02_info = {
@@ -974,10 +977,11 @@ static int mcp47feb02_parse_fw(struct iio_dev *indio_dev,
set_bit(reg, &data->active_channels_mask);
- ret = fwnode_property_read_string(child, "label", &data->labels[reg]);
- if (ret)
- return dev_err_probe(dev, ret, "%pfw: invalid label\n",
- fwnode_get_name(child));
+ if (fwnode_property_present(child, "label")) {
+ ret = fwnode_property_read_string(child, "label", &data->labels[reg]);
+ if (ret)
+ dev_warn_probe(dev, ret, "%pfw: invalid label\n", child);
+ }
chanspec.address = reg;
chanspec.channel = reg;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0351/1257] iio: adc: stm32: fix minimum sampling time values
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0350/1257] iio: dac: mcp47feb02: Avoid unjustified probe error on missing label Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0352/1257] iio: pressure: dps310: fix CFG_REG bit definitions Greg Kroah-Hartman
` (647 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cheick Traore, Fabrice Gasnier,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheick Traore <cheick.traore-ext@st.com>
[ Upstream commit ef04fdc999ee40a58d513ea48d391c7dc78c908c ]
- On stm32mp15: vddcpu and vddq_ddr are not connected to internal
channel, so their sampling time shouldn't be set.
- On stm32mp13: vddcpu and vddq_ddr are connected to internal channels
and the value for vddcore was not correct. Values from the datasheet
are 1us (e.g. 1000ns) for ts_vddcore, ts_vddcpu and ts_vddq_ddr.
Fixes: 7cb2303dd024 ("iio: adc: stm32: manage min sampling time on all internal channels")
Cc: stable@vger.kernel.org
Signed-off-by: Cheick Traore <cheick.traore-ext@st.com>
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/stm32-adc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index 90f0e257e6d1b..b024326775aeb 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -2734,7 +2734,7 @@ static const struct stm32_adc_cfg stm32h7_adc_cfg = {
.set_ovs = stm32h7_adc_set_ovs,
};
-static const unsigned int stm32_adc_min_ts_mp1[] = { 100, 100, 100, 4300, 9800 };
+static const unsigned int stm32_adc_min_ts_mp1[] = { 100, 0, 0, 4300, 9800 };
static_assert(ARRAY_SIZE(stm32_adc_min_ts_mp1) == STM32_ADC_INT_CH_NB);
static const struct stm32_adc_cfg stm32mp1_adc_cfg = {
@@ -2756,7 +2756,7 @@ static const struct stm32_adc_cfg stm32mp1_adc_cfg = {
.set_ovs = stm32h7_adc_set_ovs,
};
-static const unsigned int stm32_adc_min_ts_mp13[] = { 100, 0, 0, 4300, 9800 };
+static const unsigned int stm32_adc_min_ts_mp13[] = { 1000, 1000, 1000, 4300, 9800 };
static_assert(ARRAY_SIZE(stm32_adc_min_ts_mp13) == STM32_ADC_INT_CH_NB);
static const struct stm32_adc_cfg stm32mp13_adc_cfg = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0352/1257] iio: pressure: dps310: fix CFG_REG bit definitions
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0351/1257] iio: adc: stm32: fix minimum sampling time values Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0353/1257] spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup() Greg Kroah-Hartman
` (646 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rupesh Majhi, Jonathan Cameron,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rupesh Majhi <zoone.rupert@gmail.com>
[ Upstream commit 4334dc4092c271e6cd010c2ee70b7f4415c4c199 ]
Driver defines them as BIT(4), BIT(5) and BIT(6). Per datasheet P_SHIFT
is bit 2, FIFO_EN is bit 1 and SPI_MODE is bit 0.
Only P_SHIFT has a user. dps310_set_pres_precision() sets it at
oversampling 16 or above, so with wrong bit the result register is never
shifted and stops matching the scale factor compensation divides by.
in_pressure_input returns -ERANGE at oversampling 16, 32 and 64.
FIFO_EN needed by FIFO support later in this series.
Fixes: ba6ec48e76bc ("iio: Add driver for Infineon DPS310")
Fixes: d711a3c7dc82 ("iio: dps310: Add pressure sensing capability")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Rupesh Majhi <zoone.rupert@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/pressure/dps310.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/pressure/dps310.c b/drivers/iio/pressure/dps310.c
index 45bdb8c7670f0..35260b3993903 100644
--- a/drivers/iio/pressure/dps310.c
+++ b/drivers/iio/pressure/dps310.c
@@ -50,9 +50,9 @@
#define DPS310_CFG_REG 0x09
#define DPS310_INT_HL BIT(7)
#define DPS310_TMP_SHIFT_EN BIT(3)
-#define DPS310_PRS_SHIFT_EN BIT(4)
-#define DPS310_FIFO_EN BIT(5)
-#define DPS310_SPI_EN BIT(6)
+#define DPS310_PRS_SHIFT_EN BIT(2)
+#define DPS310_FIFO_EN BIT(1)
+#define DPS310_SPI_EN BIT(0)
#define DPS310_RESET 0x0c
#define DPS310_RESET_MAGIC 0x09
#define DPS310_COEF_BASE 0x10
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0353/1257] spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0352/1257] iio: pressure: dps310: fix CFG_REG bit definitions Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0354/1257] fs/ntfs3: fix integer overflow in find_log_rec() causing OOB read Greg Kroah-Hartman
` (645 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lucas Costa, Bartosz Golaszewski,
Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Costa <2000.costalucas@gmail.com>
[ Upstream commit 8db44cca03df066186d6220bfad9fa482d7cdc13 ]
of_find_compatible_node() returns a device_node with its reference count
incremented, but bcm2835_spi_setup() only uses the return value to test
for a matching node in the loop and never releases it.
Declare the node with a scope-based __free(device_node) cleanup so the
reference is dropped automatically when leaving the loop body, matching
the existing __free(kfree) usage in the same function.
Fixes: e19c1272c80a ("spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent")
Cc: stable@vger.kernel.org
Signed-off-by: Lucas Costa <2000.costalucas@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260925193008.127314-1-2000.costalucas@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-bcm2835.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 8f8715809c7ce..23606967f7d1f 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -1297,7 +1297,9 @@ static int bcm2835_spi_setup(struct spi_device *spi)
}
for (i = 0; i < ARRAY_SIZE(pinctrl_compats); i++) {
- if (of_find_compatible_node(NULL, NULL, pinctrl_compats[i]))
+ struct device_node *np __free(device_node) =
+ of_find_compatible_node(NULL, NULL, pinctrl_compats[i]);
+ if (np)
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0354/1257] fs/ntfs3: fix integer overflow in find_log_rec() causing OOB read
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0353/1257] spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup() Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0355/1257] fs/ntfs3: reject an oversized resident attribute on the inline iomap path Greg Kroah-Hartman
` (644 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ibrahim Hashimov, Konstantin Komarov,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <security@auditcode.ai>
[ Upstream commit e2fcb0040b0b4097b2e97f3fbe77d3b66df9e816 ]
find_log_rec() validates the on-disk LFS_RECORD_HDR.client_data_len
field (`len`, a raw u32 read straight from a mounted $LogFile page)
against the log's total available space:
len = le32_to_cpu(rh->client_data_len);
rec_len = len + log->record_header_len;
if (rec_len >= log->total_avail)
return -EINVAL;
The addition is unchecked. For len in [0xffffffd0, 0xffffffff] (i.e.
log->record_header_len away from UINT_MAX), `rec_len` wraps to a small
u32 value that trivially clears the `rec_len >= log->total_avail`
guard, so a record whose declared length is actually ~4 GiB is
reported as valid and in-page.
Because find_log_rec() wrongly accepts the record, its caller
read_log_rec_lcb() hands it back to log_replay() as good. On the
transaction-table replay leg, log_replay() re-derives the record
length directly from the same raw, still-unclamped client_data_len
field and uses it to size the restart-table blob:
rec_len = le32_to_cpu(frh->client_data_len); /* ~0xffffffff */
...
t16 = le16_to_cpu(lrh->redo_off);
rt = Add2Ptr(lrh, t16);
t32 = rec_len - t16; /* still ~4 GiB */
if (!check_rstbl(rt, t32))
return -EINVAL;
check_rstbl()'s own `bytes < ts` bounds guard is defeated because the
caller-supplied `bytes` (t32) is itself the poisoned ~4 GiB value, so
the guard can never trigger. The subsequent entry-validation loop then
walks `rt->used` (also attacker-controlled) entries of
sizeof(struct RESTART_TABLE) == 0x18 bytes each straight past the end
of the kmalloc(log->page_size) log-page buffer allocated in
read_log_page(), producing an out-of-bounds read that is reachable
simply by mounting a crafted $LogFile (no genuine dirty-page /
crash-recovery state is required). Confirmed via KASAN as a
slab-out-of-bounds read in check_rstbl(), called from log_replay() ->
ntfs_loadlog_and_replay() -> ntfs_fill_super() -> mount(2).
Fix the root cause instead of hardening every downstream consumer of
the poisoned length: make the addition in find_log_rec() overflow-safe
with check_add_overflow(), mirroring the pattern fs/ntfs3/run.c
already uses to validate other attacker-controlled on-disk
length/offset arithmetic decoded from MAPPING_PAIRS runs, e.g.:
if (check_add_overflow(vcn64, len, &next_vcn))
return -EINVAL;
...
if (check_add_overflow(lcn, len, &lcn_end))
return -EINVAL;
(fs/ntfs3/run.c, run_unpack()).
With the overflow rejected instead of silently wrapped, `rec_len` is
only ever a true, non-wrapped sum, so the existing
`rec_len >= log->total_avail` check now correctly rejects any
oversized record up front. log_replay()'s transaction-table leg then
never gets a chance to re-read the poisoned client_data_len, and
check_rstbl() is never invoked with an attacker-inflated `bytes` for
this path.
Verified on a v6.19 KASAN build: mounting a crafted $LogFile whose
client_data_len overflows trips a KASAN slab-out-of-bounds-read
report in check_rstbl() before this fix; with check_add_overflow()
applied, the same image is cleanly rejected during log replay and no
KASAN report fires.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fslog.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index ed50c1d0c23e3..9a44b322ad60e 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -7,6 +7,7 @@
#include <linux/blkdev.h>
#include <linux/fs.h>
+#include <linux/overflow.h>
#include <linux/random.h>
#include <linux/slab.h>
@@ -2457,7 +2458,8 @@ static int find_log_rec(struct ntfs_log *log, u64 lsn, struct lcb *lcb)
* Check that the length field isn't greater than the total
* available space the log file.
*/
- rec_len = len + log->record_header_len;
+ if (check_add_overflow(len, log->record_header_len, &rec_len))
+ return -EINVAL;
if (rec_len >= log->total_avail)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0355/1257] fs/ntfs3: reject an oversized resident attribute on the inline iomap path
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0354/1257] fs/ntfs3: fix integer overflow in find_log_rec() causing OOB read Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0356/1257] cxl/acpi: Check ACPI companion before use Greg Kroah-Hartman
` (643 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Konstantin Komarov, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit 456189f9c714dee6716c2a3aad908e63830cac66 ]
attr_data_get_block_locked() maps a resident attribute as a one-page
IOMAP_INLINE extent: it allocates a single page, copies the resident
value into it with memcpy(), and hands that page to ntfs_iomap_begin()
as the inline data. The copy length is the on-disk resident value
length (res.data_size), and mi_enum_attr() only bounds that length
against the MFT record size. A corrupted volume with MFT records larger
than a page can therefore present a resident $DATA whose length exceeds
PAGE_SIZE, and the memcpy() then writes past the single destination page.
Impact: reading or writing a resident file on a mounted crafted NTFS
volume whose MFT records are larger than a page overflows the one-page
inline buffer in attr_data_get_block_locked() with attacker-controlled
bytes.
Reject such an attribute in attr_data_get_block_locked(), before the
page is allocated and the copy is made.
Fixes: 099ef9ab9203 ("fs/ntfs3: implement iomap-based file operations")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/attrib.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index b1c315206ffaf..fd2640878e6a5 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -1034,6 +1034,21 @@ int attr_data_get_block_locked(struct ntfs_inode *ni, CLST vcn, CLST clen,
if (!attr_b->non_res) {
u32 data_size = le32_to_cpu(attr_b->res.data_size);
+
+ /*
+ * A resident attribute is copied into a single page below
+ * (alloc_page() + memcpy()) and mapped as a one-page
+ * IOMAP_INLINE extent by ntfs_iomap_begin(). mi_enum_attr()
+ * only bounds the resident value length against the MFT record
+ * size, so a corrupted volume whose records are larger than a
+ * page can report data_size > PAGE_SIZE; copying that many bytes
+ * would overflow the single destination page. Reject it.
+ */
+ if (data_size > PAGE_SIZE) {
+ err = -EINVAL;
+ goto out;
+ }
+
*lcn = RESIDENT_LCN;
*len = data_size;
if (res) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0356/1257] cxl/acpi: Check ACPI companion before use
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0355/1257] fs/ntfs3: reject an oversized resident attribute on the inline iomap path Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0357/1257] ALSA: timer: Handle userspace-driven timer ioctls from 32-bit tasks Greg Kroah-Hartman
` (642 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Jonathan Cameron,
Dave Jiang, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 371c2ad1624283b6c7a62a28199f5161d388a738 ]
Platform drivers can be forced to match devices outside their ID tables
through driver_override. cxl_acpi_probe() assumes that every bound device
has an ACPI companion and dereferences adev->dev.bus without checking the
result of ACPI_COMPANION(). Force-binding cxl_acpi to a platform device
without a companion therefore causes a NULL pointer dereference.
This was reproduced by setting the driver override for the pcspkr platform
device to cxl_acpi and binding it through sysfs:
BUG: kernel NULL pointer dereference, address: 0000000000000280
#PF: supervisor read access in kernel mode
RIP: cxl_acpi_probe+0xf4/0x220
Call Trace:
platform_probe+0x4d/0x80
really_probe+0x106/0x370
device_driver_attach+0x4c/0xa0
bind_store+0xd0/0x100
Commit 2b3a5dabe89e ("platform/surface: acpi-notify: Check ACPI
companion before use") fixed the same force-binding issue in another
platform driver. Check the companion before setting up the CXL root and
return -ENODEV when it is absent.
Fixes: 7d4b5ca2e2cb ("cxl/acpi: Add downstream port data to cxl_port instances")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Link: https://patch.msgid.link/20260926071605.3013893-1-yaojiale02@163.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/acpi.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
index 3b818adbd38b5..fb09a5ff48c16 100644
--- a/drivers/cxl/acpi.c
+++ b/drivers/cxl/acpi.c
@@ -885,13 +885,17 @@ static int pair_cxl_resource(struct device *dev, void *data)
static int cxl_acpi_probe(struct platform_device *pdev)
{
- int rc;
+ struct cxl_cfmws_context ctx;
+ struct acpi_device *adev;
struct resource *cxl_res;
struct cxl_root *cxl_root;
struct cxl_port *root_port;
struct device *host = &pdev->dev;
- struct acpi_device *adev = ACPI_COMPANION(host);
- struct cxl_cfmws_context ctx;
+ int rc;
+
+ adev = ACPI_COMPANION(host);
+ if (!adev)
+ return -ENODEV;
device_lock_set_class(&pdev->dev, &cxl_root_key);
rc = devm_add_action_or_reset(&pdev->dev, cxl_acpi_lock_reset_class,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0357/1257] ALSA: timer: Handle userspace-driven timer ioctls from 32-bit tasks
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0356/1257] cxl/acpi: Check ACPI companion before use Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0358/1257] media: qcom: camss: vfe-17x: Fix write master buffer done being dropped Greg Kroah-Hartman
` (641 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danish Khateeb, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danish Khateeb <danishkhateeb03@gmail.com>
[ Upstream commit 1bbc033983b76f41d51d4a48838bf94c5e6b6f50 ]
32-bit tasks on a 64-bit kernel can't use userspace-driven timers. The
compat handler for /dev/snd/timer doesn't list SNDRV_TIMER_IOCTL_CREATE,
so creating a timer fails with -ENOTTY. The file returned for a timer
has no .compat_ioctl either, so SNDRV_TIMER_IOCTL_TRIGGER fails with
-ENOTTY too.
struct snd_timer_uinfo has the same layout for 32-bit and 64-bit tasks,
and SNDRV_TIMER_IOCTL_TRIGGER takes no argument, so both commands can
be passed through unchanged.
The utimer selftest doesn't catch this when built with -m32: it takes
-ENOTTY from SNDRV_TIMER_IOCTL_CREATE to mean CONFIG_SND_UTIMER=n and
skips.
Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
Link: https://patch.msgid.link/20260928182352.309457-1-danishkhateeb03@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/timer.c | 1 +
sound/core/timer_compat.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 679b264356709..69a59b25fe0a8 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -2176,6 +2176,7 @@ static const struct file_operations snd_utimer_fops = {
.llseek = noop_llseek,
.release = snd_utimer_release,
.unlocked_ioctl = snd_utimer_ioctl,
+ .compat_ioctl = snd_utimer_ioctl,
};
static int snd_utimer_start(struct snd_timer *t)
diff --git a/sound/core/timer_compat.c b/sound/core/timer_compat.c
index 25ee81c1668b7..5bab00466de7f 100644
--- a/sound/core/timer_compat.c
+++ b/sound/core/timer_compat.c
@@ -99,6 +99,7 @@ static long __snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd,
case SNDRV_TIMER_IOCTL_PAUSE:
case SNDRV_TIMER_IOCTL_PAUSE_OLD:
case SNDRV_TIMER_IOCTL_NEXT_DEVICE:
+ case SNDRV_TIMER_IOCTL_CREATE:
return __snd_timer_user_ioctl(file, cmd, (unsigned long)argp, true);
case SNDRV_TIMER_IOCTL_GPARAMS32:
return snd_timer_user_gparams_compat(file, argp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0358/1257] media: qcom: camss: vfe-17x: Fix write master buffer done being dropped
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0357/1257] ALSA: timer: Handle userspace-driven timer ioctls from 32-bit tasks Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0359/1257] media: qcom: camss: vfe-17x: Fix write master selection for RDI lines Greg Kroah-Hartman
` (640 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Loic Poulain,
Hitesh Patel, Bryan ODonoghue, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hitesh Patel <hitesh@ebytelogic.com>
[ Upstream commit eed550a8191c2f6984047a1b794b313d1bacf77d ]
The VFE 17x interrupt handler reads and clears the bus status
registers on every interrupt, but only acts on the per write master
BUF_DONE bits when bit 9 of IRQ_STATUS_0 is set as well. Bit 9 is the
ping-pong flag of image master 1. It has nothing to do with the other
write masters, and it is not guaranteed to be set in the same
interrupt in which a write master reports a completed buffer.
The bus status is read-to-clear. When a buffer done arrives while bit
9 is not set, the handler clears the status and never calls
wm_done() for it. The buffer stays queued in the driver and the video
node never receives that frame.
With one RDI streaming this is rare. With two RDIs streaming on the
same VFE, for instance two virtual channels demultiplexed by the CSID,
the interrupt rate doubles and one of the two lines loses buffer done
events continuously.
Act on the bus status alone, as the other gen2 VFE handlers do.
Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Hitesh Patel <hitesh@ebytelogic.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/camss/camss-vfe-17x.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe-17x.c b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
index e5ee7e717b3bc..c011f64f63e93 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-17x.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
@@ -364,9 +364,8 @@ static irqreturn_t vfe_isr(int irq, void *dev)
vfe->isr_ops.comp_done(vfe, i);
for (wm = 0; wm < MSM_VFE_IMAGE_MASTERS_NUM; wm++)
- if (status0 & BIT(9))
- if (vfe_bus_status[1] & STATUS1_WM_CLIENT_BUF_DONE(wm))
- vfe->isr_ops.wm_done(vfe, wm);
+ if (vfe_bus_status[1] & STATUS1_WM_CLIENT_BUF_DONE(wm))
+ vfe->isr_ops.wm_done(vfe, wm);
return IRQ_HANDLED;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0359/1257] media: qcom: camss: vfe-17x: Fix write master selection for RDI lines
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0358/1257] media: qcom: camss: vfe-17x: Fix write master buffer done being dropped Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0360/1257] media: qcom: camss: vfe: Fix VFE reset while another line is streaming Greg Kroah-Hartman
` (639 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Loic Poulain,
Hitesh Patel, Bryan ODonoghue, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hitesh Patel <hitesh@ebytelogic.com>
[ Upstream commit fc02156a3efb747b724a490cc50e1ad8c28a3b23 ]
On the gen2 VFE bus there is no crossbar between the RDI paths and
the bus write masters: RDI n is served by write master n. The common
vfe_get_output_v2() reflects this by mapping line->id to write master
line->id, and every gen2 VFE except 17x uses it.
The 17x code kept its own vfe_get_output(), which reserves whichever
write master is free first. That happens to be the right one as long
as a single line streams and it is RDI0. As soon as two lines of the
same VFE stream, for instance two virtual channels demultiplexed by
the CSID to RDI0 and RDI1, the second line to start is given the
write master of the other RDI. Both write masters are then programmed
with the buffer address and frame size of the wrong line. The frames
are truncated to the smaller of the two buffers and the SMMU faults
on the larger one.
Use vfe_get_output_v2() on 17x like the other gen2 VFEs and drop the
duplicate. This also removes an error path that released
output->wm_idx[0] before it had been assigned.
The gen1 VFEs are not affected: they have a bus crossbar and any write
master can serve any line, so vfe_reserve_wm() is correct there.
Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Hitesh Patel <hitesh@ebytelogic.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/qcom/camss/camss-vfe-17x.c | 41 +------------------
1 file changed, 1 insertion(+), 40 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe-17x.c b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
index c011f64f63e93..62c2405359a06 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-17x.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
@@ -382,45 +382,6 @@ static int vfe_halt(struct vfe_device *vfe)
return 0;
}
-static int vfe_get_output(struct vfe_line *line)
-{
- struct vfe_device *vfe = to_vfe(line);
- struct vfe_output *output;
- unsigned long flags;
- int wm_idx;
-
- spin_lock_irqsave(&vfe->output_lock, flags);
-
- output = &line->output;
- if (output->state > VFE_OUTPUT_RESERVED) {
- dev_err(vfe->camss->dev, "Output is running\n");
- goto error;
- }
-
- output->wm_num = 1;
-
- wm_idx = vfe_reserve_wm(vfe, line->id);
- if (wm_idx < 0) {
- dev_err(vfe->camss->dev, "Can not reserve wm\n");
- goto error_get_wm;
- }
- output->wm_idx[0] = wm_idx;
-
- output->drop_update_idx = 0;
-
- spin_unlock_irqrestore(&vfe->output_lock, flags);
-
- return 0;
-
-error_get_wm:
- vfe_release_wm(vfe, output->wm_idx[0]);
- output->state = VFE_OUTPUT_OFF;
-error:
- spin_unlock_irqrestore(&vfe->output_lock, flags);
-
- return -EINVAL;
-}
-
/*
* vfe_enable - Enable streaming on VFE line
* @line: VFE line
@@ -441,7 +402,7 @@ static int vfe_enable(struct vfe_line *line)
mutex_unlock(&vfe->stream_lock);
- ret = vfe_get_output(line);
+ ret = vfe_get_output_v2(line);
if (ret < 0)
goto error_get_output;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0360/1257] media: qcom: camss: vfe: Fix VFE reset while another line is streaming
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0359/1257] media: qcom: camss: vfe-17x: Fix write master selection for RDI lines Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0361/1257] media: qcom: camss: Add "gcc_axi_hf" to 8775p VFE lite clock lists Greg Kroah-Hartman
` (638 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hitesh Patel, Bryan ODonoghue,
Bryan ODonoghue, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hitesh Patel <hitesh@ebytelogic.com>
[ Upstream commit e5d4b0e69a4017fd39354499c9d7583f625f0524 ]
vfe_disable_output() stops the write masters of the line being
disabled and then resets the whole VFE. The reset is not limited to
that line.
When two lines of one VFE stream at the same time, which is the case
whenever a CSID demultiplexes several virtual channels to different
RDIs, stopping the first line resets the VFE underneath the second
line. The second line's write master configuration is wiped, the
buffers it had in flight are never completed, and the VFE is left in
a state in which the next global reset is not acknowledged. Stopping
or restarting the second line then fails with:
VFE reset timeout
Move the reset to vfe_disable() and do it under stream_lock, as part
of the decrement that makes the count reach zero, so that exactly one
caller resets and no line can be enabled while the reset runs.
Stopping the line's write masters is enough to quiesce that line on
its own. With a single line streaming, the reset happens exactly as
before.
Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
Cc: stable@vger.kernel.org
Signed-off-by: Hitesh Patel <hitesh@ebytelogic.com>
Suggested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
[bod: Converted vfe_disable_output to void]
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/camss/camss-vfe.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
index 319d191589884..55c0a0ee398fe 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe.c
@@ -808,7 +808,7 @@ int vfe_put_output(struct vfe_line *line)
return 0;
}
-static int vfe_disable_output(struct vfe_line *line)
+static void vfe_disable_output(struct vfe_line *line)
{
struct vfe_device *vfe = to_vfe(line);
struct vfe_output *output = &line->output;
@@ -820,8 +820,6 @@ static int vfe_disable_output(struct vfe_line *line)
vfe->res->hw_ops->vfe_wm_stop(vfe, output->wm_idx[i]);
output->gen2.active_num = 0;
spin_unlock_irqrestore(&vfe->output_lock, flags);
-
- return vfe_reset(vfe);
}
/*
@@ -833,21 +831,19 @@ static int vfe_disable_output(struct vfe_line *line)
int vfe_disable(struct vfe_line *line)
{
struct vfe_device *vfe = to_vfe(line);
- int ret;
+ int ret = 0;
- ret = vfe_disable_output(line);
- if (ret)
- goto error;
+ vfe_disable_output(line);
vfe_put_output(line);
mutex_lock(&vfe->stream_lock);
- vfe->stream_count--;
+ if (--vfe->stream_count == 0)
+ ret = vfe_reset(vfe);
mutex_unlock(&vfe->stream_lock);
-error:
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0361/1257] media: qcom: camss: Add "gcc_axi_hf" to 8775p VFE lite clock lists
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0360/1257] media: qcom: camss: vfe: Fix VFE reset while another line is streaming Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0362/1257] media: venus: Fix iova allocation from restrict region Greg Kroah-Hartman
` (637 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wenmeng Liu, Bryan ODonoghue,
Hans de Goede, Cory Keitz, Loic Poulain, Vladimir Zapolskiy,
Bryan ODonoghue, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <johannes.goede@oss.qualcomm.com>
[ Upstream commit 583b27edfe669fe27c631b4ac77c0ce0250f7bba ]
The "gcc_axi_hf" clock is correctly listed in the clock list of the
8775p 2 main VFE-s, but it is missing from all the VFE-lite clock lists,
causing these to not work on platforms where the firmware allows turning
off "gcc_axi_hf".
Add the missing "gcc_axi_hf" to fix the VFE-lite blocks not working on
these platforms.
Fixes: 924f45e58b1fe ("media: qcom: camss: Add missing clocks for VFE lite on sa8775p")
Cc: stable@vger.kernel.org
Suggested-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Tested-by: Cory Keitz <ckeitz@amazon.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/camss/camss.c | 25 ++++++++++++++---------
1 file changed, 15 insertions(+), 10 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
index 2123f6388e3d7..68491b16d6476 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -4037,10 +4037,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
/* VFE2 (lite) */
{
.regulators = {},
- .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
+ .clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+ "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
"vfe_lite", "camnoc_axi"},
.clock_rate = {
+ { 0 },
{ 0 },
{ 0 },
{ 300000000, 400000000, 400000000, 400000000 },
@@ -4062,10 +4063,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
/* VFE3 (lite) */
{
.regulators = {},
- .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
+ .clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+ "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
"vfe_lite", "camnoc_axi"},
.clock_rate = {
+ { 0 },
{ 0 },
{ 0 },
{ 300000000, 400000000, 400000000, 400000000 },
@@ -4087,10 +4089,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
/* VFE4 (lite) */
{
.regulators = {},
- .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
+ .clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+ "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
"vfe_lite", "camnoc_axi"},
.clock_rate = {
+ { 0 },
{ 0 },
{ 0 },
{ 300000000, 400000000, 400000000, 400000000 },
@@ -4112,10 +4115,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
/* VFE5 (lite) */
{
.regulators = {},
- .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
+ .clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+ "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
"vfe_lite", "camnoc_axi"},
.clock_rate = {
+ { 0 },
{ 0 },
{ 0 },
{ 300000000, 400000000, 400000000, 400000000 },
@@ -4137,10 +4141,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
/* VFE6 (lite) */
{
.regulators = {},
- .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
+ .clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+ "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
"vfe_lite", "camnoc_axi"},
.clock_rate = {
+ { 0 },
{ 0 },
{ 0 },
{ 300000000, 400000000, 400000000, 400000000 },
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0362/1257] media: venus: Fix iova allocation from restrict region
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0361/1257] media: qcom: camss: Add "gcc_axi_hf" to 8775p VFE lite clock lists Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0363/1257] media: iris: reset AHB bridge before enabling HW mode Greg Kroah-Hartman
` (636 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vikash Garodia, Dmitry Baryshkov,
Vishnu Reddy, Bryan ODonoghue, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[ Upstream commit 953439251b596cee039fbfeaffeb1d88a4b40f43 ]
The VPU issues DMA through several SMMU streams, and the hardware does
not give every stream the same addressable range. The non-pixel stream
cannot address the low 600MB of IOVA space, while the pixel stream can
address the full range:
+-----------------------------------------------------------+
| non-pixel stream addressable range (600 MB - 3.5 GB) |
| 0x25800000 - 0xe0000000 |
+-----------------------------------------------------------+
| pixel stream addressable range (0 - 3.5 GB) |
| 0x00000000 - 0xe0000000 |
+-----------------------------------------------------------+
A single "iommus" property on the video-codec node puts every stream
in one IOMMU domain sharing one IOVA space, so nothing stops a
non-pixel buffer from landing below 600MB. Once an allocation lands
below that boundary the hardware faults, which shows up as unhandled
SMMU page faults and spontaneous reboots.
https://gitlab.freedesktop.org/drm/msm/-/work_items/100
Fix this by reserving the 0-600MB range, below the boundary the
non-pixel stream cannot address, using dma_iova_try_alloc() so the
IOMMU-DMA core never hands that range out to a real DMA mapping. This
reserves only IOVA space, it does not allocate any physical memory.
Since sub-nodes for non-pixel, pixel, and secure streams do not exist
yet and only a single device is available, the restriction is applied
to both non-pixel and pixel stream IDs.
Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions")
Cc: stable@vger.kernel.org
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[bod: took iova_state description from iris and applied to venus in core.h]
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/core.c | 66 ++++++++++++++++++++++--
drivers/media/platform/qcom/venus/core.h | 6 +++
2 files changed, 69 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
index 243e342b0ae75..2a0ab553c4519 100644
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -377,6 +377,57 @@ static int venus_add_dynamic_nodes(struct venus_core *core)
static void venus_remove_dynamic_nodes(struct venus_core *core) {}
#endif
+static void venus_unreserve_iova_region(struct device *dev, struct dma_iova_state *state)
+{
+ unsigned int i;
+
+ for (i = 0; dma_iova_size(&state[i]); i++)
+ dma_iova_free(dev, &state[i]);
+}
+
+static int venus_reserve_iova_region(struct device *dev, struct dma_iova_state **iova_state,
+ unsigned long start, unsigned long size)
+{
+ unsigned long dma_limit = dev->bus_dma_limit;
+ unsigned long end, rem, chunk;
+ struct dma_iova_state *state;
+ unsigned int count = 0;
+ int ret = -ENOMEM;
+
+ state = devm_kcalloc(dev, BITS_PER_TYPE(dma_addr_t) + 1, sizeof(*state), GFP_KERNEL);
+ if (!state)
+ return ret;
+
+ end = start + size;
+ rem = end - max(start, PAGE_SIZE);
+ dev->bus_dma_limit = end - 1;
+
+ while (rem) {
+ chunk = min(end & -end, (u64)1 << (fls64(rem) - 1));
+
+ if (!dma_iova_try_alloc(dev, &state[count], 0, chunk))
+ goto err_free_iova;
+
+ if (state[count].addr != end - chunk || state[count].__size != chunk)
+ goto err_free_iova;
+
+ rem -= chunk;
+ end -= chunk;
+ count++;
+ }
+
+ *iova_state = state;
+ dev->bus_dma_limit = dma_limit;
+
+ return 0;
+
+err_free_iova:
+ venus_unreserve_iova_region(dev, state);
+ dev->bus_dma_limit = dma_limit;
+
+ return ret;
+}
+
static int venus_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -421,10 +472,15 @@ static int venus_probe(struct platform_device *pdev)
return ret;
}
- ret = dma_set_mask_and_coherent(dev, core->res->dma_mask);
+ ret = venus_reserve_iova_region(dev, &core->iova_state, VENUS_NP_RESERVE_IOVA_START,
+ VENUS_NP_RESERVE_IOVA_SIZE);
if (ret)
goto err_core_put;
+ ret = dma_set_mask_and_coherent(dev, core->res->dma_mask);
+ if (ret)
+ goto err_unresv_iova_region;
+
dma_set_max_seg_size(dev, UINT_MAX);
INIT_LIST_HEAD(&core->instances);
@@ -434,13 +490,13 @@ static int venus_probe(struct platform_device *pdev)
ret = hfi_create(core, &venus_core_ops);
if (ret)
- goto err_core_put;
+ goto err_unresv_iova_region;
ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
"venus", core);
if (ret)
- goto err_core_put;
+ goto err_unresv_iova_region;
venus_assign_register_offsets(core);
@@ -525,6 +581,8 @@ static int venus_probe(struct platform_device *pdev)
v4l2_device_unregister(&core->v4l2_dev);
err_hfi_destroy:
hfi_destroy(core);
+err_unresv_iova_region:
+ venus_unreserve_iova_region(dev, core->iova_state);
err_core_put:
if (core->pm_ops->core_put)
core->pm_ops->core_put(core);
@@ -562,6 +620,8 @@ static void venus_remove(struct platform_device *pdev)
hfi_destroy(core);
+ venus_unreserve_iova_region(dev, core->iova_state);
+
mutex_destroy(&core->pm_lock);
mutex_destroy(&core->lock);
venus_dbgfs_deinit(core);
diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h
index 46705a6667762..93fa77f05834c 100644
--- a/drivers/media/platform/qcom/venus/core.h
+++ b/drivers/media/platform/qcom/venus/core.h
@@ -8,6 +8,7 @@
#define __VENUS_CORE_H_
#include <linux/bitops.h>
+#include <linux/dma-mapping.h>
#include <linux/list.h>
#include <media/videobuf2-v4l2.h>
#include <media/v4l2-ctrls.h>
@@ -30,6 +31,9 @@
#define VENUS_MAX_FPS 240
+#define VENUS_NP_RESERVE_IOVA_START 0x0
+#define VENUS_NP_RESERVE_IOVA_SIZE 0x25800000
+
extern int venus_fw_debug;
struct freq_tbl {
@@ -189,6 +193,7 @@ struct venus_format {
* @dump_core: a flag indicating that a core dump is required
* @ocs: OF changeset pointer
* @hwmode_dev: a flag indicating that HW_CTRL_TRIGGER is used in clock driver
+ * @iova_state: a pointer to an array of dma_iova_state entries reserved for restricted IOVA region
*/
struct venus_core {
void __iomem *base;
@@ -250,6 +255,7 @@ struct venus_core {
unsigned long dump_core;
struct of_changeset *ocs;
bool hwmode_dev;
+ struct dma_iova_state *iova_state;
};
struct vdec_controls {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0363/1257] media: iris: reset AHB bridge before enabling HW mode
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0362/1257] media: venus: Fix iova allocation from restrict region Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0364/1257] media: iris: avoid bit depth validation for capture formats Greg Kroah-Hartman
` (635 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Birk Skyum, Renjiang Han,
Vikash Garodia, Vishnu Reddy, Bryan ODonoghue, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
[ Upstream commit cc330f5589965bcf99307ee9c66deb8a0a53e0ee ]
When video power domain is switched from software-controlled mode to
hardware-controlled mode, the core may be powered down without the AHB
bridge going through the required reset sequence. This may leave the
bridge FIFO in a stale state.
Reset the CPU-to-VPU AHB bridge before switching the power domain to
hardware-controlled mode. This ensures that the bridge FIFO are in
reset state before going for mode switch.
Reported-by: Birk Skyum <birk.skyum@pm.me>
Link: https://lore.kernel.org/all/20260913194707.91885-1-birk.skyum@pm.me
Fixes: 95a337f92f0a ("media: iris: switch to hardware mode after firmware boot")
Cc: stable@vger.kernel.org
Co-developed-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Signed-off-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Signed-off-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Reviewed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Tested-by: Birk Skyum <birk.skyum@pm.me> # Lenovo Yoga Slim 7x
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_vpu_common.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/media/platform/qcom/iris/iris_vpu_common.c b/drivers/media/platform/qcom/iris/iris_vpu_common.c
index e4847c1077097..2ef8004e976e3 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu_common.c
+++ b/drivers/media/platform/qcom/iris/iris_vpu_common.c
@@ -311,6 +311,11 @@ int iris_vpu_power_on_hw(struct iris_core *core)
int iris_vpu_set_hwmode(struct iris_core *core)
{
+ writel(CORE_BRIDGE_SW_RESET | CORE_BRIDGE_HW_RESET_DISABLE,
+ core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
+ writel(CORE_BRIDGE_HW_RESET_DISABLE, core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
+ writel(0x0, core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
+
return dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], true);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0364/1257] media: iris: avoid bit depth validation for capture formats
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0363/1257] media: iris: reset AHB bridge before enabling HW mode Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0365/1257] media: iris: Fix iova allocation from restrict region Greg Kroah-Hartman
` (634 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vishnu Reddy, Vikash Garodia,
Bryan ODonoghue, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[ Upstream commit 40e9c3b3e35c6d65a3a0d3b1483716ad48b046bd ]
When validating a capture format, check_format() compares the requested
pixel format against inst->fw_caps[BIT_DEPTH]. However, the bit depth
capability is not available at this stage and it contains the default
value of BIT_DEPTH_8. The actual bit depth is updated later after the
firmware reports stream capabilities through read_input_subcr_params().
Because of this, a valid client request of QC10C format request is
rejected during the initial format negotiation. The driver then falls
back to the default capture format (NV12) and stores it as capture format.
Later, when the firmware reports that the stream is 10-bit, the driver
sees NV12 as the selected capture format and switches to the default
10-bit format (P010). As a result, the original QC10C format requested
by userspace is lost and QC10C decoding cannot work correctly.
The bit depth information is not reliable during the initial format
setup, so it should not be used to validate capture formats. Remove
the bit-depth checks from check_format() and only verify that the
requested pixel format is supported. This allows the format requested
by userspace is handled correctly.
Fixes: 20c3ef4c7cae ("media: qcom: iris: vdec: update find_format to handle 8bit and 10bit formats")
Cc: stable@vger.kernel.org
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_vdec.c | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_vdec.c b/drivers/media/platform/qcom/iris/iris_vdec.c
index 9e228b70420e4..7f89e745a4b1b 100644
--- a/drivers/media/platform/qcom/iris/iris_vdec.c
+++ b/drivers/media/platform/qcom/iris/iris_vdec.c
@@ -95,16 +95,6 @@ static bool check_format(struct iris_inst *inst, u32 pixfmt, u32 type)
if (i == size)
return false;
- if (type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
- if (iris_fmt_is_8bit(pixfmt) &&
- inst->fw_caps[BIT_DEPTH].value == BIT_DEPTH_10)
- return false;
-
- if (iris_fmt_is_10bit(pixfmt) &&
- inst->fw_caps[BIT_DEPTH].value != BIT_DEPTH_10)
- return false;
- }
-
return true;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0365/1257] media: iris: Fix iova allocation from restrict region
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0364/1257] media: iris: avoid bit depth validation for capture formats Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0366/1257] media: iris: Fix bus_info prefix in VIDIOC_QUERYCAP Greg Kroah-Hartman
` (633 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vikash Garodia, Dmitry Baryshkov,
Vishnu Reddy, Bryan ODonoghue, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[ Upstream commit 200473c198b201c308dfb916fb3233074d9407fa ]
The VPU issues DMA through several SMMU streams, and the hardware does
not give every stream the same addressable range. The non-pixel stream
cannot address the low 600MB of IOVA space, while the pixel stream can
address the full range:
+-----------------------------------------------------------+
| non-pixel stream addressable range (600 MB - 3.5 GB) |
| 0x25800000 - 0xe0000000 |
+-----------------------------------------------------------+
| pixel stream addressable range (0 - 3.5 GB) |
| 0x00000000 - 0xe0000000 |
+-----------------------------------------------------------+
A single "iommus" property on the video-codec node puts every stream
in one IOMMU domain sharing one IOVA space, so nothing stops a
non-pixel buffer from landing below 600MB. Once an allocation lands
below that boundary the hardware faults, which shows up as unhandled
SMMU page faults and spontaneous reboots.
https://gitlab.freedesktop.org/drm/msm/-/work_items/100
Fix this by reserving the 0-600MB range, below the boundary the
non-pixel stream cannot address, using dma_iova_try_alloc() so the
IOMMU-DMA core never hands that range out to a real DMA mapping. This
reserves only IOVA space, it does not allocate any physical memory.
Since sub-nodes for non-pixel, pixel, and secure streams do not exist
yet and only a single device is available, the restriction is applied
to both non-pixel and pixel stream IDs.
Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues")
Cc: stable@vger.kernel.org
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_core.h | 6 ++
drivers/media/platform/qcom/iris/iris_probe.c | 62 ++++++++++++++++++-
2 files changed, 67 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/iris/iris_core.h b/drivers/media/platform/qcom/iris/iris_core.h
index 24da60448cf24..3e4cf652bf39a 100644
--- a/drivers/media/platform/qcom/iris/iris_core.h
+++ b/drivers/media/platform/qcom/iris/iris_core.h
@@ -7,6 +7,7 @@
#define __IRIS_CORE_H__
#include <linux/types.h>
+#include <linux/dma-mapping.h>
#include <linux/pm_domain.h>
#include <media/v4l2-device.h>
@@ -25,6 +26,9 @@ struct icc_info {
#define IRIS_FW_VERSION_LENGTH 128
#define IFACEQ_CORE_PKT_SIZE (1024 * 4)
+#define IRIS_NP_RESERVE_IOVA_START 0x0
+#define IRIS_NP_RESERVE_IOVA_SIZE 0x25800000
+
enum domain_type {
ENCODER = BIT(0),
DECODER = BIT(1),
@@ -77,6 +81,7 @@ struct qcom_ubwc_cfg_data;
* @instances: a list_head of all instances
* @inst_fw_caps_dec: an array of supported instance capabilities by decoder
* @inst_fw_caps_enc: an array of supported instance capabilities by encoder
+ * @iova_state: a pointer to an array of dma_iova_state entries reserved for restricted IOVA region
*/
struct iris_core {
@@ -123,6 +128,7 @@ struct iris_core {
/* encoder and decoder have overlapping caps, so two different arrays are required */
struct platform_inst_fw_cap inst_fw_caps_dec[INST_FW_CAP_MAX];
struct platform_inst_fw_cap inst_fw_caps_enc[INST_FW_CAP_MAX];
+ struct dma_iova_state *iova_state;
};
int iris_core_init(struct iris_core *core);
diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c
index e4acf4a74f944..6581a969fe3fb 100644
--- a/drivers/media/platform/qcom/iris/iris_probe.c
+++ b/drivers/media/platform/qcom/iris/iris_probe.c
@@ -150,6 +150,57 @@ static int iris_init_resources(struct iris_core *core)
return iris_init_resets(core);
}
+static void iris_unreserve_iova_region(struct device *dev, struct dma_iova_state *iova_state)
+{
+ unsigned int i;
+
+ for (i = 0; dma_iova_size(&iova_state[i]); i++)
+ dma_iova_free(dev, &iova_state[i]);
+}
+
+static int iris_reserve_iova_region(struct device *dev, struct dma_iova_state **iova_state,
+ unsigned long start, unsigned long size)
+{
+ unsigned long dma_limit = dev->bus_dma_limit;
+ unsigned long end, rem, chunk;
+ struct dma_iova_state *state;
+ unsigned int count = 0;
+ int ret = -ENOMEM;
+
+ state = devm_kcalloc(dev, BITS_PER_TYPE(dma_addr_t) + 1, sizeof(*state), GFP_KERNEL);
+ if (!state)
+ return ret;
+
+ end = start + size;
+ rem = end - max(start, PAGE_SIZE);
+ dev->bus_dma_limit = end - 1;
+
+ while (rem) {
+ chunk = min(end & -end, (u64)1 << (fls64(rem) - 1));
+
+ if (!dma_iova_try_alloc(dev, &state[count], 0, chunk))
+ goto err_free_iova;
+
+ if (state[count].addr != end - chunk || state[count].__size != chunk)
+ goto err_free_iova;
+
+ rem -= chunk;
+ end -= chunk;
+ count++;
+ }
+
+ *iova_state = state;
+ dev->bus_dma_limit = dma_limit;
+
+ return 0;
+
+err_free_iova:
+ iris_unreserve_iova_region(dev, state);
+ dev->bus_dma_limit = dma_limit;
+
+ return ret;
+}
+
static int iris_register_video_device(struct iris_core *core, enum domain_type type)
{
struct video_device *vdev;
@@ -207,6 +258,8 @@ static void iris_remove(struct platform_device *pdev)
v4l2_device_unregister(&core->v4l2_dev);
+ iris_unreserve_iova_region(core->dev, core->iova_state);
+
mutex_destroy(&core->lock);
}
@@ -269,10 +322,15 @@ static int iris_probe(struct platform_device *pdev)
if (ret)
return ret;
- ret = v4l2_device_register(dev, &core->v4l2_dev);
+ ret = iris_reserve_iova_region(dev, &core->iova_state, IRIS_NP_RESERVE_IOVA_START,
+ IRIS_NP_RESERVE_IOVA_SIZE);
if (ret)
return ret;
+ ret = v4l2_device_register(dev, &core->v4l2_dev);
+ if (ret)
+ goto err_unresv_iova_region;
+
ret = iris_register_video_device(core, DECODER);
if (ret)
goto err_v4l2_unreg;
@@ -306,6 +364,8 @@ static int iris_probe(struct platform_device *pdev)
video_unregister_device(core->vdev_dec);
err_v4l2_unreg:
v4l2_device_unregister(&core->v4l2_dev);
+err_unresv_iova_region:
+ iris_unreserve_iova_region(dev, core->iova_state);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0366/1257] media: iris: Fix bus_info prefix in VIDIOC_QUERYCAP
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0365/1257] media: iris: Fix iova allocation from restrict region Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0367/1257] media: iris: Fix power-off ordering to disable power domain after clocks Greg Kroah-Hartman
` (632 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vishnu Reddy, Vikash Garodia,
Bryan ODonoghue, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[ Upstream commit 1facae9bc3c1cfcabc77184754d64c349831cbc5 ]
The bus_info field returned by VIDIOC_QUERYCAP used the abbreviated
prefix "plat:" instead of the standard "platform:" prefix expected
for platform devices. v4l2-compliance validates that bus_info for
platform devices starts with "platform:", and fails otherwise:
fail: ../utils/v4l2-compliance/v4l2-compliance.cpp(671):
missing bus_info prefix ('plat:aa00000.video-codec:dec')
Update the format string in iris_querycap() to use "platform:" so
that v4l2-compliance bus_info check passes.
Fixes: 94ef75095d5e ("media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_vidc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
index fcbc60016beec..d39ac71a25aa6 100644
--- a/drivers/media/platform/qcom/iris/iris_vidc.c
+++ b/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -466,7 +466,7 @@ static int iris_querycap(struct file *filp, void *fh, struct v4l2_capability *ca
info = "enc";
}
snprintf(cap->bus_info, sizeof(cap->bus_info),
- "plat:%s:%s", dev_name(core->dev), info);
+ "platform:%s:%s", dev_name(core->dev), info);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0367/1257] media: iris: Fix power-off ordering to disable power domain after clocks
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0366/1257] media: iris: Fix bus_info prefix in VIDIOC_QUERYCAP Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0368/1257] media: iris: Fix frame interval enumeration for non-divisor framerates Greg Kroah-Hartman
` (631 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Vishnu Reddy,
Bryan ODonoghue, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[ Upstream commit 9cfae7726a9a9f526e8905dbddde355be2674e3d ]
In iris_vpu_power_off_hw(), iris_disable_power_domains() was called
before the associated clocks (IRIS_BSE_HW_CLK, IRIS_HW_AHB_CLK,
IRIS_HW_CLK) were disabled and unprepared. This reverses the correct
power-down sequence: with the power domain already removed, the
subsequent clk_disable_unprepare() calls end up operating on
clock-controller hardware that is no longer powered, which can hang
or behave unpredictably.
Reorder the calls so iris_disable_power_domains() runs after all
three clocks are disabled, ensuring clocks are always turned off
while their power domain is still active, and mirroring the reverse
of the power-on sequence.
Fixes: bb8a95aa038e ("media: iris: implement power management")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_vpu_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/iris/iris_vpu_common.c b/drivers/media/platform/qcom/iris/iris_vpu_common.c
index 2ef8004e976e3..c9f5dc851d9f7 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu_common.c
+++ b/drivers/media/platform/qcom/iris/iris_vpu_common.c
@@ -223,10 +223,10 @@ int iris_vpu_power_off_controller(struct iris_core *core)
void iris_vpu_power_off_hw(struct iris_core *core)
{
dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], false);
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]);
iris_disable_unprepare_clock(core, IRIS_BSE_HW_CLK);
iris_disable_unprepare_clock(core, IRIS_HW_AHB_CLK);
iris_disable_unprepare_clock(core, IRIS_HW_CLK);
+ iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]);
}
void iris_vpu_power_off(struct iris_core *core)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0368/1257] media: iris: Fix frame interval enumeration for non-divisor framerates
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0367/1257] media: iris: Fix power-off ordering to disable power domain after clocks Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0369/1257] ALSA: sgio2audio: Only free successfully requested IRQs Greg Kroah-Hartman
` (630 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Vishnu Reddy,
Bryan ODonoghue, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[ Upstream commit 3ad393b701dd99274f09403185f71ec7a93135bd ]
iris_enum_frameintervals() advertised frame intervals using
V4L2_FRMIVAL_TYPE_STEPWISE with step=1/MAXIMUM_FPS where MAXIMUM_FPS
is 480. This caused client to enumerate only framerates of the form
MAXIMUM_FPS/n (where n is a positive integer), restricting support to
exact divisors of MAXIMUM_FPS (e.g., 480, 240, 160, 120, 96, 80, 60,
30, 24, 1).
Framerates that are not exact divisors of MAXIMUM_FPS, such as 29 fps,
25 fps, were excluded from the enumerated list. There is no hardware
restriction to framerates that are exact divisors of MAXIMUM_FPS. This
caused GStreamer caps negotiation to fail with an "internal data
stream error" when encoding content at such framerates.
Fix this by using V4L2_FRMIVAL_TYPE_CONTINUOUS. With CONTINUOUS type,
GStreamer creates a continuous framerate range [1, max_fps], allowing
any integer framerate within the range to pass caps negotiation. The
step field is set to 1/1 as required by the V4L2 specification for
continuous frame intervals.
Fixes: a6882431a138 ("media: iris: Add support for ENUM_FRAMESIZES/FRAMEINTERVALS for encoder")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_vidc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
index d39ac71a25aa6..f1d7f186002d9 100644
--- a/drivers/media/platform/qcom/iris/iris_vidc.c
+++ b/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -438,14 +438,14 @@ static int iris_enum_frameintervals(struct file *filp, void *fh,
mbpf = NUM_MBS_PER_FRAME(fival->height, fival->width);
fps = DIV_ROUND_UP(core->iris_platform_data->max_core_mbps, mbpf);
- fival->type = V4L2_FRMIVAL_TYPE_STEPWISE;
+ fival->type = V4L2_FRMIVAL_TYPE_CONTINUOUS;
fival->stepwise.min.numerator = 1;
fival->stepwise.min.denominator =
min_t(u32, fps, MAXIMUM_FPS);
fival->stepwise.max.numerator = 1;
fival->stepwise.max.denominator = 1;
fival->stepwise.step.numerator = 1;
- fival->stepwise.step.denominator = MAXIMUM_FPS;
+ fival->stepwise.step.denominator = 1;
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0369/1257] ALSA: sgio2audio: Only free successfully requested IRQs
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0368/1257] media: iris: Fix frame interval enumeration for non-divisor framerates Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0370/1257] m68k: dmasound: Keep the Q40 IRQ handler registered Greg Kroah-Hartman
` (629 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit af3d225b639c6f9fb8fd5e1e27f11672d56724b6 ]
snd_sgio2audio_create() calls snd_sgio2audio_free() when an IRQ
request fails. The cleanup helper currently walks the complete IRQ table,
including entries whose request_irq() calls have not been attempted yet.
free_irq() then receives an IRQ and dev_id pair that was never registered.
Pass the number of successfully requested IRQs to the cleanup helper on
the request failure path, while retaining the full-table cleanup for
teardown after all requests have succeeded.
Fixes: 862c2c0a61c5 ("ALSA: ALSA driver for SGI O2 audio board")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260929084540.2065213-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/mips/sgio2audio.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/sound/mips/sgio2audio.c b/sound/mips/sgio2audio.c
index 497d84cff12f3..35648b0b97b90 100644
--- a/sound/mips/sgio2audio.c
+++ b/sound/mips/sgio2audio.c
@@ -742,7 +742,8 @@ static struct {
/* ALSA driver */
-static int snd_sgio2audio_free(struct snd_sgio2audio *chip)
+static int snd_sgio2audio_free(struct snd_sgio2audio *chip,
+ unsigned int irq_count)
{
int i;
@@ -752,7 +753,7 @@ static int snd_sgio2audio_free(struct snd_sgio2audio *chip)
writeq(0, &mace->perif.audio.control);
/* release IRQ's */
- for (i = 0; i < ARRAY_SIZE(snd_sgio2_isr_table); i++)
+ for (i = 0; i < irq_count; i++)
free_irq(snd_sgio2_isr_table[i].irq,
&chip->channel[snd_sgio2_isr_table[i].idx]);
@@ -768,7 +769,7 @@ static int snd_sgio2audio_dev_free(struct snd_device *device)
{
struct snd_sgio2audio *chip = device->device_data;
- return snd_sgio2audio_free(chip);
+ return snd_sgio2audio_free(chip, ARRAY_SIZE(snd_sgio2_isr_table));
}
static const struct snd_device_ops ops = {
@@ -819,7 +820,7 @@ static int snd_sgio2audio_create(struct snd_card *card,
0,
snd_sgio2_isr_table[i].desc,
&chip->channel[snd_sgio2_isr_table[i].idx])) {
- snd_sgio2audio_free(chip);
+ snd_sgio2audio_free(chip, i);
printk(KERN_ERR "sgio2audio: cannot allocate irq %d\n",
snd_sgio2_isr_table[i].irq);
return -EBUSY;
@@ -843,13 +844,13 @@ static int snd_sgio2audio_create(struct snd_card *card,
/* initialize the AD1843 codec */
err = ad1843_init(&chip->ad1843);
if (err < 0) {
- snd_sgio2audio_free(chip);
+ snd_sgio2audio_free(chip, ARRAY_SIZE(snd_sgio2_isr_table));
return err;
}
err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops);
if (err < 0) {
- snd_sgio2audio_free(chip);
+ snd_sgio2audio_free(chip, ARRAY_SIZE(snd_sgio2_isr_table));
return err;
}
*rchip = chip;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0370/1257] m68k: dmasound: Keep the Q40 IRQ handler registered
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0369/1257] ALSA: sgio2audio: Only free successfully requested IRQs Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0371/1257] ALSA: core: Check shutdown flag at D0 power-state, too Greg Kroah-Hartman
` (628 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit fa2e77ac5bf81a60864e71fc72196227692d7162 ]
Q40PlayNextFrame() re-registers the sample IRQ after stopping it. This
function can be called with dmasound.lock held and from the sample IRQ
handler, so free_irq() and request_irq() can sleep or deadlock. A failed
re-registration can also leave playback without an IRQ.
Register one handler for the lifetime of the driver and select mono or
stereo sample handling inside that handler. Call the frame completion
path after releasing dmasound.lock so it can refill the queue safely.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260929085400.2068977-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/oss/dmasound/dmasound_q40.c | 65 ++++++++++++++-----------------
1 file changed, 29 insertions(+), 36 deletions(-)
diff --git a/sound/oss/dmasound/dmasound_q40.c b/sound/oss/dmasound/dmasound_q40.c
index e25a78dd1bf2a..339311e5d8070 100644
--- a/sound/oss/dmasound/dmasound_q40.c
+++ b/sound/oss/dmasound/dmasound_q40.c
@@ -49,9 +49,8 @@ static int Q40SetFormat(int format);
static int Q40SetVolume(int volume);
static void Q40PlayNextFrame(int index);
static void Q40Play(void);
-static irqreturn_t Q40StereoInterrupt(int irq, void *dummy);
-static irqreturn_t Q40MonoInterrupt(int irq, void *dummy);
-static void Q40Interrupt(void);
+static irqreturn_t q40_audio_interrupt(int irq, void *dummy);
+static void q40_frame_done(void);
/*** Mid level stuff *********************************************************/
@@ -372,8 +371,8 @@ static void Q40Free(void *ptr, unsigned int size)
static int __init Q40IrqInit(void)
{
/* Register interrupt handler. */
- if (request_irq(Q40_IRQ_SAMPLE, Q40StereoInterrupt, 0,
- "DMA sound", Q40Interrupt))
+ if (request_irq(Q40_IRQ_SAMPLE, q40_audio_interrupt, 0,
+ "DMA sound", q40_frame_done))
return 0;
return(1);
@@ -384,7 +383,7 @@ static int __init Q40IrqInit(void)
static void Q40IrqCleanUp(void)
{
master_outb(0,SAMPLE_ENABLE_REG);
- free_irq(Q40_IRQ_SAMPLE, Q40Interrupt);
+ free_irq(Q40_IRQ_SAMPLE, q40_frame_done);
}
#endif /* MODULE */
@@ -403,7 +402,6 @@ static void Q40PlayNextFrame(int index)
u_char *start;
u_long size;
u_char speed;
- int error;
/* used by Q40Play() if all doubts whether there really is something
* to be played are already wiped out.
@@ -420,15 +418,6 @@ static void Q40PlayNextFrame(int index)
speed=(dmasound.hard.speed==10000 ? 0 : 1);
master_outb( 0,SAMPLE_ENABLE_REG);
- free_irq(Q40_IRQ_SAMPLE, Q40Interrupt);
- if (dmasound.soft.stereo)
- error = request_irq(Q40_IRQ_SAMPLE, Q40StereoInterrupt, 0,
- "Q40 sound", Q40Interrupt);
- else
- error = request_irq(Q40_IRQ_SAMPLE, Q40MonoInterrupt, 0,
- "Q40 sound", Q40Interrupt);
- if (error && printk_ratelimit())
- pr_err("Couldn't register sound interrupt\n");
master_outb( speed, SAMPLE_RATE_REG);
master_outb( 1,SAMPLE_CLEAR_REG);
@@ -456,31 +445,35 @@ static void Q40Play(void)
spin_unlock_irqrestore(&dmasound.lock, flags);
}
-static irqreturn_t Q40StereoInterrupt(int irq, void *dummy)
-{
- spin_lock(&dmasound.lock);
- if (q40_sc>1){
- *DAC_LEFT=*q40_pp++;
- *DAC_RIGHT=*q40_pp++;
- q40_sc -=2;
- master_outb(1,SAMPLE_CLEAR_REG);
- }else Q40Interrupt();
- spin_unlock(&dmasound.lock);
- return IRQ_HANDLED;
-}
-static irqreturn_t Q40MonoInterrupt(int irq, void *dummy)
+static irqreturn_t q40_audio_interrupt(int irq, void *dummy)
{
+ bool frame_done = false;
+
spin_lock(&dmasound.lock);
- if (q40_sc>0){
- *DAC_LEFT=*q40_pp;
- *DAC_RIGHT=*q40_pp++;
- q40_sc --;
- master_outb(1,SAMPLE_CLEAR_REG);
- }else Q40Interrupt();
+ if (dmasound.hard.stereo) {
+ if (q40_sc > 1) {
+ *DAC_LEFT = *q40_pp++;
+ *DAC_RIGHT = *q40_pp++;
+ q40_sc -= 2;
+ master_outb(1, SAMPLE_CLEAR_REG);
+ } else {
+ frame_done = true;
+ }
+ } else if (q40_sc > 0) {
+ *DAC_LEFT = *q40_pp;
+ *DAC_RIGHT = *q40_pp++;
+ q40_sc--;
+ master_outb(1, SAMPLE_CLEAR_REG);
+ } else {
+ frame_done = true;
+ }
spin_unlock(&dmasound.lock);
+ if (frame_done)
+ q40_frame_done();
return IRQ_HANDLED;
}
-static void Q40Interrupt(void)
+
+static void q40_frame_done(void)
{
if (!write_sq.active) {
/* playing was interrupted and sq_reset() has already cleared
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0371/1257] ALSA: core: Check shutdown flag at D0 power-state, too
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0370/1257] m68k: dmasound: Keep the Q40 IRQ handler registered Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0372/1257] clk: starfive: jh7110-isp: fix refcount leak in jh7110_ispcrg_probe() Greg Kroah-Hartman
` (627 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit ad63c5b62843895e8c3cd7291ed07cc659df0355 ]
The snd_power_ref_and_wait() skips the card->shutdown check when the
card is already in D0 state and immediately returns as successful, by
assuming the all-green in D0. This assumption makes the code after
this sync point behaving as if all power is up and ready, even though
actually it might have been already at the disconnected state.
Add the missing check of shutdown flag there for the more consistent
behavior.
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260929125346.1478631-2-tiwai@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/init.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/sound/core/init.c b/sound/core/init.c
index 1bcb6a2e75507..a51b71812fd9b 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -1174,12 +1174,12 @@ EXPORT_SYMBOL(snd_card_file_remove);
int snd_power_ref_and_wait(struct snd_card *card)
{
snd_power_ref(card);
- if (snd_power_get_state(card) == SNDRV_CTL_POWER_D0)
- return 0;
- wait_event_cmd(card->power_sleep,
- card->shutdown ||
- snd_power_get_state(card) == SNDRV_CTL_POWER_D0,
- snd_power_unref(card), snd_power_ref(card));
+ if (snd_power_get_state(card) != SNDRV_CTL_POWER_D0) {
+ wait_event_cmd(card->power_sleep,
+ card->shutdown ||
+ snd_power_get_state(card) == SNDRV_CTL_POWER_D0,
+ snd_power_unref(card), snd_power_ref(card));
+ }
if (card->shutdown) {
snd_power_unref(card);
return -ENODEV;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0372/1257] clk: starfive: jh7110-isp: fix refcount leak in jh7110_ispcrg_probe()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0371/1257] ALSA: core: Check shutdown flag at D0 power-state, too Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0373/1257] powerpc64/bpf: fix percpu private stack leak on JIT failure Greg Kroah-Hartman
` (626 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Hal Feng, Brian Masney,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 1c4f9480473917558908c083d1293b4ebb3d50c5 ]
In jh7110_ispcrg_probe(), the error path for pm_runtime_get_sync()
failure directly returns without releasing the runtime PM reference
count. The call to __pm_runtime_resume() increments the usage count
unconditionally before attempting to resume, and does not decrement it
on failure. Thus the leaked reference makes it impossible to suspend
the device later.
All other error paths correctly jump to err_exit and call
pm_runtime_put_sync(). Fix this by replacing pm_runtime_get_sync()
with pm_runtime_resume_and_get(), which properly balances the
reference count on error.
Cc: stable@vger.kernel.org
Fixes: 81279f5d0812 ("clk: starfive: Add StarFive JH7110 Image-Signal-Process clock driver")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Hal Feng <hal.feng@starfivetech.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/starfive/clk-starfive-jh7110-isp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/starfive/clk-starfive-jh7110-isp.c b/drivers/clk/starfive/clk-starfive-jh7110-isp.c
index f3fa069db193e..c02c8b29a1230 100644
--- a/drivers/clk/starfive/clk-starfive-jh7110-isp.c
+++ b/drivers/clk/starfive/clk-starfive-jh7110-isp.c
@@ -130,7 +130,7 @@ static int jh7110_ispcrg_probe(struct platform_device *pdev)
/* enable power domain and clocks */
pm_runtime_enable(priv->dev);
- ret = pm_runtime_get_sync(priv->dev);
+ ret = pm_runtime_resume_and_get(priv->dev);
if (ret < 0)
return dev_err_probe(priv->dev, ret, "failed to turn on power\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0373/1257] powerpc64/bpf: fix percpu private stack leak on JIT failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0372/1257] clk: starfive: jh7110-isp: fix refcount leak in jh7110_ispcrg_probe() Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0374/1257] powerpc/bpf: fix buffer overflow in JIT for large BPF programs Greg Kroah-Hartman
` (625 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Abhishek Dubey,
Saket Kumar Bhaskar, Yeswanth Krishna Tellakula,
R Nageswara Sastry, Hari Bathini, Madhavan Srinivasan,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Dubey <adubey@linux.ibm.com>
[ Upstream commit 24affb84d98e6b37b276aa57e5dd25ad93458cea ]
The existing conditional statement in bpf_int_jit_compile() frees the
percpu private stack at out_addrs only when the image buffer was never
allocated.
If bpf_jit_build_body() fails during a code-generation pass, the
image buffer has already been allocated, so !image is false and the
percpu stack is not freed.
Because JIT compilation failed, fp->jited remains at 0. The subsequent
bpf_jit_free() path only frees priv_stack_ptr when fp->jited is set, so
freeing is skipped here too, leaking the percpu allocation.
Fix implements freeing the private stack whenever fp->jited was not set,
i.e. compilation did not succeed, instead of keying off !image. !fp->jited
already covers the !image case, since image is only NULL on early-failure
paths where fp->jited is likewise 0.
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/bpf/20260616135426.A06B71F000E9@smtp.kernel.org
Fixes: 156d985123b6 ("powerpc64/bpf: Implement JIT support for private stack")
Cc: stable@vger.kernel.org
Signed-off-by: Abhishek Dubey <adubey@linux.ibm.com>
Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
Tested-by: Yeswanth Krishna Tellakula <yeswanth@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Acked-by: Hari Bathini <hbathini@linux.ibm.com>
Link: https://lore.kernel.org/bpf/20260616135426.A06B71F000E9@smtp.kernel.org
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/a827e3ef81cd43f2aee7e9bdfe8683f2c77065da.1789982239.git.skb99@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/net/bpf_jit_comp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 7a612688e7a20..ffee1a76e5302 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -357,7 +357,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
(void *)fimage + FUNCTION_DESCR_SIZE);
out_addrs:
- if (!image && priv_stack_ptr) {
+ if (!fp->jited && priv_stack_ptr) {
fp->aux->priv_stack_ptr = NULL;
free_percpu(priv_stack_ptr);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0374/1257] powerpc/bpf: fix buffer overflow in JIT for large BPF programs
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0373/1257] powerpc64/bpf: fix percpu private stack leak on JIT failure Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0375/1257] powerpc/bpf: fix alignment of long branch trampoline address Greg Kroah-Hartman
` (624 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Hari Bathini,
Abhishek Dubey, Saket Kumar Bhaskar, Yeswanth Krishna Tellakula,
R Nageswara Sastry, Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Dubey <adubey@linux.ibm.com>
[ Upstream commit 78ce55b7913a78e1687306668e078b86bc6508ee ]
During size calculation in pass-0, exit_addr is 0 since addrs[fp->len]
is not yet populated. bpf_jit_emit_exit_insn() treats a zero exit_addr
as in-range and skips bpf_jit_build_epilogue(), so the alternate inline
epilogue instructions are not counted in alloclen.
In later passes, if the real exit_addr falls outside the 32MB branch
range, the full inline epilogue is emitted into the already-allocated
buffer, writing past its end and corrupting adjacent memory.
Fix by ensuring exit_addr is non-zero before treating it as in-range,
so pass-0 always falls through to bpf_jit_build_epilogue() and
conservatively accounts for all epilogue instructions in alloclen.
Also range check alt_exit_addr directly in the else-if condition.
Since exit_addr handling now falls through to the epilogue, two
related issues in bpf_int_jit_compile() must also be addressed:
1. Reset cgctx.alt_exit_addr before the second size-calculation pass.
Without this, a stale alt_exit_addr from the first pass causes the
second pass to emit a single jump instead of the full epilogue,
undercounting alloclen and reintroducing the overflow.
2. Recompute addrs[fp->len] at the end of each code-generation pass.
The larger pass-0 body can shrink in later passes as out-of-range
exits settle into in-range jumps; a stale addrs[fp->len] would
leave exit branches targeting past the real (shrunken) epilogue.
Because shrinkage in a later pass can move the epilogue offset, the
fixed two-pass loop is no longer sufficient: an exit that was out of
range in an earlier pass may fall in range once the epilogue offset
shrinks, shrinking the body further and overwriting the start of the
epilogue. Convert the code-generation loop to iterate until the
program size converges, bounded by CODEGEN_MAX_PASSES, and fail the
JIT if it does not converge.
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/bpf/20260529015855.364704-2-adubey@linux.ibm.com/T/#mfcb23909d977b949727cca4f59ee56a13fd69b92
Fixes: 0ffdbce6f4a8 ("powerpc/bpf: Handle large branch ranges with BPF_EXIT")
Cc: stable@vger.kernel.org
Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
Signed-off-by: Abhishek Dubey <adubey@linux.ibm.com>
Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
Tested-by: Yeswanth Krishna Tellakula <yeswanth@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Link: https://lore.kernel.org/bpf/20260529015855.364704-2-adubey@linux.ibm.com/T/#mfcb23909d977b949727cca4f59ee56a13fd69b92
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/eebffa997e07781b384c4480e2b03c5b87c1aeb1.1789982239.git.skb99@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/net/bpf_jit.h | 7 +++++++
arch/powerpc/net/bpf_jit_comp.c | 34 +++++++++++++++++++++++++--------
2 files changed, 33 insertions(+), 8 deletions(-)
diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
index f32de8704d4d9..995308654a569 100644
--- a/arch/powerpc/net/bpf_jit.h
+++ b/arch/powerpc/net/bpf_jit.h
@@ -14,6 +14,13 @@
#include <asm/ppc-opcode.h>
#include <linux/build_bug.h>
+/*
+ * We need at least 2 passes for proper code generation, and may need
+ * additional passes if code size changes between passes.
+ */
+#define CODEGEN_MIN_PASSES 2
+#define CODEGEN_MAX_PASSES 3
+
#ifdef CONFIG_PPC64_ELF_ABI_V1
#define FUNCTION_DESCR_SIZE 24
#else
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index ffee1a76e5302..0c277a11b641e 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -99,11 +99,10 @@ void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg, long exit_addr)
{
- if (!exit_addr || is_offset_in_branch_range(exit_addr - (ctx->idx * 4))) {
+ if (exit_addr && is_offset_in_branch_range(exit_addr - (long)(ctx->idx * 4))) {
PPC_JMP(exit_addr);
- } else if (ctx->alt_exit_addr) {
- if (WARN_ON(!is_offset_in_branch_range((long)ctx->alt_exit_addr - (ctx->idx * 4))))
- return -1;
+ } else if (ctx->alt_exit_addr && is_offset_in_branch_range(
+ (long)(ctx->alt_exit_addr) - (long)(ctx->idx * 4))) {
PPC_JMP(ctx->alt_exit_addr);
} else {
ctx->alt_exit_addr = ctx->idx * 4;
@@ -274,6 +273,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
*/
if (cgctx.seen & SEEN_TAILCALL || !is_offset_in_branch_range((long)cgctx.idx * 4)) {
cgctx.idx = 0;
+ cgctx.alt_exit_addr = 0;
if (bpf_jit_build_body(fp, NULL, NULL, &cgctx, addrs, 0, false))
goto out_err;
}
@@ -306,10 +306,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
code_base = (u32 *)(image + FUNCTION_DESCR_SIZE);
fcode_base = (u32 *)(fimage + FUNCTION_DESCR_SIZE);
- /* Code generation passes 1-2 */
- for (pass = 1; pass < 3; pass++) {
+ /* Code generation passes 1-2+, loop until program size converges. */
+ for (pass = 1; pass <= CODEGEN_MAX_PASSES; pass++) {
+ u32 prev_proglen = proglen;
+
/* Now build the prologue, body code & epilogue for real. */
cgctx.idx = 0;
+ cgctx.exentry_idx = 0;
cgctx.alt_exit_addr = 0;
bpf_jit_build_prologue(code_base, &cgctx);
if (bpf_jit_build_body(fp, code_base, fcode_base, &cgctx, addrs, pass,
@@ -318,11 +321,26 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
bpf_jit_binary_pack_free(fhdr, hdr);
goto out_err;
}
+ addrs[fp->len] = cgctx.idx * 4;
bpf_jit_build_epilogue(code_base, &cgctx);
+ proglen = cgctx.idx * 4;
+
if (bpf_jit_enable > 1)
pr_info("Pass %d: shrink = %d, seen = 0x%x\n", pass,
- proglen - (cgctx.idx * 4), cgctx.seen);
+ prev_proglen - proglen, cgctx.seen);
+
+ /* Check if program size has converged, but ensure minimum passes */
+ if (pass >= CODEGEN_MIN_PASSES && proglen == prev_proglen)
+ break;
+
+ if (pass == CODEGEN_MAX_PASSES && proglen != prev_proglen) {
+ pr_err("BPF JIT: Program did not converge after %d passes\n",
+ CODEGEN_MAX_PASSES);
+ bpf_arch_text_copy(&fhdr->size, &hdr->size, sizeof(hdr->size));
+ bpf_jit_binary_pack_free(fhdr, hdr);
+ goto out_err;
+ }
}
if (bpf_jit_enable > 1)
@@ -399,7 +417,7 @@ int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, u32 *fimage, int pass
u32 *fixup;
/* Populate extable entries only in the last pass */
- if (pass != 2)
+ if (pass < CODEGEN_MIN_PASSES)
return 0;
if (!fp->aux->extable ||
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0375/1257] powerpc/bpf: fix alignment of long branch trampoline address
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0374/1257] powerpc/bpf: fix buffer overflow in JIT for large BPF programs Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0376/1257] pseries/plpks: fix error handling in plpks_read_var() Greg Kroah-Hartman
` (623 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hari Bathini, Abhishek Dubey,
Saket Kumar Bhaskar, Yeswanth Krishna Tellakula,
R Nageswara Sastry, Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Dubey <adubey@linux.ibm.com>
[ Upstream commit 04001e8ddb979f463f1c3ca8ac4d6ac59fb48921 ]
Ensure the dummy trampoline address field present between the OOL stub
and the long branch stub is 4/8-byte aligned, for memory compatibility
when content loaded to a register.
Reported-by: Hari Bathini <hbathini@linux.ibm.com>
Fixes: d243b62b7bd3 ("powerpc64/bpf: Add support for bpf trampolines")
Cc: stable@vger.kernel.org
Signed-off-by: Abhishek Dubey <adubey@linux.ibm.com>
Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
Tested-by: Yeswanth Krishna Tellakula <yeswanth@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Hari Bathini <hbathini@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/a8257022057cbb71928c960be589e10b89fc0899.1789982239.git.skb99@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/net/bpf_jit.h | 7 +++---
arch/powerpc/net/bpf_jit_comp.c | 38 ++++++++++++++++++++++++++-----
arch/powerpc/net/bpf_jit_comp32.c | 7 +++---
arch/powerpc/net/bpf_jit_comp64.c | 7 +++---
4 files changed, 44 insertions(+), 15 deletions(-)
diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
index 995308654a569..44fa414dc5a76 100644
--- a/arch/powerpc/net/bpf_jit.h
+++ b/arch/powerpc/net/bpf_jit.h
@@ -221,10 +221,11 @@ int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context *
int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct codegen_context *ctx,
u32 *addrs, int pass, bool extra_pass);
void bpf_jit_build_prologue(u32 *image, struct codegen_context *ctx);
-void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx);
-void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx);
+void bpf_jit_build_epilogue(u32 *image, u32 *fimage, struct codegen_context *ctx);
+void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context *ctx);
void bpf_jit_realloc_regs(struct codegen_context *ctx);
-int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg, long exit_addr);
+int bpf_jit_emit_exit_insn(u32 *image, u32 *fimage, struct codegen_context *ctx, int tmp_reg,
+ long exit_addr);
void prepare_for_fsession_fentry(u32 *image, struct codegen_context *ctx, int cookie_cnt,
int cookie_off, int retval_off);
void store_func_meta(u32 *image, struct codegen_context *ctx, u64 func_meta, int func_meta_off);
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 0c277a11b641e..1272409336120 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -49,11 +49,35 @@ asm (
" .popsection ;"
);
-void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
+void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context *ctx)
{
int ool_stub_idx, long_branch_stub_idx;
+ int ool_stub_sz;
/*
+ * Align the mis-aligned dummy_tramp_addr field in the fimage.
+ * The alignment NOP must appear before OOL stub, to make
+ * ool_stub_idx & long_branch_stub_idx constant from end.
+ *
+ * The fimage can be non 8-byte aligned, so final alignment depends
+ * on start of fimage and the stub's instruction count offset. The
+ * OOL stub size is 4 instructions (with CONFIG_PPC_FTRACE_OUT_OF_LINE)
+ * or 3 instructions (without) before dummy_tramp_addr.
+ *
+ * Emit a NOP here if address is not SZL aligned.
+ *
+ * In pass=0 when image==NULL, conservatively account for space
+ * required to accommodate alignment NOP. In case final pass skips
+ * emitting alignment NOP, the image buffer have 4 spare bytes and
+ * jited_len signifies correct program size.
+ */
+
+ ool_stub_sz = IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE) ? 16 : 12;
+ if (!image || !IS_ALIGNED((unsigned long)fimage + ctx->idx*4 + ool_stub_sz, SZL))
+ EMIT(PPC_RAW_NOP());
+
+ /*
+ * nop // optional, for alignment of dummy_tramp_addr
* Out-of-line stub:
* mflr r0
* [b|bl] tramp
@@ -70,7 +94,7 @@ void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
/*
* Long branch stub:
- * .long <dummy_tramp_addr>
+ * .long <dummy_tramp_addr> // 8-byte aligned
* mflr r11
* bcl 20,31,$+4
* mflr r12
@@ -81,6 +105,7 @@ void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
*/
if (image)
*((unsigned long *)&image[ctx->idx]) = (unsigned long)dummy_tramp;
+
ctx->idx += SZL / 4;
long_branch_stub_idx = ctx->idx;
EMIT(PPC_RAW_MFLR(_R11));
@@ -97,7 +122,8 @@ void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
}
}
-int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg, long exit_addr)
+int bpf_jit_emit_exit_insn(u32 *image, u32 *fimage, struct codegen_context *ctx,
+ int tmp_reg, long exit_addr)
{
if (exit_addr && is_offset_in_branch_range(exit_addr - (long)(ctx->idx * 4))) {
PPC_JMP(exit_addr);
@@ -106,7 +132,7 @@ int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg,
PPC_JMP(ctx->alt_exit_addr);
} else {
ctx->alt_exit_addr = ctx->idx * 4;
- bpf_jit_build_epilogue(image, ctx);
+ bpf_jit_build_epilogue(image, fimage, ctx);
}
return 0;
@@ -286,7 +312,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
*/
bpf_jit_build_prologue(NULL, &cgctx);
addrs[fp->len] = cgctx.idx * 4;
- bpf_jit_build_epilogue(NULL, &cgctx);
+ bpf_jit_build_epilogue(NULL, NULL, &cgctx);
fixup_len = fp->aux->num_exentries * BPF_FIXUP_LEN * 4;
extable_len = fp->aux->num_exentries * sizeof(struct exception_table_entry);
@@ -322,7 +348,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
goto out_err;
}
addrs[fp->len] = cgctx.idx * 4;
- bpf_jit_build_epilogue(code_base, &cgctx);
+ bpf_jit_build_epilogue(code_base, fcode_base, &cgctx);
proglen = cgctx.idx * 4;
diff --git a/arch/powerpc/net/bpf_jit_comp32.c b/arch/powerpc/net/bpf_jit_comp32.c
index bfdc50740da8e..f5b9441cf46aa 100644
--- a/arch/powerpc/net/bpf_jit_comp32.c
+++ b/arch/powerpc/net/bpf_jit_comp32.c
@@ -229,7 +229,7 @@ static void bpf_jit_emit_common_epilogue(u32 *image, struct codegen_context *ctx
}
-void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
+void bpf_jit_build_epilogue(u32 *image, u32 *fimage, struct codegen_context *ctx)
{
EMIT(PPC_RAW_MR(_R3, bpf_to_ppc(BPF_REG_0)));
@@ -237,7 +237,7 @@ void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
EMIT(PPC_RAW_BLR());
- bpf_jit_build_fentry_stubs(image, ctx);
+ bpf_jit_build_fentry_stubs(image, fimage, ctx);
}
/* Relative offset needs to be calculated based on final image location */
@@ -1149,7 +1149,8 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
* we'll just fall through to the epilogue.
*/
if (i != flen - 1) {
- ret = bpf_jit_emit_exit_insn(image, ctx, _R0, exit_addr);
+ ret = bpf_jit_emit_exit_insn(image, fimage,
+ ctx, _R0, exit_addr);
if (ret)
return ret;
}
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index fc9db691e8203..667e2d4d2c612 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -398,7 +398,7 @@ static void bpf_jit_emit_common_epilogue(u32 *image, struct codegen_context *ctx
}
}
-void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
+void bpf_jit_build_epilogue(u32 *image, u32 *fimage, struct codegen_context *ctx)
{
bpf_jit_emit_common_epilogue(image, ctx);
@@ -407,7 +407,7 @@ void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
EMIT(PPC_RAW_BLR());
- bpf_jit_build_fentry_stubs(image, ctx);
+ bpf_jit_build_fentry_stubs(image, fimage, ctx);
}
/*
@@ -1737,7 +1737,8 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
* we'll just fall through to the epilogue.
*/
if (i != flen - 1) {
- ret = bpf_jit_emit_exit_insn(image, ctx, tmp1_reg, exit_addr);
+ ret = bpf_jit_emit_exit_insn(image, fimage, ctx,
+ tmp1_reg, exit_addr);
if (ret)
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0376/1257] pseries/plpks: fix error handling in plpks_read_var()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0375/1257] powerpc/bpf: fix alignment of long branch trampoline address Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0377/1257] pseries/plpks: fix error code for wrapping key reads Greg Kroah-Hartman
` (622 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit d52a1659cb1718f93166ab8dd8621237e564a1c4 ]
When a PLPKS variable is initialized without a policy and used to read an
object with the PLPKS_WRAPPINGKEY policy set, the hypervisor returns
H_AUTHORITY along with the object's policy. However, plpks_read_var()
currently treats this the same as any other H_AUTHORITY failure and returns
an error without propagating the policy information to the caller.
Distinguish this case from other H_AUTHORITY failures and propagate the
returned policy to the caller while preserving the authorization error.
Remove the explicit assignment of zero to rc on H_SUCCESS, as it is
redundant.
Also validate the PLPKS variable pointer before dereferencing it.
Fixes: 2454a7af0f2a ("powerpc/pseries: define driver for Platform KeyStore")
Cc: stable@vger.kernel.org # 6.0
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-2-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 23e4e2a922fcf..7e56b3dcacbc7 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -822,6 +822,9 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
u8 *output;
int rc;
+ if (!var)
+ return -EINVAL;
+
if (var->namelen > PLPKS_MAX_NAME_SIZE)
return -EINVAL;
@@ -856,22 +859,21 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
virt_to_phys(var->name), var->namelen, virt_to_phys(output),
maxobjsize);
-
if (rc != H_SUCCESS) {
rc = pseries_status_to_err(rc);
- goto out_free_output;
+ if (rc != -EPERM || !retbuf[1])
+ goto out_free_output;
+ goto out_copy_policy;
}
if (!var->data || var->datalen > retbuf[0])
var->datalen = retbuf[0];
- var->policy = retbuf[1];
-
if (var->data)
memcpy(var->data, output, var->datalen);
- rc = 0;
-
+out_copy_policy:
+ var->policy = retbuf[1];
out_free_output:
kfree(output);
out_free_label:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0377/1257] pseries/plpks: fix error code for wrapping key reads
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0376/1257] pseries/plpks: fix error handling in plpks_read_var() Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0378/1257] pseries/plpks: validate input to plpks_signed_update_var() Greg Kroah-Hartman
` (621 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit 0d0eafedcaf4939819d38ede6ad355ea37acd978 ]
PLPKS variables with the PLPKS_WRAPPINGKEY policy bit set are not
readable. Return -EPERM instead of -EINVAL in this case to better
reflect the access restriction being enforced.
Fixes: 133aa79e211d ("pseries/plpks: add HCALLs for PowerVM Key Wrapping Module")
Cc: stable@vger.kernel.org # 7.0
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-3-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 7e56b3dcacbc7..ccf5765a907bf 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -829,7 +829,7 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
return -EINVAL;
if (var->policy & PLPKS_WRAPPINGKEY)
- return -EINVAL;
+ return -EPERM;
auth = construct_auth(consumer);
if (IS_ERR(auth))
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0378/1257] pseries/plpks: validate input to plpks_signed_update_var()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0377/1257] pseries/plpks: fix error code for wrapping key reads Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0379/1257] pseries/plpks: clear sensitive PLPKS buffers Greg Kroah-Hartman
` (620 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit b59ff2d50b817eeec1259f357aae821c7834007f ]
plpks_signed_update_var() dereferences the supplied PLPKS variable pointer
without validating it. A NULL argument could therefore result in a NULL
pointer dereference.
Reject a NULL pointer argument with -EINVAL.
Fixes: 899d9b8fee66 ("powerpc/pseries: Implement signed update for PLPKS objects")
Cc: stable@vger.kernel.org # 6.3
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-4-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index ccf5765a907bf..e3ae2cd78247a 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -637,6 +637,9 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags)
u64 continuetoken = 0;
u64 timeout = 0;
+ if (!var)
+ return -EINVAL;
+
if (!var->data || var->datalen <= 0 || var->namelen > PLPKS_MAX_NAME_SIZE)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0379/1257] pseries/plpks: clear sensitive PLPKS buffers
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0378/1257] pseries/plpks: validate input to plpks_signed_update_var() Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0380/1257] pseries/plpks: clear sensitive buffers in wrapping operations Greg Kroah-Hartman
` (619 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Nayna Jain, Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit fe18716ff314eb32299048fd64242d31b4e852cf ]
PLPKS read, remove, and write operations use authentication buffers that
contain passwords. The read output buffer may also contain sensitive data.
Freeing these buffers with kfree(), without wiping the contents, can leave
sensitive data in memory.
Use kfree_sensitive() to wipe the buffers when freeing them.
Fixes: 2454a7af0f2a ("powerpc/pseries: define driver for Platform KeyStore")
Cc: stable@vger.kernel.org # 6.0
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-5-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index e3ae2cd78247a..8dbf85e9714c2 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -754,7 +754,7 @@ int plpks_write_var(struct plpks_var var)
rc = pseries_status_to_err(rc);
kfree(label);
out:
- kfree(auth);
+ kfree_sensitive(auth);
return rc;
}
@@ -812,7 +812,7 @@ int plpks_remove_var(char *component, u8 varos, struct plpks_var_name vname)
rc = pseries_status_to_err(rc);
kfree(label);
out:
- kfree(auth);
+ kfree_sensitive(auth);
return rc;
}
@@ -878,11 +878,11 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
out_copy_policy:
var->policy = retbuf[1];
out_free_output:
- kfree(output);
+ kfree_sensitive(output);
out_free_label:
kfree(label);
out_free_auth:
- kfree(auth);
+ kfree_sensitive(auth);
return rc;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0380/1257] pseries/plpks: clear sensitive buffers in wrapping operations
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0379/1257] pseries/plpks: clear sensitive PLPKS buffers Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0381/1257] pseries/plpks: clear signed update authentication buffer Greg Kroah-Hartman
` (618 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Nayna Jain, Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit 203695c109e37d8fe3531844218f75b98eef8e1f ]
PLPKS wrapping key generation, object wrapping, and object unwrapping use
authentication buffers that contain passwords. An object unwrapping failure
also frees an output buffer that may contain sensitive data. Freeing these
buffers with kfree(), without wiping the contents, can leave sensitive data
in memory.
Use kfree_sensitive() to wipe the buffers when freeing them.
Fixes: 133aa79e211d ("pseries/plpks: add HCALLs for PowerVM Key Wrapping Module")
Cc: stable@vger.kernel.org # 7.0
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-6-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 8dbf85e9714c2..17a73a04d45b4 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -975,7 +975,7 @@ int plpks_gen_wrapping_key(void)
kfree(label);
out:
- kfree(auth);
+ kfree_sensitive(auth);
return rc;
}
EXPORT_SYMBOL_GPL(plpks_gen_wrapping_key);
@@ -1100,7 +1100,7 @@ int plpks_wrap_object(u8 **input_buf, u32 input_len, u16 wrap_flags,
out_free_label:
kfree(label);
out:
- kfree(auth);
+ kfree_sensitive(auth);
return rc;
}
EXPORT_SYMBOL_GPL(plpks_wrap_object);
@@ -1177,14 +1177,14 @@ int plpks_unwrap_object(u8 **input_buf, u32 input_len, u8 **output_buf,
if (rc) {
pr_err("H_PKS_UNWRAP_OBJECT failed. pseries_status=%d, rc=%d",
pseries_status, rc);
- kfree(*output_buf);
+ kfree_sensitive(*output_buf);
*output_buf = NULL;
} else {
*output_len = retbuf[1];
}
out:
- kfree(auth);
+ kfree_sensitive(auth);
return rc;
}
EXPORT_SYMBOL_GPL(plpks_unwrap_object);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0381/1257] pseries/plpks: clear signed update authentication buffer
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0380/1257] pseries/plpks: clear sensitive buffers in wrapping operations Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0382/1257] pseries/plpks: clear SED key data after use Greg Kroah-Hartman
` (617 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Nayna Jain, Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit 63de55024e7c85975f4410380323edb05b186d7c ]
The PLPKS signed update operation uses an authentication buffer that
contains a password. Freeing this buffer with kfree(), without wiping
the contents, can leave sensitive data in memory.
Use kfree_sensitive() to wipe the buffer when freeing it.
Fixes: 899d9b8fee66 ("powerpc/pseries: Implement signed update for PLPKS objects")
Cc: stable@vger.kernel.org # 6.3
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-7-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 17a73a04d45b4..b057e378a6b39 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -685,7 +685,7 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags)
kfree(label);
out:
- kfree(auth);
+ kfree_sensitive(auth);
return rc;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0382/1257] pseries/plpks: clear SED key data after use
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0381/1257] pseries/plpks: clear signed update authentication buffer Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0383/1257] pseries/plpks: fix self-reference in plpks_var initializer Greg Kroah-Hartman
` (616 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Greg Joyce, Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit 217ba01e5b9096091acc2c1a3776cb3eb88c00ff ]
Explicitly clear the temporary buffer containing SED key data after read
and write operations.
Fixes: ec8cf230cecc ("powerpc/pseries: PLPKS SED Opal keystore support")
Cc: stable@vger.kernel.org # 6.7
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Greg Joyce <gjoyce@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-8-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks_sed_ops.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/plpks_sed_ops.c b/arch/powerpc/platforms/pseries/plpks_sed_ops.c
index 7c873c9589eff..ac3ec2ca7fbee 100644
--- a/arch/powerpc/platforms/pseries/plpks_sed_ops.c
+++ b/arch/powerpc/platforms/pseries/plpks_sed_ops.c
@@ -84,14 +84,16 @@ int sed_read_key(char *keyname, char *key, u_int *keylen)
ret = plpks_read_os_var(&var);
if (ret != 0)
- return ret;
+ goto out;
len = min_t(u16, be32_to_cpu(data.key_len), var.datalen);
memcpy(key, data.key, len);
key[len] = '\0';
*keylen = len;
- return 0;
+out:
+ memzero_explicit(&data, sizeof(data));
+ return ret;
}
/*
@@ -102,6 +104,7 @@ int sed_write_key(char *keyname, char *key, u_int keylen)
struct plpks_var var;
struct plpks_sed_object_data data;
struct plpks_var_name vname;
+ int ret;
plpks_init_var(&var, keyname);
@@ -127,5 +130,8 @@ int sed_write_key(char *keyname, char *key, u_int keylen)
vname.name = var.name;
plpks_remove_var(var.component, var.os, vname);
- return plpks_write_var(var);
+ ret = plpks_write_var(var);
+ memzero_explicit(&data, sizeof(data));
+
+ return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0383/1257] pseries/plpks: fix self-reference in plpks_var initializer
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0382/1257] pseries/plpks: clear SED key data after use Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0384/1257] pseries/plpks: hide wrapping_features when unsupported Greg Kroah-Hartman
` (615 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, R Nageswara Sastry, Srish Srinivasan,
Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit abcccecf4aa4b681f50eb7d7de93fc9a0a61c181 ]
In plpks_gen_wrapping_key() and plpks_wrap_object(), strlen(var.name) is
used to initialize var.namelen within the same struct initializer. This
references a member of var before initialization of var is complete.
Use the compile-time length of PLPKS_WRAPKEY_NAME instead.
Reported-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Fixes: 133aa79e211d ("pseries/plpks: add HCALLs for PowerVM Key Wrapping Module")
Cc: stable@vger.kernel.org # 7.0
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-9-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index b057e378a6b39..896eda3eb65f4 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -939,7 +939,7 @@ int plpks_gen_wrapping_key(void)
int rc = 0, pseries_status = 0;
struct plpks_var var = {
.name = PLPKS_WRAPKEY_NAME,
- .namelen = strlen(var.name),
+ .namelen = sizeof(PLPKS_WRAPKEY_NAME) - 1,
.policy = PLPKS_WRAPPINGKEY,
.os = PLPKS_VAR_LINUX,
.component = PLPKS_WRAPKEY_COMPONENT
@@ -1034,7 +1034,7 @@ int plpks_wrap_object(u8 **input_buf, u32 input_len, u16 wrap_flags,
bool sb_enforce_bit = wrap_flags & BIT(1);
struct plpks_var var = {
.name = PLPKS_WRAPKEY_NAME,
- .namelen = strlen(var.name),
+ .namelen = sizeof(PLPKS_WRAPKEY_NAME) - 1,
.os = PLPKS_VAR_LINUX,
.component = PLPKS_WRAPKEY_COMPONENT
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0384/1257] pseries/plpks: hide wrapping_features when unsupported
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0383/1257] pseries/plpks: fix self-reference in plpks_var initializer Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0385/1257] powerpc/pseries/iommu: Add TCEs for 16GB pages when RAM is pre-mapped Greg Kroah-Hartman
` (614 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srish Srinivasan, R Nageswara Sastry,
Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <ssrish@linux.ibm.com>
[ Upstream commit 46b8411b2ee948b1786bc4af76e7feede0c2ddff ]
The PLPKS wrapping features config is only valid on systems that support
the "Key Wrapping" feature. Currently the config is always exposed, even
when the feature is unavailable.
Add an is_visible() callback to suppress the wrapping_features sysfs
attribute when the "Key Wrapping" feature is not supported. Declare the
attribute group static const, as it is not modified after initialization.
Fixes: 447eb1d5ef00 ("pseries/plpks: expose PowerVM wrapping features via the sysfs")
Cc: stable@vger.kernel.org # 7.0
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-10-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/plpks-sysfs.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/plpks-sysfs.c b/arch/powerpc/platforms/pseries/plpks-sysfs.c
index c2ebcbb41ae39..f2436229f3233 100644
--- a/arch/powerpc/platforms/pseries/plpks-sysfs.c
+++ b/arch/powerpc/platforms/pseries/plpks-sysfs.c
@@ -45,6 +45,16 @@ static const struct attribute *config_attrs[] = {
static struct kobject *plpks_kobj, *plpks_config_kobj;
+static umode_t plpks_config_attr_is_visible(struct kobject *kobj,
+ struct attribute *attr, int n)
+{
+ if (attr == &attr_wrapping_features.attr &&
+ !plpks_wrapping_is_supported())
+ return 0;
+
+ return attr->mode;
+}
+
int plpks_config_create_softlink(struct kobject *from)
{
if (!plpks_config_kobj)
@@ -52,13 +62,13 @@ int plpks_config_create_softlink(struct kobject *from)
return sysfs_create_link(from, plpks_config_kobj, "config");
}
+static const struct attribute_group config_group = {
+ .attrs = (struct attribute **)config_attrs,
+ .is_visible = plpks_config_attr_is_visible,
+};
+
static __init int plpks_sysfs_config(struct kobject *kobj)
{
- struct attribute_group config_group = {
- .name = NULL,
- .attrs = (struct attribute **)config_attrs,
- };
-
return sysfs_create_group(kobj, &config_group);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0385/1257] powerpc/pseries/iommu: Add TCEs for 16GB pages when RAM is pre-mapped
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0384/1257] pseries/plpks: hide wrapping_features when unsupported Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0386/1257] ASoC: pcm6240: do not free an unrequested IRQ Greg Kroah-Hartman
` (613 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gaurav Batra, Ritesh Harjani (IBM),
Madhavan Srinivasan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaurav Batra <gbatra@linux.ibm.com>
[ Upstream commit 0b8b0c17a8998709ecb2852d56442ea981102941 ]
In powerPC, if Dynamic DMA Window is big enough, RAM is pre-mapped. To
determine the size of RAM, a PAPR+ property "ibm,lrdr-capacity" is used.
This OF property dictates what is the max size of RAM an LPAR can have,
including DR added memory.
In PowerPC, 16GB pages can be allocated at machine level and then
assigned to LPARs. These 16GB pages are added to LPAR memory at the time
of boot. The address range for these 16GB pages is above MAX RAM an LPAR
can have (ibm,lrdr-capacity). In the current implementation, these 16GB
pages are being excluded from pre-mapped TCEs. A driver can have DMA
buffers allocated from 16GB pages. This results in platform to raise an
EEH when DMA is attempted on buffers in 16GB memory range.
commit 6aa989ab2bd0 ("powerpc/pseries/iommu: memory notifier incorrectly
adds TCEs for pmemory")
Prior to the above patch, memblock_end_of_DRAM() was being used to
determine the MAX memory of an LPAR. This included 16GB pages as well.
The issue with using memblock_end_of_DRAM() is that when pmemory is
converted to RAM via daxctl command, the DDW engine will incorrectly try
to add TCEs for pmemory as well.
Below is the address distribution of RAM, 16GB pages and pmemory for an
LPAR with max memory of 256GB, memory allocated 64GB, 2 16GB pages and
assigned pmemory of 8GB.
RANGE SIZE STATE REMOVABLE BLOCK
0x0000000000000000-0x0000000fffffffff 64G online yes 0-255
0x0000004000000000-0x00000047ffffffff 32G online yes 1024-1151
cat /sys/bus/nd/devices/region0/resource
0x40100000000
cat /sys/bus/nd/devices/region0/size
8589934592
The approach to fix this problem is to revert back the code changes
introduced by the above patch and to stash away the MAX memory of an
LPAR, including 16GB pages, at the LPAR boot time. This value is then
used whenever TCEs are needed to be pre-mapped - enable_DDW() or,
iommu_mem_notifier()
Fixes: 6aa989ab2bd0 ("powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory")
Cc: stable@vger.kernel.org
Signed-off-by: Gaurav Batra <gbatra@linux.ibm.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260806205027.86428-1-gbatra@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/iommu.c | 67 +++++++++++++++++---------
1 file changed, 45 insertions(+), 22 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
index 272e9aab66d4f..32d414c2cb843 100644
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -69,6 +69,8 @@ static struct iommu_table *iommu_pseries_alloc_table(int node)
return tbl;
}
+static phys_addr_t pseries_ddw_max_ram __ro_after_init;
+
#ifdef CONFIG_IOMMU_API
static struct iommu_table_group_ops spapr_tce_table_group_ops;
#endif
@@ -1284,15 +1286,19 @@ struct failed_ddw_pdn {
static LIST_HEAD(failed_ddw_pdn_list);
-static phys_addr_t ddw_memory_hotplug_max(void)
+static phys_addr_t __init ddw_memory_hotplug_max(void)
{
- resource_size_t max_addr;
+ resource_size_t max_addr = memory_hotplug_max();
+ struct device_node *memory;
-#if defined(CONFIG_NUMA) && defined(CONFIG_MEMORY_HOTPLUG)
- max_addr = hot_add_drconf_memory_max();
-#else
- max_addr = memblock_end_of_DRAM();
-#endif
+ for_each_node_by_type(memory, "memory") {
+ struct resource res;
+
+ if (of_address_to_resource(memory, 0, &res))
+ continue;
+
+ max_addr = max_t(resource_size_t, max_addr, res.end + 1);
+ }
return max_addr;
}
@@ -1447,7 +1453,7 @@ static struct property *ddw_property_create(const char *propname, u32 liobn, u64
static bool enable_ddw(struct pci_dev *dev, struct device_node *pdn, u64 dma_mask)
{
int len = 0, ret;
- int max_ram_len = order_base_2(ddw_memory_hotplug_max());
+ int max_ram_len = order_base_2(pseries_ddw_max_ram);
struct ddw_query_response query;
struct ddw_create_response create;
int page_shift;
@@ -1617,12 +1623,12 @@ static bool enable_ddw(struct pci_dev *dev, struct device_node *pdn, u64 dma_mas
if (default_win_removed && pmem_present && !direct_mapping) {
/* DDW is big enough to be split */
if ((1ULL << ddw_sz) >=
- MIN_DDW_VPMEM_DMA_WINDOW + (1ULL << max_ram_len)) {
+ MIN_DDW_VPMEM_DMA_WINDOW + pseries_ddw_max_ram) {
direct_mapping = true;
/* offset of the Dynamic part of DDW */
- dynamic_offset = 1ULL << max_ram_len;
+ dynamic_offset = pseries_ddw_max_ram;
}
/* DDW will at least have dynamic allocation */
@@ -1669,7 +1675,7 @@ static bool enable_ddw(struct pci_dev *dev, struct device_node *pdn, u64 dma_mas
if (direct_mapping) {
/* DDW maps the whole partition, so enable direct DMA mapping */
- ret = walk_system_ram_range(0, ddw_memory_hotplug_max() >> PAGE_SHIFT,
+ ret = walk_system_ram_range(0, pseries_ddw_max_ram >> PAGE_SHIFT,
win64->value, tce_setrange_multi_pSeriesLP_walk);
if (ret) {
dev_info(&dev->dev, "failed to map DMA window for %pOF: %d\n",
@@ -1772,8 +1778,7 @@ static bool enable_ddw(struct pci_dev *dev, struct device_node *pdn, u64 dma_mas
/* For pre-mapped memory, set bus_dma_limit to the max RAM */
if (direct_mapping)
- dev->dev.bus_dma_limit = dev->dev.archdata.dma_offset +
- (1ULL << max_ram_len);
+ dev->dev.bus_dma_limit = dev->dev.archdata.dma_offset + pseries_ddw_max_ram;
dev_info(&dev->dev, "lsa_required: %x, lsa_enabled: %x, direct mapping: %x\n",
limited_addr_req, limited_addr_enabled, direct_mapping);
@@ -2420,23 +2425,35 @@ static int iommu_mem_notifier(struct notifier_block *nb, unsigned long action,
{
struct dma_win *window;
struct memory_notify *arg = data;
+ unsigned long limit = arg->nr_pages;
+ unsigned long max_ram_pages = pseries_ddw_max_ram >> PAGE_SHIFT;
int ret = 0;
/* This notifier can get called when onlining persistent memory as well.
* TCEs are not pre-mapped for persistent memory. Persistent memory will
- * always be above ddw_memory_hotplug_max()
+ * always be above pseries_ddw_max_ram
*/
+ if (arg->start_pfn >= max_ram_pages)
+ return NOTIFY_OK;
+
+ /* RAM is being DLPAR'ed. The range should never exceed max ram.
+ * Just in case, clamp the range and throw a warning.
+ */
+ if (arg->start_pfn + limit > max_ram_pages) {
+ limit = max_ram_pages - arg->start_pfn;
+ WARN_ONCE(1, "Limiting Page Range %lx - %lx to Max Mem Pages: %lx\n",
+ arg->start_pfn, arg->start_pfn + arg->nr_pages,
+ max_ram_pages);
+ }
switch (action) {
case MEM_GOING_ONLINE:
spin_lock(&dma_win_list_lock);
list_for_each_entry(window, &dma_win_list, list) {
- if (window->direct && (arg->start_pfn << PAGE_SHIFT) <
- ddw_memory_hotplug_max()) {
+ if (window->direct) {
ret |= tce_setrange_multi_pSeriesLP(arg->start_pfn,
- arg->nr_pages, window->prop);
+ limit, window->prop);
}
- /* XXX log error */
}
spin_unlock(&dma_win_list_lock);
break;
@@ -2444,12 +2461,10 @@ static int iommu_mem_notifier(struct notifier_block *nb, unsigned long action,
case MEM_OFFLINE:
spin_lock(&dma_win_list_lock);
list_for_each_entry(window, &dma_win_list, list) {
- if (window->direct && (arg->start_pfn << PAGE_SHIFT) <
- ddw_memory_hotplug_max()) {
+ if (window->direct) {
ret |= tce_clearrange_multi_pSeriesLP(arg->start_pfn,
- arg->nr_pages, window->prop);
+ limit, window->prop);
}
- /* XXX log error */
}
spin_unlock(&dma_win_list_lock);
break;
@@ -2533,6 +2548,14 @@ void __init iommu_init_early_pSeries(void)
register_memory_notifier(&iommu_mem_nb);
set_pci_dma_ops(&dma_iommu_ops);
+
+ /* During init determine the max memory an LPAR can have and set it. This
+ * will be used for pre-mapping RAM in DDW. memblock_end_of_DRAM() can
+ * change during the running of LPAR - daxctl can add pmemory as
+ * "system-ram". This memory range should not be pre-mapped in DDW since
+ * the address of pmemory can be much higher than the DDW size.
+ */
+ pseries_ddw_max_ram = ddw_memory_hotplug_max();
}
static int __init disable_multitce(char *str)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0386/1257] ASoC: pcm6240: do not free an unrequested IRQ
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0385/1257] powerpc/pseries/iommu: Add TCEs for 16GB pages when RAM is pre-mapped Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0387/1257] nilfs2: clear dirty flag on bdev buffers on log write failure Greg Kroah-Hartman
` (612 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 995b96380ba5d98131acc162608da3538e1395d8 ]
The driver obtains an IRQ number from device tree but never requests an
IRQ handler for the PCM6240 device. Removing the device must not pass
that number to free_irq().
Leave IRQ ownership to a matching request path if one is added later.
Fixes: 1324eafd37aa ("ASoc: PCM6240: Create PCM6240 Family driver code")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260929095920.2092147-1-runyu.xiao@seu.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/pcm6240.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/sound/soc/codecs/pcm6240.c b/sound/soc/codecs/pcm6240.c
index db85ae2f8aed0..7a8c8f53f04c5 100644
--- a/sound/soc/codecs/pcm6240.c
+++ b/sound/soc/codecs/pcm6240.c
@@ -2019,8 +2019,6 @@ static const struct regmap_config pcmdevice_i2c_regmap = {
static void pcmdevice_remove(struct pcmdevice_priv *pcm_dev)
{
- if (pcm_dev->irq)
- free_irq(pcm_dev->irq, pcm_dev);
mutex_destroy(&pcm_dev->codec_lock);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0387/1257] nilfs2: clear dirty flag on bdev buffers on log write failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0386/1257] ASoC: pcm6240: do not free an unrequested IRQ Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0388/1257] clk: tenstorrent: Assign .num before accessing .hws Greg Kroah-Hartman
` (611 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryusuke Konishi, Viacheslav Dubeyko,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
[ Upstream commit 6faad04a002603d800134398fcd042b403b32d35 ]
Since the commit referenced in the Fixes tag stopped directly calling
inode_attach_wb(), a dirty flag is set on buffers (with
mark_buffer_dirty()) allocated to the backing device for segment
summaries and the super root block during log writes.
While this dirty flag is cleared upon a successful log write, it remains
uncleared if the log write fails.
Consequently, when a log write fails, these backing device buffers are
left in an inconsistent state where their uptodate flag and the dirty
flag of the containing page/folio are cleared, but the buffer's dirty
flag remains as stale garbage.
Particularly when the block size is smaller than the page size, if other
buffers on the same page/folio become dirty, this buffer unexpectedly
becomes a target for writeback again. As a result, if the block is
later reused for other data or metadata, that contents risks being
corrupted.
Fix this issue by calling clear_buffer_dirty() for the backing device
buffers when aborting log writes in nilfs_abort_logs().
Fixes: 68142cb628f7 ("nilfs2: do not call inode_attach_wb() directly")
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/segment.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 829573cb61316..2f0e59847d026 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1829,6 +1829,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
list_for_each_entry(segbuf, logs, sb_list) {
list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
b_assoc_buffers) {
+ clear_buffer_dirty(bh);
clear_buffer_uptodate(bh);
if (bh->b_folio != bd_folio) {
if (bd_folio)
@@ -1840,6 +1841,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
list_for_each_entry(bh, &segbuf->sb_payload_buffers,
b_assoc_buffers) {
if (bh == segbuf->sb_super_root) {
+ clear_buffer_dirty(bh);
clear_buffer_uptodate(bh);
if (bh->b_folio != bd_folio) {
folio_end_writeback(bd_folio);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0388/1257] clk: tenstorrent: Assign .num before accessing .hws
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0387/1257] nilfs2: clear dirty flag on bdev buffers on log write failure Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0389/1257] clk: tenstorrent: Fix refcount leak on shared gate clk enable failure Greg Kroah-Hartman
` (610 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aamir Ahmed, Gustavo A. R. Silva,
Anirudh Srinivasan, Drew Fustini (Tenstorrent), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aamir Ahmed <elb12345@hotmail.co.uk>
[ Upstream commit da9f1312b06e4c03d43d21494fb5beea7f9e096d ]
Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
__counted_by") annotated the hws member of 'struct clk_hw_onecell_data'
with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)
about the number of elements in .hws[], so that it can warn when .hws[]
is accessed out of bounds. As noted in that change, the __counted_by
member must be initialized with the number of elements before the first
array access happens, otherwise there will be a warning from each access
prior to the initialization because the number of elements is zero.
This occurs in atlantis_prcm_clocks_register() due to .num being
assigned only after every clock has been stored in .hws[]. With
CONFIG_UBSAN_BOUNDS and a compiler that implements __counted_by (GCC
15.1+ or Clang 20.1+), this triggers an array-index-out-of-bounds report
during probe, and with CONFIG_UBSAN_TRAP the first store traps so the
clock provider never registers.
Move the .num initialization to right after the allocation.
Fixes: 23c8ebc95284 ("clk: tenstorrent: Add Atlantis clock controller driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Reviewed-by: Drew Fustini (Tenstorrent) <fustini@kernel.org>
Link: https://patch.msgid.link/AS8P251MB00013BD9A093C06D2D60E10EC8B42@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
[fustini: drop num_clks, use data->num per Gustavo]
Signed-off-by: Drew Fustini (Tenstorrent) <fustini@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/tenstorrent/atlantis-prcm.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/clk/tenstorrent/atlantis-prcm.c b/drivers/clk/tenstorrent/atlantis-prcm.c
index 6d4386eeb7dae..6772035ec8726 100644
--- a/drivers/clk/tenstorrent/atlantis-prcm.c
+++ b/drivers/clk/tenstorrent/atlantis-prcm.c
@@ -789,13 +789,14 @@ static int atlantis_prcm_clocks_register(struct device *dev,
{
struct clk_hw_onecell_data *clk_data;
int i, ret;
- size_t num_clks = data->num;
clk_data = devm_kzalloc(dev, struct_size(clk_data, hws, data->num),
GFP_KERNEL);
if (!clk_data)
return -ENOMEM;
+ clk_data->num = data->num;
+
for (i = 0; i < data->num; i++) {
struct clk_hw *hw = data->hws[i];
struct atlantis_clk_common *common =
@@ -809,8 +810,6 @@ static int atlantis_prcm_clocks_register(struct device *dev,
clk_data->hws[common->clkid] = hw;
}
- clk_data->num = num_clks;
-
return devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get, clk_data);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0389/1257] clk: tenstorrent: Fix refcount leak on shared gate clk enable failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0388/1257] clk: tenstorrent: Assign .num before accessing .hws Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0390/1257] vfio/pci: Restore 8-byte ioeventfd support Greg Kroah-Hartman
` (609 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Anirudh Srinivasan,
Drew Fustini (Tenstorrent), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
[ Upstream commit 3f0655b51eb01dad30d61ced0a81718211f2776e ]
atlantis_clk_gate_shared_enable() increments the refcount for the number
of clks requesting the shared gate clk to be enabled always. It should
only do this when the enable for the gate took effect in hardware. It's
possible to end up in a situation where the gate enable failed, but the
refcount is incremented anyway, so subsequent requests by other clks
that share the same refcount get ignored and the gate enable is never
retried.
Update this function so that the refcount is not incremented when the
gate clk enable fails in hardware.
Fixes: 23c8ebc95284 ("clk: tenstorrent: Add Atlantis clock controller driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/AS8P251MB00013BD9A093C06D2D60E10EC8B42%40AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Reviewed-by: Drew Fustini (Tenstorrent) <fustini@kernel.org>
Link: https://patch.msgid.link/20260924-atlantis_gate_shared_enable_fix-v1-1-303f925b8a3d@oss.tenstorrent.com
Signed-off-by: Drew Fustini (Tenstorrent) <fustini@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/tenstorrent/atlantis-prcm.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/drivers/clk/tenstorrent/atlantis-prcm.c b/drivers/clk/tenstorrent/atlantis-prcm.c
index 6772035ec8726..bf244b1fbfc1c 100644
--- a/drivers/clk/tenstorrent/atlantis-prcm.c
+++ b/drivers/clk/tenstorrent/atlantis-prcm.c
@@ -397,22 +397,21 @@ static int atlantis_clk_gate_shared_enable(struct clk_hw *hw)
scoped_guard(spinlock_irqsave, gate->config.refcount_lock)
{
- need_enable = (*gate->config.share_count)++ == 0;
+ need_enable = (*gate->config.share_count) == 0;
if (need_enable) {
regmap_set_bits(gate->common.regmap,
gate->config.reg_offset,
gate->config.enable);
- }
- }
- if (need_enable) {
- if (!regmap_test_bits(gate->common.regmap,
- gate->config.reg_offset,
- gate->config.enable)) {
- pr_warn("%s: gate enable %d failed to enable\n",
- clk_hw_get_name(hw), gate->config.enable);
- return -EIO;
+ if (!regmap_test_bits(gate->common.regmap,
+ gate->config.reg_offset,
+ gate->config.enable)) {
+ pr_warn("%s: gate enable %d failed to enable\n",
+ clk_hw_get_name(hw), gate->config.enable);
+ return -EIO;
+ }
}
+ (*gate->config.share_count)++;
}
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0390/1257] vfio/pci: Restore 8-byte ioeventfd support
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0389/1257] clk: tenstorrent: Fix refcount leak on shared gate clk enable failure Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0391/1257] nilfs2: ignore non-fatal signals during synchronous log write wait Greg Kroah-Hartman
` (608 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li RongQing, Alex Williamson,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
[ Upstream commit b30b52c2fb82e6d38ee2845a4d85e8254b44f3d8 ]
Commit b44a06bd28f2 ("vfio/pci: Remove #ifdef iowrite64 and #ifdef
ioread64") inadvertently converted a conditional 8-byte rejection
into an unconditional one.
Originally, 'count == 8' was rejected only if iowrite64 was undefined
(#ifndef iowrite64). When iowrite64 became globally available via generic
fallbacks, this rejection became dead code, allowing 8-byte ioeventfds.
However, b44a06bd28f2 removed the #ifndef wrappers but left the nested
'if (count == 8) return -EINVAL;' intact, breaking all 8-byte
registrations.
Drop the unconditional check to restore 8-byte ioeventfd support,
matching the original intent.
Fixes: b44a06bd28f2 ("vfio/pci: Remove #ifdef iowrite64 and #ifdef ioread64")
Cc: stable@vger.kernel.org
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Link: https://lore.kernel.org/r/20260922040013.2188-1-lirongqing@baidu.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/pci/vfio_pci_rdwr.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
index 7f14dd46de17a..df88480876815 100644
--- a/drivers/vfio/pci/vfio_pci_rdwr.c
+++ b/drivers/vfio/pci/vfio_pci_rdwr.c
@@ -423,9 +423,6 @@ int vfio_pci_ioeventfd(struct vfio_pci_core_device *vdev, loff_t offset,
pos >= vdev->msix_offset + vdev->msix_size))
return -EINVAL;
- if (count == 8)
- return -EINVAL;
-
io = vfio_pci_core_get_iomap(vdev, bar);
if (IS_ERR(io))
return PTR_ERR(io);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0391/1257] nilfs2: ignore non-fatal signals during synchronous log write wait
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0390/1257] vfio/pci: Restore 8-byte ioeventfd support Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0392/1257] pwm: tiehrpwm: Clear period on disable to allow reconfiguration Greg Kroah-Hartman
` (607 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+f6c7e1f1809f235eeb90,
Wang Jianjian, Ryusuke Konishi, Viacheslav Dubeyko, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
[ Upstream commit 7131aaa74bcc7c9da1f1d1c8724da75c775557a0 ]
Based on a syzbot report, Wang Jianjian pointed out that following a
successful directory operation in nilfs_rename(), a synchronous write
requested within nilfs_transaction_commit(), triggered by a sync flag
set by nilfs_commit_chunk(), could be interrupted by a user signal.
This interruption leaves in-memory metadata updates intact while
returning an error, causing inconsistency with the VFS dentry cache and
ultimately triggering a kernel warning.
According to "signal(7)", local disks are not classified as "slow
devices" (such as terminals, FIFOs, or pipes) and their I/O operations
on disk devices are not interrupted by signals. In kernel space,
waiting for such disk I/O should therefore not be aborted by ordinary
(non-fatal) signals.
Suppress this issue by modifying nilfs_segctor_sync(), which waits for
the log writer thread to complete synchronous writes, to catch only
fatal signals via fatal_signal_pending() and return -EINTR rather than
-ERESTARTSYS. To complement this change and prevent the wait loop from
busy-looping when schedule() returns immediately due to a pending
non-fatal signal, switch the wait state from TASK_INTERRUPTIBLE to
TASK_KILLABLE.
This serves as an effective interim stabilization measure without
structural changes until a comprehensive fix for metadata consistency
is implemented.
Reported-by: syzbot+f6c7e1f1809f235eeb90@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f6c7e1f1809f235eeb90
Fixes: 9ff05123e3bf ("nilfs2: segment constructor")
Tested-by: syzbot+f6c7e1f1809f235eeb90@syzkaller.appspotmail.com
Cc: Wang Jianjian <wangjianjian3@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/ioctl.c | 2 +-
fs/nilfs2/recovery.c | 2 +-
fs/nilfs2/segment.c | 10 +++++-----
3 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 01a04080ef704..b2b67d6a1f097 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -965,10 +965,10 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
* Return: 0 on success, or one of the following negative error codes on
* failure:
* * %-EFAULT - Failure during execution of requested operation.
+ * * %-EINTR - Interrupted.
* * %-EIO - I/O error.
* * %-ENOMEM - Insufficient memory available.
* * %-ENOSPC - No space left on device (only in a panic state).
- * * %-ERESTARTSYS - Interrupted.
* * %-EROFS - Read only filesystem.
*/
static int nilfs_ioctl_sync(struct inode *inode, struct file *filp,
diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index 45fb372156699..a7086a93480b1 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -785,11 +785,11 @@ static void nilfs_abort_roll_forward(struct the_nilfs *nilfs)
*
* Return: 0 on success, or one of the following negative error codes on
* failure:
+ * * %-EINTR - Interrupted.
* * %-EINVAL - Inconsistent filesystem state.
* * %-EIO - I/O error.
* * %-ENOMEM - Insufficient memory available.
* * %-ENOSPC - No space left on device (only in a panic state).
- * * %-ERESTARTSYS - Interrupted.
*/
int nilfs_salvage_orphan_logs(struct the_nilfs *nilfs,
struct super_block *sb,
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 2f0e59847d026..af0c3560444f5 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2259,7 +2259,7 @@ static int nilfs_segctor_sync(struct nilfs_sc_info *sci)
wake_up(&sci->sc_wait_daemon);
for (;;) {
- set_current_state(TASK_INTERRUPTIBLE);
+ set_current_state(TASK_KILLABLE);
/*
* Synchronize only while the log writer thread is alive.
@@ -2273,11 +2273,11 @@ static int nilfs_segctor_sync(struct nilfs_sc_info *sci)
err = wait_req.err;
break;
}
- if (!signal_pending(current)) {
+ if (!fatal_signal_pending(current)) {
schedule();
continue;
}
- err = -ERESTARTSYS;
+ err = -EINTR;
break;
}
finish_wait(&sci->sc_wait_request, &wait_req.wq);
@@ -2311,10 +2311,10 @@ static void nilfs_segctor_wakeup(struct nilfs_sc_info *sci, int err, bool force)
*
* Return: 0 on success, or one of the following negative error codes on
* failure:
+ * * %-EINTR - Interrupted.
* * %-EIO - I/O error (including metadata corruption).
* * %-ENOMEM - Insufficient memory available.
* * %-ENOSPC - No space left on device (only in a panic state).
- * * %-ERESTARTSYS - Interrupted.
* * %-EROFS - Read only filesystem.
*/
int nilfs_construct_segment(struct super_block *sb)
@@ -2341,10 +2341,10 @@ int nilfs_construct_segment(struct super_block *sb)
*
* Return: 0 on success, or one of the following negative error codes on
* failure:
+ * * %-EINTR - Interrupted.
* * %-EIO - I/O error (including metadata corruption).
* * %-ENOMEM - Insufficient memory available.
* * %-ENOSPC - No space left on device (only in a panic state).
- * * %-ERESTARTSYS - Interrupted.
* * %-EROFS - Read only filesystem.
*/
int nilfs_construct_dsync_segment(struct super_block *sb, struct inode *inode,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0392/1257] pwm: tiehrpwm: Clear period on disable to allow reconfiguration
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0391/1257] nilfs2: ignore non-fatal signals during synchronous log write wait Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0393/1257] IB/hfi1: Shutdown self-rearming timers before freeing Greg Kroah-Hartman
` (606 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Sverdlin,
Uwe Kleine-König, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <alexander.sverdlin@siemens.com>
[ Upstream commit e74b9a7ee50071aad25d3989bf985292f90b0c6e ]
Both channels share one period register, so ehrpwm_pwm_config() rejects a
period differing from the sibling's period_cycles[]. That value was cleared
only in .free(), not in .disable(), so a stopped channel kept blocking the
sibling from switching to a new frequency. Clear it in .disable() too.
Testcase:
cd /sys/class/pwm/pwmchip0; echo 0 > export; echo 1 > export
for p in pwm0 pwm1; do
echo 1000000 > $p/period; echo 500000 > $p/duty_cycle
echo 1 > $p/enable; echo 0 > $p/enable; echo 2000000 > $p/period
done
echo 1 > pwm0/enable # before: -EINVAL, after: succeeds
Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting")
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Link: https://patch.msgid.link/20260929120806.2790355-1-alexander.sverdlin@siemens.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-tiehrpwm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index 3a53489f0b982..e3407d0a1f7fe 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -358,6 +358,9 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
/* Disable clock on PWM disable */
pm_runtime_put_sync(pwmchip_parent(chip));
+
+ /* A disabled channel must not constrain the sibling's period */
+ pc->period_cycles[pwm->hwpwm] = 0;
}
static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0393/1257] IB/hfi1: Shutdown self-rearming timers before freeing
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0392/1257] pwm: tiehrpwm: Clear period on disable to allow reconfiguration Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0394/1257] arm64: dts: freescale: imx95-aquila: Enable I2C_3_DSI1 on Clover board Greg Kroah-Hartman
` (605 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Leon Romanovsky,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 9d3259e41ccd5016cd2c6d013232b89df6d73011 ]
The HFI1 receive error and synthetic counter timers rearm themselves from
their callbacks. Their cleanup paths use timer_delete_sync(), which only
waits for a running callback and does not prevent a concurrent or
subsequent rearm.
Use timer_shutdown_sync() when releasing these timers. This prevents a
callback from enqueueing either timer after cleanup begins, before the
containing hfi1_devdata is freed.
Preserve the existing work cancellation and workqueue destruction ordering
for synthetic counters.
Fixes: 7724105686e7 ("IB/hfi1: add driver files")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260930070455.2934286-1-runyu.xiao@seu.edu.cn
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/chip.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 592e330e74bf1..faa724ca33bd7 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -5567,7 +5567,7 @@ static int init_rcverr(struct hfi1_devdata *dd)
static void free_rcverr(struct hfi1_devdata *dd)
{
if (dd->rcverr_timer.function)
- timer_delete_sync(&dd->rcverr_timer);
+ timer_shutdown_sync(&dd->rcverr_timer);
}
static void handle_rxe_err(struct hfi1_devdata *dd, u32 unused, u64 reg)
@@ -12300,7 +12300,7 @@ static void free_cntrs(struct hfi1_devdata *dd)
int i;
if (dd->synth_stats_timer.function)
- timer_delete_sync(&dd->synth_stats_timer);
+ timer_shutdown_sync(&dd->synth_stats_timer);
cancel_work_sync(&dd->update_cntr_work);
ppd = (struct hfi1_pportdata *)(dd + 1);
for (i = 0; i < dd->num_pports; i++, ppd++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0394/1257] arm64: dts: freescale: imx95-aquila: Enable I2C_3_DSI1 on Clover board
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0393/1257] IB/hfi1: Shutdown self-rearming timers before freeing Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0395/1257] i3c: master: adi: free the IRQ before unregistering the master Greg Kroah-Hartman
` (604 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Franz Schnyder, Frank Li,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Franz Schnyder <franz.schnyder@toradex.com>
[ Upstream commit cffbc25c212bd41885094648918a935da0115a0e ]
Enable lpi2c8, which is used for the I2C_3_DSI1 signals on the Clover
carrier board. It was left disabled by mistake in the initial commit.
Fixes: 3f519121e120 ("arm64: dts: freescale: imx95-aquila: Add Clover carrier board")
Cc: stable@vger.kernel.org
Signed-off-by: Franz Schnyder <franz.schnyder@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx95-aquila-clover.dts | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/arm64/boot/dts/freescale/imx95-aquila-clover.dts b/arch/arm64/boot/dts/freescale/imx95-aquila-clover.dts
index fd93043314466..435567b257087 100644
--- a/arch/arm64/boot/dts/freescale/imx95-aquila-clover.dts
+++ b/arch/arm64/boot/dts/freescale/imx95-aquila-clover.dts
@@ -188,6 +188,11 @@ &lpi2c5 {
status = "okay";
};
+/* Aquila I2C_3_DSI1 */
+&lpi2c8 {
+ status = "okay";
+};
+
/* Aquila SPI_1 */
&lpspi6 {
pinctrl-names = "default";
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0395/1257] i3c: master: adi: free the IRQ before unregistering the master
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0394/1257] arm64: dts: freescale: imx95-aquila: Enable I2C_3_DSI1 on Clover board Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0396/1257] drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure Greg Kroah-Hartman
` (603 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Frank Li,
Alexandre Belloni, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit 1c1e2d90aa452764df66bb1dd774aa0d06d89cc8 ]
adi_i3c_master_irq() is requested with devm_request_irq(), so it stays
registered when adi_i3c_master_remove() runs, and the writes masking the
controller IRQ sources do not synchronize with a handler that is already
running on another CPU. i3c_master_unregister() then frees the
struct i3c_dev_desc objects that master->ibi.slots[] still point to, so
the IBI path in adi_i3c_master_handle_ibi() can dereference freed memory.
Fix this by storing the IRQ number in the private structure and calling
devm_free_irq() after the IRQ sources are masked, so a running handler
is finished before the master is torn down.
This issue was found by an in-house static analysis tool.
Fixes: a79ac2cdc91d ("i3c: master: Add driver for Analog Devices I3C Controller IP")
Cc: stable@vger.kernel.org
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260923085340.490776-1-fanwu01@zju.edu.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/adi-i3c-master.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/i3c/master/adi-i3c-master.c b/drivers/i3c/master/adi-i3c-master.c
index b35386260350c..ad57b7500678d 100644
--- a/drivers/i3c/master/adi-i3c-master.c
+++ b/drivers/i3c/master/adi-i3c-master.c
@@ -115,6 +115,7 @@ struct adi_i3c_master {
spinlock_t lock; /* Protect transfer */
} xferqueue;
void __iomem *regs;
+ int irq;
struct clk *clk;
unsigned long i3c_scl_lim;
struct {
@@ -957,6 +958,7 @@ static int adi_i3c_master_probe(struct platform_device *pdev)
irq = platform_get_irq(pdev, 0);
if (irq < 0)
return irq;
+ master->irq = irq;
version = readl(master->regs + ADI_AXI_REG_VERSION);
if (ADI_AXI_PCORE_VER_MAJOR(version) != 1)
@@ -1001,6 +1003,8 @@ static void adi_i3c_master_remove(struct platform_device *pdev)
writel(0x00, master->regs + REG_IRQ_MASK);
writel(0x01, master->regs + REG_ENABLE);
+ devm_free_irq(&pdev->dev, master->irq, master);
+
i3c_master_unregister(&master->base);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0396/1257] drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0395/1257] i3c: master: adi: free the IRQ before unregistering the master Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0397/1257] drm/msm/hdmi: Handle msm_hdmi_power_on() errors during .atomic_pre_enable() Greg Kroah-Hartman
` (602 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Dmitry Baryshkov, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit d27f831aaf20aaf06e41ceb1b260e10672269155 ]
If msm_hdmi_phy_resource_enable() fails, e.g. when enabling regulators,
it should reverse the state of things already changed.
msm_hdmi_phy_resource_enable() is used also in probe path, thus such
failure, which could be simple deferred probe, would leave these
resources permanently enabled for the rest of the runtime.
Cc: <stable@vger.kernel.org>
Fixes: 15b4a4523859 ("drm/msm/hdmi: Create a separate HDMI PHY driver")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/752654/
Link: https://lore.kernel.org/r/20260911-drm-msm-hdmi-fixes-before-eliza-v4-1-87bdb9f1987f@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/hdmi/hdmi_phy.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_phy.c b/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
index 77dce35cd45e0..ebb600d77cd82 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
@@ -67,16 +67,28 @@ int msm_hdmi_phy_resource_enable(struct hdmi_phy *phy)
ret = regulator_bulk_enable(cfg->num_regs, phy->regs);
if (ret) {
DRM_DEV_ERROR(dev, "failed to enable regulators: (%d)\n", ret);
- return ret;
+ goto err_pm_put;
}
for (i = 0; i < cfg->num_clks; i++) {
ret = clk_prepare_enable(phy->clks[i]);
- if (ret)
+ if (ret) {
DRM_DEV_ERROR(dev, "failed to enable clock: %s (%d)\n",
cfg->clk_names[i], ret);
+ goto err_clk_unprepare;
+ }
}
+ return 0;
+
+err_clk_unprepare:
+ for (; i > 0; i--)
+ clk_disable_unprepare(phy->clks[i - 1]);
+ regulator_bulk_disable(cfg->num_regs, phy->regs);
+
+err_pm_put:
+ pm_runtime_put_sync(dev);
+
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0397/1257] drm/msm/hdmi: Handle msm_hdmi_power_on() errors during .atomic_pre_enable()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0396/1257] drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0398/1257] drm/msm/hdmi_bridge: Correct poweroff/audio cleanup order in post_disable Greg Kroah-Hartman
` (601 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski,
Dmitry Baryshkov, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit dd6ecace57851878e62367a6f1a26dd5b9aa217f ]
Properly handle power up failures during .atomic_pre_enable() by
aborting the .atomic_pre_enable() to avoid accessing registers why
blocks did not bring up. Otherwise this could lead to imprecise aborts
when accessing MMIO while entire power domain is off.
Cc: <stable@vger.kernel.org>
Fixes: ba3d7bf3a7ab ("drm/msm/hdmi: Convert PHY files according to new design")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/752652/
Link: https://lore.kernel.org/r/20260911-drm-msm-hdmi-fixes-before-eliza-v4-2-87bdb9f1987f@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 30 ++++++++++++++++++--------
1 file changed, 21 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
index 157f19bd90b4e..db85400e574e4 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
@@ -13,14 +13,16 @@
#include "msm_kms.h"
#include "hdmi.h"
-static void msm_hdmi_power_on(struct drm_bridge *bridge)
+static int msm_hdmi_power_on(struct drm_bridge *bridge)
{
struct drm_device *dev = bridge->dev;
struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
struct hdmi *hdmi = hdmi_bridge->hdmi;
int ret;
- pm_runtime_resume_and_get(&hdmi->pdev->dev);
+ ret = pm_runtime_resume_and_get(&hdmi->pdev->dev);
+ if (ret)
+ return ret;
if (hdmi->extp_clk) {
DBG("pixclock: %lu", hdmi->pixclock);
@@ -29,9 +31,14 @@ static void msm_hdmi_power_on(struct drm_bridge *bridge)
DRM_DEV_ERROR(dev->dev, "failed to set extp clk rate: %d\n", ret);
ret = clk_prepare_enable(hdmi->extp_clk);
- if (ret)
+ if (ret) {
DRM_DEV_ERROR(dev->dev, "failed to enable extp clk: %d\n", ret);
+ pm_runtime_put(&hdmi->pdev->dev);
+ return ret;
+ }
}
+
+ return 0;
}
static void power_off(struct drm_bridge *bridge)
@@ -287,13 +294,18 @@ static void msm_hdmi_bridge_atomic_pre_enable(struct drm_bridge *bridge,
msm_hdmi_set_timings(hdmi, &crtc_state->adjusted_mode);
- mutex_lock(&hdmi->state_mutex);
- if (!hdmi->power_on) {
- msm_hdmi_phy_resource_enable(phy);
- msm_hdmi_power_on(bridge);
- hdmi->power_on = true;
+ scoped_guard(mutex, &hdmi->state_mutex) {
+ if (!hdmi->power_on) {
+ if (msm_hdmi_phy_resource_enable(phy))
+ return;
+
+ if (msm_hdmi_power_on(bridge)) {
+ msm_hdmi_phy_resource_disable(phy);
+ return;
+ }
+ hdmi->power_on = true;
+ }
}
- mutex_unlock(&hdmi->state_mutex);
if (connector->display_info.is_hdmi)
msm_hdmi_audio_update(hdmi);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0398/1257] drm/msm/hdmi_bridge: Correct poweroff/audio cleanup order in post_disable
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0397/1257] drm/msm/hdmi: Handle msm_hdmi_power_on() errors during .atomic_pre_enable() Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0399/1257] drm/msm/dsi: Fix VM leak in dsi_tx_buf_alloc_6g() Greg Kroah-Hartman
` (600 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Krzysztof Kozlowski,
Dmitry Baryshkov, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit 0499f0576e4442d67c164119f9d7f75d3cc945e7 ]
Turning off the power in msm_hdmi_bridge_atomic_post_disable() should
follow reverse order of powering up, not only because it is logical, but
also because msm_hdmi_audio_update() accesses registers thus block
should still be powered on.
Depending on specific timing, existing code could have accesses to MMIO
of powered off block.
Cc: stable@vger.kernel.org
Fixes: c0c0d9eeeb8d ("drm/msm: hdmi audio support")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/752655/
Link: https://lore.kernel.org/r/20260911-drm-msm-hdmi-fixes-before-eliza-v4-3-87bdb9f1987f@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
index db85400e574e4..1860605850c9b 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
@@ -339,10 +339,10 @@ static void msm_hdmi_bridge_atomic_post_disable(struct drm_bridge *bridge,
msm_hdmi_phy_powerdown(phy);
if (hdmi->power_on) {
- power_off(bridge);
hdmi->power_on = false;
if (hdmi->connector->display_info.is_hdmi)
msm_hdmi_audio_update(hdmi);
+ power_off(bridge);
msm_hdmi_phy_resource_disable(phy);
}
mutex_unlock(&hdmi->state_mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0399/1257] drm/msm/dsi: Fix VM leak in dsi_tx_buf_alloc_6g()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0398/1257] drm/msm/hdmi_bridge: Correct poweroff/audio cleanup order in post_disable Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0400/1257] staging: greybus: uart: fix racy TIOCMIWAIT implementation Greg Kroah-Hartman
` (599 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Rob Clark,
Dmitry Baryshkov, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit ab91ba61871a896ca2ecc6e048d80a152136da44 ]
dsi_tx_buf_alloc_6g() takes a reference to the kms VM with
drm_gpuvm_get() and stores it in msm_host->vm. If
msm_gem_kernel_new() fails, the function returns early without
dropping that reference. Since msm_host->tx_gem_obj is cleared on
the error path, msm_dsi_tx_buf_free() will never see a non-NULL
tx_gem_obj and thus never calls drm_gpuvm_put(), leaking the VM
reference.
Drop the VM reference and clear msm_host->vm on the error path.
Fixes: 5e05be782645 ("drm/msm/dsi: free TX buffer in unbind")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Rob Clark <rob.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/754332/
Link: https://lore.kernel.org/r/20260916175738.2089950-1-vulab@iscas.ac.cn
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/dsi_host.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index b292dfd266d17..d92659d80f172 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -1254,6 +1254,8 @@ int dsi_tx_buf_alloc_6g(struct msm_dsi_host *msm_host, int size)
if (IS_ERR(data)) {
msm_host->tx_gem_obj = NULL;
+ drm_gpuvm_put(msm_host->vm);
+ msm_host->vm = NULL;
return PTR_ERR(data);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0400/1257] staging: greybus: uart: fix racy TIOCMIWAIT implementation
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0399/1257] drm/msm/dsi: Fix VM leak in dsi_tx_buf_alloc_6g() Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0401/1257] staging: rtl8723bs: fix RX buffer OOB write from device-reported length Greg Kroah-Hartman
` (598 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Sasha Levin, stable
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit e94cda6551d4716b17353fc458baa9e85ddea9ff ]
Check the wakeup condition after adding the task to the waitqueue and
updating the task state to avoid missing a racing modem status update or
disconnect.
Store the old icount on entry and do not update it in the completion
handler to avoid missing events or reporting spurious ones (due to modem
status changes before TIOCMIWAIT was called).
Fixes: e68453ed28c5 ("greybus: uart-gb: now builds, more framework added")
Cc: stable@kernel.org # 4.9
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260907095305.130762-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/greybus/uart.c | 30 ++++++++++++++++++------------
1 file changed, 18 insertions(+), 12 deletions(-)
diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c
index 172cf900eaf0b..2c47418a11ef8 100644
--- a/drivers/staging/greybus/uart.c
+++ b/drivers/staging/greybus/uart.c
@@ -53,7 +53,6 @@ struct gb_tty {
spinlock_t read_lock;
spinlock_t write_lock;
struct async_icount iocount;
- struct async_icount oldcount;
wait_queue_head_t wioctl;
struct mutex mutex;
u8 ctrlin; /* input control lines */
@@ -643,11 +642,16 @@ static int wait_serial_change(struct gb_tty *gb_tty, unsigned long arg)
if (!(arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD)))
return -EINVAL;
- do {
+ spin_lock_irq(&gb_tty->read_lock);
+ old = gb_tty->iocount;
+ spin_unlock_irq(&gb_tty->read_lock);
+
+ add_wait_queue(&gb_tty->wioctl, &wait);
+ for (;;) {
+ set_current_state(TASK_INTERRUPTIBLE);
+
spin_lock_irq(&gb_tty->read_lock);
- old = gb_tty->oldcount;
new = gb_tty->iocount;
- gb_tty->oldcount = new;
spin_unlock_irq(&gb_tty->read_lock);
if ((arg & TIOCM_DSR) && (old.dsr != new.dsr))
@@ -657,18 +661,20 @@ static int wait_serial_change(struct gb_tty *gb_tty, unsigned long arg)
if ((arg & TIOCM_RI) && (old.rng != new.rng))
break;
- add_wait_queue(&gb_tty->wioctl, &wait);
- set_current_state(TASK_INTERRUPTIBLE);
- schedule();
- remove_wait_queue(&gb_tty->wioctl, &wait);
if (gb_tty->disconnected) {
- if (arg & TIOCM_CD)
- break;
retval = -ENODEV;
- } else if (signal_pending(current)) {
+ break;
+ }
+
+ schedule();
+
+ if (signal_pending(current)) {
retval = -ERESTARTSYS;
+ break;
}
- } while (!retval);
+ }
+ __set_current_state(TASK_RUNNING);
+ remove_wait_queue(&gb_tty->wioctl, &wait);
return retval;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0401/1257] staging: rtl8723bs: fix RX buffer OOB write from device-reported length
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0400/1257] staging: greybus: uart: fix racy TIOCMIWAIT implementation Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0402/1257] media: mali-c55: add padding to mali_c55_params_ccm structure Greg Kroah-Hartman
` (597 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tianchu Chen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianchu Chen <flynnnchen@tencent.com>
[ Upstream commit c52929073fccbc149267a2fd7458626a7e9abcfc ]
sd_recv_rxfifo() trusts the device-reported RX0_REQ_LEN value
(hal->SdioRxFIFOSize, a u16 read from the card via CMD52) as the
size of the next RX packet and passes it to sdio_read_port(), which
copies that many bytes into the recvbuf skb whose data area is only
MAX_RECVBUF_SZ (10240) bytes. A bogus device on SDIO can report up to
65535 bytes, causing a heap overflow of up to ~55KB past the skb
buffer.
Bail out when the RX0_REQ_LEN exceeds MAX_RECVBUF_SZ. This is expected
to keep behavior unchanged on normal devices.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Link: https://patch.msgid.link/8114c3adc1acaea78523cc0fb4d4b25f7665cee9@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/hal/sdio_ops.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/staging/rtl8723bs/hal/sdio_ops.c b/drivers/staging/rtl8723bs/hal/sdio_ops.c
index da2d9088ab5ac..b7a4ab0bedc90 100644
--- a/drivers/staging/rtl8723bs/hal/sdio_ops.c
+++ b/drivers/staging/rtl8723bs/hal/sdio_ops.c
@@ -644,6 +644,13 @@ static struct recv_buf *sd_recv_rxfifo(struct adapter *adapter, u32 size)
struct recv_priv *recv_priv;
struct recv_buf *recvbuf;
+ /* RX0_REQ_LEN is device-reported; the skb buffer is only
+ * MAX_RECVBUF_SZ bytes, reject bogus lengths instead of
+ * overflowing past it.
+ */
+ if (size > MAX_RECVBUF_SZ)
+ return NULL;
+
/* Patch for some SDIO Host 4 bytes issue */
/* ex. RK3188 */
readsize = round_up(size, 4);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0402/1257] media: mali-c55: add padding to mali_c55_params_ccm structure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0401/1257] staging: rtl8723bs: fix RX buffer OOB write from device-reported length Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0403/1257] media: renesas: rzv2h-ivc: manage runtime PM with devres Greg Kroah-Hartman
` (596 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Vincenzo Frascino,
Linus Walleij, Jacopo Mondi, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 2d3873cadda8537d8991abb24484bc590001fcbe ]
The newly added structure has extra padding on the on
some architectures, which triggers a pedantic uapi check:
./usr/include/linux/media/arm/mali-c55-config.h:807:1: error: padding struct size to alignment boundary with 2 bytes [-Werror=padded]
Add explicit padding here to avoid risking information leaks
and incompatibilities between architectures.
Fixes: bb401df68c06 ("media: mali-c55: Add support for CCM")
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/media/arm/mali-c55-config.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/include/uapi/linux/media/arm/mali-c55-config.h b/include/uapi/linux/media/arm/mali-c55-config.h
index ef0fe17df96e7..3ba416d81cd70 100644
--- a/include/uapi/linux/media/arm/mali-c55-config.h
+++ b/include/uapi/linux/media/arm/mali-c55-config.h
@@ -794,12 +794,14 @@ struct mali_c55_params_mesh_shading_selection {
* Q4.8 format
* @gains: Gains for red, green and blue channels in unsigned Q4.8 format
* @offs: Offsets for red, green and blue channels
+ * @__pad: Reserved bytes
*/
struct mali_c55_params_ccm {
struct v4l2_isp_params_block_header header;
__u16 coeffs[3][3];
__u16 gains[3];
__u16 offs[3];
+ __u16 __pad;
};
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0403/1257] media: renesas: rzv2h-ivc: manage runtime PM with devres
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0402/1257] media: mali-c55: add padding to mali_c55_params_ccm structure Greg Kroah-Hartman
@ 2026-11-07 13:44 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0404/1257] media: v4l2-isp: reject zero-sized parameter blocks Greg Kroah-Hartman
` (595 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Jacopo Mondi, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 64e07ebcb3d054672cff678edb5344586d2d3286 ]
Runtime PM is enabled before the IRQ is looked up. If that lookup
fails, probe returns without disabling runtime PM. The subdevice
initialization error path disables runtime PM but leaves autosuspend
enabled, while the remove path does neither.
Use devm_pm_runtime_enable() so the driver core disables autosuspend and
runtime PM on every failed probe and after remove. This also makes the
manual subdevice error unwind unnecessary.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/renesas/rzv2h-ivc/rzv2h-ivc-dev.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-dev.c b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-dev.c
index 355842abb24b8..48f9fd818bfff 100644
--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-dev.c
+++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-dev.c
@@ -202,7 +202,9 @@ static int rzv2h_ivc_probe(struct platform_device *pdev)
pm_runtime_set_autosuspend_delay(dev, 2000);
pm_runtime_use_autosuspend(dev);
- pm_runtime_enable(dev);
+ ret = devm_pm_runtime_enable(dev);
+ if (ret)
+ return ret;
ivc->irqnum = platform_get_irq(pdev, 0);
if (ivc->irqnum < 0)
@@ -210,14 +212,9 @@ static int rzv2h_ivc_probe(struct platform_device *pdev)
ret = rzv2h_ivc_initialise_subdevice(ivc);
if (ret)
- goto err_disable_pm_runtime;
+ return ret;
return 0;
-
-err_disable_pm_runtime:
- pm_runtime_disable(dev);
-
- return ret;
}
static void rzv2h_ivc_remove(struct platform_device *pdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0404/1257] media: v4l2-isp: reject zero-sized parameter blocks
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2026-11-07 13:44 ` [PATCH 7.3 0403/1257] media: renesas: rzv2h-ivc: manage runtime PM with devres Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0405/1257] media: mali-c55: fail power-on when safe stop times out Greg Kroah-Hartman
` (594 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacopo Mondi, David Carlier,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
[ Upstream commit 43ba38e1e02bbfbe99d3c4145df3c24797586c97 ]
v4l2_isp_params_validate_buffer() walks the blocks of a parameters
buffer by adding block->size to the current offset. A block whose
type_info[] entry is an uninitialised hole passes every check on the
way there: a size of 0 is not caught by the block->size > buffer_size
test, and the match against the type info size compares 0 with the
hole's own 0 and passes as well. The walk then makes no forward
progress and loops forever.
Drivers build their type_info[] arrays with designated initialisers
indexed by their block type enumeration, so an enumerator left without
an entry leaves a zeroed hole rather than failing the build. Drivers
call the validator from vb2 .buf_prepare, so such a hole turns a
VIDIOC_QBUF on the parameters video device into an unkillable task
spinning with the queue mutex held.
Reject a block whose type info entry is empty. The driver does not
implement the type, so it cannot tell whether the block content is
meaningful, and accepting it silently would leave that content
unconstrained until a later kernel implements the type and starts
validating it. The size match then always runs against a non-zero
size, and no block can advance the walk by zero.
Fixes: 3cb6de6fafb8 ("media: v4l2-core: Introduce v4l2-isp.c")
Cc: stable@vger.kernel.org
Suggested-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-isp.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-isp.c b/drivers/media/v4l2-core/v4l2-isp.c
index 1eb46e080afa1..8e6c2ef326aaa 100644
--- a/drivers/media/v4l2-core/v4l2-isp.c
+++ b/drivers/media/v4l2-core/v4l2-isp.c
@@ -99,12 +99,25 @@ int v4l2_isp_params_validate_buffer(struct device *dev, struct vb2_buffer *vb,
return -EINVAL;
}
+ /*
+ * An empty type info entry denotes a block type the driver
+ * does not support. Reject the buffer instead of ignoring the
+ * block: accepting it silently would let userspace fill it
+ * with data that a later kernel, once it implements the type,
+ * would validate and possibly reject.
+ */
+ info = &type_info[block->type];
+ if (!info->size) {
+ dev_dbg(dev, "Unsupported block type %u at offset %zu\n",
+ block->type, block_offset);
+ return -EINVAL;
+ }
+
/*
* Match the block reported size against the type info provided
* one, but allow the block to only contain the header in
* case it is going to be disabled.
*/
- info = &type_info[block->type];
if (block->size != info->size &&
(!(block->flags & V4L2_ISP_PARAMS_FL_BLOCK_DISABLE) ||
block->size != sizeof(*block))) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0405/1257] media: mali-c55: fail power-on when safe stop times out
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0404/1257] media: v4l2-isp: reject zero-sized parameter blocks Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0406/1257] media: mali-c55: Free the ISP control handler on unregister Greg Kroah-Hartman
` (593 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Jacopo Mondi,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 73d3d5c97c9c0d71ef9ac6bc72520fb1dc547702 ]
The power-on path requests safe stop to establish a non-streaming state but
ignores the polling result and publishes runtime resume success.
Power the block back off and propagate a safe-stop timeout.
Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/arm/mali-c55/mali-c55-core.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-core.c b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
index f28e9f4354aca..288fba4831808 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
@@ -730,8 +730,13 @@ static int __mali_c55_power_on(struct mali_c55 *mali_c55)
/* Set safe stop to ensure we're in a non-streaming state */
mali_c55_write(mali_c55, MALI_C55_REG_INPUT_MODE_REQUEST,
MALI_C55_INPUT_SAFE_STOP);
- readl_poll_timeout(mali_c55->base + MALI_C55_REG_MODE_STATUS,
- val, !val, 10 * USEC_PER_MSEC, 250 * USEC_PER_MSEC);
+ ret = readl_poll_timeout(mali_c55->base + MALI_C55_REG_MODE_STATUS,
+ val, !val, 10 * USEC_PER_MSEC, 250 * USEC_PER_MSEC);
+ if (ret) {
+ dev_err(mali_c55->dev, "safe stop timed out\n");
+ __mali_c55_power_off(mali_c55);
+ return ret;
+ }
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0406/1257] media: mali-c55: Free the ISP control handler on unregister
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0405/1257] media: mali-c55: fail power-on when safe stop times out Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0407/1257] media: mali-c55: Check the parameters buffer address before copying Greg Kroah-Hartman
` (592 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Carlier, Jacopo Mondi,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
[ Upstream commit 5f09aaf3fbc0d592df65c1aaa2ad113e56940070 ]
mali_c55_isp_init_controls() initialises isp->handler and adds the
capabilities control, but mali_c55_unregister_isp() never frees it.
Neither v4l2_device_unregister_subdev() nor v4l2_subdev_cleanup()
touches sd->ctrl_handler, so the handler and its control are leaked on
every unbind or module removal. The probe error path already frees it,
and the TPG subdevice does so in its own unregister function.
Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
index e128adf6ee37e..c45a3760e0848 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
@@ -641,6 +641,7 @@ void mali_c55_unregister_isp(struct mali_c55 *mali_c55)
mutex_destroy(&isp->capture_lock);
v4l2_device_unregister_subdev(&isp->sd);
+ v4l2_ctrl_handler_free(&isp->handler);
v4l2_subdev_cleanup(&isp->sd);
media_entity_cleanup(&isp->sd.entity);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0407/1257] media: mali-c55: Check the parameters buffer address before copying
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0406/1257] media: mali-c55: Free the ISP control handler on unregister Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0408/1257] media: mali-c55: Check the statistics buffer address before filling Greg Kroah-Hartman
` (591 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Carlier, Jacopo Mondi,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
[ Upstream commit 901d72d26b6dc135a41e3901b4690de124665d18 ]
mali_c55_params_buf_prepare() copies the parameters buffer supplied by
userspace into the driver's scratch buffer, using the result of
vb2_plane_vaddr() as the source without checking it. The queue accepts
VB2_DMABUF, and vb2_dc_vaddr() returns NULL for an exporter that cannot
be vmapped, so the memcpy() dereferences NULL.
Reject the buffer at prepare time instead.
Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/arm/mali-c55/mali-c55-params.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-params.c b/drivers/media/platform/arm/mali-c55/mali-c55-params.c
index 70106276b7e4e..16e895e3488ec 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-params.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-params.c
@@ -710,6 +710,9 @@ static int mali_c55_params_buf_prepare(struct vb2_buffer *vb)
struct mali_c55 *mali_c55 = params->mali_c55;
int ret;
+ if (!config)
+ return -EFAULT;
+
ret = v4l2_isp_params_validate_buffer_size(mali_c55->dev, vb,
v4l2_isp_buffer_size(MALI_C55_PARAMS_MAX_SIZE));
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0408/1257] media: mali-c55: Check the statistics buffer address before filling
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0407/1257] media: mali-c55: Check the parameters buffer address before copying Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0409/1257] media: mali-c55: Ignore disconnected queues when checking readiness Greg Kroah-Hartman
` (590 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Carlier, Jacopo Mondi,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
[ Upstream commit 907273d00dabc60494a691907cfb9bb9bb50ab2f ]
mali_c55_stats_cpu_read() copies the metering registers into the buffer
returned by vb2_plane_vaddr() without checking it. As for the parameters
queue, a DMABUF whose exporter cannot be vmapped yields NULL, and the
memcpy_fromio() then dereferences it from the threaded interrupt
handler.
Report the failure to mali_c55_stats_fill_buffer() and complete the
buffer with VB2_BUF_STATE_ERROR.
Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/arm/mali-c55/mali-c55-stats.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-stats.c b/drivers/media/platform/arm/mali-c55/mali-c55-stats.c
index 655e52a5f288b..a9c28b090b2a1 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-stats.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-stats.c
@@ -200,9 +200,9 @@ static const struct vb2_ops mali_c55_stats_vb2_ops = {
.stop_streaming = mali_c55_stats_stop_streaming,
};
-static void mali_c55_stats_cpu_read(struct mali_c55_stats *stats,
- struct mali_c55_stats_buf *buf,
- enum mali_c55_config_spaces cfg_space)
+static int mali_c55_stats_cpu_read(struct mali_c55_stats *stats,
+ struct mali_c55_stats_buf *buf,
+ enum mali_c55_config_spaces cfg_space)
{
struct mali_c55 *mali_c55 = stats->mali_c55;
const void __iomem *src;
@@ -211,12 +211,18 @@ static void mali_c55_stats_cpu_read(struct mali_c55_stats *stats,
src = mali_c55->base + MALI_C55_REG_1024BIN_HIST;
dst = vb2_plane_vaddr(&buf->vb.vb2_buf, 0);
+
+ if (!dst)
+ return -EFAULT;
+
memcpy_fromio(dst, src, MALI_C55_1024BIN_HIST_SIZE);
src = mali_c55->base + metering_space_addrs[cfg_space];
dst += MALI_C55_1024BIN_HIST_SIZE;
length = sizeof(struct mali_c55_stats_buffer) - MALI_C55_1024BIN_HIST_SIZE;
memcpy_fromio(dst, src, length);
+
+ return 0;
}
void mali_c55_stats_fill_buffer(struct mali_c55 *mali_c55,
@@ -224,6 +230,7 @@ void mali_c55_stats_fill_buffer(struct mali_c55 *mali_c55,
{
struct mali_c55_stats *stats = &mali_c55->stats;
struct mali_c55_stats_buf *buf = NULL;
+ int ret;
spin_lock(&stats->buffers.lock);
if (!list_empty(&stats->buffers.queue)) {
@@ -239,8 +246,9 @@ void mali_c55_stats_fill_buffer(struct mali_c55 *mali_c55,
buf->vb.sequence = mali_c55->isp.frame_sequence;
buf->vb.vb2_buf.timestamp = ktime_get_boottime_ns();
- mali_c55_stats_cpu_read(stats, buf, cfg_space);
- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
+ ret = mali_c55_stats_cpu_read(stats, buf, cfg_space);
+ vb2_buffer_done(&buf->vb.vb2_buf,
+ ret ? VB2_BUF_STATE_ERROR : VB2_BUF_STATE_DONE);
}
void mali_c55_unregister_stats(struct mali_c55 *mali_c55)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0409/1257] media: mali-c55: Ignore disconnected queues when checking readiness
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0408/1257] media: mali-c55: Check the statistics buffer address before filling Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0410/1257] media: tw686x: fix V4L2 device lifetime on probe failure Greg Kroah-Hartman
` (589 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Jacopo Mondi,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linusw@kernel.org>
[ Upstream commit 9cfc1aca0781ce08e307b6c9dd617d37021544a8 ]
mali_c55_pipeline_ready() waits for every video queue to enter its
start_streaming callback, regardless of whether its media link is enabled.
When libcamera uses the TPG, it disables the statistics and parameters
links and queues only image buffers. Although STREAMON succeeds on the
metadata nodes, videobuf2 never invokes their callbacks without queued
buffers. The ISP and TPG are therefore never enabled and capture hangs.
An unused full-resolution or downscaled output can similarly prevent the
pipeline from starting.
Only require queues connected through enabled media links to have started.
Use media_pad_remote_pad_first() to check the video node pads, retaining
the capability check before accessing the optional downscale device.
The shared readiness check also keeps stream-off consistent: the first
active queue to stop disables the ISP.
Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/arm/mali-c55/mali-c55-core.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-core.c b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
index 288fba4831808..a14c6042345bf 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
@@ -510,11 +510,16 @@ bool mali_c55_pipeline_ready(struct mali_c55 *mali_c55)
struct mali_c55_params *params = &mali_c55->params;
struct mali_c55_stats *stats = &mali_c55->stats;
- return vb2_start_streaming_called(&fr->queue) &&
+ /* Only wait for queues connected through enabled media links. */
+ return (!media_pad_remote_pad_first(&fr->pad) ||
+ vb2_start_streaming_called(&fr->queue)) &&
(!(mali_c55->capabilities & MALI_C55_GPS_DS_PIPE_FITTED) ||
+ !media_pad_remote_pad_first(&ds->pad) ||
vb2_start_streaming_called(&ds->queue)) &&
- vb2_start_streaming_called(¶ms->queue) &&
- vb2_start_streaming_called(&stats->queue);
+ (!media_pad_remote_pad_first(¶ms->pad) ||
+ vb2_start_streaming_called(¶ms->queue)) &&
+ (!media_pad_remote_pad_first(&stats->pad) ||
+ vb2_start_streaming_called(&stats->queue));
}
static int mali_c55_check_hwcfg(struct mali_c55 *mali_c55)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0410/1257] media: tw686x: fix V4L2 device lifetime on probe failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0409/1257] media: mali-c55: Ignore disconnected queues when checking readiness Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0411/1257] media: pvrusb2: Fix USB parent device leak in class_dev_create() Greg Kroah-Hartman
` (588 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit ce6c6dd632b3b4a2c2bfc9efd8f656f4d2137dbd ]
tw686x_video_init() registers the V4L2 device, which initializes its
reference count. Successfully registered video devices take additional
references to the V4L2 device as well.
The probe failure paths currently tear down the PCI resources and then
free the channel arrays and the tw686x device directly. This bypasses
the V4L2 device reference count and the tw686x_dev_release() callback.
If a video device still holds a reference, its eventual release will
drop a reference to the already freed V4L2 device. Even when no extra
references remain, directly freeing the device bypasses the lifetime
management established by v4l2_device_register().
After cleaning up the PCI resources, check whether the V4L2 device was
registered. If so, mark the hardware unavailable and drop the driver's
V4L2 device reference, letting tw686x_dev_release() free the backing
objects when the final reference is released. Keep the existing direct
free path for failures that occur before V4L2 device registration.
This issue was found by manual code inspection.
Fixes: 704a84ccdbf1 ("[media] media: Support Intersil/Techwell TW686x-based video capture cards")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/tw686x/tw686x-core.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/media/pci/tw686x/tw686x-core.c b/drivers/media/pci/tw686x/tw686x-core.c
index 5a4ab329c06e9..1e3079bb8bb45 100644
--- a/drivers/media/pci/tw686x/tw686x-core.c
+++ b/drivers/media/pci/tw686x/tw686x-core.c
@@ -241,6 +241,7 @@ static int tw686x_probe(struct pci_dev *pci_dev,
const struct pci_device_id *pci_id)
{
struct tw686x_dev *dev;
+ unsigned long flags;
int err;
dev = kzalloc_obj(*dev);
@@ -352,6 +353,15 @@ static int tw686x_probe(struct pci_dev *pci_dev,
pci_release_regions(pci_dev);
disable_pci:
pci_disable_device(pci_dev);
+ if (dev->v4l2_dev.dev) {
+ spin_lock_irqsave(&dev->lock, flags);
+ dev->pci_dev = NULL;
+ spin_unlock_irqrestore(&dev->lock, flags);
+
+ v4l2_device_put(&dev->v4l2_dev);
+ return err;
+ }
+
free_audio:
kfree(dev->audio_channels);
free_video:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0411/1257] media: pvrusb2: Fix USB parent device leak in class_dev_create()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0410/1257] media: tw686x: fix V4L2 device lifetime on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0412/1257] media: rtl28xxu: fix SDR platform device leak Greg Kroah-Hartman
` (587 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 02421d7278e4a62c3daf37ad6c45d4af96ee4252 ]
class_dev_create() stores a reference to the USB device obtained with
get_device() in class_dev->parent, which class_dev_destroy() releases.
When device_register() fails the function only drops class_dev, so the
reference to the USB parent device is never released.
Drop the parent reference on the failure path as well.
Fixes: 28c4a5e6d324 ("V4L/DVB: pvrusb2: Fix USB parent device reference count")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c b/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c
index dba43d4c24f23..678e069b4c924 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c
@@ -633,6 +633,7 @@ static void class_dev_create(struct pvr2_sysfs *sfp)
if (ret) {
pvr2_trace(PVR2_TRACE_ERROR_LEGS,
"device_register failed");
+ put_device(class_dev->parent);
put_device(class_dev);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0412/1257] media: rtl28xxu: fix SDR platform device leak
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0411/1257] media: pvrusb2: Fix USB parent device leak in class_dev_create() Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0413/1257] media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler Greg Kroah-Hartman
` (586 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 083a92996598a5080965f1baa84175082e14a45b ]
rtl2832u_tuner_attach() registers an rtl2832_sdr platform device, but
does not unregister it if no driver is bound. It also does not take a
reference on the bound driver module.
Unregister the platform device when no driver is bound or the module
reference cannot be acquired. Drop the module reference in
rtl28xxu_tuner_detach() before unregistering the device.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fixes: a2f7f220df5e ("[media] rtl28xxu: switch SDR module to platform driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 487c6ab784abd..d2957e4bf0173 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -1391,8 +1391,16 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
"rtl2832_sdr",
PLATFORM_DEVID_AUTO,
&pdata, sizeof(pdata));
- if (IS_ERR(pdev) || pdev->dev.driver == NULL)
+ if (IS_ERR(pdev))
break;
+ if (!pdev->dev.driver) {
+ platform_device_unregister(pdev);
+ break;
+ }
+ if (!try_module_get(pdev->dev.driver->owner)) {
+ platform_device_unregister(pdev);
+ break;
+ }
dev->platform_device_sdr = pdev;
break;
default:
@@ -1426,8 +1434,10 @@ static int rtl28xxu_tuner_detach(struct dvb_usb_adapter *adap)
/* remove platform SDR */
pdev = dev->platform_device_sdr;
- if (pdev)
+ if (pdev) {
+ module_put(pdev->dev.driver->owner);
platform_device_unregister(pdev);
+ }
/* remove I2C tuner */
client = dev->i2c_client_tuner;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0413/1257] media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0412/1257] media: rtl28xxu: fix SDR platform device leak Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0414/1257] media: em28xx: fix double free in em28xx_alloc_urbs Greg Kroah-Hartman
` (585 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ginger Li, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ginger Li <ginger.jzllee@gmail.com>
[ Upstream commit c65eb69f8170975802ddbede84420553eb681d62 ]
fimc_lite_subdev_s_stream(on = 0) sets ST_FLITE_OFF outside of the
fimc->slock protected region, and only then stops the capture in the
hardware. flite_irq_handler() runs under fimc->slock and clears
ST_FLITE_OFF, so an interrupt can be handled in between: the handler finds
ST_FLITE_OFF already set, clears it and wakes up fimc->irq_queue before the
capture has actually been stopped. The wait_event_timeout() right after it
then returns immediately and the driver continues as if the capture had
stopped.
Set ST_FLITE_OFF in the same critical section that stops the capture, as
fimc_lite_stop_capture() already does.
Fixes: 6319d6a002be ("[media] fimc-lite: Add ISP FIFO output support")
Cc: stable@vger.kernel.org
Signed-off-by: Ginger Li <ginger.jzllee@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/samsung/exynos4-is/fimc-lite.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/media/platform/samsung/exynos4-is/fimc-lite.c b/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
index 8be20fd32d1c7..ce3634909c8cf 100644
--- a/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
+++ b/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
@@ -1209,9 +1209,8 @@ static int fimc_lite_subdev_s_stream(struct v4l2_subdev *sd, int on)
spin_unlock_irqrestore(&fimc->slock, flags);
}
} else {
- set_bit(ST_FLITE_OFF, &fimc->state);
-
spin_lock_irqsave(&fimc->slock, flags);
+ set_bit(ST_FLITE_OFF, &fimc->state);
flite_hw_capture_stop(fimc);
spin_unlock_irqrestore(&fimc->slock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0414/1257] media: em28xx: fix double free in em28xx_alloc_urbs
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0413/1257] media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0415/1257] media: em28xx: fix inverted tuner capability check for VBI device Greg Kroah-Hartman
` (584 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+6a04efcebe0fc0ce, Kaho Jiang,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaho Jiang <kj2864@nyu.edu>
[ Upstream commit fd427b8adae437cac78a2332241a03cac56e95c2 ]
When allocation of usb_bufs->buf[i] fails, em28xx_alloc_urbs()
explicitly frees all items within usb_bufs->buf before calling
em28xx_uninit_usb_xfer(), which also frees these items, causing them to be
freed twice.
BUG: KASAN: double-free in usb_free_urb.part.0 (drivers/usb/core/urb.c:25 ./include/linux/kref.h:65 drivers/usb/core/urb.c:96)
Free of addr ffff88802fd37c00 by task kworker/1:2/1182
Workqueue: events request_module_async
Call Trace:
kasan_report_invalid_free (mm/kasan/report.c:557)
check_slab_allocation (mm/kasan/common.c:235)
kfree (./include/linux/kasan.h:199 (discriminator 1) mm/slub.c:2693 (discriminator 1) mm/slub.c:6508 (discriminator 1) mm/slub.c:6801 (discriminator 1))
usb_free_urb.part.0 (drivers/usb/core/urb.c:25 ./include/linux/kref.h:65 drivers/usb/core/urb.c:96)
usb_free_urb (drivers/usb/core/urb.c:95)
em28xx_uninit_usb_xfer (drivers/media/usb/em28xx/em28xx-core.c:964)
em28xx_alloc_urbs (drivers/media/usb/em28xx/em28xx-core.c:1076)
em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Allocated by task 1182:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
__kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5414 mm/slub.c:5439)
em28xx_alloc_urbs (./include/linux/slab.h:995 ./include/linux/slab.h:1312 drivers/media/usb/em28xx/em28xx-core.c:1081)
em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Freed by task 1182:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
kasan_save_free_info (mm/kasan/generic.c:584)
__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
kfree (./include/linux/kasan.h:235 mm/slub.c:2748 mm/slub.c:6508 mm/slub.c:6801)
em28xx_alloc_urbs (drivers/media/usb/em28xx/em28xx-core.c:1084)
em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Remove the explicit cleanup loop and let em28xx_uninit_usb_xfer()
handle the cleanup.
Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers")
Cc: stable@vger.kernel.org
Reported-by: co+6a04efcebe0fc0ce@bugs.sh
Assisted-by: LLM
Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/em28xx/em28xx-core.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index 0b998e7cafef8..62a1c25a2de13 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -1080,9 +1080,6 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
if (!usb_bufs->buf[i]) {
- for (i--; i >= 0; i--)
- kfree(usb_bufs->buf[i]);
-
em28xx_uninit_usb_xfer(dev, mode);
return -ENOMEM;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0415/1257] media: em28xx: fix inverted tuner capability check for VBI device
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0414/1257] media: em28xx: fix double free in em28xx_alloc_urbs Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0416/1257] dm: fix a bug in dm_accept_partial_bio Greg Kroah-Hartman
` (583 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christopher Snowhill, Hans Verkuil,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Snowhill <chris@kode54.net>
[ Upstream commit a8296bfabd1112e690aad9acc7de3c431f39d0e6 ]
Commit 8e53399c63c3 ("media: em28xx: Add support for Empia em2828X
bridge") changed the condition for setting V4L2_CAP_TUNER on the VBI
device from "dev->tuner_type != TUNER_ABSENT" to a check of the video
device's capabilities, but inverted it: the VBI node now advertises a
tuner only when the video node does not have one.
On boards without a tuner (e.g. the MyGica iGrabber, card=105) the VBI
device's device_caps therefore contain V4L2_CAP_TUNER, while the shared
vidioc_querycap() correctly omits it from cap->capabilities. This trips
the sanity check in v4l_querycap() whenever the VBI node is queried,
for example by udev's v4l_id on every hotplug:
WARNING: drivers/media/v4l2-core/v4l2-ioctl.c:1119 at v4l_querycap+0xff/0x110 [videodev]
(cap->capabilities & (vfd->device_caps | V4L2_CAP_DEVICE_CAPS)) != (vfd->device_caps | V4L2_CAP_DEVICE_CAPS)
It also leaves the tuner ioctls enabled on the VBI node of tuner-less
boards and disables them on boards that do have a tuner.
Restore the intended logic so the VBI device has V4L2_CAP_TUNER exactly
when the video device does.
Fixes: 8e53399c63c3 ("media: em28xx: Add support for Empia em2828X bridge")
Assisted-by: LLM
Signed-off-by: Christopher Snowhill <chris@kode54.net>
Cc: stable@vger.kernel.org
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/em28xx/em28xx-video.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index 79af154767c17..e441f221dbb7a 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -3001,7 +3001,7 @@ static int em28xx_v4l2_init(struct em28xx *dev)
v4l2->vbi_dev.queue->lock = &v4l2->vb_vbi_queue_lock;
v4l2->vbi_dev.device_caps = V4L2_CAP_STREAMING |
V4L2_CAP_READWRITE | V4L2_CAP_VBI_CAPTURE;
- if ((v4l2->vdev.device_caps & V4L2_CAP_TUNER) == 0)
+ if (v4l2->vdev.device_caps & V4L2_CAP_TUNER)
v4l2->vbi_dev.device_caps |= V4L2_CAP_TUNER;
/* disable inapplicable ioctls */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0416/1257] dm: fix a bug in dm_accept_partial_bio
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0415/1257] media: em28xx: fix inverted tuner capability check for VBI device Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0417/1257] dm-writecache: report I/O error if flush failed Greg Kroah-Hartman
` (582 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit a279804752e6c767b7f9ecbb32a15bdfd2b80aea ]
dm-writecache doesn't work in pmem mode - mkfs.ext4 and the following
fsck.ext4 fail with data corruption reported.
The commit 7dd76d1feec7 ("dm: improve bio splitting and associated IO
accounting") introduced a latent bug in dm_accept_partial_bio - it set
tio->io->sectors = n_sectors;. This is incorrect, according to the
diagram in the source code at dm_accept_partial_bio, it should be the
size of regions 1+2, not the region 2 alone.
The latent bug become real bug with the commit 8b211aaccb91 ("dm: add two
stage requeue mechanism").
dm-writecache in pmem mode is the only target that actually advances bio
with bio_advance and then calls dm_accept_partial_bio (so, the region 1
is non-empty). All the other targets call dm_accept_partial_bio with
region 1 empty, so bug went unnoticed for so long.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Fixes: 8b211aaccb91 ("dm: add two stage requeue mechanism")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index eb9e32995b79c..1881d86111fb2 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1350,7 +1350,7 @@ void dm_accept_partial_bio(struct bio *bio, unsigned int n_sectors)
* for accounting but it is being reduced so update accordingly.
*/
dm_io_set_flag(io, DM_IO_WAS_SPLIT);
- io->sectors = n_sectors;
+ io->sectors = *tio->len_ptr;
io->sector_offset = bio_sectors(io->orig_bio);
}
EXPORT_SYMBOL_GPL(dm_accept_partial_bio);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0417/1257] dm-writecache: report I/O error if flush failed
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0416/1257] dm: fix a bug in dm_accept_partial_bio Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0418/1257] dm-writecache: fix a quirk in statistics Greg Kroah-Hartman
` (581 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 78a6afc2999d26e5a30a56db77db34c22b88f5d5 ]
There was a bug that if writecache_flush fails due to I/O error, the
error is not reported in the FUA bio. This commit fixes it.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: opencode:big-pickle
Cc: stable@vger.kernel.org
Fixes: 48debafe4f2f ("dm: add writecache target")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 978646f71f996..5804cbc62a511 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -1493,10 +1493,13 @@ static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio
}
} while (bio->bi_iter.bi_size);
- if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks))
+ if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks)) {
writecache_flush(wc);
- else
+ if (writecache_has_error(wc))
+ bio->bi_status = BLK_STS_IOERR;
+ } else {
writecache_schedule_autocommit(wc);
+ }
return WC_MAP_SUBMIT;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0418/1257] dm-writecache: fix a quirk in statistics
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0417/1257] dm-writecache: report I/O error if flush failed Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0419/1257] dm-writecache: fix a crash if we attempt to use non-dax device Greg Kroah-Hartman
` (580 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit c1ab80af0d99a906b60b769f2e692c37d2db1323 ]
writecache_bio_copy_ssd() unconditionally adds the number of extra blocks
in the merged bio to stats.writes_allocate. That is only correct when the
entries were taken off the freelist.
When the function is called with search_used == true -- i.e. from the
write_hits_uncommitted / write_hits_committed paths in
writecache_map_write() -- the first entry was found in the rbtree and
every following entry is picked up with rb_next(), so nothing is
allocated at all. Accordingly the writes_allocate++ that accompanies a
successful writecache_pop_from_freelist() is skipped for that case, but
the batch accounting below still adds n - 1.
An in-place overwrite of n contiguous cached blocks therefore reports n -
1 allocations that never happened. Only the dmsetup status output is
affected; there is no functional change.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Fixes: b2676e1482af ("dm writecache: count number of blocks written, not number of write bios")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 5804cbc62a511..e4559d1de3dde 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -1424,7 +1424,8 @@ static void writecache_bio_copy_ssd(struct dm_writecache *wc, struct bio *bio,
dm_accept_partial_bio(bio, bio_size >> SECTOR_SHIFT);
wc->stats.writes += bio->bi_iter.bi_size >> wc->block_size_bits;
- wc->stats.writes_allocate += (bio->bi_iter.bi_size - wc->block_size) >> wc->block_size_bits;
+ if (!search_used)
+ wc->stats.writes_allocate += (bio->bi_iter.bi_size - wc->block_size) >> wc->block_size_bits;
if (unlikely(wc->uncommitted_blocks >= wc->autocommit_blocks)) {
wc->uncommitted_blocks = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0419/1257] dm-writecache: fix a crash if we attempt to use non-dax device
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0418/1257] dm-writecache: fix a quirk in statistics Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0420/1257] dm-writecache: fix uncommitted_blocks underflow Greg Kroah-Hartman
` (579 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit b15dc73f60ebf02410bc7014ce34fb7fd1040045 ]
If we specify a non-DAX device as a cache device in the 'P' mode,
dm-writecache crashes on NULL pointer dereference inside dax_synchronous.
Note that this is not a security bug because only root can trigger it.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: a46624580376 ("dm writecache: reject asynchronous pmem devices")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index e4559d1de3dde..6ec3e20553174 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -2502,6 +2502,11 @@ static int writecache_ctr(struct dm_target *ti, unsigned int argc, char **argv)
}
if (WC_MODE_PMEM(wc)) {
+ if (!wc->ssd_dev->dax_dev) {
+ r = -EOPNOTSUPP;
+ ti->error = "Cache device is not a DAX device";
+ goto bad;
+ }
if (!dax_synchronous(wc->ssd_dev->dax_dev)) {
r = -EOPNOTSUPP;
ti->error = "Asynchronous persistent memory not supported as pmem cache";
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0420/1257] dm-writecache: fix uncommitted_blocks underflow
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0419/1257] dm-writecache: fix a crash if we attempt to use non-dax device Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0421/1257] dm-writecache: fix REQ_FUA processing Greg Kroah-Hartman
` (578 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 8a0cc5f3446a324b13f62020eeddb32d6ba1c2db ]
Revert the commit 39495b12ef1cf602e6abd350dce2ef4199906531
writecache_bio_copy_ssd sets wc->uncommitted_blocks = 0; and then queues
the flush work: queue_work(wc->writeback_wq, &wc->flush_work);
It may be possible that discard is dispatched in this window, and the
discard would decrement wc->uncommitted_blocks to -1U.
Note that this bug is benign - wc->uncommitted_blocks is only used to
trigged autocommit, so decrementing it to -1U will trigger a spurious
autocommit, but won't cause any data corruption.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Fixes: 39495b12ef1c ("dm writecache: correct uncommitted_block when discarding uncommitted entry")
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 6ec3e20553174..302ebed4e6ceb 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -899,8 +899,6 @@ static void writecache_discard(struct dm_writecache *wc, sector_t start, sector_
}
discarded_something = true;
}
- if (!writecache_entry_is_committed(wc, e))
- wc->uncommitted_blocks--;
writecache_free_entry(wc, e);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0421/1257] dm-writecache: fix REQ_FUA processing
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0420/1257] dm-writecache: fix uncommitted_blocks underflow Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0422/1257] KVM: arm64: Fix MMFR0 TGRAN advertisement for pVMs Greg Kroah-Hartman
` (577 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit c0df022cb0fa2bbee74bd9b90c66790bcd4e3050 ]
REQ_FUA did not flush metadata in SSD mode, this commit fixes it.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Fixes: c1005322ff02 ("dm writecache: handle REQ_FUA")
Assisted-by: Claude:claude-opus-5
Assisted-by: Codex:gpt-6-sol
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 45 +++++++++++++++++++++++++++++---------
1 file changed, 35 insertions(+), 10 deletions(-)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 302ebed4e6ceb..75287f1667fdc 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -194,6 +194,7 @@ struct dm_writecache {
struct task_struct *endio_thread;
struct task_struct *flush_thread;
+ spinlock_t flush_list_lock;
struct bio_list flush_list;
struct dm_kcopyd_client *dm_kcopyd;
@@ -1288,9 +1289,11 @@ static int writecache_flush_thread(void *data)
struct bio *bio;
wc_lock(wc);
+ spin_lock_irq(&wc->flush_list_lock);
bio = bio_list_pop(&wc->flush_list);
if (!bio) {
set_current_state(TASK_INTERRUPTIBLE);
+ spin_unlock_irq(&wc->flush_list_lock);
wc_unlock(wc);
if (unlikely(kthread_should_stop())) {
@@ -1301,6 +1304,7 @@ static int writecache_flush_thread(void *data)
schedule();
continue;
}
+ spin_unlock_irq(&wc->flush_list_lock);
if (bio_op(bio) == REQ_OP_DISCARD) {
writecache_discard(wc, bio->bi_iter.bi_sector,
@@ -1322,9 +1326,12 @@ static int writecache_flush_thread(void *data)
static void writecache_offload_bio(struct dm_writecache *wc, struct bio *bio)
{
+ unsigned long flags;
+ spin_lock_irqsave(&wc->flush_list_lock, flags);
if (bio_list_empty(&wc->flush_list))
wake_up_process(wc->flush_thread);
bio_list_add(&wc->flush_list, bio);
+ spin_unlock_irqrestore(&wc->flush_list_lock, flags);
}
enum wc_map_op {
@@ -1436,6 +1443,8 @@ static void writecache_bio_copy_ssd(struct dm_writecache *wc, struct bio *bio,
static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio *bio)
{
struct wc_entry *e;
+ enum wc_map_op ret = WC_MAP_SUBMIT;
+ bool need_flush = false;
do {
bool found_entry = false;
@@ -1472,7 +1481,8 @@ static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio
writecache_map_remap_origin(wc, bio, e);
wc->stats.writes_around += bio->bi_iter.bi_size >> wc->block_size_bits;
wc->stats.writes += bio->bi_iter.bi_size >> wc->block_size_bits;
- return WC_MAP_REMAP_ORIGIN;
+ ret = WC_MAP_REMAP_ORIGIN;
+ goto flush_pmem_and_ret;
}
wc->stats.writes_blocked_on_freelist++;
writecache_wait_on_freelist(wc);
@@ -1486,21 +1496,25 @@ static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio
if (WC_MODE_PMEM(wc)) {
bio_copy_block(wc, bio, memory_data(wc, e));
wc->stats.writes++;
+ need_flush = true;
} else {
writecache_bio_copy_ssd(wc, bio, e, search_used);
return WC_MAP_REMAP;
}
} while (bio->bi_iter.bi_size);
- if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks)) {
- writecache_flush(wc);
- if (writecache_has_error(wc))
- bio->bi_status = BLK_STS_IOERR;
- } else {
- writecache_schedule_autocommit(wc);
+flush_pmem_and_ret:
+ if (need_flush) {
+ if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks)) {
+ writecache_flush(wc);
+ if (writecache_has_error(wc))
+ ret = WC_MAP_ERROR;
+ } else {
+ writecache_schedule_autocommit(wc);
+ }
}
- return WC_MAP_SUBMIT;
+ return ret;
}
static enum wc_map_op writecache_map_flush(struct dm_writecache *wc, struct bio *bio)
@@ -1590,7 +1604,10 @@ static int writecache_map(struct dm_target *ti, struct bio *bio)
case WC_MAP_REMAP:
/* make sure that writecache_end_io decrements bio_in_progress: */
- bio->bi_private = (void *)1;
+ if (unlikely(bio->bi_opf & REQ_FUA) && bio_op(bio) == REQ_OP_WRITE)
+ bio->bi_private = (void *)3;
+ else
+ bio->bi_private = (void *)1;
atomic_inc(&wc->bio_in_progress[bio_data_dir(bio)]);
wc_unlock(wc);
return DM_MAPIO_REMAPPED;
@@ -1620,12 +1637,19 @@ static int writecache_end_io(struct dm_target *ti, struct bio *bio, blk_status_t
{
struct dm_writecache *wc = ti->private;
- if (bio->bi_private == (void *)1) {
+ if (bio->bi_private == (void *)1 || bio->bi_private == (void *)3) {
int dir = bio_data_dir(bio);
+ bool fua = bio->bi_private == (void *)3;
if (atomic_dec_and_test(&wc->bio_in_progress[dir]))
if (unlikely(waitqueue_active(&wc->bio_in_progress_wait[dir])))
wake_up(&wc->bio_in_progress_wait[dir]);
+
+ if (fua && likely(*status == BLK_STS_OK)) {
+ bio->bi_private = NULL;
+ writecache_offload_bio(wc, bio);
+ return DM_ENDIO_INCOMPLETE;
+ }
} else if (bio->bi_private == (void *)2) {
dm_iot_io_end(&wc->iot, 1);
}
@@ -2522,6 +2546,7 @@ static int writecache_ctr(struct dm_target *ti, unsigned int argc, char **argv)
wc->memory_map_size -= (uint64_t)wc->start_sector << SECTOR_SHIFT;
+ spin_lock_init(&wc->flush_list_lock);
bio_list_init(&wc->flush_list);
wc->flush_thread = kthread_run(writecache_flush_thread, wc, "dm_writecache_flush");
if (IS_ERR(wc->flush_thread)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0422/1257] KVM: arm64: Fix MMFR0 TGRAN advertisement for pVMs
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0421/1257] dm-writecache: fix REQ_FUA processing Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0423/1257] pps: generators: stop the generator on unregister Greg Kroah-Hartman
` (576 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Donnefort, Fuad Tabba,
Fuad Tabba, Marc Zyngier, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <vdonnefort@google.com>
[ Upstream commit 6c29285e78b5e4811145ebda382ac0ba732ce56a ]
Protected VM ID register emulation leaves unlisted fields at 0. This
creates two issues for TGRAN:
* TGRAN16: 0 means non-implemented. It prevents 16KB protected VMs
from booting even when the hardware supports it.
* TGRAN4|TGRAN64: 0 means implemented. This may falsely advertise the
feature even when the hardware does not support it.
Advertise all the TGRAN fields in pvmid_aa64mmfr0 so that the hardware
support is properly propagated.
Cc: stable@vger.kernel.org
Fixes: 6c30bfb18d0b ("KVM: arm64: Add handlers for protected VM System Registers")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://patch.msgid.link/20260928095454.3255918-2-vdonnefort@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/hyp/nvhe/sys_regs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/kvm/hyp/nvhe/sys_regs.c b/arch/arm64/kvm/hyp/nvhe/sys_regs.c
index 8758c68017765..ec469d96516a5 100644
--- a/arch/arm64/kvm/hyp/nvhe/sys_regs.c
+++ b/arch/arm64/kvm/hyp/nvhe/sys_regs.c
@@ -121,6 +121,9 @@ static const struct pvm_ftr_bits pvmid_aa64mmfr0[] = {
MAX_FEAT(ID_AA64MMFR0_EL1, SNSMEM, IMP),
MAX_FEAT(ID_AA64MMFR0_EL1, BIGENDEL0, IMP),
MAX_FEAT(ID_AA64MMFR0_EL1, EXS, IMP),
+ MAX_FEAT(ID_AA64MMFR0_EL1, TGRAN4, IMP),
+ MAX_FEAT(ID_AA64MMFR0_EL1, TGRAN16, IMP),
+ MAX_FEAT(ID_AA64MMFR0_EL1, TGRAN64, IMP),
FEAT_END
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0423/1257] pps: generators: stop the generator on unregister
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0422/1257] KVM: arm64: Fix MMFR0 TGRAN advertisement for pVMs Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0424/1257] block: drop the cached plug time when blk_add_rq_to_plug() flushes Greg Kroah-Hartman
` (575 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rodolfo Giometti, Danish Khateeb,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danish Khateeb <danishkhateeb03@gmail.com>
[ Upstream commit 3e75af9f41c7509884d0955245dec2b791287e8c ]
Both generator drivers stop their timer and then call
pps_gen_unregister_source(): pps_gen_tio_remove() cancels its hrtimer
and disables the TIO, and pps_gen_dummy_exit() deletes its timer. But
/dev/pps-genN and the sysfs "enable" attribute are still there until
the unregister, and a PPS_GEN_SETENABLE or a write to "enable" in
between starts the timer again. Nothing stops it after that: TIO's
hrtimer keeps running in the devm memory freed by the unbind, and the
dummy's timer is left in the unloaded module.
The drivers can't avoid this by unregistering first, as TIO's timer
callback uses pps_gen, which the unregister may free.
Stop the generator in pps_gen_unregister_cdev() instead, under
info_lock after the device and its sysfs files are gone, when nothing
can enable it again. pps_gen_unregister_source() then also does what
its kernel-doc says: "it disables the generator so no pulses are
generated anymore".
Fixes: 86b525bed275 ("drivers pps: add PPS generators support")
Cc: stable@vger.kernel.org
Suggested-by: Rodolfo Giometti <giometti@enneenne.com>
Assisted-by: LLM
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Link: https://patch.msgid.link/20260929124937.51114-4-danishkhateeb03@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pps/generators/pps_gen.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/pps/generators/pps_gen.c b/drivers/pps/generators/pps_gen.c
index d80e28dc31dca..452cc12a96f27 100644
--- a/drivers/pps/generators/pps_gen.c
+++ b/drivers/pps/generators/pps_gen.c
@@ -228,9 +228,18 @@ static void pps_gen_unregister_cdev(struct pps_gen_device *pps_gen)
* An open file keeps pps_gen around, but the driver may free info as
* soon as we return. The sysfs files are gone now, so wait for the
* ioctls using info and make later ones fail.
+ *
+ * The driver may have stopped the generator before calling us, but
+ * userspace could have enabled it again since. Nothing can enable it
+ * after this point, so stop it here for good.
*/
- scoped_guard(mutex, &pps_gen->info_lock)
+ scoped_guard(mutex, &pps_gen->info_lock) {
+ if (pps_gen->enabled) {
+ pps_gen->info->enable(pps_gen, false);
+ pps_gen->enabled = false;
+ }
pps_gen->info = NULL;
+ }
put_device(&pps_gen->dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0424/1257] block: drop the cached plug time when blk_add_rq_to_plug() flushes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0423/1257] pps: generators: stop the generator on unregister Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0425/1257] block: amiflop: synchronize flush timer before track flush Greg Kroah-Hartman
` (574 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vasileios Almpanis, Jens Axboe,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasileios Almpanis <vasileios.almpanis@virtuozzo.com>
[ Upstream commit e0f2224433b15a57125d6ac5d46182f99c6c9d08 ]
blk_time_get_ns() caches the current time in the task's plug. The idea
is that the cache lives for one plug and is dropped when the plug is
flushed. __blk_flush_plug() and finish_task_switch() do that.
blk_add_rq_to_plug() also flushes, when the plug has too many requests
or the last request is at least BLK_PLUG_FLUSH_SIZE. But it calls
blk_mq_flush_plug_list() directly and never drops the cached time. So
a task that keeps submitting without sleeping stamps every request
after that with the time first cached in the plug. start_time_ns and
io_start_time_ns are stale and the disk stats charge each request for
the whole time since the plug began.
Drop the cached time after the flush, same as __blk_flush_plug() does.
Fixes: da4c8c3d0975 ("block: cache current nsec time in struct blk_plug")
Cc: stable@vger.kernel.org
Signed-off-by: Vasileios Almpanis <vasileios.almpanis@virtuozzo.com>
Link: https://patch.msgid.link/20260930-blk-plug-ts-flush-v1-1-bf8ca7bc5cd6@virtuozzo.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 025a799f35b92..e929f94b25c7f 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1397,6 +1397,7 @@ static void blk_add_rq_to_plug(struct blk_plug *plug, struct request *rq)
(!blk_queue_nomerges(rq->q) &&
blk_rq_bytes(last) >= BLK_PLUG_FLUSH_SIZE)) {
blk_mq_flush_plug_list(plug, false);
+ blk_plug_invalidate_ts();
last = NULL;
trace_block_plug(rq->q);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0425/1257] block: amiflop: synchronize flush timer before track flush
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0424/1257] block: drop the cached plug time when blk_add_rq_to_plug() flushes Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0426/1257] arm64: dts: qcom: shikra: Remove cdsp compute-cb@9 Greg Kroah-Hartman
` (573 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 9690943353cec1690a715e000ba6a74e5139f530 ]
The amiflop track buffer is shared with the timer callback. timer_delete()
does not wait for an in-flight callback, and that callback can rearm itself
when it cannot acquire the floppy controller. A synchronous track flush can
therefore race with the callback.
Stop the timer before synchronous track writes and use timer_delete_sync()
to wait for any callback already running. Keep callback rearming disabled
until the write is complete. Apply this to the FDFMTTRK path as well.
FDFLUSH, FDFMTTRK and close-time flushes run outside the blk-mq
request callback. Freeze their queues so an in-flight request cannot
change the shared track buffer while it is encoded and written. Restart
the timer if a track remains dirty after a failed flush.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260930065951.2932739-1-runyu.xiao@seu.edu.cn
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/amiflop.c | 71 ++++++++++++++++++++++++++++++++++++-----
1 file changed, 63 insertions(+), 8 deletions(-)
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index 2932b6653b6f0..a477ada6b1ef5 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -265,6 +265,8 @@ static struct fd_data_type data_types[] = {
static struct amiga_floppy_struct unit[FD_MAX_UNITS];
static struct timer_list flush_track_timer[FD_MAX_UNITS];
+static DEFINE_SPINLOCK(flush_track_timer_lock);
+static bool flush_track_timer_stopped[FD_MAX_UNITS];
static struct timer_list post_write_timer;
static unsigned long post_write_timer_drive;
static struct timer_list motor_on_timer;
@@ -1370,11 +1372,22 @@ static void flush_track_callback(struct timer_list *timer)
sizeof(flush_track_timer[0]);
nr&=3;
+ spin_lock(&flush_track_timer_lock);
+ if (flush_track_timer_stopped[nr]) {
+ spin_unlock(&flush_track_timer_lock);
+ return;
+ }
+ spin_unlock(&flush_track_timer_lock);
+
writefromint = 1;
if (!try_fdc(nr)) {
/* we might block in an interrupt, so try again later */
- flush_track_timer[nr].expires = jiffies + 1;
- add_timer(flush_track_timer + nr);
+ spin_lock(&flush_track_timer_lock);
+ if (!flush_track_timer_stopped[nr]) {
+ flush_track_timer[nr].expires = jiffies + 1;
+ add_timer(flush_track_timer + nr);
+ }
+ spin_unlock(&flush_track_timer_lock);
return;
}
get_fdc(nr);
@@ -1421,6 +1434,35 @@ static int non_int_flush_track (unsigned long nr)
return 1;
}
+static void flush_track_timer_stop(unsigned int drive)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&flush_track_timer_lock, flags);
+ flush_track_timer_stopped[drive] = true;
+ spin_unlock_irqrestore(&flush_track_timer_lock, flags);
+
+ timer_delete_sync(flush_track_timer + drive);
+}
+
+static void flush_track_timer_start(unsigned int drive)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&flush_track_timer_lock, flags);
+ flush_track_timer_stopped[drive] = false;
+ if (unit[drive].dirty)
+ mod_timer(flush_track_timer + drive, jiffies + 1);
+ spin_unlock_irqrestore(&flush_track_timer_lock, flags);
+}
+
+static void flush_track_timer_sync(unsigned int drive)
+{
+ flush_track_timer_stop(drive);
+ non_int_flush_track(drive);
+ flush_track_timer_start(drive);
+}
+
static int get_track(int drive, int track)
{
int error, errcnt;
@@ -1435,8 +1477,7 @@ static int get_track(int drive, int track)
}
if (unit[drive].dirty == 1) {
- timer_delete(flush_track_timer + drive);
- non_int_flush_track (drive);
+ flush_track_timer_sync(drive);
}
errcnt = 0;
while (errcnt < MAX_ERRORS) {
@@ -1562,6 +1603,12 @@ static int fd_locked_ioctl(struct block_device *bdev, blk_mode_t mode,
case FDFMTTRK:
if (param < p->type->tracks * p->type->heads)
{
+ flush_track_timer_stop(drive);
+ if (unit[drive].dirty == 1 &&
+ !non_int_flush_track(drive)) {
+ flush_track_timer_start(drive);
+ return -EIO;
+ }
get_fdc(drive);
if (fd_seek(drive,param) != 0){
memset(p->trackbuf, FD_FILL_BYTE,
@@ -1570,6 +1617,7 @@ static int fd_locked_ioctl(struct block_device *bdev, blk_mode_t mode,
}
floppy_off(drive);
rel_fdc();
+ flush_track_timer_start(drive);
}
else
return -EINVAL;
@@ -1591,8 +1639,7 @@ static int fd_locked_ioctl(struct block_device *bdev, blk_mode_t mode,
case FDDEFPRM:
return -EINVAL;
case FDFLUSH: /* unconditionally, even if not needed */
- timer_delete(flush_track_timer + drive);
- non_int_flush_track(drive);
+ flush_track_timer_sync(drive);
break;
#ifdef RAW_IOCTL
case IOCTL_RAW_TRACK:
@@ -1611,9 +1658,15 @@ static int fd_ioctl(struct block_device *bdev, blk_mode_t mode,
unsigned int cmd, unsigned long param)
{
int ret;
+ unsigned int memflags = 0;
+ bool freeze_queue = cmd == FDFMTTRK || cmd == FDFLUSH;
mutex_lock(&amiflop_mutex);
+ if (freeze_queue)
+ memflags = blk_mq_freeze_queue(bdev->bd_disk->queue);
ret = fd_locked_ioctl(bdev, mode, cmd, param);
+ if (freeze_queue)
+ blk_mq_unfreeze_queue(bdev->bd_disk->queue, memflags);
mutex_unlock(&amiflop_mutex);
return ret;
@@ -1711,11 +1764,12 @@ static void floppy_release(struct gendisk *disk)
{
struct amiga_floppy_struct *p = disk->private_data;
int drive = p - unit;
+ unsigned int memflags;
mutex_lock(&amiflop_mutex);
+ memflags = blk_mq_freeze_queue(disk->queue);
if (unit[drive].dirty == 1) {
- timer_delete(flush_track_timer + drive);
- non_int_flush_track (drive);
+ flush_track_timer_sync(drive);
}
if (!fd_ref[drive]--) {
@@ -1725,6 +1779,7 @@ static void floppy_release(struct gendisk *disk)
#ifdef MODULE
floppy_off (drive);
#endif
+ blk_mq_unfreeze_queue(disk->queue, memflags);
mutex_unlock(&amiflop_mutex);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0426/1257] arm64: dts: qcom: shikra: Remove cdsp compute-cb@9
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0425/1257] block: amiflop: synchronize flush timer before track flush Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0427/1257] PCI: Disable MSI for ULi M1575 EHCI controller Greg Kroah-Hartman
` (572 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Anandu Krishnan E,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anandu Krishnan E <anandu.e@oss.qualcomm.com>
[ Upstream commit 90ae3eb55ad64dc05ab7ad4a667c921d0504ccc4 ]
Remove the context bank compute-cb@9 as it is a secure context bank
used for secure use cases. Secure use case support is not currently
implemented upstream, and allowing other use cases to be offloaded
onto this context bank results in an SMMU fault.
Fixes: 8b6f81f7801a ("arm64: dts: qcom: shikra: Add CDSP, LPAICP, MPSS remoteproc PAS nodes")
Cc: stable@kernel.org
Signed-off-by: Anandu Krishnan E <anandu.e@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260929-shikra-dts-cdsp-compute-cb-fix-v1-1-90e4abb873d6@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/shikra.dtsi | 6 ------
1 file changed, 6 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/shikra.dtsi b/arch/arm64/boot/dts/qcom/shikra.dtsi
index 92d22e3b6931c..65cc94b9a624b 100644
--- a/arch/arm64/boot/dts/qcom/shikra.dtsi
+++ b/arch/arm64/boot/dts/qcom/shikra.dtsi
@@ -1948,12 +1948,6 @@ compute-cb@6 {
reg = <6>;
iommus = <&apps_smmu 0x0206 0x0000>;
};
-
- compute-cb@9 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <9>;
- iommus = <&apps_smmu 0x0209 0x0000>;
- };
};
};
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0427/1257] PCI: Disable MSI for ULi M1575 EHCI controller
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0426/1257] arm64: dts: qcom: shikra: Remove cdsp compute-cb@9 Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0428/1257] media: uvcvideo: Fix NULL deref on events for uninitialized controls Greg Kroah-Hartman
` (571 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Imre Kaloz, Bjorn Helgaas,
Andy Shevchenko, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Kaloz <kaloz@kernel.org>
[ Upstream commit 5f30217ec296fb5742f6fd306586dbca5b81b4eb ]
With MSI, the ULi M1575 EHCI controller (10b9:5239) intermittently stops
executing its asynchronous schedule. Control transfers time out ("device
not accepting address", "device descriptor read/64"), the port is handed to
the companion OHCI controller, and the device ends up at full speed. On a
configured hub the stall shows up as hub descriptor and status read
failures. Only re-initializing the controller recovers it.
On a Sun Ultra 45, 65 of 800 controller initializations stalled with MSI
and none of 200 with INTx. Each initialization is an unbind and bind of
ehci-pci on the EHCI function, with MSI or INTx selected through its
msi_bus attribute; with this quirk, 0 of 100 cycles of the same loop
stalled. The stall reproduces on a kernel that already contains commit
0b60557230ad ("usb: ehci: Prevent missed ehci interrupts with
edge-triggered MSI").
The OHCI functions (10b9:5237) keep MSI. They showed no stall, and the hub
enumerated through them on MSI during the EHCI failures, so only the EHCI
function is quirked.
The illumos EHCI driver also disables MSI on this chip, in
ehci_register_intrs_and_init_mutex() in
usr/src/uts/common/io/usb/hcd/ehci/ehci_util.c.
Until USB HCDs started trying MSI first in v5.9, the controller always used
INTx. Disable MSI so it uses INTx again on this chipset.
Fixes: 306c54d0edb6 ("usb: hcd: Try MSI interrupts on PCI devices")
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260930191100.6127-1-kaloz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 866493aceef0c..edf035d251cc2 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1945,6 +1945,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4388, quirk_no_msi);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4389, quirk_no_msi);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438a, quirk_no_msi);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438b, quirk_no_msi);
+/* ULi M1575 EHCI (10b9:5239): MSI stalls the async schedule */
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, 0x5239, quirk_no_msi);
static void quirk_pcie_mch(struct pci_dev *pdev)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0428/1257] media: uvcvideo: Fix NULL deref on events for uninitialized controls
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0427/1257] PCI: Disable MSI for ULi M1575 EHCI controller Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0429/1257] crypto: sa2ul - Fix HMAC key preparation Greg Kroah-Hartman
` (570 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Jie Law, Ricardo Ribalda,
Hans de Goede, Laurent Pinchart, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Jie Law <98lawweijie@gmail.com>
[ Upstream commit daa379e2b74d6c10ba4e3b56eeca5aa8c8704fca ]
A null-ptr-deref exists in v6.12.105 and upstream. KASAN crash log:
KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]
Workqueue: events uvc_ctrl_status_event_work
RIP: 0010:uvc_ctrl_status_event+0x105/0x280
uvc_ctrl_status_event_work+0x82/0x240
process_one_work+0x66f/0x10b0
XU controls are initialized lazily, on the first UVCIOC_CTRL_MAP or
UVCIOC_CTRL_QUERY. Until then ctrl->info is all zeroes, so
info.mappings is not a valid list head, list_empty() returns false, and
uvc_ctrl_status_event() walks it from a NULL next pointer.
Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives")
Cc: stable@vger.kernel.org
Signed-off-by: Wei Jie Law <98lawweijie@gmail.com>
Assisted-by: LLM
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://patch.msgid.link/20260907121844.2592492-1-98lawweijie@gmail.com
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 3ca108b83f1da..ea28c4e819bd4 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -2209,7 +2209,7 @@ bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain,
struct uvc_device *dev = chain->dev;
struct uvc_ctrl_work *w = &dev->async_ctrl;
- if (list_empty(&ctrl->info.mappings))
+ if (!ctrl->initialized || list_empty(&ctrl->info.mappings))
return false;
w->data = data;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0429/1257] crypto: sa2ul - Fix HMAC key preparation
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0428/1257] media: uvcvideo: Fix NULL deref on events for uninitialized controls Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0430/1257] crypto: caam - fix double-free in caam_rsa_set_priv_key_form() Greg Kroah-Hartman
` (569 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
[ Upstream commit 780cd10c8e78f97ed768be229acff0ffd5483477 ]
sa_prepare_iopads() has multiple bugs, as discussed at
https://lore.kernel.org/linux-crypto/20260831055141.1632832-1-s-vadapalli@ti.com/T/#u
- Commit 3bf533787910 ("crypto: sha256 - Use the partial block API")
introduced a 1-byte buffer overflow in the SHA-256 case by making the
crypto_shash_export() write 1 more than sizeof(struct sha256_state).
- It never worked for HMAC keys longer than 64 bytes in the first place.
Fix both of these bugs by just using the crypto library to prepare the
key, like what the chelsio and qat drivers do. Also remove the
pointless use of an indirect call.
Fixes: 3bf533787910 ("crypto: sha256 - Use the partial block API")
Fixes: d2c8ac187fc9 ("crypto: sa2ul - Add AEAD algorithm support")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sa2ul.c | 121 +++++++++--------------------------------
1 file changed, 27 insertions(+), 94 deletions(-)
diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
index 9846cbeb3449c..255334b6b0db9 100644
--- a/drivers/crypto/sa2ul.c
+++ b/drivers/crypto/sa2ul.c
@@ -125,9 +125,7 @@ struct sa_cmdl_cfg {
* @mci_enc: Mode Control Instruction for Encryption algorithm
* @mci_dec: Mode Control Instruction for Decryption
* @inv_key: Whether the encryption algorithm demands key inversion
- * @ctx: Pointer to the algorithm context
* @keyed_mac: Whether the authentication algorithm has key
- * @prep_iopad: Function pointer to generate intermediate ipad/opad
*/
struct algo_data {
struct sa_eng_info enc_eng;
@@ -141,10 +139,7 @@ struct algo_data {
u8 *mci_enc;
u8 *mci_dec;
bool inv_key;
- struct sa_tfm_ctx *ctx;
bool keyed_mac;
- void (*prep_iopad)(struct algo_data *algo, const u8 *key,
- u16 key_sz, __be32 *ipad, __be32 *opad);
};
/**
@@ -381,86 +376,36 @@ static void sa_swiz_128(u8 *in, u16 len)
}
}
-/* Prepare the ipad and opad from key as per SHA algorithm step 1*/
-static void prepare_kipad(u8 *k_ipad, const u8 *key, u16 key_sz)
+static void sa_prepare_iopads(struct algo_data *data, const u8 *key, u16 key_sz,
+ __be32 *ipad, __be32 *opad)
{
- int i;
-
- for (i = 0; i < key_sz; i++)
- k_ipad[i] = key[i] ^ 0x36;
-
- /* Instead of XOR with 0 */
- for (; i < SHA1_BLOCK_SIZE; i++)
- k_ipad[i] = 0x36;
-}
-
-static void prepare_kopad(u8 *k_opad, const u8 *key, u16 key_sz)
-{
- int i;
-
- for (i = 0; i < key_sz; i++)
- k_opad[i] = key[i] ^ 0x5c;
-
- /* Instead of XOR with 0 */
- for (; i < SHA1_BLOCK_SIZE; i++)
- k_opad[i] = 0x5c;
-}
-
-static void sa_export_shash(void *state, struct shash_desc *hash,
- int digest_size, __be32 *out)
-{
- struct sha1_state *sha1;
- struct sha256_state *sha256;
- u32 *result;
-
- switch (digest_size) {
- case SHA1_DIGEST_SIZE:
- sha1 = state;
- result = sha1->state;
+ union {
+ struct hmac_sha1_key sha1;
+ struct hmac_sha256_key sha256;
+ } k;
+
+ switch (data->aalg_id) {
+ case SA_AALG_ID_HMAC_SHA1:
+ hmac_sha1_preparekey(&k.sha1, key, key_sz);
+ cpu_to_be32_array(ipad, k.sha1.istate.h,
+ ARRAY_SIZE(k.sha1.istate.h));
+ cpu_to_be32_array(opad, k.sha1.ostate.h,
+ ARRAY_SIZE(k.sha1.ostate.h));
break;
- case SHA256_DIGEST_SIZE:
- sha256 = state;
- result = sha256->state;
+ case SA_AALG_ID_HMAC_SHA2_256:
+ hmac_sha256_preparekey(&k.sha256, key, key_sz);
+ cpu_to_be32_array(ipad, k.sha256.key.istate.h,
+ ARRAY_SIZE(k.sha256.key.istate.h));
+ cpu_to_be32_array(opad, k.sha256.key.ostate.h,
+ ARRAY_SIZE(k.sha256.key.ostate.h));
break;
default:
- dev_err(sa_k3_dev, "%s: bad digest_size=%d\n", __func__,
- digest_size);
+ dev_err(sa_k3_dev, "%s: bad aalg_id=%d\n", __func__,
+ data->aalg_id);
return;
}
- crypto_shash_export(hash, state);
-
- cpu_to_be32_array(out, result, digest_size / 4);
-}
-
-static void sa_prepare_iopads(struct algo_data *data, const u8 *key,
- u16 key_sz, __be32 *ipad, __be32 *opad)
-{
- SHASH_DESC_ON_STACK(shash, data->ctx->shash);
- int block_size = crypto_shash_blocksize(data->ctx->shash);
- int digest_size = crypto_shash_digestsize(data->ctx->shash);
- union {
- struct sha1_state sha1;
- struct sha256_state sha256;
- u8 k_pad[SHA1_BLOCK_SIZE];
- } sha;
-
- shash->tfm = data->ctx->shash;
-
- prepare_kipad(sha.k_pad, key, key_sz);
-
- crypto_shash_init(shash);
- crypto_shash_update(shash, sha.k_pad, block_size);
- sa_export_shash(&sha, shash, digest_size, ipad);
-
- prepare_kopad(sha.k_pad, key, key_sz);
-
- crypto_shash_init(shash);
- crypto_shash_update(shash, sha.k_pad, block_size);
-
- sa_export_shash(&sha, shash, digest_size, opad);
-
- memzero_explicit(&sha, sizeof(sha));
+ memzero_explicit(&k, sizeof(k));
}
/* Derive the inverse key used in AES-CBC decryption operation */
@@ -544,7 +489,7 @@ static void sa_set_sc_auth(struct algo_data *ad, const u8 *key, u16 key_sz,
/* Copy the keys or ipad/opad */
if (ad->keyed_mac)
- ad->prep_iopad(ad, key, key_sz, ipad, opad);
+ sa_prepare_iopads(ad, key, key_sz, ipad, opad);
else {
/* basic hash */
sc_buf[1] |= SA_BASIC_HASH;
@@ -1697,8 +1642,7 @@ static void sa_aead_dma_in_callback(void *data)
aead_request_complete(req, err);
}
-static int sa_cra_init_aead(struct crypto_aead *tfm, const char *hash,
- const char *fallback)
+static int sa_cra_init_aead(struct crypto_aead *tfm, const char *fallback)
{
struct sa_tfm_ctx *ctx = crypto_aead_ctx(tfm);
struct sa_crypto_data *data = dev_get_drvdata(sa_k3_dev);
@@ -1707,12 +1651,6 @@ static int sa_cra_init_aead(struct crypto_aead *tfm, const char *hash,
memzero_explicit(ctx, sizeof(*ctx));
ctx->dev_data = data;
- ctx->shash = crypto_alloc_shash(hash, 0, CRYPTO_ALG_NEED_FALLBACK);
- if (IS_ERR(ctx->shash)) {
- dev_err(sa_k3_dev, "base driver %s couldn't be loaded\n", hash);
- return PTR_ERR(ctx->shash);
- }
-
ctx->fallback.aead = crypto_alloc_aead(fallback, 0,
CRYPTO_ALG_NEED_FALLBACK);
@@ -1744,14 +1682,12 @@ static int sa_cra_init_aead(struct crypto_aead *tfm, const char *hash,
static int sa_cra_init_aead_sha1(struct crypto_aead *tfm)
{
- return sa_cra_init_aead(tfm, "sha1",
- "authenc(hmac(sha1),cbc(aes))");
+ return sa_cra_init_aead(tfm, "authenc(hmac(sha1),cbc(aes))");
}
static int sa_cra_init_aead_sha256(struct crypto_aead *tfm)
{
- return sa_cra_init_aead(tfm, "sha256",
- "authenc(hmac(sha256),cbc(aes))");
+ return sa_cra_init_aead(tfm, "authenc(hmac(sha256),cbc(aes))");
}
static void sa_exit_tfm_aead(struct crypto_aead *tfm)
@@ -1759,7 +1695,6 @@ static void sa_exit_tfm_aead(struct crypto_aead *tfm)
struct sa_tfm_ctx *ctx = crypto_aead_ctx(tfm);
struct sa_crypto_data *data = dev_get_drvdata(sa_k3_dev);
- crypto_free_shash(ctx->shash);
crypto_free_aead(ctx->fallback.aead);
sa_free_ctx_info(&ctx->enc, data);
@@ -1785,7 +1720,6 @@ static int sa_aead_setkey(struct crypto_aead *authenc,
if (key_idx >= 3)
return -EINVAL;
- ad->ctx = ctx;
ad->enc_eng.eng_id = SA_ENG_ID_EM1;
ad->enc_eng.sc_size = SA_CTX_ENC_TYPE1_SZ;
ad->auth_eng.eng_id = SA_ENG_ID_AM1;
@@ -1795,7 +1729,6 @@ static int sa_aead_setkey(struct crypto_aead *authenc,
ad->inv_key = true;
ad->keyed_mac = true;
ad->ealg_id = SA_EALG_ID_AES_CBC;
- ad->prep_iopad = sa_prepare_iopads;
memset(&cfg, 0, sizeof(cfg));
cfg.enc = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0430/1257] crypto: caam - fix double-free in caam_rsa_set_priv_key_form()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0429/1257] crypto: sa2ul - Fix HMAC key preparation Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0431/1257] hwrng: amd - report partial reads in non-blocking mode Greg Kroah-Hartman
` (568 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ZhaoJinming, Sahil Malhotra,
Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhaoJinming <zhaojinming@uniontech.com>
[ Upstream commit a91d9346a70b68f77884cba9d9ec3b70f96bf9d2 ]
caam_rsa_set_priv_key_form() frees the partially allocated key
components (p, q, tmp1, tmp2, dp, dq) with kfree_sensitive() on its
error path, but does not set those pointers to NULL afterward.
When the function returns an error, caam_rsa_set_priv_key() jumps to
its err label and calls caam_rsa_free_key(), which frees all of those
same pointers again, resulting in a double-free.
This is reachable when the allocation of q, tmp1, tmp2, dp, dq or qinv
fails, e.g. under memory pressure, or for a malformed key whose CRT
members decode to zero length and make caam_read_rsa_crt() return NULL.
Set each pointer to NULL right after freeing it so that the subsequent
caam_rsa_free_key() call becomes a no-op for the already-freed fields.
Fixes: 52e26d77b8b3 ("crypto: caam - add support for RSA key form 2")
Cc: stable@vger.kernel.org
Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
Reviewed-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/caam/caampkc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
index cb001aa1de661..ac515ed8c5755 100644
--- a/drivers/crypto/caam/caampkc.c
+++ b/drivers/crypto/caam/caampkc.c
@@ -1033,16 +1033,22 @@ static int caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,
free_dq:
kfree_sensitive(rsa_key->dq);
+ rsa_key->dq = NULL;
free_dp:
kfree_sensitive(rsa_key->dp);
+ rsa_key->dp = NULL;
free_tmp2:
kfree_sensitive(rsa_key->tmp2);
+ rsa_key->tmp2 = NULL;
free_tmp1:
kfree_sensitive(rsa_key->tmp1);
+ rsa_key->tmp1 = NULL;
free_q:
kfree_sensitive(rsa_key->q);
+ rsa_key->q = NULL;
free_p:
kfree_sensitive(rsa_key->p);
+ rsa_key->p = NULL;
return -ENOMEM;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0431/1257] hwrng: amd - report partial reads in non-blocking mode
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0430/1257] crypto: caam - fix double-free in caam_rsa_set_priv_key_form() Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0432/1257] hwrng: ba431 - fix reported byte count Greg Kroah-Hartman
` (567 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit e7f5ce911efb2017381f28bbedb6243a74a9c285 ]
amd_rng_read() returns 0 if no more data is available, even if some data
was already copied to the output buffer. Return the number of copied
bytes instead.
Fixes: 85962d2248fa ("hwrng: amd - Convert to new hwrng read() API")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/amd-rng.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/hw_random/amd-rng.c b/drivers/char/hw_random/amd-rng.c
index dff80daae5877..ac2d257793bf3 100644
--- a/drivers/char/hw_random/amd-rng.c
+++ b/drivers/char/hw_random/amd-rng.c
@@ -80,7 +80,7 @@ static int amd_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
if (timeout-- == 0)
return read;
} else {
- return 0;
+ return read;
}
} else {
*data = ioread32(priv->iobase + RNGDATA);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0432/1257] hwrng: ba431 - fix reported byte count
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0431/1257] hwrng: amd - report partial reads in non-blocking mode Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0433/1257] hwrng: core - reject unknown RNG names Greg Kroah-Hartman
` (566 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit 7e638679883ceff5b6e7b6dcad09c21a105e941f ]
Use the size of the buffer element instead of the pointer size to report
the number of bytes read. Since data is a u32 pointer and sizeof(data)
is 8 bytes on 64-bit systems, using the pointer size reports twice the
number of bytes actually read.
Fixes: 0289e9be5dc2 ("hwrng: ba431 - add support for BA431 hwrng")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/ba431-rng.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/hw_random/ba431-rng.c b/drivers/char/hw_random/ba431-rng.c
index b0a39032c6107..810c8cd5629a9 100644
--- a/drivers/char/hw_random/ba431-rng.c
+++ b/drivers/char/hw_random/ba431-rng.c
@@ -147,7 +147,7 @@ static int ba431_trng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
}
}
- n *= sizeof(data);
+ n *= sizeof(*data);
return (n || !wait) ? n : -EIO;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0433/1257] hwrng: core - reject unknown RNG names
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0432/1257] hwrng: ba431 - fix reported byte count Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0434/1257] crypto: nx - validate ignore before subtracting in decompress Greg Kroah-Hartman
` (565 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Andy Shevchenko,
Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit 7e7be8815143751c20260f80cb4e7fe14dd24b74 ]
In rng_current_store(), err is 0 after successfully locking rng_mutex,
and if the requested RNG name cannot be found, the function reports
success even though the current RNG was not changed.
Set err = -ENODEV before searching the RNG list to reject unknown names.
Fixes: 142a27f0a731 ("hwrng: core - Reset user selected rng by writing "" to rng_current")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 57eeefe90da92..1f9e31cdc7f00 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -376,6 +376,7 @@ static ssize_t rng_current_store(struct device *dev,
cur_rng_set_by_user = 1;
drop_current_rng();
} else {
+ err = -ENODEV;
list_for_each_entry(rng, &rng_list, list) {
if (sysfs_streq(rng->name, buf)) {
err = set_current_rng(rng);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0434/1257] crypto: nx - validate ignore before subtracting in decompress
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0433/1257] hwrng: core - reject unknown RNG names Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0435/1257] crypto: ecc - Handle exceptional points in Shamir multiplication Greg Kroah-Hartman
` (564 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Ariel Panzardo, Herbert Xu,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
[ Upstream commit b5c2df42977390a71f1940def5be9bd5c69ac2e0 ]
The decompress() function subtracts the header-supplied `ignore` value
(a u16 from the compressed stream) from `dlen` (the number of bytes
produced by the decompressor) without checking that ignore <= dlen.
If a caller decompresses a crafted buffer where `hdr->ignore` exceeds
the actual decompressed length, the subtraction wraps around to a
near-UINT_MAX value. The subsequent memcpy() then copies gigabytes of
data past the destination buffer, causing an out-of-bounds kernel write.
Add a bounds check before the subtraction and return -EINVAL if the
value is inconsistent.
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/nx/nx-842.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/crypto/nx/nx-842.c b/drivers/crypto/nx/nx-842.c
index a61208cbcd279..b4404a1389621 100644
--- a/drivers/crypto/nx/nx-842.c
+++ b/drivers/crypto/nx/nx-842.c
@@ -421,6 +421,8 @@ static int decompress(struct nx842_crypto_ctx *ctx,
slen -= spadding;
+ if (ignore > dlen)
+ return -EINVAL;
dlen -= ignore;
if (ignore)
pr_debug("ignoring last %x bytes\n", ignore);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0435/1257] crypto: ecc - Handle exceptional points in Shamir multiplication
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0434/1257] crypto: nx - validate ignore before subtracting in decompress Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0436/1257] drm/panel: simple: Add Raystar RFF500F-AWH-DNN enable delay Greg Kroah-Hartman
` (563 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean,
Ignat Korchagin, Stefan Berger, Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
[ Upstream commit 6fd70bc8bc01a578c7728b7bd1cb5689c62cc5b7 ]
Shamir multiplication mishandles equal points, opposite points and the
point at infinity. This rejects valid ECDSA signatures and can accept
invalid digest/signature tuples when the public key is G or -G. The
kernel incorrectly rejects 16 valid signatures from Wycheproof.
Handle doubling, cancellation and the point at infinity in precomputation
and accumulation. Add regression tests for P-256 ECDSA and 256/512-bit
EC-RDSA. The valid vectors are Wycheproof P1363 secp256r1/SHA-256 cases
60 and 210 converted to X9.62, two constructed ECDSA signatures for
Q = +/-G with k = 2, and six constructed EC-RDSA signatures for Q = G,
-G and -2G. Also add two invalid P-256 digest/signature tuples for
Q = +/-G that must return -EKEYREJECTED.
Fixes: 0d7a78643f69 ("crypto: ecrdsa - add EC-RDSA (GOST 34.10) algorithm")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Ignat Korchagin <ignat@linux.win>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/ecc.c | 33 ++++-
crypto/testmgr.c | 11 +-
crypto/testmgr.h | 327 ++++++++++++++++++++++++++++++++++++++++++++++-
3 files changed, 363 insertions(+), 8 deletions(-)
diff --git a/crypto/ecc.c b/crypto/ecc.c
index 3250a464b8523..c7366eb7ce1f1 100644
--- a/crypto/ecc.c
+++ b/crypto/ecc.c
@@ -1423,9 +1423,22 @@ static void ecc_point_add(const struct ecc_point *result,
vli_set(result->x, q->x, ndigits);
vli_set(result->y, q->y, ndigits);
vli_mod_sub(z, result->x, p->x, curve->p, ndigits);
+ if (vli_is_zero(z, ndigits)) {
+ if (vli_cmp(p->y, q->y, ndigits)) {
+ /* P + (-P) is the point at infinity. */
+ vli_clear(result->x, ndigits);
+ vli_clear(result->y, ndigits);
+ return;
+ }
+ /* The co-Z addition formula does not handle P == Q. */
+ z[0] = 1;
+ ecc_point_double_jacobian(result->x, result->y, z, curve);
+ goto out;
+ }
vli_set(px, p->x, ndigits);
vli_set(py, p->y, ndigits);
xycz_add(px, py, result->x, result->y, curve);
+out:
vli_mod_inv(z, z, curve->p, ndigits);
apply_z(result->x, result->y, z, curve);
}
@@ -1465,22 +1478,38 @@ void ecc_point_mult_shamir(const struct ecc_point *result,
vli_set(rx, point->x, ndigits);
vli_set(ry, point->y, ndigits);
vli_clear(z + 1, ndigits - 1);
- z[0] = 1;
+ z[0] = !ecc_point_is_zero(point);
for (--i; i >= 0; i--) {
ecc_point_double_jacobian(rx, ry, z, curve);
idx = !!vli_test_bit(u1, i);
idx |= (!!vli_test_bit(u2, i)) << 1;
point = points[idx];
- if (point) {
+ if (point && !ecc_point_is_zero(point)) {
u64 tx[ECC_MAX_DIGITS];
u64 ty[ECC_MAX_DIGITS];
u64 tz[ECC_MAX_DIGITS];
+ if (vli_is_zero(z, ndigits)) {
+ /* Adding to infinity starts a new accumulator. */
+ vli_set(rx, point->x, ndigits);
+ vli_set(ry, point->y, ndigits);
+ z[0] = 1;
+ continue;
+ }
vli_set(tx, point->x, ndigits);
vli_set(ty, point->y, ndigits);
apply_z(tx, ty, z, curve);
vli_mod_sub(tz, rx, tx, curve->p, ndigits);
+ if (vli_is_zero(tz, ndigits)) {
+ if (!vli_cmp(ry, ty, ndigits))
+ ecc_point_double_jacobian(rx, ry, z,
+ curve);
+ else
+ /* Adding opposite points yields infinity. */
+ vli_clear(z, ndigits);
+ continue;
+ }
xycz_add(tx, ty, rx, ry, curve);
vli_mod_mult_fast(z, z, tz, curve);
}
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 4958211fbfa93..9419d61d06027 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -3958,16 +3958,17 @@ static int test_sig_one(struct crypto_sig *tfm, const struct sig_testvec *vecs)
*/
err = crypto_sig_verify(tfm, vecs->c, vecs->c_size,
vecs->m, vecs->m_size);
- if (err) {
- pr_err("alg: sig: verify test failed: err %d\n", err);
- return err;
+ if (err != vecs->verify_error) {
+ pr_err("alg: sig: verify test failed: expected %d, got %d\n",
+ vecs->verify_error, err);
+ return err ?: -EINVAL;
}
/*
* Don't invoke sign test (which requires a private key)
- * for vectors with only a public key.
+ * for vectors with only a public key or an invalid signature.
*/
- if (vecs->public_key_vec)
+ if (vecs->public_key_vec || vecs->verify_error)
return 0;
sig_size = crypto_sig_maxsize(tfm);
diff --git a/crypto/testmgr.h b/crypto/testmgr.h
index c4a15e714ecd1..0ee15a8fae27b 100644
--- a/crypto/testmgr.h
+++ b/crypto/testmgr.h
@@ -161,6 +161,7 @@ struct sig_testvec {
unsigned int param_len;
unsigned int m_size;
unsigned int c_size;
+ int verify_error;
bool public_key_vec;
enum OID algo;
};
@@ -1443,6 +1444,140 @@ static const struct sig_testvec x962_ecdsa_nist_p192_tv_template[] = {
};
static const struct sig_testvec x962_ecdsa_nist_p256_tv_template[] = {
+ /* Invalid signature: Q = G, r = s, e = 3r mod n. */
+ {
+ .key =
+ "\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+ "\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+ "\x96\x4f\xe3\x42\xe2\xfe\x1a\x7f\x9b\x8e\xe7\xeb\x4a\x7c\x0f\x9e"
+ "\x16\x2b\xce\x33\x57\x6b\x31\x5e\xce\xcb\xb6\x40\x68\x37\xbf\x51"
+ "\xf5",
+ .key_len = 65,
+ .m =
+ "\xb2\xc3\x09\x72\x03\x17\x9d\xaa\x5c\x4a\xd8\xff\x02\xfe\xcb\x15"
+ "\x21\x53\x81\x77\x45\xec\x45\x24\x3d\x68\x10\xb9\xf2\xa5\x88\x3a",
+ .m_size = 32,
+ .c =
+ "\x30\x46\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e\x74\x18\xf2"
+ "\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3\x10\x60\x9e"
+ "\x7e\xfa\x58\x39\xd9\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e"
+ "\x74\x18\xf2\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3"
+ "\x10\x60\x9e\x7e\xfa\x58\x39\xd9",
+ .c_size = 72,
+ .verify_error = -EKEYREJECTED,
+ .public_key_vec = true,
+ },
+ /* Invalid signature: Q = -G, r = s, e = 3r mod n. */
+ {
+ .key =
+ "\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+ "\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+ "\x96\xb0\x1c\xbd\x1c\x01\xe5\x80\x65\x71\x18\x14\xb5\x83\xf0\x61"
+ "\xe9\xd4\x31\xcc\xa9\x94\xce\xa1\x31\x34\x49\xbf\x97\xc8\x40\xae"
+ "\x0a",
+ .key_len = 65,
+ .m =
+ "\xb2\xc3\x09\x72\x03\x17\x9d\xaa\x5c\x4a\xd8\xff\x02\xfe\xcb\x15"
+ "\x21\x53\x81\x77\x45\xec\x45\x24\x3d\x68\x10\xb9\xf2\xa5\x88\x3a",
+ .m_size = 32,
+ .c =
+ "\x30\x46\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e\x74\x18\xf2"
+ "\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3\x10\x60\x9e"
+ "\x7e\xfa\x58\x39\xd9\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e"
+ "\x74\x18\xf2\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3"
+ "\x10\x60\x9e\x7e\xfa\x58\x39\xd9",
+ .c_size = 72,
+ .verify_error = -EKEYREJECTED,
+ .public_key_vec = true,
+ },
+ /* Wycheproof secp256r1/SHA-256 tcId 60. */
+ {
+ .key =
+ "\x04\x29\x27\xb1\x05\x12\xba\xe3\xed\xdc\xfe\x46\x78\x28\x12\x8b"
+ "\xad\x29\x03\x26\x99\x19\xf7\x08\x60\x69\xc8\xc4\xdf\x6c\x73\x28"
+ "\x38\xc7\x78\x79\x64\xea\xac\x00\xe5\x92\x1f\xb1\x49\x8a\x60\xf4"
+ "\x60\x67\x66\xb3\xd9\x68\x50\x01\x55\x8d\x1a\x97\x4e\x73\x41\x51"
+ "\x3e",
+ .key_len = 65,
+ .m =
+ "\x70\x23\x9d\xd8\x77\xf7\xc9\x44\xc4\x22\xf4\x4d\xea\x4e\xd1\xa5"
+ "\x2f\x26\x27\x41\x6f\xaf\x2f\x07\x2f\xa5\x0c\x77\x2e\xd6\xf8\x07",
+ .m_size = 32,
+ .c =
+ "\x30\x44\x02\x20\x64\xa1\xaa\xb5\x00\x0d\x0e\x80\x4f\x3e\x2f\xc0"
+ "\x2b\xde\xe9\xbe\x8f\xf3\x12\x33\x4e\x2b\xa1\x6d\x11\x54\x7c\x97"
+ "\x71\x1c\x89\x8e\x02\x20\x6a\xf0\x15\x97\x1c\xc3\x0b\xe6\xd1\xa2"
+ "\x06\xd4\xe0\x13\xe0\x99\x77\x72\xa2\xf9\x1d\x73\x28\x6f\xfd\x68"
+ "\x3b\x9b\xb2\xcf\x4f\x1b",
+ .c_size = 70,
+ .public_key_vec = true,
+ },
+ /* Wycheproof secp256r1/SHA-256 tcId 210. */
+ {
+ .key =
+ "\x04\xc6\xa7\x71\x52\x70\x24\x22\x77\x92\x17\x0a\x6f\x8e\xee\x73"
+ "\x5b\xf3\x2b\x7f\x98\xaf\x66\x9e\xad\x29\x98\x02\xe3\x2d\x7c\x31"
+ "\x07\xbc\x3b\x4b\x5e\x65\xab\x88\x7b\xbd\x34\x35\x72\xb3\xe5\x61"
+ "\x92\x61\xfe\x3a\x07\x3e\x2f\xfd\x78\x41\x2f\x72\x68\x67\xdb\x58"
+ "\x9e",
+ .key_len = 65,
+ .m =
+ "\xbb\x5a\x52\xf4\x2f\x9c\x92\x61\xed\x43\x61\xf5\x94\x22\xa1\xe3"
+ "\x00\x36\xe7\xc3\x2b\x27\x0c\x88\x07\xa4\x19\xfe\xca\x60\x50\x23",
+ .m_size = 32,
+ .c =
+ "\x30\x45\x02\x20\x7c\xf2\x7b\x18\x8d\x03\x4f\x7e\x8a\x52\x38\x03"
+ "\x04\xb5\x1a\xc3\xc0\x89\x69\xe2\x77\xf2\x1b\x35\xa6\x0b\x48\xfc"
+ "\x47\x66\x99\x78\x02\x21\x00\xb6\xdb\x6d\xb6\x24\x92\x49\x25\x49"
+ "\x24\x92\x49\x24\x92\x49\x24\x62\x5b\xd7\xa0\x9b\xec\x4c\xa8\x1b"
+ "\xcd\xd9\xf8\xfd\x6b\x63\xcc",
+ .c_size = 71,
+ .public_key_vec = true,
+ },
+ /* Q = G, d = 1, k = 2. */
+ {
+ .key =
+ "\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+ "\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+ "\x96\x4f\xe3\x42\xe2\xfe\x1a\x7f\x9b\x8e\xe7\xeb\x4a\x7c\x0f\x9e"
+ "\x16\x2b\xce\x33\x57\x6b\x31\x5e\xce\xcb\xb6\x40\x68\x37\xbf\x51"
+ "\xf5",
+ .key_len = 65,
+ .m =
+ "\x35\x9d\x17\x29\xb9\x1a\x52\xe9\x8b\xb5\x95\xc3\x86\x28\x3c\x10"
+ "\x30\x44\x95\x1a\xa1\x08\x20\xf0\xa0\x22\xc4\x18\xc2\x71\xa0\xcc",
+ .m_size = 32,
+ .c =
+ "\x30\x44\x02\x20\x7c\xf2\x7b\x18\x8d\x03\x4f\x7e\x8a\x52\x38\x03"
+ "\x04\xb5\x1a\xc3\xc0\x89\x69\xe2\x77\xf2\x1b\x35\xa6\x0b\x48\xfc"
+ "\x47\x66\x99\x78\x02\x20\x59\x47\xc9\x21\x23\x0e\xd1\x34\x0b\x03"
+ "\xe6\xe3\x45\x6e\xab\x69\xf8\x66\xff\x7e\x8c\x7d\x1e\x13\x23\x17"
+ "\x06\x8a\x84\xec\x1d\x22",
+ .c_size = 70,
+ .public_key_vec = true,
+ },
+ /* Q = -G, d = n - 1, k = 2. */
+ {
+ .key =
+ "\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+ "\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+ "\x96\xb0\x1c\xbd\x1c\x01\xe5\x80\x65\x71\x18\x14\xb5\x83\xf0\x61"
+ "\xe9\xd4\x31\xcc\xa9\x94\xce\xa1\x31\x34\x49\xbf\x97\xc8\x40\xae"
+ "\x0a",
+ .key_len = 65,
+ .m =
+ "\x35\x9d\x17\x29\xb9\x1a\x52\xe9\x8b\xb5\x95\xc3\x86\x28\x3c\x10"
+ "\x30\x44\x95\x1a\xa1\x08\x20\xf0\xa0\x22\xc4\x18\xc2\x71\xa0\xcc",
+ .m_size = 32,
+ .c =
+ "\x30\x45\x02\x20\x7c\xf2\x7b\x18\x8d\x03\x4f\x7e\x8a\x52\x38\x03"
+ "\x04\xb5\x1a\xc3\xc0\x89\x69\xe2\x77\xf2\x1b\x35\xa6\x0b\x48\xfc"
+ "\x47\x66\x99\x78\x02\x21\x00\xdc\x55\x4e\x07\x96\x0b\x81\xb6\x80"
+ "\xb1\xae\xe0\x40\xb9\x90\xa5\xf4\xc4\x90\x49\xbb\xa2\xa1\x62\x70"
+ "\xc5\x88\x51\x39\xe8\xa8\xfb",
+ .c_size = 71,
+ .public_key_vec = true,
+ },
{
.key = /* secp256r1(sha1) */
"\x04\xb9\x7b\xbb\xd7\x17\x64\xd2\x7e\xfc\x81\x5d\x87\x06\x83\x41"
@@ -1827,7 +1962,8 @@ static const struct sig_testvec p1363_ecdsa_nist_p256_tv_template[] = {
};
/*
- * EC-RDSA test vectors are generated by gost-engine.
+ * EC-RDSA test vectors generated by gost-engine, followed by constructed
+ * exceptional-point regression vectors.
*/
static const struct sig_testvec ecrdsa_tv_template[] = {
{
@@ -1973,6 +2109,195 @@ static const struct sig_testvec ecrdsa_tv_template[] = {
.m_size = 64,
.public_key_vec = true,
},
+ /*
+ * Constructed EC-RDSA exceptional-point vectors.
+ * With Q = dG, choose k = z1 + d*z2 (mod n), r = x(kG) mod n,
+ * e = -r/z2 (mod n), and s = r*d + k*e (mod n).
+ * The input digest is e, encoded little-endian.
+ */
+ /* cp256a: Q=G, z1 = 3, z2 = 1. */
+ {
+ .key =
+ "\x04\x40\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x14\x1e\x9f\x9e\x9c\xc9\xac\x22\xb1\xe3\x23\xdf\x2d\x4f"
+ "\x29\x35\x76\x2b\x3f\x45\x5a\x50\xdf\x27\xda\x9c\x98\xe0\x71\xe4"
+ "\x91\x8d",
+ .key_len = 66,
+ .params = /* OID_gostCPSignA */
+ "\x30\x13\x06\x07\x2a\x85\x03\x02\x02\x23\x01\x06\x08\x2a\x85\x03"
+ "\x07\x01\x01\x02\x02",
+ .param_len = 21,
+ .c =
+ "\x1a\xed\x44\xae\xd4\x4a\xed\x44\xae\xd4\x4a\xed\x44\xae\xd4\x49"
+ "\x32\x67\xe0\x26\x16\xfd\xb7\xaf\xa4\xd7\x3e\x61\xd4\xf9\x7b\x94"
+ "\xf7\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe7"
+ "\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe4\xb7",
+ .c_size = 64,
+ .m =
+ "\xdc\xd3\xfd\x46\xcb\x14\x9d\xe1\x8f\x92\x54\xb2\x0c\xa0\x22\x66"
+ "\x18\x9c\x8f\xc1\xf9\x18\x9c\x8f\xc1\xf9\x18\x9c\x8f\xc1\xf9\x08",
+ .m_size = 32,
+ .algo = OID_gost2012PKey256,
+ .public_key_vec = true,
+ },
+ /* cp256a: Q=-G, z1 = 7, z2 = 6. */
+ {
+ .key =
+ "\x04\x40\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x83\xdf\x60\x61\x63\x36\x53\xdd\x4e\x1c\xdc\x20\xd2\xb0"
+ "\xd6\xca\x89\xd4\xc0\xba\xa5\xaf\x20\xd8\x25\x63\x67\x1f\x8e\x1b"
+ "\x6e\x72",
+ .key_len = 66,
+ .params = /* OID_gostCPSignA */
+ "\x30\x13\x06\x07\x2a\x85\x03\x02\x02\x23\x01\x06\x08\x2a\x85\x03"
+ "\x07\x01\x01\x02\x02",
+ .param_len = 21,
+ .c =
+ "\x2a\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+ "\x92\x10\x2d\x68\x19\x8f\x22\xd5\x60\xeb\x59\xd6\xf3\xe5\x9e\xc2"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01",
+ .c_size = 64,
+ .m =
+ "\xc3\x9e\xe5\xf3\xd6\x59\xeb\x60\xd5\x22\x8f\x19\x68\x2d\x10\x92"
+ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\x2a",
+ .m_size = 32,
+ .algo = OID_gost2012PKey256,
+ .public_key_vec = true,
+ },
+ /* cp256a: Q=-2G, z1 = 5, z2 = 2. */
+ {
+ .key =
+ "\x04\x40\x95\xfd\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\x14\x1e\x9f\x9e\x9c\xc9\xac\x22\xb1\xe3\x23\xdf\x2d\x4f"
+ "\x29\x35\x76\x2b\x3f\x45\x5a\x50\xdf\x27\xda\x9c\x98\xe0\x71\xe4"
+ "\x91\x8d",
+ .key_len = 66,
+ .params = /* OID_gostCPSignA */
+ "\x30\x13\x06\x07\x2a\x85\x03\x02\x02\x23\x01\x06\x08\x2a\x85\x03"
+ "\x07\x01\x01\x02\x02",
+ .param_len = 21,
+ .c =
+ "\x7f\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xb6\x30\x88\x38\x4c\xad\x68\x80\x22\xc2\x0d\x84\xdb\xb0\xdc\x47"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01",
+ .c_size = 64,
+ .m =
+ "\x49\xdc\xb0\xdb\x84\x0d\xc2\x22\x80\x68\xad\x4c\x38\x88\x30\xb6"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x7f",
+ .m_size = 32,
+ .algo = OID_gost2012PKey256,
+ .public_key_vec = true,
+ },
+ /* tc512a: Q=G, z1 = 3, z2 = 1. */
+ {
+ .key =
+ "\x04\x81\x80\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\xa4\xf2\x15\x52\xcb\x89\xa5\x89\xb8\xf5\x35\xc2\x5f"
+ "\xfe\x28\x80\xe9\x41\x3a\x0e\xa5\xe6\x75\x3d\xe9\x36\xd0\x4f\xbe"
+ "\x26\x16\xdf\x21\xa9\xef\xcb\xfd\x64\x80\x77\xc1\xab\xf1\xac\x93"
+ "\x1c\x5e\xce\xe6\x50\x54\xe2\x16\x88\x1b\xa6\xe3\x6a\x83\x7a\xe8"
+ "\xcf\x03\x75",
+ .key_len = 131,
+ .params = /* OID_gostTC26Sign512A */
+ "\x30\x0b\x06\x09\x2a\x85\x03\x07\x01\x02\x01\x02\x01",
+ .param_len = 13,
+ .c =
+ "\xd8\xc0\xd7\xe3\xfb\xa6\xca\xff\x6a\xd1\xb4\xb4\x82\x1d\x15\x6f"
+ "\xa7\xc7\xbd\x63\x95\xb8\x29\x0d\xd4\xfa\xb1\x1c\x36\xbd\x32\x8d"
+ "\x1a\xba\xf1\x2e\xbc\x7b\xf2\x02\x96\xf8\xef\x2a\x5e\x72\x64\x86"
+ "\x67\x62\xfb\x62\x8e\x83\x53\x63\xb7\xe6\x78\x3c\x42\xd7\x0d\x1d"
+ "\xb7\xbf\xb8\x09\x56\xc8\x67\x00\x31\xba\x19\x19\x29\xf6\x4e\x30"
+ "\x1d\x68\x16\x34\x23\x6d\x47\xa6\x0e\x57\x1a\x4b\xed\xc0\xef\x25"
+ "\x74\x52\xef\x78\xb5\xb9\x8d\xbb\x3d\x9f\x31\x29\xd9\x34\x94\x33"
+ "\xce\x2a\x3a\x35\xcb\x51\x9c\x91\xe2\xd6\x33\xd7\xb3\x73\xae\x16",
+ .c_size = 128,
+ .m =
+ "\x5f\x04\x9d\x6b\x69\x7d\xf7\xe7\xcb\x1b\x81\x2f\x76\xfe\x20\xcd"
+ "\x2c\xcc\xd0\x74\x63\xfa\x52\x32\x56\xfb\xd3\x3e\xba\xa5\x93\xb3"
+ "\xd9\x10\x3f\x12\xb4\xe5\xa8\xf1\x59\xb8\x92\xdc\xcb\xe9\x97\xe2"
+ "\xcf\xb1\x09\xd6\xe6\xe6\x45\xce\xff\x98\x37\xa9\xf6\x47\x40\x48",
+ .m_size = 64,
+ .algo = OID_gost2012PKey512,
+ .public_key_vec = true,
+ },
+ /* tc512a: Q=-G, z1 = 7, z2 = 6. */
+ {
+ .key =
+ "\x04\x81\x80\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x23\x0b\xea\xad\x34\x76\x5a\x76\x47\x0a\xca\x3d\xa0"
+ "\x01\xd7\x7f\x16\xbe\xc5\xf1\x5a\x19\x8a\xc2\x16\xc9\x2f\xb0\x41"
+ "\xd9\xe9\x20\xde\x56\x10\x34\x02\x9b\x7f\x88\x3e\x54\x0e\x53\x6c"
+ "\xe3\xa1\x31\x19\xaf\xab\x1d\xe9\x77\xe4\x59\x1c\x95\x7c\x85\x17"
+ "\x30\xfc\x8a",
+ .key_len = 131,
+ .params = /* OID_gostTC26Sign512A */
+ "\x30\x0b\x06\x09\x2a\x85\x03\x07\x01\x02\x01\x02\x01",
+ .param_len = 13,
+ .c =
+ "\x7f\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\x93\xf3\x4a\x99\x7a\x46\xc4\x88\xb7\xf9\x15\xc6\xa7\x02\xb0\x30"
+ "\x4d\xa5\x9c\x55\xfd\x69\x5c\x2e\xe5\x66\xd8\xa0\x8f\x88\x59\x37"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03",
+ .c_size = 128,
+ .m =
+ "\x3a\x59\x88\x8f\xa0\xd8\x66\xe5\x2e\x5c\x69\xfd\x55\x9c\xa5\x4d"
+ "\x30\xb0\x02\xa7\xc6\x15\xf9\xb7\x88\xc4\x46\x7a\x99\x4a\xf3\x93"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x7f",
+ .m_size = 64,
+ .algo = OID_gost2012PKey512,
+ .public_key_vec = true,
+ },
+ /* tc512a: Q=-2G, z1 = 5, z2 = 2. */
+ {
+ .key =
+ "\x04\x81\x80\x7c\x13\xea\xd2\xd9\xaf\x82\xb9\x1f\xb2\xfd\xe1\x8d"
+ "\xf4\x5b\x37\xe4\xf2\x04\x6a\x2a\x1d\x15\x16\x95\x2a\x5d\x40\xcd"
+ "\xbb\x34\x44\x2f\x2b\x13\x0a\x47\xb0\xf6\xe5\xa5\x58\x3a\xf4\x54"
+ "\x09\xb0\x1d\xf5\x5c\xf1\xbf\x9d\x86\xa5\x97\xab\x96\x29\x62\xfc"
+ "\xdc\x89\x3b\x76\x3d\x50\x6e\x8a\xcf\x02\x4c\x74\x0e\x6e\xe0\x1f"
+ "\x28\xab\x27\x9b\x20\x02\xc8\xc4\x12\xcb\x8a\xe3\xa4\x27\xce\x39"
+ "\x62\xdf\x35\x6d\xc1\x65\x7f\x7b\x48\x90\x11\x8f\x19\x7c\x1e\x67"
+ "\x91\x97\xeb\x90\x85\x25\xfc\x86\xb3\x88\x6e\x5c\x57\x1f\x1d\x1d"
+ "\x3b\xec\x37",
+ .key_len = 131,
+ .params = /* OID_gostTC26Sign512A */
+ "\x30\x0b\x06\x09\x2a\x85\x03\x07\x01\x02\x01\x02\x01",
+ .param_len = 13,
+ .c =
+ "\x7f\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\x93\xf3\x4a\x99\x7a\x46\xc4\x88\xb7\xf9\x15\xc6\xa7\x02\xb0\x30"
+ "\x4d\xa5\x9c\x55\xfd\x69\x5c\x2e\xe5\x66\xd8\xa0\x8f\x88\x59\x33"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03",
+ .c_size = 128,
+ .m =
+ "\x39\x59\x88\x8f\xa0\xd8\x66\xe5\x2e\x5c\x69\xfd\x55\x9c\xa5\x4d"
+ "\x30\xb0\x02\xa7\xc6\x15\xf9\xb7\x88\xc4\x46\x7a\x99\x4a\xf3\x93"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+ "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x7f",
+ .m_size = 64,
+ .algo = OID_gost2012PKey512,
+ .public_key_vec = true,
+ },
};
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0436/1257] drm/panel: simple: Add Raystar RFF500F-AWH-DNN enable delay
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0435/1257] crypto: ecc - Handle exceptional points in Shamir multiplication Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0437/1257] KVM: arm64: Validate the host vCPUs VM before reading it under pKVM Greg Kroah-Hartman
` (562 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabio Estevam, Neil Armstrong,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <festevam@nabladev.com>
[ Upstream commit a92ed345422cd66329b5e9d4e82b0452e185f36f ]
The RFF500F-AWH-DNN datasheet requires a minimum delay of 250 ms
between display signal output and backlight power-on.
Without this delay, the backlight can expose unsettled panel contents
during display startup, resulting in a brief bright flash.
Set the panel enable delay to the datasheet-specified minimum.
Cc: stable@vger.kernel.org
Fixes: 1b2a9ec82099 ("drm/panel: simple: Add Raystar RFF500F-AWH-DNN panel entry")
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260909201346.937343-1-festevam@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-simple.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index c95964ba25a95..70e37ff12c9e8 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -4354,6 +4354,9 @@ static const struct panel_desc raystar_rff500f_awh_dnn = {
.width = 108,
.height = 65,
},
+ .delay = {
+ .enable = 250,
+ },
.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
.connector_type = DRM_MODE_CONNECTOR_LVDS,
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0437/1257] KVM: arm64: Validate the host vCPUs VM before reading it under pKVM
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0436/1257] drm/panel: simple: Add Raystar RFF500F-AWH-DNN enable delay Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0438/1257] KVM: arm64: Pin the host vCPU before adjusting its PC " Greg Kroah-Hartman
` (561 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Vincent Donnefort,
Joey Gouly, Fuad Tabba, Marc Zyngier, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fuad Tabba <fuad.tabba@linux.dev>
[ Upstream commit cf533b4d3630b229d78ad55567c5db2f365052a2 ]
On an MTE-capable host under pKVM, enter_exception64() reads the VM's
MTE flag through vcpu->kvm, which for a host vCPU is a host-writable
pointer nothing validates. The host can point it at any address in the
hyp linear map and read back bit 1 of that word through PSR_TCO in the
vCPU's CPSR, or panic the hypervisor with an unmapped one.
Get the VM through a get/put pair around the read: a loaded vCPU's is
the hyp VM, an unloaded host vCPU's is read once and pinned, and a
pointer the host never shared leaves TCO clear.
Fixes: ea7fc1bb1cd1b ("KVM: arm64: Introduce MTE VM feature")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260914070536.877D91F000FF@smtp.kernel.org/
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Reviewed-by: Joey Gouly <joey.gouly@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261001135711.1640520-3-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/hyp/exception.c | 5 ++-
arch/arm64/kvm/hyp/include/hyp/adjust_pc.h | 28 ++++++++++++++++
arch/arm64/kvm/hyp/include/nvhe/pkvm.h | 2 ++
arch/arm64/kvm/hyp/nvhe/pkvm.c | 37 ++++++++++++++++++++++
4 files changed, 71 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kvm/hyp/exception.c b/arch/arm64/kvm/hyp/exception.c
index 754e2dc1df54a..6e60d890afa4a 100644
--- a/arch/arm64/kvm/hyp/exception.c
+++ b/arch/arm64/kvm/hyp/exception.c
@@ -70,6 +70,7 @@ static void enter_exception64(struct kvm_vcpu *vcpu, unsigned long target_mode,
enum exception_type type)
{
unsigned long sctlr, vbar, old, new, mode;
+ struct kvm *kvm;
u64 exc_offset;
mode = *vcpu_cpsr(vcpu) & (PSR_MODE_MASK | PSR_MODE32_BIT);
@@ -109,8 +110,10 @@ static void enter_exception64(struct kvm_vcpu *vcpu, unsigned long target_mode,
new |= (old & PSR_C_BIT);
new |= (old & PSR_V_BIT);
- if (kvm_has_mte(kern_hyp_va(vcpu->kvm)))
+ kvm = vcpu_get_kvm(vcpu);
+ if (kvm && kvm_has_mte(kvm))
new |= PSR_TCO_BIT;
+ vcpu_put_kvm(vcpu, kvm);
new |= (old & PSR_DIT_BIT);
diff --git a/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h b/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h
index 4fdfeabefeb43..f55950ee2a7e4 100644
--- a/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h
+++ b/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h
@@ -13,6 +13,34 @@
#include <asm/kvm_emulate.h>
#include <asm/kvm_host.h>
+#ifdef __KVM_NVHE_HYPERVISOR__
+#include <nvhe/pkvm.h>
+
+/* Under pKVM a host vCPU's ->kvm is host-writable. */
+static inline struct kvm *vcpu_get_kvm(struct kvm_vcpu *vcpu)
+{
+ if (is_protected_kvm_enabled())
+ return pkvm_vcpu_get_kvm(vcpu);
+
+ return kern_hyp_va(vcpu->kvm);
+}
+
+static inline void vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm)
+{
+ if (is_protected_kvm_enabled())
+ pkvm_vcpu_put_kvm(vcpu, kvm);
+}
+#else
+static inline struct kvm *vcpu_get_kvm(struct kvm_vcpu *vcpu)
+{
+ return vcpu->kvm;
+}
+
+static inline void vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm)
+{
+}
+#endif
+
static inline void kvm_skip_instr(struct kvm_vcpu *vcpu)
{
if (vcpu_mode_is_32bit(vcpu)) {
diff --git a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
index 5c050f21066ab..5cd8b2769cba7 100644
--- a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
+++ b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
@@ -92,6 +92,8 @@ struct pkvm_hyp_vcpu *pkvm_load_hyp_vcpu(pkvm_handle_t handle,
unsigned int vcpu_idx);
void pkvm_put_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu);
struct pkvm_hyp_vcpu *pkvm_get_loaded_hyp_vcpu(void);
+struct kvm *pkvm_vcpu_get_kvm(struct kvm_vcpu *vcpu);
+void pkvm_vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm);
struct pkvm_hyp_vm *get_pkvm_hyp_vm(pkvm_handle_t handle);
struct pkvm_hyp_vm *get_np_pkvm_hyp_vm(pkvm_handle_t handle);
diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
index 6290c4b62659b..1a17ab23ddfe8 100644
--- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
+++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
@@ -311,6 +311,43 @@ struct pkvm_hyp_vcpu *pkvm_get_loaded_hyp_vcpu(void)
}
+static struct pkvm_hyp_vm *pkvm_get_loaded_hyp_vm(struct kvm_vcpu *vcpu)
+{
+ struct pkvm_hyp_vcpu *hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
+
+ if (hyp_vcpu &&
+ (vcpu == &hyp_vcpu->vcpu || vcpu == hyp_vcpu->host_vcpu))
+ return pkvm_hyp_vcpu_to_hyp_vm(hyp_vcpu);
+
+ return NULL;
+}
+
+/*
+ * A loaded vCPU's VM is the hyp VM. An unloaded host vCPU's is mapped at
+ * EL2 only while pinned, so it's read once and pinned; the pin fails for
+ * memory the host isn't sharing.
+ */
+struct kvm *pkvm_vcpu_get_kvm(struct kvm_vcpu *vcpu)
+{
+ struct pkvm_hyp_vm *hyp_vm = pkvm_get_loaded_hyp_vm(vcpu);
+ struct kvm *kvm;
+
+ if (hyp_vm)
+ return &hyp_vm->kvm;
+
+ kvm = kern_hyp_va(READ_ONCE(vcpu->kvm));
+ if (hyp_pin_shared_mem(kvm, kvm + 1))
+ return NULL;
+
+ return kvm;
+}
+
+void pkvm_vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm)
+{
+ if (kvm && !pkvm_get_loaded_hyp_vm(vcpu))
+ hyp_unpin_shared_mem(kvm, kvm + 1);
+}
+
struct pkvm_hyp_vm *get_pkvm_hyp_vm(pkvm_handle_t handle)
{
struct pkvm_hyp_vm *hyp_vm;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0438/1257] KVM: arm64: Pin the host vCPU before adjusting its PC under pKVM
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0437/1257] KVM: arm64: Validate the host vCPUs VM before reading it under pKVM Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0439/1257] x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n mitigation reporting Greg Kroah-Hartman
` (560 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Donnefort, Joey Gouly,
Fuad Tabba, Marc Zyngier, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fuad Tabba <fuad.tabba@linux.dev>
[ Upstream commit a2bb5f5c67a95ac97fcd6859dab51be421cf26fe ]
Under pKVM, a page the host shares with EL2 is mapped at EL2 only while
it's pinned, and the host vCPU is pinned at its first KVM_RUN.
KVM_SET_VCPU_EVENTS with ext_dabt_pending reaches __kvm_adjust_pc() at
EL2 before that, and dereferencing the unmapped host vCPU panics the
hypervisor. Any process holding /dev/kvm on a pKVM host can trigger it.
Pin the host vCPU around the adjustment when no hyp vCPU is loaded for
it. A loaded hyp vCPU implies it's pinned. A pin fails only for memory
the host isn't sharing, and the request is then dropped like any other
bad host pointer.
Fixes: efa1368ba9f4b ("KVM: arm64: Commit exceptions from KVM_SET_VCPU_EVENTS immediately")
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Reviewed-by: Joey Gouly <joey.gouly@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261001135711.1640520-4-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/hyp/nvhe/hyp-main.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
index ac64a036b0a95..c8e6e50d2f353 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
@@ -543,8 +543,27 @@ static void handle___pkvm_host_mkyoung_guest(struct kvm_cpu_context *host_ctxt)
static void handle___kvm_adjust_pc(struct kvm_cpu_context *host_ctxt)
{
DECLARE_REG(struct kvm_vcpu *, vcpu, host_ctxt, 1);
+ struct pkvm_hyp_vcpu *hyp_vcpu;
+ struct kvm_vcpu *host_vcpu;
+
+ host_vcpu = __get_host_hyp_vcpus(vcpu, &hyp_vcpu);
+ if (host_vcpu) {
+ __kvm_adjust_pc(host_vcpu);
+ return;
+ }
+
+ /*
+ * With no hyp vCPU loaded for it, the host vCPU may be unpinned,
+ * and so unmapped at EL2: its first run pins it. A pin fails only
+ * for memory the host isn't sharing, a bad pointer, so the request
+ * is dropped.
+ */
+ host_vcpu = kern_hyp_va(vcpu);
+ if (hyp_pin_shared_mem(host_vcpu, host_vcpu + 1))
+ return;
- __kvm_adjust_pc(kern_hyp_va(vcpu));
+ __kvm_adjust_pc(host_vcpu);
+ hyp_unpin_shared_mem(host_vcpu, host_vcpu + 1);
}
static void handle___kvm_flush_vm_context(struct kvm_cpu_context *host_ctxt)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0439/1257] x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n mitigation reporting
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0438/1257] KVM: arm64: Pin the host vCPU before adjusting its PC " Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0440/1257] KVM: arm64: vgic-v3: Undo assignment on iodev registration failure Greg Kroah-Hartman
` (559 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pawan Gupta, Kim Phillips,
Borislav Petkov (AMD), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kim Phillips <kim.phillips@amd.com>
[ Upstream commit 1847c80537891baead3975f3ca969233ff7b2a11 ]
When the kernel lacks retpoline support, spectre_v2_select_retpoline()
emits
"Kernel not compiled with retpoline; no mitigation available!"
before returning SPECTRE_V2_NONE to its callers. SPECTRE_V2_NONE is not
the final answer, though: spectre_v2_update_mitigation() runs afterwards
and can still upgrade the mitigation.
On an Intel CPU affected by RETBleed, built with
CONFIG_MITIGATION_IBRS_ENTRY=y and
CONFIG_MITIGATION_RETPOLINE=n,
and booted with spectre_v2=auto, retbleed_select_mitigation() picks
RETBLEED_MITIGATION_IBRS, and spectre_v2_update_mitigation() then promotes
SPECTRE_V2_NONE to SPECTRE_V2_IBRS. The boot log claims no mitigation is
available immediately before reporting
"Spectre V2 : Mitigation: IBRS",
and sysfs reports the machine as mitigated. The message is alarming and
simply wrong.
Drop "no mitigation available!" because the final mitigation state is printed
afterwards in spectre_v2_update_mitigation() anyway.
[ bp: Drop CC:stable, massage commit message. ]
Fixes: 480e803dacf8 ("x86/bugs: Restructure spectre_v2 mitigation")
Suggested-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Assisted-by: LLM
Signed-off-by: Kim Phillips <kim.phillips@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Link: https://patch.msgid.link/20260831210916.987152-1-kim.phillips@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/cpu/bugs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 1b2381da4d831..000ebee2d247b 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1958,7 +1958,7 @@ early_param("spectre_v2", spectre_v2_parse_cmdline);
static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void)
{
if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE)) {
- pr_err("Kernel not compiled with retpoline; no mitigation available!");
+ pr_err("Kernel not compiled with retpoline");
return SPECTRE_V2_NONE;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0440/1257] KVM: arm64: vgic-v3: Undo assignment on iodev registration failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0439/1257] x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n mitigation reporting Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0441/1257] soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup Greg Kroah-Hartman
` (558 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Fuad Tabba,
Marc Zyngier, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 8a88a46b86ca3dbbd24522760d29edfb3f24ac2a ]
vgic_register_redist_iodev() assigns a redistributor region and base
address to the vCPU before adding its iodev to the MMIO bus. However, the
region's free_index is advanced only after registration succeeds.
If kvm_io_bus_register_dev() fails, the vCPU retains the assignment while
free_index still identifies the same slot as free. A later registration can
therefore reuse a slot that remains assigned to the vCPU.
Reserve the slot before registering its iodev. The caller holds slots_lock,
so a registration failure cannot race with a later assignment. Undo the
reservation and clear the cached assignment on failure.
Fixes: dbd9733ab674 ("KVM: arm/arm64: Replace the single rdist region by a list")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20260831081005.41346-2-kmehltretter@gmail.com
[maz: moved helper into the sole caller]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
index 5913a20d83019..8fb0a3eb3457d 100644
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -818,16 +818,21 @@ int vgic_register_redist_iodev(struct kvm_vcpu *vcpu)
rd_dev->nr_regions = ARRAY_SIZE(vgic_v3_rd_registers);
rd_dev->redist_vcpu = vcpu;
+ /* Protected by slots_lock */
+ rdreg->free_index++;
+
mutex_unlock(&kvm->arch.config_lock);
ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, rd_base,
2 * SZ_64K, &rd_dev->dev);
- if (ret)
- return ret;
+ if (ret) {
+ guard(mutex)(&vcpu->kvm->arch.config_lock);
+ vgic_cpu->rdreg->free_index--;
+ vgic_cpu->rdreg = NULL;
+ vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF;
+ }
- /* Protected by slots_lock */
- rdreg->free_index++;
- return 0;
+ return ret;
out_unlock:
mutex_unlock(&kvm->arch.config_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0441/1257] soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0440/1257] KVM: arm64: vgic-v3: Undo assignment on iodev registration failure Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0442/1257] phy: apple: atc: Support DUMMY PIPEHANDLER state in configure_pipehandler Greg Kroah-Hartman
` (557 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Alexey Klimov,
Krzysztof Kozlowski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <alexey.klimov@linaro.org>
[ Upstream commit f7b2b6acf658be412b0c4746d07d210a9e18f13b ]
The setup_cpuhp_and_cpuidle() initialisation sequence currently ignores
the return values of cpuhp_setup_state(), cpu_pm_register_notifier(), and
register_reboot_notifier(). If any of these registrations fail during
probe() routine, the driver returns 0, leaving the driver partially
configured.
Furthermore, if anything after setup_cpuhp_and_cpuidle() fails in probe()
routine, for instance devm_mfd_add_devices(), the probe() lacks an error
path and leaves notifiers and cpu hotplug states registered.
Introduce variables for the cpu hotplug state IDs in exynos_pmu_context
struct, that should be initialised to CPUHP_INVALID by default. Check all
return codes in setup_cpuhp_and_cpuidle(), and add an error path to remove
registered states on failure. Finally, add destroy_cpuhp_and_cpuidle()
helper to safely tear down notifiers and cpu hotplug states.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260513-exynos850-cpuhotplug-v4-0-54fec5f65362@linaro.org?part=3
Fixes: 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for gs101")
Cc: stable@vger.kernel.org
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
Link: https://patch.msgid.link/20260930-exynos-pmu-cpuhp-idle-fixes-v3-1-4269d8425978@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/samsung/exynos-pmu.c | 61 +++++++++++++++++++++++++++-----
1 file changed, 53 insertions(+), 8 deletions(-)
diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c
index efccdd63e40ea..c764f35fbfc25 100644
--- a/drivers/soc/samsung/exynos-pmu.c
+++ b/drivers/soc/samsung/exynos-pmu.c
@@ -38,6 +38,8 @@ struct exynos_pmu_context {
unsigned long *in_cpuhp;
bool sys_insuspend;
bool sys_inreboot;
+ int cpuhp_prepare_state;
+ int cpuhp_online_state;
};
void __iomem *pmu_base_addr;
@@ -458,16 +460,55 @@ static int setup_cpuhp_and_cpuidle(struct device *dev)
gs101_cpuhp_pmu_online(cpu);
/* register CPU hotplug callbacks */
- cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "soc/exynos-pmu:prepare",
- gs101_cpuhp_pmu_online, NULL);
+ pmu_context->cpuhp_prepare_state = CPUHP_INVALID;
+ pmu_context->cpuhp_online_state = CPUHP_INVALID;
- cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "soc/exynos-pmu:online",
- NULL, gs101_cpuhp_pmu_offline);
+ ret = cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "soc/exynos-pmu:prepare",
+ gs101_cpuhp_pmu_online, NULL);
+ if (ret < 0)
+ return ret;
+
+ pmu_context->cpuhp_prepare_state = ret;
+
+ ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "soc/exynos-pmu:online",
+ NULL, gs101_cpuhp_pmu_offline);
+ if (ret < 0)
+ goto clean_cpuhp_state_prepare;
+
+ pmu_context->cpuhp_online_state = ret;
/* register CPU PM notifiers for cpuidle */
- cpu_pm_register_notifier(&gs101_cpu_pm_notifier);
- register_reboot_notifier(&exynos_cpupm_reboot_nb);
- return 0;
+ ret = cpu_pm_register_notifier(&gs101_cpu_pm_notifier);
+ if (ret)
+ goto clean_cpuhp_states;
+
+ ret = register_reboot_notifier(&exynos_cpupm_reboot_nb);
+ if (!ret)
+ /* Success */
+ return ret;
+
+ cpu_pm_unregister_notifier(&gs101_cpu_pm_notifier);
+
+clean_cpuhp_states:
+ cpuhp_remove_state(pmu_context->cpuhp_online_state);
+ pmu_context->cpuhp_online_state = CPUHP_INVALID;
+
+clean_cpuhp_state_prepare:
+ cpuhp_remove_state(pmu_context->cpuhp_prepare_state);
+ pmu_context->cpuhp_prepare_state = CPUHP_INVALID;
+
+ return ret;
+}
+
+static void destroy_cpuhp_and_cpuidle(void)
+{
+ cpu_pm_unregister_notifier(&gs101_cpu_pm_notifier);
+ unregister_reboot_notifier(&exynos_cpupm_reboot_nb);
+
+ if (pmu_context->cpuhp_prepare_state != CPUHP_INVALID)
+ cpuhp_remove_state(pmu_context->cpuhp_prepare_state);
+ if (pmu_context->cpuhp_online_state != CPUHP_INVALID)
+ cpuhp_remove_state(pmu_context->cpuhp_online_state);
}
static int exynos_pmu_probe(struct platform_device *pdev)
@@ -541,8 +582,12 @@ static int exynos_pmu_probe(struct platform_device *pdev)
ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, exynos_pmu_devs,
ARRAY_SIZE(exynos_pmu_devs), NULL, 0, NULL);
- if (ret)
+ if (ret) {
+ if (pmu_context->pmu_data && pmu_context->pmu_data->pmu_cpuhp)
+ destroy_cpuhp_and_cpuidle();
+
return ret;
+ }
if (devm_of_platform_populate(dev))
dev_err(dev, "Error populating children, reboot and poweroff might not work properly\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0442/1257] phy: apple: atc: Support DUMMY PIPEHANDLER state in configure_pipehandler
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0441/1257] soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0443/1257] KVM: arm64: vgic-v3: Roll back assignments from the new region Greg Kroah-Hartman
` (556 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Cristian, Sven Peter,
Janne Grunau, Vinod Koul, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Peter <sven@kernel.org>
[ Upstream commit a2fd3d1f4db720ac1deb477ce4811c5e4e60e5f8 ]
For both Thunderbolt and DisplayPort atcphy_configure_pipehandler is
reached with a request to switch to the DUMMY state (i.e. usb2 only).
With the current code this breaks USB2 when all four SS lanes are used
for DisplayPort AltMode because the -EINVAL is passed all the way back
to the phy_set_mode() call which results in tearing down xhci and dwc3
again.
Let's actually handle that case correctly and also drop the default from
the switch such that we get a compiler warning if another pipehandler
state is ever added and forgotten here.
Reported-by: Paul Cristian <p4ulcristian@gmail.com>
Closes: https://github.com/AsahiLinux/linux/pull/515
Fixes: 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY")
Cc: stable@vger.kernel.org
Signed-off-by: Sven Peter <sven@kernel.org>
Reviewed-by: Janne Grunau <j@jannau.net>
Link: https://patch.msgid.link/20260821-b4-atcphy-usb4-v1-1-45c0b741e0c0@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/apple/atc.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/phy/apple/atc.c b/drivers/phy/apple/atc.c
index 4156fabad742c..a3162f25e6cd6 100644
--- a/drivers/phy/apple/atc.c
+++ b/drivers/phy/apple/atc.c
@@ -1121,7 +1121,7 @@ static int atcphy_configure_pipehandler_dummy(struct apple_atcphy *atcphy)
static int atcphy_configure_pipehandler(struct apple_atcphy *atcphy, bool host)
{
- int ret;
+ int ret = -EINVAL;
lockdep_assert_held(&atcphy->lock);
@@ -1136,8 +1136,10 @@ static int atcphy_configure_pipehandler(struct apple_atcphy *atcphy, bool host)
ret = atcphy_configure_pipehandler_dummy(atcphy);
atcphy->pipehandler_up = false;
break;
- default:
- ret = -EINVAL;
+ case ATCPHY_PIPEHANDLER_STATE_DUMMY:
+ ret = atcphy_configure_pipehandler_dummy(atcphy);
+ atcphy->pipehandler_up = false;
+ break;
}
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0443/1257] KVM: arm64: vgic-v3: Roll back assignments from the new region
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0442/1257] phy: apple: atc: Support DUMMY PIPEHANDLER state in configure_pipehandler Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0444/1257] media: imagination: Fix value clamping in calculate_qp_tables Greg Kroah-Hartman
` (555 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Marc Zyngier,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit a32c01324eb494dda811912eb847b0e907cd7270 ]
A failed REDIST_REGION write unregisters the redistributor iodevs of every
vCPU processed before the failure. This includes vCPUs assigned to older
regions. Their assignments remain cached, so a retry does not register the
iodevs again.
The vCPU whose registration fails has no assignment to roll back. For vCPUs
processed earlier, limit rollback to those assigned to the new region. The
region is removed on failure, so its free_index does not need restoring.
Resetting assignments from older regions is unsafe because a vCPU can own
one before kvm_for_each_vcpu() can see it. Rollback could then move
free_index behind that live assignment.
kvm_vgic_addr() holds slots_lock across the REDIST_REGION write. vCPU
creation takes the same lock before assigning a redistributor. A concurrent
vCPU cannot acquire an assignment from the new region before rollback
completes. The lock also keeps rdreg valid across the config_lock drop
required by MMIO-bus registration.
Fixes: c011f4ea106b ("KVM: arm/arm64: Check vcpu redist base before registering an iodev")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260831081005.41346-3-kmehltretter@gmail.com
[maz: moved helper into the sole caller]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
index 8fb0a3eb3457d..5ab789accc9d4 100644
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -846,7 +846,8 @@ void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu)
kvm_io_bus_unregister_dev(vcpu->kvm, KVM_MMIO_BUS, &rd_dev->dev);
}
-static int vgic_register_all_redist_iodevs(struct kvm *kvm)
+static int vgic_register_all_redist_iodevs(struct kvm *kvm,
+ struct vgic_redist_region *rdreg)
{
struct kvm_vcpu *vcpu;
unsigned long c;
@@ -866,7 +867,14 @@ static int vgic_register_all_redist_iodevs(struct kvm *kvm)
for (i = 0; i < c; i++) {
vcpu = kvm_get_vcpu(kvm, i);
+ if (vcpu->arch.vgic_cpu.rdreg != rdreg)
+ continue;
+
vgic_unregister_redist_iodev(vcpu);
+
+ guard(mutex)(&vcpu->kvm->arch.config_lock);
+ vcpu->arch.vgic_cpu.rdreg = NULL;
+ vcpu->arch.vgic_cpu.rd_iodev.base_addr = VGIC_ADDR_UNDEF;
}
}
@@ -975,10 +983,13 @@ void vgic_v3_free_redist_region(struct kvm *kvm, struct vgic_redist_region *rdre
int vgic_v3_set_redist_base(struct kvm *kvm, u32 index, u64 addr, u32 count)
{
+ struct vgic_redist_region *rdreg;
int ret;
mutex_lock(&kvm->arch.config_lock);
ret = vgic_v3_alloc_redist_region(kvm, index, addr, count);
+ if (!ret)
+ rdreg = vgic_v3_rdist_region_from_index(kvm, index);
mutex_unlock(&kvm->arch.config_lock);
if (ret)
return ret;
@@ -987,12 +998,9 @@ int vgic_v3_set_redist_base(struct kvm *kvm, u32 index, u64 addr, u32 count)
* Register iodevs for each existing VCPU. Adding more VCPUs
* afterwards will register the iodevs when needed.
*/
- ret = vgic_register_all_redist_iodevs(kvm);
+ ret = vgic_register_all_redist_iodevs(kvm, rdreg);
if (ret) {
- struct vgic_redist_region *rdreg;
-
mutex_lock(&kvm->arch.config_lock);
- rdreg = vgic_v3_rdist_region_from_index(kvm, index);
vgic_v3_free_redist_region(kvm, rdreg);
mutex_unlock(&kvm->arch.config_lock);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0444/1257] media: imagination: Fix value clamping in calculate_qp_tables
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0443/1257] KVM: arm64: vgic-v3: Roll back assignments from the new region Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0445/1257] media: v4l2-common: Fix P010 format info Greg Kroah-Hartman
` (554 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Jai Luthra,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit c8454a41da59d51fbcc5743f8c71a03b096a770f ]
The local variable 'val' was never clamped to 1 or 255 because the
return value of clamp() was not used. Fix this by assigning the clamped
value back to 'val'.
Cc: stable@vger.kernel.org
Fixes: a1e294045885 ("media: imagination: Add E5010 JPEG Encoder driver")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/imagination/e5010-jpeg-enc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/imagination/e5010-jpeg-enc.c b/drivers/media/platform/imagination/e5010-jpeg-enc.c
index 42ad9ee3993b4..420cb8bfdb12a 100644
--- a/drivers/media/platform/imagination/e5010-jpeg-enc.c
+++ b/drivers/media/platform/imagination/e5010-jpeg-enc.c
@@ -175,12 +175,12 @@ static void calculate_qp_tables(struct e5010_context *ctx)
long long delta = v4l2_jpeg_ref_table_chroma_qt[i] * contrast + luminosity;
int val = (int)(v4l2_jpeg_ref_table_chroma_qt[i] + delta);
- clamp(val, 1, 255);
+ val = clamp(val, 1, 255);
ctx->chroma_qp[i] = quality == -50 ? 1 : val;
delta = v4l2_jpeg_ref_table_luma_qt[i] * contrast + luminosity;
val = (int)(v4l2_jpeg_ref_table_luma_qt[i] + delta);
- clamp(val, 1, 255);
+ val = clamp(val, 1, 255);
ctx->luma_qp[i] = quality == -50 ? 1 : val;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0445/1257] media: v4l2-common: Fix P010 format info
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0444/1257] media: imagination: Fix value clamping in calculate_qp_tables Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0446/1257] media: sti: delta: use unaligned accessors for MJPEG SOF fields Greg Kroah-Hartman
` (553 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nas Chung, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nas Chung <nas.chung@chipsnmedia.com>
[ Upstream commit 8761a87aff8259eab0add8a9428cee2c280fb6eb ]
V4L2_PIX_FMT_P010 is a 10-bit 4:2:0 semi-planar format, but its
v4l2_format_info() entry described a 4:2:2 layout with a half-width
chroma plane. Correct bpp and vdiv to match P010's real layout,
consistent with the other semi-planar formats.
Cc: stable@vger.kernel.org
Fixes: 5374d8fb75f3 ("media: Add P010 video format")
Signed-off-by: Nas Chung <nas.chung@chipsnmedia.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c
index 65db7340ad384..4de8aa3ef7d2e 100644
--- a/drivers/media/v4l2-core/v4l2-common.c
+++ b/drivers/media/v4l2-core/v4l2-common.c
@@ -323,7 +323,7 @@ const struct v4l2_format_info *v4l2_format_info(u32 format)
{ .format = V4L2_PIX_FMT_NV20, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 5, 10, 0, 0 }, .bpp_div = { 4, 4, 1, 1 }, .hdiv = 2, .vdiv = 1 },
{ .format = V4L2_PIX_FMT_NV24, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 1, .vdiv = 1 },
{ .format = V4L2_PIX_FMT_NV42, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 1, .vdiv = 1 },
- { .format = V4L2_PIX_FMT_P010, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 2, 2, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 2, .vdiv = 1 },
+ { .format = V4L2_PIX_FMT_P010, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 2, 4, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 2, .vdiv = 2 },
{ .format = V4L2_PIX_FMT_P012, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 2, 4, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 2, .vdiv = 2 },
{ .format = V4L2_PIX_FMT_YUV410, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 3, .bpp = { 1, 1, 1, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 4, .vdiv = 4 },
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0446/1257] media: sti: delta: use unaligned accessors for MJPEG SOF fields
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0445/1257] media: v4l2-common: Fix P010 format info Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0447/1257] media: rockchip: rga: quiesce IRQ before releasing m2m state Greg Kroah-Hartman
` (552 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit fdc5bf02aeaef04e7d13895db9b6eaf8083953f9 ]
delta_mjpeg_read_header() scans a compressed MJPEG access unit byte by
byte and passes the bytes after an SOF marker to delta_mjpeg_read_sof().
The SOF parser then reads 16-bit big-endian fields directly from that
byte stream.
The SOF payload is not an aligned object. The marker scan can find the
payload at any byte position, and the SOF layout also puts frame_height
and frame_width after a one-byte sample_precision field. Those fields
therefore sit at odd offsets within the payload even when the payload
base happens to be 2-byte aligned.
Avoid casting the byte stream to __be16 pointers and use
get_unaligned_be16() for the SOF length, height, and width fields.
This issue was detected by our static analysis tool and confirmed by
manual audit. A focused UBSAN alignment validation of the same typed
load shape reported a misaligned __be16 access in delta_mjpeg_read_sof().
Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
index 90e5b2f72c82b..849a5e118aec4 100644
--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
+++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
@@ -4,6 +4,7 @@
* Author: Hugues Fruchet <hugues.fruchet@st.com> for STMicroelectronics.
*/
+#include <linux/unaligned.h>
#include "delta.h"
#include "delta-mjpeg.h"
@@ -48,13 +49,13 @@ static int delta_mjpeg_read_sof(struct delta_ctx *pctx,
goto err_no_more;
memset(header, 0, sizeof(*header));
- header->length = be16_to_cpu(*(__be16 *)(data + offset));
+ header->length = get_unaligned_be16(data + offset);
offset += sizeof(u16);
header->sample_precision = *(u8 *)(data + offset);
offset += sizeof(u8);
- header->frame_height = be16_to_cpu(*(__be16 *)(data + offset));
+ header->frame_height = get_unaligned_be16(data + offset);
offset += sizeof(u16);
- header->frame_width = be16_to_cpu(*(__be16 *)(data + offset));
+ header->frame_width = get_unaligned_be16(data + offset);
offset += sizeof(u16);
header->nb_of_components = *(u8 *)(data + offset);
offset += sizeof(u8);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0447/1257] media: rockchip: rga: quiesce IRQ before releasing m2m state
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0446/1257] media: sti: delta: use unaligned accessors for MJPEG SOF fields Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0448/1257] media: chips-media: wave5: Handle polling IRQ thread failure Greg Kroah-Hartman
` (551 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fan Wu, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit a875c43dd95ee4f9c4e3e5ae1cb8362cc6d7817d ]
rga_remove() releases the m2m state before the IRQ is freed. The IRQ is
devm-managed and is only released once rga_remove() returns, so rga_isr()
can still run while the m2m device state is being torn down.
Store the IRQ number in struct rockchip_rga, unregister the video device
first, and free the IRQ before releasing the m2m state so the handler
cannot run against the freed state.
Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/rockchip/rga/rga.c | 4 +++-
drivers/media/platform/rockchip/rga/rga.h | 1 +
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
index b3cb6bf8eb863..fbc99462dce28 100644
--- a/drivers/media/platform/rockchip/rga/rga.c
+++ b/drivers/media/platform/rockchip/rga/rga.c
@@ -797,6 +797,7 @@ static int rga_probe(struct platform_device *pdev)
ret = irq;
goto err_put_clk;
}
+ rga->irq = irq;
ret = devm_request_irq(rga->dev, irq, rga_isr,
rga_has_internal_iommu(rga) ? 0 : IRQF_SHARED,
@@ -876,8 +877,9 @@ static void rga_remove(struct platform_device *pdev)
v4l2_info(&rga->v4l2_dev, "Removing\n");
- v4l2_m2m_release(rga->m2m_dev);
video_unregister_device(rga->vfd);
+ devm_free_irq(rga->dev, rga->irq, rga);
+ v4l2_m2m_release(rga->m2m_dev);
v4l2_device_unregister(&rga->v4l2_dev);
pm_runtime_disable(rga->dev);
diff --git a/drivers/media/platform/rockchip/rga/rga.h b/drivers/media/platform/rockchip/rga/rga.h
index bd431534d0d39..7bcdf36c11b4d 100644
--- a/drivers/media/platform/rockchip/rga/rga.h
+++ b/drivers/media/platform/rockchip/rga/rga.h
@@ -73,6 +73,7 @@ struct rockchip_rga {
struct device *dev;
struct regmap *grf;
void __iomem *regs;
+ int irq;
struct clk_bulk_data *clks;
int num_clks;
struct rockchip_rga_version version;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0448/1257] media: chips-media: wave5: Handle polling IRQ thread failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0447/1257] media: rockchip: rga: quiesce IRQ before releasing m2m state Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0449/1257] media: chips-media: wave5: Balance runtime PM on encoder close errors Greg Kroah-Hartman
` (550 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 1d563e3d718a1c7c16355843374fbdd4c798ac66 ]
When falling back to polling mode, wave5_vpu_probe() does not check the
return value of kthread_run(). On failure, dev->irq_thread holds an
error pointer instead of a valid task pointer.
Both the probe error path and the remove path only check
dev->irq_thread against NULL before calling kthread_stop() on it, so an
error pointer passes the check and kthread_stop() crashes on it.
Check the kthread_run() result, clear dev->irq_thread and unwind the
probe on failure.
Fixes: e66ff2b08e4e ("media: chips-media: wave5: Fix Null reference while testing fluster")
Cc: stable@vger.kernel.org
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index 76d57c6b636a2..37df270b5f991 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -340,6 +340,13 @@ static int wave5_vpu_probe(struct platform_device *pdev)
dev_err(&pdev->dev, "failed to get irq resource, falling back to polling\n");
sema_init(&dev->irq_sem, 1);
dev->irq_thread = kthread_run(irq_thread, dev, "irq thread");
+ if (IS_ERR(dev->irq_thread)) {
+ ret = PTR_ERR(dev->irq_thread);
+ dev_err(&pdev->dev, "failed to create irq thread\n");
+ dev->irq_thread = NULL;
+ goto err_vdi_release;
+ }
+
hrtimer_setup(&dev->hrtimer, &wave5_vpu_timer_callback, CLOCK_MONOTONIC,
HRTIMER_MODE_REL_PINNED);
dev->worker = kthread_run_worker(0, "vpu_irq_thread");
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0449/1257] media: chips-media: wave5: Balance runtime PM on encoder close errors
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0448/1257] media: chips-media: wave5: Handle polling IRQ thread failure Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0450/1257] media: chips-media: wave5: Check decoder qbuf runtime resume Greg Kroah-Hartman
` (549 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 4009daa5d9a72a67dd497bb4546632b2506a3650 ]
wave5_vpu_enc_close() resumes the device before taking the hardware lock.
Its three error paths call pm_runtime_resume_and_get() again instead of
dropping that reference. Each failure therefore increments the runtime PM
usage count twice and can prevent the device from suspending afterward.
Replace the extra resume calls with pm_runtime_put_sync() to balance the
reference acquired on entry, matching the successful close path. This
aligns wave5_vpu_enc_close() with wave5_vpu_dec_close(), which already
releases the reference on its error paths.
Fixes: 2092b3833487 ("media: chips-media: wave5: Support runtime suspend/resume")
Cc: stable@vger.kernel.org
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/chips-media/wave5/wave5-vpuapi.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c b/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
index f77abd5e122a2..4c1842f02c883 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
@@ -754,7 +754,7 @@ int wave5_vpu_enc_close(struct vpu_instance *inst, u32 *fail_res)
ret = mutex_lock_interruptible(&vpu_dev->hw_lock);
if (ret) {
- pm_runtime_resume_and_get(inst->dev->dev);
+ pm_runtime_put_sync(inst->dev->dev);
return ret;
}
@@ -762,16 +762,13 @@ int wave5_vpu_enc_close(struct vpu_instance *inst, u32 *fail_res)
ret = wave5_vpu_enc_finish_seq(inst, fail_res);
if (ret < 0 && *fail_res != WAVE5_SYSERR_VPU_STILL_RUNNING) {
dev_warn(inst->dev->dev, "enc_finish_seq timed out\n");
- pm_runtime_resume_and_get(inst->dev->dev);
- mutex_unlock(&vpu_dev->hw_lock);
- return ret;
+ goto unlock_and_return;
}
if (*fail_res == WAVE5_SYSERR_VPU_STILL_RUNNING &&
retry++ >= MAX_FIRMWARE_CALL_RETRY) {
- pm_runtime_resume_and_get(inst->dev->dev);
- mutex_unlock(&vpu_dev->hw_lock);
- return -ETIMEDOUT;
+ ret = -ETIMEDOUT;
+ goto unlock_and_return;
}
} while (ret != 0);
@@ -787,10 +784,12 @@ int wave5_vpu_enc_close(struct vpu_instance *inst, u32 *fail_res)
}
wave5_vdi_free_dma_memory(vpu_dev, &p_enc_info->vb_task);
+
+unlock_and_return:
mutex_unlock(&vpu_dev->hw_lock);
pm_runtime_put_sync(inst->dev->dev);
- return 0;
+ return ret;
}
int wave5_vpu_enc_register_frame_buffer(struct vpu_instance *inst, unsigned int num,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0450/1257] media: chips-media: wave5: Check decoder qbuf runtime resume
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0449/1257] media: chips-media: wave5: Balance runtime PM on encoder close errors Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0451/1257] media: meson: vdec: size capture planes from the aligned canvas Greg Kroah-Hartman
` (548 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 158b39a0f7d198454a1fb34dcca5c25de588d54f ]
wave5_vpu_dec_buf_queue_dst() resumes the VPU before it may clear a
decoder display flag. This is needed because clearing the display flag
accesses VPU registers.
However, the return value from pm_runtime_resume_and_get() is ignored.
If the resume fails, pm_runtime_resume_and_get() returns without holding
a runtime PM usage reference. The unconditional
pm_runtime_put_autosuspend() at the end of the function then drops an
unmatched reference.
The failed resume path can also continue into
wave5_vpu_dec_clr_disp_flag() while the device is still suspended.
Check the return value. If the resume fails, complete the queued buffer
with an error and return without touching the hardware or dropping an
unmatched runtime PM reference.
Fixes: cbb9c0d50e47 ("media: chips-media: wave5: Fix SError of kernel panic when closed")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
index 6564cf3ec739b..86bc36ee17fd6 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
@@ -1302,8 +1302,14 @@ static void wave5_vpu_dec_buf_queue_dst(struct vb2_buffer *vb)
struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
struct vpu_instance *inst = vb2_get_drv_priv(vb->vb2_queue);
struct v4l2_m2m_ctx *m2m_ctx = inst->v4l2_fh.m2m_ctx;
+ int ret;
+
+ ret = pm_runtime_resume_and_get(inst->dev->dev);
+ if (ret < 0) {
+ vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
+ return;
+ }
- pm_runtime_resume_and_get(inst->dev->dev);
vbuf->sequence = inst->queued_dst_buf_num++;
if (inst->state == VPU_INST_STATE_PIC_RUN) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0451/1257] media: meson: vdec: size capture planes from the aligned canvas
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0450/1257] media: chips-media: wave5: Check decoder qbuf runtime resume Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0452/1257] media: rockchip: rga: fix rotation on rev0 hardware Greg Kroah-Hartman
` (547 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Freidkin, Dan Carpenter,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Freidkin <freidkin@gmail.com>
[ Upstream commit b3a805dd5a83ba8c85e2085d3411eb9975e0aea4 ]
The decoder writes a whole canvas of ALIGN(width, 32) x ALIGN(height, 32)
(amvdec_set_canvases()) and reports bytesperline = ALIGN(width, 32), but
get_output_size() derives sizeimage from the raw width x height.
When the width is not a multiple of 32 the planes are too small for the
advertised stride: for 720x360 NV12M the luma plane is 262144 bytes while
736 * 360 = 264960 are needed (282624 for the canvas the firmware fills).
The decoder writes past the buffer, and importing the capture dma-buf
into DRM fails: drmModeAddFB2() returns -EINVAL, so e.g. Kodi plays the
sound over a black screen. 1280x720 and 1920x1080 are not affected.
Size the planes from the aligned canvas the hardware actually uses.
Tested on an S905X (GXL p212) board with LibreELEC 12 (6.16.0-rc3):
720x360 and 1920x1080 H.264 play through V4L2 m2m + DRM PRIME with no
AddFB2 errors.
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Freidkin <freidkin@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/meson/vdec/vdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index c18bf352b1996..be29d5a11c2e6 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -34,7 +34,7 @@ struct dummy_buf {
static u32 get_output_size(u32 width, u32 height)
{
- return ALIGN(width * height, SZ_64K);
+ return ALIGN(ALIGN(width, 32) * ALIGN(height, 32), SZ_64K);
}
u32 amvdec_get_output_size(struct amvdec_session *sess)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0452/1257] media: rockchip: rga: fix rotation on rev0 hardware
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0451/1257] media: meson: vdec: size capture planes from the aligned canvas Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0453/1257] media: amphion: drain message work before releasing core state Greg Kroah-Hartman
` (546 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Keeping, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <jkeeping@inmusicbrands.com>
[ Upstream commit a67578c0179850e80cf08b1e0b8b1eb857f0fc46 ]
On RK3288 where the RGA reports version zero [1], rotating a buffer
gives corrupt output where one edge will be truncated. This is a result
of some adjustment done specifically for hardware revision zero. But it
seems this is not necessary and there is no evidence for why this
adjustment should be applied on these hardware revisions.
Comparing the TRMs between RK3288 with revision zero and RK3588 with
revision 3.2 there is evidence of new features supported by later
hardware, but nothing indicating any difference in behaviour for
rotation which is supported by all hardware revisions.
The logic here looks wrong anyway, since it's bizarre that minor
revision zero would need the adjustment for _all_ major revisions. This
was added with the initial version of the driver in commit f7e7b48e6d796
("[media] rockchip/rga: v4l2 m2m support") so there is no detail in the
Git history to indicate why this special-case might be needed.
[1] Comparing with the vendor code, it seems this is actually 1.3 with
the hardware reporting zero more by coincidence than design since the
version register is not defined for RK3288.
Fixes: f7e7b48e6d796 ("[media] rockchip/rga: v4l2 m2m support")
Cc: stable@vger.kernel.org
Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/rockchip/rga/rga-hw.c | 8 --------
1 file changed, 8 deletions(-)
diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c
index be1bc8ddbd03b..2e7ec8b7c20f7 100644
--- a/drivers/media/platform/rockchip/rga/rga-hw.c
+++ b/drivers/media/platform/rockchip/rga/rga-hw.c
@@ -158,7 +158,6 @@ static void rga_cmd_set_dst_addr(struct rga_ctx *ctx, dma_addr_t dma_addr)
static void rga_cmd_set_trans_info(struct rga_ctx *ctx)
{
- struct rockchip_rga *rga = ctx->rga;
u32 *dest = ctx->cmdbuf_virt;
unsigned int scale_dst_w, scale_dst_h;
unsigned int src_h, src_w, dst_h, dst_w;
@@ -251,13 +250,6 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx)
*/
if (src_info.data.rot_mode == RGA_SRC_ROT_MODE_90_DEGREE ||
src_info.data.rot_mode == RGA_SRC_ROT_MODE_270_DEGREE) {
- if (rga->version.major == 0 || rga->version.minor == 0) {
- if (dst_w == src_h)
- src_h -= 8;
- if (abs(src_w - dst_h) < 16)
- src_w -= 16;
- }
-
scale_dst_h = dst_w;
scale_dst_w = dst_h;
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0453/1257] media: amphion: drain message work before releasing core state
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0452/1257] media: rockchip: rga: fix rotation on rev0 hardware Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0454/1257] media: amphion: prevent unbind while video instances are open Greg Kroah-Hartman
` (545 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Ming Qian,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit ec95ae226f240ed657834fe4114abb7067e1af2d ]
vpu_core_unregister() frees core->msg_buffer before cancelling the message
workers, although core->msg_fifo still uses the buffer as its backing
storage. A queued worker can read it after it has been freed.
Drain the core and instance message work first, then release core->vpu
and the FIFO buffer. This follows the ordering in vpu_core_suspend().
Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vpu_core.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index 85cc4a14f8ed3..a0c58ec97a424 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -299,22 +299,23 @@ static void vpu_core_put_vpu(struct vpu_core *core)
core->vpu->put_vpu(core->vpu);
}
+static void vpu_core_cancel_work(struct vpu_core *core);
+
static int vpu_core_unregister(struct device *dev, struct vpu_core *core)
{
list_del_init(&core->list);
- vpu_core_put_vpu(core);
- core->vpu = NULL;
- kfree(core->msg_buffer);
- core->msg_buffer = NULL;
-
if (core->workqueue) {
- cancel_work_sync(&core->msg_work);
- cancel_delayed_work_sync(&core->msg_delayed_work);
+ vpu_core_cancel_work(core);
destroy_workqueue(core->workqueue);
core->workqueue = NULL;
}
+ vpu_core_put_vpu(core);
+ core->vpu = NULL;
+ kfree(core->msg_buffer);
+ core->msg_buffer = NULL;
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0454/1257] media: amphion: prevent unbind while video instances are open
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0453/1257] media: amphion: drain message work before releasing core state Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0455/1257] media: mediatek: vpu: free IRQ before destroying watchdog workqueue Greg Kroah-Hartman
` (544 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Ming Qian,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 96ea6bc6835f1b18b75303d536a7f9a3829c9bc1 ]
An open video instance holds a plain pointer to its devm-allocated core.
Unbinding the core or its parent through sysfs can release that memory
while the instance remains open. A later ioctl or close then uses the
stale pointer.
The video file operations pin the module, but sysfs unbind bypasses that
protection. Suppress manual bind and unbind for both platform drivers,
and warn if core removal ever encounters a live instance.
Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vpu_core.c | 3 +++
drivers/media/platform/amphion/vpu_drv.c | 1 +
2 files changed, 4 insertions(+)
diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index a0c58ec97a424..2e8e08e05de7c 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -696,6 +696,8 @@ static void vpu_core_remove(struct platform_device *pdev)
struct vpu_core *core = platform_get_drvdata(pdev);
int ret;
+ WARN_ON(!list_empty(&core->instances));
+
vpu_core_remove_dbgfs_file(core);
ret = pm_runtime_resume_and_get(dev);
WARN_ON(ret < 0);
@@ -846,6 +848,7 @@ static struct platform_driver amphion_vpu_core_driver = {
.remove = vpu_core_remove,
.driver = {
.name = "amphion-vpu-core",
+ .suppress_bind_attrs = true,
.of_match_table = vpu_core_dt_match,
.pm = &vpu_core_pm_ops,
},
diff --git a/drivers/media/platform/amphion/vpu_drv.c b/drivers/media/platform/amphion/vpu_drv.c
index 2cca61f41beae..9c6f32c5eae96 100644
--- a/drivers/media/platform/amphion/vpu_drv.c
+++ b/drivers/media/platform/amphion/vpu_drv.c
@@ -205,6 +205,7 @@ static struct platform_driver amphion_vpu_driver = {
.remove = vpu_remove,
.driver = {
.name = "amphion-vpu",
+ .suppress_bind_attrs = true,
.of_match_table = vpu_dt_match,
},
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0455/1257] media: mediatek: vpu: free IRQ before destroying watchdog workqueue
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0454/1257] media: amphion: prevent unbind while video instances are open Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0456/1257] media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init() Greg Kroah-Hartman
` (543 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit 2c50b58d4105f6dbaa36d6306087954b9100e9ae ]
mtk_vpu_remove() destroys the watchdog workqueue while the interrupt
handler requested with devm_request_irq() is still registered: the
devres core frees the interrupt only after remove() has returned. If
the VPU watchdog fires in that window, vpu_irq_handler() queues
vpu->wdt.ws on the already destroyed vpu->wdt.wq.
Fix this by calling devm_free_irq() before destroy_workqueue(), which
releases the interrupt and waits for a running handler, so no new work
can be queued while the workqueue is drained and freed.
This issue was found by an in-house static analysis tool.
Fixes: 3003a180ef6b ("[media] VPU: mediatek: support Mediatek VPU")
Cc: stable@vger.kernel.org
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/vpu/mtk_vpu.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
index 8d8319f0cd221..b6bd80b684459 100644
--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
@@ -962,6 +962,7 @@ static void mtk_vpu_remove(struct platform_device *pdev)
#ifdef CONFIG_DEBUG_FS
debugfs_remove(vpu_debugfs);
#endif
+ devm_free_irq(&pdev->dev, vpu->reg.irq, vpu);
if (vpu->wdt.wq)
destroy_workqueue(vpu->wdt.wq);
vpu_free_ext_mem(vpu, P_FW);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0456/1257] media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0455/1257] media: mediatek: vpu: free IRQ before destroying watchdog workqueue Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0457/1257] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker() Greg Kroah-Hartman
` (542 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit ff3308afa9c9da0ef9113cb80803588adabef902 ]
mdp_comp_init() takes a reference to the component platform device
with of_find_device_by_node(), but the error path taken when the
clock array cannot be allocated and the one taken for a component
without a GCE EOF event return without dropping it. The caller
frees the mdp_comp in those cases, so the reference is leaked.
Release the reference on both error paths.
Fixes: c4320f9721fd ("media: platform: mtk-mdp3: dynamically allocate component clocks")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/mediatek/mdp3/mtk-mdp3-comp.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c
index 7fcb2fbdd64ee..acb2758a7b42d 100644
--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c
+++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c
@@ -1730,6 +1730,7 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
struct device *dev = &mdp->pdev->dev;
struct platform_device *pdev_c;
int clk_ofst;
+ int ret;
int i;
s32 event;
@@ -1756,8 +1757,10 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
comp->clk_num = mdp->mdp_data->comp_data[id].info.clk_num;
comp->clks = devm_kzalloc(dev, sizeof(struct clk *) * comp->clk_num,
GFP_KERNEL);
- if (!comp->clks)
- return -ENOMEM;
+ if (!comp->clks) {
+ ret = -ENOMEM;
+ goto err_put_device;
+ }
clk_ofst = mdp->mdp_data->comp_data[id].info.clk_ofst;
@@ -1782,7 +1785,8 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
if (of_property_read_u32_index(node, "mediatek,gce-events",
MDP_GCE_EVENT_EOF, &event)) {
dev_err(dev, "Component id %d has no EOF\n", id);
- return -EINVAL;
+ ret = -EINVAL;
+ goto err_put_device;
}
} else {
event = MDP_GCE_NO_EVENT;
@@ -1791,6 +1795,10 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
comp->gce_event[MDP_GCE_EVENT_EOF] = event;
return 0;
+
+err_put_device:
+ put_device(&pdev_c->dev);
+ return ret;
}
static void mdp_comp_deinit(struct mdp_comp *comp)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0457/1257] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0456/1257] media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init() Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0458/1257] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker() Greg Kroah-Hartman
` (541 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit befd4506174addc5e85641b4ef304c9247b48c55 ]
pm_runtime_get_sync() leaves the device's runtime PM usage count
incremented even when it fails. mtk_jpegdec_worker() jumps to
dec_end on that failure, which does not call pm_runtime_put(), so
the reference taken by the failed resume is leaked.
Use pm_runtime_resume_and_get() instead, which drops the reference
again when resuming the device fails.
Fixes: dedc21500334 ("media: mtk-jpegdec: add jpeg decode worker interface")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index d147ec4830811..af44d581e4980 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1733,7 +1733,7 @@ static void mtk_jpegdec_worker(struct work_struct *work)
jpeg_dst_buf->frame_num = ctx->total_frame_num;
mtk_jpegdec_set_hw_param(ctx, hw_id, src_buf, dst_buf);
- ret = pm_runtime_get_sync(comp_jpeg[hw_id]->dev);
+ ret = pm_runtime_resume_and_get(comp_jpeg[hw_id]->dev);
if (ret < 0) {
dev_err(jpeg->dev, "%s : %d, pm_runtime_get_sync fail !!!\n",
__func__, __LINE__);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0458/1257] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0457/1257] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker() Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0459/1257] media: rkvdec: do not destroy borrowed SRAM pool Greg Kroah-Hartman
` (540 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 7ec8fd17f3a8059dcf94101065a35d0136031794 ]
pm_runtime_get_sync() leaves the device's runtime PM usage count
incremented even when it fails, and a failed clk_prepare_enable()
drops the reference as well. mtk_jpegenc_worker() jumps to enc_end
in both cases, which does not call pm_runtime_put(), so the
reference taken by the successful resume is leaked.
Use pm_runtime_resume_and_get() for the resume failure and release
the reference explicitly when the clock cannot be enabled, as
mtk_jpegdec_worker() already does.
Fixes: 5fb1c2361e56 ("mtk-jpegenc: add jpeg encode worker interface")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index af44d581e4980..906174302476c 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1623,7 +1623,7 @@ static void mtk_jpegenc_worker(struct work_struct *work)
v4l2_m2m_buf_copy_metadata(src_buf, dst_buf);
mtk_jpegenc_set_hw_param(ctx, hw_id, src_buf, dst_buf);
- ret = pm_runtime_get_sync(comp_jpeg[hw_id]->dev);
+ ret = pm_runtime_resume_and_get(comp_jpeg[hw_id]->dev);
if (ret < 0) {
dev_err(jpeg->dev, "%s : %d, pm_runtime_get_sync fail !!!\n",
__func__, __LINE__);
@@ -1634,6 +1634,7 @@ static void mtk_jpegenc_worker(struct work_struct *work)
if (ret) {
dev_err(jpeg->dev, "%s : %d, jpegenc clk_prepare_enable fail\n",
__func__, __LINE__);
+ pm_runtime_put(comp_jpeg[hw_id]->dev);
goto enc_end;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0459/1257] media: rkvdec: do not destroy borrowed SRAM pool
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0458/1257] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker() Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0460/1257] media: mediatek: vcodec: destroy core workqueue on remove Greg Kroah-Hartman
` (539 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Detlev Casanova,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 19449e913cf0cb866957fe7ddc9b357f7244d079 ]
rkvdec_probe() obtains a provider-owned SRAM pool with
of_gen_pool_get(), but its error path incorrectly destroys the borrowed
pool with gen_pool_destroy().
of_gen_pool_get() returns a pool managed by the SRAM provider. The pool
is not created or owned by the rkvdec driver and is destroyed by the
provider when its own managed resources are released.
Destroying it when rkvdec_v4l2_init() fails can invalidate the pool
while the provider and other consumers still reference it, and can also
result in the provider attempting to destroy it again later.
Remove the incorrect gen_pool_destroy() call from the probe failure
path.
This issue was found by manual code inspection.
Fixes: e5640dbb991c ("media: rkvdec: Add RCB and SRAM support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Detlev Casanova <detlev.casanova@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/rockchip/rkvdec/rkvdec.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/media/platform/rockchip/rkvdec/rkvdec.c b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
index 061281f903f3c..4541ef9ee3b98 100644
--- a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
+++ b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
@@ -1857,9 +1857,6 @@ static int rkvdec_probe(struct platform_device *pdev)
pm_runtime_dont_use_autosuspend(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- if (rkvdec->sram_pool)
- gen_pool_destroy(rkvdec->sram_pool);
-
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0460/1257] media: mediatek: vcodec: destroy core workqueue on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0459/1257] media: rkvdec: do not destroy borrowed SRAM pool Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0461/1257] media: mediatek: vpu: release reserved memory " Greg Kroah-Hartman
` (538 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit ceb6e96122e1013550f378c738e621a6e82d246b ]
The decoder probe allocates core_workqueue for architectures with a
LAT processor. The probe failure paths destroy the workqueues, but the
remove() function only destroys decode_workqueue.
As a result, removing a decoder on LAT architectures leaves core_workqueue
allocated after the device lifetime has ended.
Destroy core_workqueue during remove for latency-based decoder
architectures, matching the cleanup performed by the probe failure
paths.
This issue was found by manual code inspection.
Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
index e936ed8dffbaf..426d060d937c1 100644
--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
@@ -570,6 +570,8 @@ static void mtk_vcodec_dec_remove(struct platform_device *pdev)
struct mtk_vcodec_dec_dev *dev = platform_get_drvdata(pdev);
destroy_workqueue(dev->decode_workqueue);
+ if (IS_VDEC_LAT_ARCH(dev->vdec_pdata->hw_arch))
+ destroy_workqueue(dev->core_workqueue);
if (media_devnode_is_registered(dev->mdev_dec.devnode)) {
media_device_unregister(&dev->mdev_dec);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0461/1257] media: mediatek: vpu: release reserved memory on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0460/1257] media: mediatek: vcodec: destroy core workqueue on remove Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0462/1257] media: mediatek: jpeg: Avoid context access after job finish Greg Kroah-Hartman
` (537 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 8af0e2bdd9791848d9caf3761825ac51a67c2b9c ]
mtk_vpu_probe() may assign a reserved memory region to the VPU device
with of_reserved_mem_device_init(). The probe failure path releases the
assignment with of_reserved_mem_device_release(), but the normal remove
path does not perform the corresponding cleanup.
As a result, removing the VPU driver after a successful probe can leave
the reserved memory assignment associated with the device after its
lifetime has ended.
Release the reserved memory assignment after freeing the VPU external
firmware memory, matching the cleanup performed by the probe failure
path.
This issue was found by manual code inspection.
Fixes: 3003a180ef6b ("[media] VPU: mediatek: support Mediatek VPU")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/vpu/mtk_vpu.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
index b6bd80b684459..9dff1d971d37c 100644
--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
@@ -967,6 +967,7 @@ static void mtk_vpu_remove(struct platform_device *pdev)
destroy_workqueue(vpu->wdt.wq);
vpu_free_ext_mem(vpu, P_FW);
vpu_free_ext_mem(vpu, D_FW);
+ of_reserved_mem_device_release(&pdev->dev);
mutex_destroy(&vpu->vpu_mutex);
clk_unprepare(vpu->clk);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0462/1257] media: mediatek: jpeg: Avoid context access after job finish
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0461/1257] media: mediatek: vpu: release reserved memory " Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0463/1257] media: verisilicon: rockchip: Fix leaks in init Greg Kroah-Hartman
` (536 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kazuki Hanai, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kazuki Hanai <hnkz.64@gmail.com>
[ Upstream commit 7c7f31405b76acd95a628c834ee8a2d6da439782 ]
v4l2_m2m_job_finish() publishes job completion and wakes waiters
before it returns. A concurrent file release can therefore finish
v4l2_m2m_ctx_release() and free the context while the single-core IRQ
handler continues with its tail.
Both handlers only need the device for the matching runtime PM put.
Use the IRQ-owned jpeg pointer instead of dereferencing ctx after
completion has been published. This preserves the get/put pairing and
removes the post-completion context access.
Fixes: 45f13a57d813 ("media: platform: Add jpeg enc feature")
Fixes: 5827e4b14ee7 ("media: platform: Improve power on and power off flow")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Kazuki Hanai <hnkz.64@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index 906174302476c..bddd0a070d665 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1574,7 +1574,7 @@ static irqreturn_t mtk_jpeg_enc_done(struct mtk_jpeg_dev *jpeg)
v4l2_m2m_buf_done(src_buf, buf_state);
v4l2_m2m_buf_done(dst_buf, buf_state);
v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
- pm_runtime_put(ctx->jpeg->dev);
+ pm_runtime_put(jpeg->dev);
return IRQ_HANDLED;
}
@@ -1856,7 +1856,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv)
v4l2_m2m_buf_done(src_buf, buf_state);
v4l2_m2m_buf_done(dst_buf, buf_state);
v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
- pm_runtime_put(ctx->jpeg->dev);
+ pm_runtime_put(jpeg->dev);
return IRQ_HANDLED;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0463/1257] media: verisilicon: rockchip: Fix leaks in init
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0462/1257] media: mediatek: jpeg: Avoid context access after job finish Greg Kroah-Hartman
@ 2026-11-07 13:45 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0464/1257] media: mediatek: jpeg: retry HW selection after successful wait Greg Kroah-Hartman
` (535 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michail Tatas, Frank Li,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michail Tatas <michail.tatas@gmail.com>
[ Upstream commit 96f6b5e2295996a9e2dd1e2382d3872f98cbb554 ]
If one of the dma_alloc_coherent in the init function fails then
the previously allocated ones leak.
Fix by freeing them in the error path.
Fixes: 727a400686a2 ("media: verisilicon: Add Rockchip AV1 decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Michail Tatas <michail.tatas@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../verisilicon/rockchip_vpu981_hw_av1_dec.c | 68 +++++++++++++++----
1 file changed, 55 insertions(+), 13 deletions(-)
diff --git a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
index 00aa566a4ccdb..2a145433e6d17 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
@@ -369,6 +369,7 @@ void rockchip_vpu981_av1_dec_exit(struct hantro_ctx *ctx)
int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx)
{
+ int ret = 0;
struct hantro_dev *vpu = ctx->dev;
struct hantro_av1_dec_hw_ctx *av1_dec = &ctx->av1_dec;
@@ -377,39 +378,54 @@ int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx)
av1_dec->global_model.cpu = dma_alloc_coherent(vpu->dev, GLOBAL_MODEL_SIZE,
&av1_dec->global_model.dma,
GFP_KERNEL);
- if (!av1_dec->global_model.cpu)
- return -ENOMEM;
+ if (!av1_dec->global_model.cpu) {
+ ret = -ENOMEM;
+ goto global_model_cpu_err;
+ }
+
av1_dec->global_model.size = GLOBAL_MODEL_SIZE;
av1_dec->tile_info.cpu = dma_alloc_coherent(vpu->dev, AV1_TILE_INFO_SIZE,
&av1_dec->tile_info.dma,
GFP_KERNEL);
- if (!av1_dec->tile_info.cpu)
- return -ENOMEM;
+ if (!av1_dec->tile_info.cpu) {
+ ret = -ENOMEM;
+ goto tile_info_cpu_err;
+ }
+
av1_dec->tile_info.size = AV1_TILE_INFO_SIZE;
av1_dec->film_grain.cpu = dma_alloc_coherent(vpu->dev,
ALIGN(sizeof(struct rockchip_av1_film_grain), 2048),
&av1_dec->film_grain.dma,
GFP_KERNEL);
- if (!av1_dec->film_grain.cpu)
- return -ENOMEM;
+ if (!av1_dec->film_grain.cpu) {
+ ret = -ENOMEM;
+ goto film_grain_cpu_err;
+ }
+
av1_dec->film_grain.size = ALIGN(sizeof(struct rockchip_av1_film_grain), 2048);
av1_dec->prob_tbl.cpu = dma_alloc_coherent(vpu->dev,
ALIGN(sizeof(struct av1cdfs), 2048),
&av1_dec->prob_tbl.dma,
GFP_KERNEL);
- if (!av1_dec->prob_tbl.cpu)
- return -ENOMEM;
+ if (!av1_dec->prob_tbl.cpu) {
+ ret = -ENOMEM;
+ goto prob_tbl_cpu_err;
+ }
+
av1_dec->prob_tbl.size = ALIGN(sizeof(struct av1cdfs), 2048);
av1_dec->prob_tbl_out.cpu = dma_alloc_coherent(vpu->dev,
ALIGN(sizeof(struct av1cdfs), 2048),
&av1_dec->prob_tbl_out.dma,
GFP_KERNEL);
- if (!av1_dec->prob_tbl_out.cpu)
- return -ENOMEM;
+ if (!av1_dec->prob_tbl_out.cpu) {
+ ret = -ENOMEM;
+ goto prob_tbl_out_cpu_err;
+ }
+
av1_dec->prob_tbl_out.size = ALIGN(sizeof(struct av1cdfs), 2048);
av1_dec->cdfs = &av1_dec->default_cdfs;
av1_dec->cdfs_ndvc = &av1_dec->default_cdfs_ndvc;
@@ -420,11 +436,37 @@ int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx)
AV1_TILE_SIZE,
&av1_dec->tile_buf.dma,
GFP_KERNEL);
- if (!av1_dec->tile_buf.cpu)
- return -ENOMEM;
+ if (!av1_dec->tile_buf.cpu) {
+ ret = -ENOMEM;
+ goto tile_buf_cpu_err;
+ }
+
av1_dec->tile_buf.size = AV1_TILE_SIZE;
- return 0;
+ return ret;
+
+tile_buf_cpu_err:
+ dma_free_coherent(vpu->dev, av1_dec->prob_tbl_out.size,
+ av1_dec->prob_tbl_out.cpu,
+ av1_dec->prob_tbl_out.dma);
+prob_tbl_out_cpu_err:
+ dma_free_coherent(vpu->dev, av1_dec->prob_tbl.size,
+ av1_dec->prob_tbl.cpu,
+ av1_dec->prob_tbl.dma);
+prob_tbl_cpu_err:
+ dma_free_coherent(vpu->dev, av1_dec->film_grain.size,
+ av1_dec->film_grain.cpu,
+ av1_dec->film_grain.dma);
+film_grain_cpu_err:
+ dma_free_coherent(vpu->dev, av1_dec->tile_info.size,
+ av1_dec->tile_info.cpu,
+ av1_dec->tile_info.dma);
+tile_info_cpu_err:
+ dma_free_coherent(vpu->dev, av1_dec->global_model.size,
+ av1_dec->global_model.cpu,
+ av1_dec->global_model.dma);
+global_model_cpu_err:
+ return ret;
}
static int rockchip_vpu981_av1_dec_prepare_run(struct hantro_ctx *ctx)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0464/1257] media: mediatek: jpeg: retry HW selection after successful wait
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2026-11-07 13:45 ` [PATCH 7.3 0463/1257] media: verisilicon: rockchip: Fix leaks in init Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0465/1257] media: vicodec: fix NULL deref on oversized frame Greg Kroah-Hartman
` (534 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit eb0bbd0ad679bf363387e3b8be8892cfbedabb72 ]
wait_event_interruptible_timeout() returns a positive value when its
condition becomes true before the timeout. mtk_jpegdec_worker() treats
every nonzero result as a failure, so a normal decoder wakeup finishes
the mem2mem job as though no hardware became available.
Handle interrupted waits and exhausted timeout retries separately, and
retry hardware selection after a successful wakeup. Increment the retry
count only for actual timeouts. The encoder uses
wait_event_interruptible(), whose successful return is zero, so its
existing check is correct; leave that separate no-timeout policy
unchanged.
Fixes: dedc21500334 ("media: mtk-jpegdec: add jpeg decode worker interface")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index bddd0a070d665..cc375309e4f34 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1698,9 +1698,15 @@ static void mtk_jpegdec_worker(struct work_struct *work)
ret = wait_event_interruptible_timeout(jpeg->hw_wq,
atomic_read(&jpeg->hw_rdy) > 0,
MTK_JPEG_HW_TIMEOUT_MSEC);
- if (ret != 0 || (i++ > MTK_JPEG_MAX_RETRY_TIME)) {
- dev_err(jpeg->dev, "%s : %d, all HW are busy\n",
- __func__, __LINE__);
+ if (ret < 0) {
+ dev_err(jpeg->dev, "decoder HW wait interrupted: %d\n",
+ ret);
+ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+ return;
+ }
+
+ if (!ret && i++ > MTK_JPEG_MAX_RETRY_TIME) {
+ dev_err(jpeg->dev, "all decoder HW are busy\n");
v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0465/1257] media: vicodec: fix NULL deref on oversized frame
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0464/1257] media: mediatek: jpeg: retry HW selection after successful wait Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0466/1257] media: hantro: Harden MPEG-2 control access against NULL Greg Kroah-Hartman
` (533 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
[ Upstream commit c657eb609197e289b054bc2c4e86a0fc32dd7ebe ]
job_ready() only honours the is_header_valid() verdict when
ctx->comp_has_frame is set, and comp_has_frame is only set once
comp_size reaches the full frame size. Since the copy is clamped to
ctx->comp_max_size, a header advertising a larger size leaves comp_size
stuck at comp_max_size, so comp_has_frame stays false and the failed
validation is discarded.
Control then falls into the resolution change branch, which calls
update_capture_data_from_header(). That function re-derives info via
info_from_header(), assigns it to q_dst->info and dereferences it as
q_dst->info->sizeimage_mult, with no NULL check of its own.
is_header_valid() does check that same info_from_header() result --
if (!info) return false which is precisely the false verdict
job_ready() discarded above. info_from_header() returns NULL whenever the
header flags resolve to no supported pixel format.
Drop the comp_has_frame conjunct so an invalid header always bails out.
The resolution change path is unaffected, as it is entered with a valid
header. Oversized frames are then rejected by device_process(), which
already returns -EINVAL when comp_frame_size exceeds comp_max_size.
Fixes: 3b15f68e19c2 ("media: vicodec: Add support for resolution change event.")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vicodec/vicodec-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/test-drivers/vicodec/vicodec-core.c b/drivers/media/test-drivers/vicodec/vicodec-core.c
index 7ea024b14f0e9..a6d12ab66a0f3 100644
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -654,7 +654,7 @@ static int job_ready(void *priv)
* if the header is invalid the device_run will just drop the frame
* with an error
*/
- if (!is_header_valid(&ctx->state.header) && ctx->comp_has_frame)
+ if (!is_header_valid(&ctx->state.header))
return 1;
flags = ntohl(ctx->state.header.flags);
hdr_width_div = (flags & V4L2_FWHT_FL_CHROMA_FULL_WIDTH) ? 1 : 2;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0466/1257] media: hantro: Harden MPEG-2 control access against NULL
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0465/1257] media: vicodec: fix NULL deref on oversized frame Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0467/1257] media: hantro: release runtime resources when device_run fails Greg Kroah-Hartman
` (532 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tharit Tangkijwanichakul,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tharit Tangkijwanichakul <tharitt97@gmail.com>
[ Upstream commit 2b685dba4226792933f45b1cbf8991e89ccd21ce ]
The MPEG-2 sequence and picture controls are validated
before a job is queued, so hantro_get_ctrl() is not expected to return
NULL in hantro_g1_mpeg2_dec_run(). The controls are nonetheless
dereferenced unconditionally.
Harden the invariant by checking the sequence and picture controls with
WARN_ON().
Found by code inspection.
Fixes: f329e21e9dad ("media: uapi: mpeg2: Split sequence and picture parameters")
Cc: stable@vger.kernel.org
Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c b/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c
index e0d6bd0a6e44f..6a942f4b8a2dd 100644
--- a/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c
+++ b/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c
@@ -161,8 +161,13 @@ int hantro_g1_mpeg2_dec_run(struct hantro_ctx *ctx)
seq = hantro_get_ctrl(ctx,
V4L2_CID_STATELESS_MPEG2_SEQUENCE);
+ if (WARN_ON(!seq))
+ return -EINVAL;
+
pic = hantro_get_ctrl(ctx,
V4L2_CID_STATELESS_MPEG2_PICTURE);
+ if (WARN_ON(!pic))
+ return -EINVAL;
reg = G1_REG_DEC_AXI_RD_ID(0) |
G1_REG_DEC_TIMEOUT_E(1) |
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0467/1257] media: hantro: release runtime resources when device_run fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0466/1257] media: hantro: Harden MPEG-2 control access against NULL Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0468/1257] media: amphion: fix runtime PM imbalance on probe failure Greg Kroah-Hartman
` (531 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tharit Tangkijwanichakul, Frank Li,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tharit Tangkijwanichakul <tharitt97@gmail.com>
[ Upstream commit 556ab0b2741d653455637ffdd453d65c0439914a ]
device_run() acquires a runtime PM reference and enables the VPU clocks
before invoking the codec-specific run callback.
If clk_bulk_enable() fails, the runtime PM reference is left held. If
the codec-specific run callback fails, both the enabled clocks and the
runtime PM reference are left held.
Make the clocks part of the device's runtime PM state by enabling them
from the runtime-resume callback and disabling them from the
runtime-suspend callback.
Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/verisilicon/hantro_drv.c | 66 +++++++++++--------
1 file changed, 39 insertions(+), 27 deletions(-)
diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index ad71c0402ef3b..43f67b9fcf273 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -59,8 +59,7 @@ static const struct v4l2_event hantro_eos_event = {
.type = V4L2_EVENT_EOS
};
-static void hantro_job_finish_no_pm(struct hantro_dev *vpu,
- struct hantro_ctx *ctx,
+static void hantro_job_finish_no_pm(struct hantro_ctx *ctx,
enum vb2_buffer_state result)
{
struct vb2_v4l2_buffer *src, *dst;
@@ -86,15 +85,13 @@ static void hantro_job_finish_no_pm(struct hantro_dev *vpu,
result);
}
-static void hantro_job_finish(struct hantro_dev *vpu,
- struct hantro_ctx *ctx,
+static void hantro_job_finish(struct hantro_ctx *ctx,
enum vb2_buffer_state result)
{
- pm_runtime_put_autosuspend(vpu->dev);
-
- clk_bulk_disable(vpu->variant->num_clocks, vpu->clocks);
+ struct hantro_dev *vpu = ctx->dev;
- hantro_job_finish_no_pm(vpu, ctx, result);
+ pm_runtime_put_autosuspend(vpu->dev);
+ hantro_job_finish_no_pm(ctx, result);
}
void hantro_irq_done(struct hantro_dev *vpu,
@@ -111,7 +108,7 @@ void hantro_irq_done(struct hantro_dev *vpu,
if (cancel_delayed_work(&vpu->watchdog_work)) {
if (result == VB2_BUF_STATE_DONE && ctx->codec_ops->done)
ctx->codec_ops->done(ctx);
- hantro_job_finish(vpu, ctx, result);
+ hantro_job_finish(ctx, result);
}
}
@@ -127,7 +124,7 @@ void hantro_watchdog(struct work_struct *work)
vpu_err("frame processing timed out!\n");
if (ctx->codec_ops->reset)
ctx->codec_ops->reset(ctx);
- hantro_job_finish(vpu, ctx, VB2_BUF_STATE_ERROR);
+ hantro_job_finish(ctx, VB2_BUF_STATE_ERROR);
}
}
@@ -170,29 +167,24 @@ void hantro_end_prepare_run(struct hantro_ctx *ctx)
static void device_run(void *priv)
{
struct hantro_ctx *ctx = priv;
+ struct hantro_dev *vpu = ctx->dev;
struct vb2_v4l2_buffer *src, *dst;
int ret;
src = hantro_get_src_buf(ctx);
dst = hantro_get_dst_buf(ctx);
- ret = pm_runtime_resume_and_get(ctx->dev->dev);
- if (ret < 0)
- goto err_cancel_job;
-
- ret = clk_bulk_enable(ctx->dev->variant->num_clocks, ctx->dev->clocks);
- if (ret)
- goto err_cancel_job;
+ ret = pm_runtime_resume_and_get(vpu->dev);
+ if (ret < 0) {
+ hantro_job_finish_no_pm(ctx, VB2_BUF_STATE_ERROR);
+ return;
+ }
v4l2_m2m_buf_copy_metadata(src, dst);
- if (ctx->codec_ops->run(ctx))
- goto err_cancel_job;
-
- return;
-
-err_cancel_job:
- hantro_job_finish_no_pm(ctx->dev, ctx, VB2_BUF_STATE_ERROR);
+ ret = ctx->codec_ops->run(ctx);
+ if (ret)
+ hantro_job_finish(ctx, VB2_BUF_STATE_ERROR);
}
static const struct v4l2_m2m_ops vpu_m2m_ops = {
@@ -1302,10 +1294,30 @@ static void hantro_remove(struct platform_device *pdev)
static int hantro_runtime_resume(struct device *dev)
{
struct hantro_dev *vpu = dev_get_drvdata(dev);
+ int ret;
+
+ ret = clk_bulk_enable(vpu->variant->num_clocks, vpu->clocks);
+ if (ret)
+ return ret;
+
+ if (vpu->variant->runtime_resume) {
+ ret = vpu->variant->runtime_resume(vpu);
+ if (ret)
+ goto err_disable_clocks;
+ }
+
+ return 0;
- if (vpu->variant->runtime_resume)
- return vpu->variant->runtime_resume(vpu);
+err_disable_clocks:
+ clk_bulk_disable(vpu->variant->num_clocks, vpu->clocks);
+ return ret;
+}
+static int hantro_runtime_suspend(struct device *dev)
+{
+ struct hantro_dev *vpu = dev_get_drvdata(dev);
+
+ clk_bulk_disable(vpu->variant->num_clocks, vpu->clocks);
return 0;
}
#endif
@@ -1313,7 +1325,7 @@ static int hantro_runtime_resume(struct device *dev)
static const struct dev_pm_ops hantro_pm_ops = {
SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
pm_runtime_force_resume)
- SET_RUNTIME_PM_OPS(NULL, hantro_runtime_resume, NULL)
+ SET_RUNTIME_PM_OPS(hantro_runtime_suspend, hantro_runtime_resume, NULL)
};
static struct platform_driver hantro_driver = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0468/1257] media: amphion: fix runtime PM imbalance on probe failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0467/1257] media: hantro: release runtime resources when device_run fails Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0469/1257] media: hantro: disable runtime PM before hardware teardown Greg Kroah-Hartman
` (530 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiawen Liu, Ming Qian,
Nicolas Dufresne, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Liu <1298662399@qq.com>
[ Upstream commit 0cabf27cf1e6f7ee5f3c5893c0f1930814d949af ]
vpu_core_probe() enables runtime PM before calling
pm_runtime_resume_and_get().
If pm_runtime_resume_and_get() fails, it has already dropped the runtime PM
usage counter that it acquired before trying to resume the device. Calling
pm_runtime_put_noidle() again on this error path drops the counter one
extra time.
Remove the extra put and keep the existing cleanup that marks the device
suspended before disabling runtime PM.
Fixes: 9f599f351e86ac ("media: amphion: add vpu core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiawen Liu <1298662399@qq.com>
Reviewed-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vpu_core.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index 2e8e08e05de7c..ad54f014d8f60 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -667,7 +667,6 @@ static int vpu_core_probe(struct platform_device *pdev)
pm_runtime_enable(dev);
ret = pm_runtime_resume_and_get(dev);
if (ret) {
- pm_runtime_put_noidle(dev);
pm_runtime_set_suspended(dev);
goto err_runtime_disable;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0469/1257] media: hantro: disable runtime PM before hardware teardown
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0468/1257] media: amphion: fix runtime PM imbalance on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0470/1257] power: supply: core: Honor supplied-from with CONFIG_OF=y Greg Kroah-Hartman
` (529 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tharit Tangkijwanichakul,
Benjamin Gaignard, Nicolas Dufresne, Hans Verkuil, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tharit Tangkijwanichakul <tharitt97@gmail.com>
[ Upstream commit 8e26d4c20ed218db6c3123480a4a4e2545680566 ]
Removing the Hantro driver may trigger an SError on RK3588:
SError Interrupt on CPU6, code 0x00000000be000011 -- SError
...
do_serror+0x5c/0x74
el1h_64_error_handler+0x34/0x50
el1h_64_error+0x6c/0x70
regmap_mmio_read32le+0x10/0x20 (P)
_regmap_bus_reg_read+0x6c/0xb4
_regmap_read+0x60/0xdc
regmap_read+0x4c/0x80
rockchip_pd_power+0xe4/0x600
rockchip_pd_power_off+0x1c/0x60
_genpd_power_off+0x98/0x198
genpd_power_off.part.0+0x178/0x288
genpd_runtime_suspend+0x210/0x300
__rpm_callback+0x48/0x1e0
rpm_callback+0x74/0x80
rpm_suspend+0x10c/0x580
rpm_idle+0x134/0x1b8
update_autosuspend+0x30/0xc4
__pm_runtime_use_autosuspend+0x48/0x64
hantro_remove+0x8c/0xa8 [hantro_vpu]
...
hantro_remove() currently asserts the device resets before disabling
runtime PM.
Calling pm_runtime_dont_use_autosuspend() causes an idle device to be
runtime-suspended immediately. At that point the Hantro hardware has
already been torn down, while the generic power-domain genpd code
still performs the power-off sequence. genpd regmap_mmio_read causes panic
subsequently because the reset lines were asserted.
Disable runtime PM before asserting the reset lines so that no runtime-PM
transition can race with hardware teardown.
Apply the same ordering to the probe error paths as well.
Fixes: ea71631b7129 ("media: hantro: add support for reset lines")
Cc: stable@vger.kernel.org
Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/verisilicon/hantro_drv.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index 43f67b9fcf273..d945cc83323e2 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -1210,7 +1210,7 @@ static int hantro_probe(struct platform_device *pdev)
ret = clk_bulk_prepare(vpu->variant->num_clocks, vpu->clocks);
if (ret) {
dev_err(&pdev->dev, "Failed to prepare clocks\n");
- goto err_rst_assert;
+ goto err_pm_disable_assert_reset;
}
ret = v4l2_device_register(&pdev->dev, &vpu->v4l2_dev);
@@ -1264,8 +1264,11 @@ static int hantro_probe(struct platform_device *pdev)
v4l2_device_unregister(&vpu->v4l2_dev);
err_clk_unprepare:
clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);
-err_rst_assert:
+err_pm_disable_assert_reset:
+ pm_runtime_dont_use_autosuspend(vpu->dev);
+ pm_runtime_disable(vpu->dev);
reset_control_assert(vpu->resets);
+ return ret;
err_pm_disable:
pm_runtime_dont_use_autosuspend(vpu->dev);
pm_runtime_disable(vpu->dev);
@@ -1285,9 +1288,9 @@ static void hantro_remove(struct platform_device *pdev)
v4l2_m2m_put(vpu->m2m_dev);
v4l2_device_unregister(&vpu->v4l2_dev);
clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);
- reset_control_assert(vpu->resets);
pm_runtime_dont_use_autosuspend(vpu->dev);
pm_runtime_disable(vpu->dev);
+ reset_control_assert(vpu->resets);
}
#ifdef CONFIG_PM
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0470/1257] power: supply: core: Honor supplied-from with CONFIG_OF=y
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0469/1257] media: hantro: disable runtime PM before hardware teardown Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0471/1257] power: supply: ltc2941: Fix of_node reference leak in ltc294x_i2c_probe() Greg Kroah-Hartman
` (528 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maurizio Casciano, Sebastian Reichel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Casciano <mauriziocasciano7@gmail.com>
[ Upstream commit 6bd80f22c764fe8c56c62c118387f86a3ca98cff ]
The supplied-from device property is the name-based counterpart to
firmware-node power-supplies references. It was added for non-DT platforms,
but its parser is compiled only when CONFIG_OF is disabled. CONFIG_OF is
a global kernel option, so x86 systems commonly enable it even when
individual power supplies are described by software nodes.
Consequently, these consumers never populate supplied_from and supplier
notifications do not reach their external_power_changed() callbacks. On a
Lenovo Yoga Book YB1-X91L, ftrace showed the Whiskey Cove supplier
notification running without invoking the BQ25892 callback, leaving the
input current limit at its boot-time value.
Use a single power_supply_check_supplies() implementation for all
configurations. Preserve firmware-node power-supplies references as the
preferred firmware description and use the name-based supplied-from
property only when no references are specified. Continue to honor an
explicitly provided supplied_from list first and propagate errors from
specified firmware references.
With the fix, ftrace shows the BQ25892 callback on hotplug. A boot-offline
test changes its input current limit from 500 mA to 2 A.
Fixes: 58a36bb06891 ("power: supply: core: Add support for supplied-from device-property")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Maurizio Casciano <mauriziocasciano7@gmail.com>
Link: https://patch.msgid.link/20260924225152.985489-1-mauriziocasciano7@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/power_supply_core.c | 84 ++++++++++++------------
1 file changed, 42 insertions(+), 42 deletions(-)
diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index 1279785645fbe..eba690f1dad35 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -190,7 +190,35 @@ static void power_supply_deferred_register_work(struct work_struct *work)
device_unlock(psy->dev.parent);
}
-#ifdef CONFIG_OF
+static int power_supply_check_supplies_by_name(struct power_supply *psy)
+{
+ struct device *parent = psy->dev.parent;
+ int nval, ret;
+
+ if (!parent)
+ return 0;
+
+ nval = device_property_string_array_count(parent, "supplied-from");
+ if (nval <= 0)
+ return 0;
+
+ psy->supplied_from = devm_kmalloc_array(&psy->dev, nval,
+ sizeof(*psy->supplied_from),
+ GFP_KERNEL);
+ if (!psy->supplied_from)
+ return -ENOMEM;
+
+ ret = device_property_read_string_array(parent, "supplied-from",
+ (const char **)psy->supplied_from,
+ nval);
+ if (ret < 0)
+ return ret;
+
+ psy->num_supplies = nval;
+
+ return 0;
+}
+
static int __power_supply_populate_supplied_from(struct power_supply *epsy,
void *data)
{
@@ -262,22 +290,21 @@ static int power_supply_find_supply_from_fwnode(struct fwnode_handle *supply_nod
static int power_supply_check_supplies(struct power_supply *psy)
{
struct fwnode_handle *np;
- int cnt = 0;
+ int cnt, ret;
/* If there is already a list honor it */
if (psy->supplied_from && psy->num_supplies > 0)
return 0;
- /* No device node found, nothing to do */
- if (!psy->dev.fwnode)
- return 0;
-
- do {
- int ret;
+ for (cnt = 0; psy->dev.fwnode; cnt++) {
+ np = fwnode_find_reference(psy->dev.fwnode, "power-supplies", cnt);
+ if (IS_ERR(np)) {
+ ret = PTR_ERR(np);
+ if (ret != -ENOENT)
+ return ret;
- np = fwnode_find_reference(psy->dev.fwnode, "power-supplies", cnt++);
- if (IS_ERR(np))
break;
+ }
ret = power_supply_find_supply_from_fwnode(np);
fwnode_handle_put(np);
@@ -286,48 +313,21 @@ static int power_supply_check_supplies(struct power_supply *psy)
dev_dbg(&psy->dev, "Failed to find supply!\n");
return ret;
}
- } while (!IS_ERR(np));
+ }
- /* Missing valid "power-supplies" entries */
- if (cnt == 1)
- return 0;
+ /* Fall back to the name-based property if no references were specified. */
+ if (!cnt)
+ return power_supply_check_supplies_by_name(psy);
/* All supplies found, allocate char * array for filling */
psy->supplied_from = devm_kcalloc(&psy->dev,
- cnt - 1, sizeof(*psy->supplied_from),
+ cnt, sizeof(*psy->supplied_from),
GFP_KERNEL);
if (!psy->supplied_from)
return -ENOMEM;
return power_supply_populate_supplied_from(psy);
}
-#else
-static int power_supply_check_supplies(struct power_supply *psy)
-{
- int nval, ret;
-
- if (!psy->dev.parent)
- return 0;
-
- nval = device_property_string_array_count(psy->dev.parent, "supplied-from");
- if (nval <= 0)
- return 0;
-
- psy->supplied_from = devm_kmalloc_array(&psy->dev, nval,
- sizeof(char *), GFP_KERNEL);
- if (!psy->supplied_from)
- return -ENOMEM;
-
- ret = device_property_read_string_array(psy->dev.parent,
- "supplied-from", (const char **)psy->supplied_from, nval);
- if (ret < 0)
- return ret;
-
- psy->num_supplies = nval;
-
- return 0;
-}
-#endif
struct psy_am_i_supplied_data {
struct power_supply *psy;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0471/1257] power: supply: ltc2941: Fix of_node reference leak in ltc294x_i2c_probe()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0470/1257] power: supply: core: Honor supplied-from with CONFIG_OF=y Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0472/1257] fsverity: hoist statx reporting of fs-verity flag Greg Kroah-Hartman
` (527 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Sebastian Reichel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 09a29213bf15630e85a375478832b074b2cfc5c8 ]
ltc294x_i2c_probe() takes a reference on the device node with
of_node_get(), but never drops it, so the reference leaks on every
return path, including the success path.
The node is only used to read the battery properties and to set
info->supply_desc.name, so release it after its last use and also on
the lltc,resistor-sense error path.
Fixes: 085bc24d1553 ("Add LTC2941/LTC2943 Battery Gauge Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917142127.2156568-1-vulab@iscas.ac.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/ltc2941-battery-gauge.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/power/supply/ltc2941-battery-gauge.c b/drivers/power/supply/ltc2941-battery-gauge.c
index d1be314f36a09..6ebb555f203d3 100644
--- a/drivers/power/supply/ltc2941-battery-gauge.c
+++ b/drivers/power/supply/ltc2941-battery-gauge.c
@@ -464,9 +464,11 @@ static int ltc294x_i2c_probe(struct i2c_client *client)
/* r_sense can be negative, when sense+ is connected to the battery
* instead of the sense-. This results in reversed measurements. */
ret = of_property_read_s32(np, "lltc,resistor-sense", &r_sense);
- if (ret < 0)
+ if (ret < 0) {
+ of_node_put(np);
return dev_err_probe(&client->dev, ret,
"Could not find lltc,resistor-sense in devicetree\n");
+ }
info->r_sense = r_sense;
ret = of_property_read_u32(np, "lltc,prescaler-exponent",
@@ -477,6 +479,8 @@ static int ltc294x_i2c_probe(struct i2c_client *client)
prescaler_exp = LTC2941_MAX_PRESCALER_EXP;
}
+ of_node_put(np);
+
if (info->id == LTC2943_ID) {
if (prescaler_exp > LTC2943_MAX_PRESCALER_EXP)
prescaler_exp = LTC2943_MAX_PRESCALER_EXP;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0472/1257] fsverity: hoist statx reporting of fs-verity flag
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0471/1257] power: supply: ltc2941: Fix of_node reference leak in ltc294x_i2c_probe() Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0473/1257] ALSA: aloop: Dont constrain playback params in notify mode Greg Kroah-Hartman
` (526 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrey Albershteyn, Eric Biggers,
Christoph Hellwig, Darrick J. Wong, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Albershteyn <aalbersh@kernel.org>
[ Upstream commit f9e450420da2624c93ce9585deebfabb87932774 ]
All filesystems, supporting fsverity, report this status by checking
inode flag. Also, BTRFS was missing stat->attributes_mask, which is
fixed now.
Fixes: 146054090b08 ("btrfs: initial fsverity support")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
Acked-by: Eric Biggers <ebiggers@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Link: https://patch.msgid.link/20261002223705.2175542-7-aalbersh@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/inode.c | 3 ---
fs/ext4/inode.c | 5 +----
fs/f2fs/file.c | 5 +----
fs/stat.c | 6 +++++-
4 files changed, 7 insertions(+), 12 deletions(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index faf6ed7deb18b..aa1201fe4d7f8 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -8252,7 +8252,6 @@ static int btrfs_getattr(struct mnt_idmap *idmap,
struct inode *inode = d_inode(path->dentry);
u32 blocksize = btrfs_sb(inode->i_sb)->sectorsize;
u32 bi_flags = BTRFS_I(inode)->flags;
- u32 bi_ro_flags = BTRFS_I(inode)->ro_flags;
stat->result_mask |= STATX_BTIME;
stat->btime.tv_sec = BTRFS_I(inode)->i_otime_sec;
@@ -8265,8 +8264,6 @@ static int btrfs_getattr(struct mnt_idmap *idmap,
stat->attributes |= STATX_ATTR_IMMUTABLE;
if (bi_flags & BTRFS_INODE_NODUMP)
stat->attributes |= STATX_ATTR_NODUMP;
- if (bi_ro_flags & BTRFS_INODE_RO_VERITY)
- stat->attributes |= STATX_ATTR_VERITY;
stat->attributes_mask |= (STATX_ATTR_APPEND |
STATX_ATTR_COMPRESSED |
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 26f0f9714f03c..206c6245c6192 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -6318,15 +6318,12 @@ int ext4_getattr(struct mnt_idmap *idmap, const struct path *path,
stat->attributes |= STATX_ATTR_IMMUTABLE;
if (flags & EXT4_NODUMP_FL)
stat->attributes |= STATX_ATTR_NODUMP;
- if (flags & EXT4_VERITY_FL)
- stat->attributes |= STATX_ATTR_VERITY;
stat->attributes_mask |= (STATX_ATTR_APPEND |
STATX_ATTR_COMPRESSED |
STATX_ATTR_ENCRYPTED |
STATX_ATTR_IMMUTABLE |
- STATX_ATTR_NODUMP |
- STATX_ATTR_VERITY);
+ STATX_ATTR_NODUMP);
generic_fillattr(idmap, request_mask, inode, stat);
return 0;
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 29466a7367e55..5bd908799e7d5 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1075,15 +1075,12 @@ int f2fs_getattr(struct mnt_idmap *idmap, const struct path *path,
stat->attributes |= STATX_ATTR_IMMUTABLE;
if (flags & F2FS_NODUMP_FL)
stat->attributes |= STATX_ATTR_NODUMP;
- if (IS_VERITY(inode))
- stat->attributes |= STATX_ATTR_VERITY;
stat->attributes_mask |= (STATX_ATTR_COMPRESSED |
STATX_ATTR_APPEND |
STATX_ATTR_ENCRYPTED |
STATX_ATTR_IMMUTABLE |
- STATX_ATTR_NODUMP |
- STATX_ATTR_VERITY);
+ STATX_ATTR_NODUMP);
generic_fillattr(idmap, request_mask, inode, stat);
diff --git a/fs/stat.c b/fs/stat.c
index c461c30542340..e03954c36b33e 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -203,8 +203,12 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat,
if (IS_DAX(inode))
stat->attributes |= STATX_ATTR_DAX;
+ if (IS_VERITY(inode))
+ stat->attributes |= STATX_ATTR_VERITY;
+
stat->attributes_mask |= (STATX_ATTR_AUTOMOUNT |
- STATX_ATTR_DAX);
+ STATX_ATTR_DAX |
+ STATX_ATTR_VERITY);
idmap = mnt_idmap(path->mnt);
if (inode->i_op->getattr) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0473/1257] ALSA: aloop: Dont constrain playback params in notify mode
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0472/1257] fsverity: hoist statx reporting of fs-verity flag Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0474/1257] power: supply: ab8500_fg: Accept status from supplied power Greg Kroah-Hartman
` (525 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Hofman, Henrik Enquist,
Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrik Enquist <henrik.enquist@gmail.com>
[ Upstream commit ded106036984a9dd766e7e1451b02e2d15c81438 ]
With notify enabled (the pcm_notify module parameter or the "PCM
Notify" control), the playback side of a cable may change format, rate
and channels while a capture is running. loopback_check_format() then
stops the capture and notifies the "PCM Slave" controls, so that the
capture application can reopen with the new parameters. For this
reason loopback_open() still gives a notify mode playback the
unconstrained loopback_pcm_hardware.
Since commit 898dfe4687f4 ("ALSA: aloop: Fix racy hw constraints
adjustment") the hw rules refine against the shared cable->hw instead
of the substream's own runtime->hw. This pins the playback side to the
parameters of an open capture whatever the notify setting is. A player
probing the device sees only the capture's rate, format and channels,
and the format change path in loopback_check_format() can't be reached
by a new playback.
Skip the format, rate and channels rules for the playback substream
when notify is enabled. Skip the period bytes rule as well: with a
sound timer source, params_change() already takes the period size from
a notify mode playback, and keeping the old capture's period bytes
leaves a playback at another rate with a period that doesn't match the
timer. The capture side stays constrained to the cable parameters.
The capture stop this makes reachable again was hardened by commit
826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") and
commit e5c33cdc6f40 ("ALSA: aloop: Fix peer runtime UAF during
format-change stop"), which need to be applied first when backporting.
Reproducer, with notify enabled on the cable:
arecord -D hw:Loopback,1,0 -r 44100 -f S32_LE -c 2 /dev/null &
aplay -D hw:Loopback,0,0 96k.wav
Before: aplay is forced to 44100 Hz and the capture keeps running.
After: aplay runs at 96000 Hz, the capture is stopped and "PCM Slave
Rate" reports 96000.
Fixes: 898dfe4687f4 ("ALSA: aloop: Fix racy hw constraints adjustment")
Reported-by: Pavel Hofman <pavel.hofman@ivitera.com>
Closes: https://lore.kernel.org/all/b4af9071-f8d7-5b47-4d7a-c5743bd67394@ivitera.com/
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Henrik Enquist <henrik.enquist@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20261003-aloop-notify-fix-v1-1-ba5dfb831bf5@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/drivers/aloop.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index 81cb1f59f703b..5f0e2dc96769e 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -1073,6 +1073,18 @@ static unsigned int get_cable_index(struct snd_pcm_substream *substream)
return !substream->stream;
}
+/*
+ * In notify mode the playback side may change format, rate, channels and,
+ * with a sound timer, the period size. A running capture that no longer
+ * matches is stopped by loopback_check_format().
+ * call in loopback->cable_lock
+ */
+static bool loopback_playback_unconstrained(struct loopback_pcm *dpcm)
+{
+ return dpcm->substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
+ get_notify(dpcm);
+}
+
static int rule_format(struct snd_pcm_hw_params *params,
struct snd_pcm_hw_rule *rule)
{
@@ -1082,6 +1094,8 @@ static int rule_format(struct snd_pcm_hw_params *params,
snd_mask_none(&m);
scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+ if (loopback_playback_unconstrained(dpcm))
+ return 0;
m.bits[0] = (u_int32_t)cable->hw.formats;
m.bits[1] = (u_int32_t)(cable->hw.formats >> 32);
}
@@ -1096,6 +1110,8 @@ static int rule_rate(struct snd_pcm_hw_params *params,
struct snd_interval t;
scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+ if (loopback_playback_unconstrained(dpcm))
+ return 0;
t.min = cable->hw.rate_min;
t.max = cable->hw.rate_max;
}
@@ -1112,6 +1128,8 @@ static int rule_channels(struct snd_pcm_hw_params *params,
struct snd_interval t;
scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+ if (loopback_playback_unconstrained(dpcm))
+ return 0;
t.min = cable->hw.channels_min;
t.max = cable->hw.channels_max;
}
@@ -1128,6 +1146,8 @@ static int rule_period_bytes(struct snd_pcm_hw_params *params,
struct snd_interval t;
scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+ if (loopback_playback_unconstrained(dpcm))
+ return 0;
t.min = cable->hw.period_bytes_min;
t.max = cable->hw.period_bytes_max;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0474/1257] power: supply: ab8500_fg: Accept status from supplied power
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0473/1257] ALSA: aloop: Dont constrain playback params in notify mode Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0475/1257] power: supply: ab8500_fg: Report sub-percent charge changes Greg Kroah-Hartman
` (524 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Sebastian Reichel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linusw@kernel.org>
[ Upstream commit 16f506a13b58a55308449bbcbec89c817d619ca2 ]
Commit dc77721ea4aa ("power: supply: ab8500: Set typing and props")
changed the charging algorithm power supply type from battery to unknown
so userspace would not mistake it for a second battery. The fuel gauge,
however, processes status changes only from battery-type supplies. It
therefore never learns that charging started and keeps running its
discharge state machine.
The power supply relationship already limits the callback to supplies
naming the fuel gauge in supplied_to. Accept status from any such supply
while retaining the battery type checks for battery-specific properties.
The Samsung-GT-I8160-Codina and Samsung-GT-I8160_HD-Codina product trees
keep the charging algorithm typed as a battery. The
Samsung-GT-I8530-Gavini, Samsung-GT-S7710-Skomer,
Samsung-SGH-I407-Kyle and Samsung-SGH-T599-Codina-TMO alternative
fuel-gauge drivers instead pass cable state directly. Both approaches
preserve the charging state handoff that was lost in mainline.
Fixes: dc77721ea4aa ("power: supply: ab8500: Set typing and props")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260916-ab8500-charging-v1-1-e986ed321cc6@kernel.org
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/ab8500_fg.c | 60 ++++++++++++++------------------
1 file changed, 27 insertions(+), 33 deletions(-)
diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
index e6b5efdf5dc9b..016ed35e90f91 100644
--- a/drivers/power/supply/ab8500_fg.c
+++ b/drivers/power/supply/ab8500_fg.c
@@ -2205,42 +2205,36 @@ static int ab8500_fg_get_ext_psy_data(struct power_supply *ext, void *data)
switch (prop) {
case POWER_SUPPLY_PROP_STATUS:
- switch (ext->desc->type) {
- case POWER_SUPPLY_TYPE_BATTERY:
- switch (ret.intval) {
- case POWER_SUPPLY_STATUS_UNKNOWN:
- case POWER_SUPPLY_STATUS_DISCHARGING:
- case POWER_SUPPLY_STATUS_NOT_CHARGING:
- if (!di->flags.charging)
- break;
- di->flags.charging = false;
- di->flags.fully_charged = false;
- if (di->bm->capacity_scaling)
- ab8500_fg_update_cap_scalers(di);
- queue_work(di->fg_wq, &di->fg_work);
+ switch (ret.intval) {
+ case POWER_SUPPLY_STATUS_UNKNOWN:
+ case POWER_SUPPLY_STATUS_DISCHARGING:
+ case POWER_SUPPLY_STATUS_NOT_CHARGING:
+ if (!di->flags.charging)
break;
- case POWER_SUPPLY_STATUS_FULL:
- if (di->flags.fully_charged)
- break;
- di->flags.fully_charged = true;
- di->flags.force_full = true;
- /* Save current capacity as maximum */
- di->bat_cap.max_mah = di->bat_cap.mah;
- queue_work(di->fg_wq, &di->fg_work);
- break;
- case POWER_SUPPLY_STATUS_CHARGING:
- if (di->flags.charging &&
- !di->flags.fully_charged)
- break;
- di->flags.charging = true;
- di->flags.fully_charged = false;
- if (di->bm->capacity_scaling)
- ab8500_fg_update_cap_scalers(di);
- queue_work(di->fg_wq, &di->fg_work);
+ di->flags.charging = false;
+ di->flags.fully_charged = false;
+ if (di->bm->capacity_scaling)
+ ab8500_fg_update_cap_scalers(di);
+ queue_work(di->fg_wq, &di->fg_work);
+ break;
+ case POWER_SUPPLY_STATUS_FULL:
+ if (di->flags.fully_charged)
break;
- }
+ di->flags.fully_charged = true;
+ di->flags.force_full = true;
+ /* Save current capacity as maximum */
+ di->bat_cap.max_mah = di->bat_cap.mah;
+ queue_work(di->fg_wq, &di->fg_work);
break;
- default:
+ case POWER_SUPPLY_STATUS_CHARGING:
+ if (di->flags.charging &&
+ !di->flags.fully_charged)
+ break;
+ di->flags.charging = true;
+ di->flags.fully_charged = false;
+ if (di->bm->capacity_scaling)
+ ab8500_fg_update_cap_scalers(di);
+ queue_work(di->fg_wq, &di->fg_work);
break;
}
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0475/1257] power: supply: ab8500_fg: Report sub-percent charge changes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0474/1257] power: supply: ab8500_fg: Accept status from supplied power Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0476/1257] spi: atmel-quadspi: balance runtime PM and pclk across system sleep Greg Kroah-Hartman
` (523 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Sebastian Reichel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linusw@kernel.org>
[ Upstream commit 4d40dba1815d46c6ef9019ed80e3b998b0fc443d ]
The fuel gauge updates bat_cap.mah from the coulomb counter but exposes
bat_cap.prev_mah through CHARGE_NOW and ENERGY_NOW. It only refreshes
prev_mah when the rounded integer capacity percentage changes, making the
momentary properties appear frozen between percentage steps.
Refresh prev_mah and notify userspace whenever the new charge remains
within the currently accepted percentage. If a discharge estimate tries
to cross upward into a higher percentage, the existing rejection still
leaves both the reported percentage and charge unchanged.
The AB8500 fuel-gauge implementations in the Samsung-GT-I8160-Codina,
Samsung-GT-I8160_HD-Codina, Samsung-GT-I8530-Gavini,
Samsung-GT-S7710-Skomer, Samsung-SGH-I407-Kyle and
Samsung-SGH-T599-Codina-TMO product trees retain the same percentage-gated
prev_mah update and contain no finer-grained reporting workaround.
Fixes: 13151631b5bd ("ab8500-fg: A8500 fuel gauge driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260916-ab8500-charging-v1-2-e986ed321cc6@kernel.org
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/ab8500_fg.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
index 016ed35e90f91..c5eaa32c4a2d8 100644
--- a/drivers/power/supply/ab8500_fg.c
+++ b/drivers/power/supply/ab8500_fg.c
@@ -1387,6 +1387,13 @@ static void ab8500_fg_check_capacity_limits(struct ab8500_fg *di, bool init)
}
}
+ /* Keep the charge properties current between percentage changes. */
+ if (di->bat_cap.prev_percent == percent &&
+ di->bat_cap.prev_mah != di->bat_cap.mah) {
+ di->bat_cap.prev_mah = di->bat_cap.mah;
+ changed = true;
+ }
+
if (changed) {
if (di->bm->capacity_scaling) {
di->bat_cap.cap_scale.scaled_cap =
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0476/1257] spi: atmel-quadspi: balance runtime PM and pclk across system sleep
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0475/1257] power: supply: ab8500_fg: Report sub-percent charge changes Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0477/1257] perf: xgene: initialize lock before requesting IRQ Greg Kroah-Hartman
` (522 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Karl Mehltretter,
Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 717e45f97246d1070cdf86ccd7a0fb872b45933a ]
On the controllers with a generic clock (SAMA7G5, SAMA7D65, SAM9X7 and
LAN969x), atmel_qspi_suspend() takes a runtime PM reference and returns
without dropping it or suspending the device. It disables the peripheral
clock directly. atmel_qspi_resume() only prepares the peripheral clock
and then reinitializes the controller with that clock still off.
On a SAM9X75 Curiosity board, the tested standby and mem resumes
failed:
atmel_qspi f0014000.spi: PM: failed to resume: error -110
spi-nor spi0.0: resume() failed
Reading the flash afterwards returned no data. The runtime usage count
grew by one with each cycle, and the second suspend disabled the
peripheral clock again:
WARNING: drivers/clk/clk.c:1257 at clk_core_disable+0x6c/0xcc
qspi_clk already disabled
Use the same runtime PM sequence as the other variants. Suspend disables
the controller and forces a runtime suspend. Resume forces a runtime
resume, which enables the peripheral clock, before it runs the init
callback, and drops the reference afterwards. With this change the
tested resumes succeed on the board in both modes, the controller
returns to runtime suspend, and the flash reads back.
Fixes: 5af42209a4d2 ("spi: atmel-quadspi: Add support for sama7g5 QSPI")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260709112006.390742-1-robert.marko%40sartura.hr?part=3
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260923012950.15651-1-kmehltretter@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/atmel-quadspi.c | 24 +++++++++++++-----------
1 file changed, 13 insertions(+), 11 deletions(-)
diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c
index ec19fa0180f00..96ed734b56218 100644
--- a/drivers/spi/atmel-quadspi.c
+++ b/drivers/spi/atmel-quadspi.c
@@ -1590,12 +1590,14 @@ static int atmel_qspi_suspend(struct device *dev)
if (aq->caps->has_gclk) {
ret = atmel_qspi_sama7g5_suspend(aq);
- clk_disable_unprepare(aq->pclk);
- return ret;
+ if (ret) {
+ pm_runtime_put_autosuspend(dev);
+ return ret;
+ }
+ } else {
+ atmel_qspi_write(QSPI_CR_QSPIDIS, aq, QSPI_CR);
}
- atmel_qspi_write(QSPI_CR_QSPIDIS, aq, QSPI_CR);
-
pm_runtime_mark_last_busy(dev);
pm_runtime_force_suspend(dev);
@@ -1621,20 +1623,20 @@ static int atmel_qspi_resume(struct device *dev)
return ret;
}
- if (aq->caps->has_gclk)
- return aq->caps->init(aq);
-
ret = pm_runtime_force_resume(dev);
if (ret < 0)
return ret;
- atmel_qspi_init(aq);
-
- atmel_qspi_write(aq->scr, aq, QSPI_SCR);
+ if (aq->caps->has_gclk) {
+ ret = aq->caps->init(aq);
+ } else {
+ atmel_qspi_init(aq);
+ atmel_qspi_write(aq->scr, aq, QSPI_SCR);
+ }
pm_runtime_put_autosuspend(dev);
- return 0;
+ return ret;
}
static int atmel_qspi_runtime_suspend(struct device *dev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0477/1257] perf: xgene: initialize lock before requesting IRQ
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0476/1257] spi: atmel-quadspi: balance runtime PM and pclk across system sleep Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0478/1257] svcrdma: Grant credits from the clamped sc_max_requests Greg Kroah-Hartman
` (521 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Will Deacon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit d4b7b0c77142b3bc535192fa65130474a129c487 ]
xgene_pmu_probe() requests the PMU IRQ before initializing
xgene_pmu->lock. request_irq() enables IRQ handling before it returns,
so xgene_pmu_isr() can run in this window and acquire the uninitialized
raw spinlock.
Initialize the lock before requesting the IRQ so the handler always sees a
valid lock.
Fixes: 832c927d119b ("perf: xgene: Add APM X-Gene SoC Performance Monitoring Unit driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/xgene_pmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
index ab3623fab914c..0aa2b605fd53d 100644
--- a/drivers/perf/xgene_pmu.c
+++ b/drivers/perf/xgene_pmu.c
@@ -1873,6 +1873,8 @@ static int xgene_pmu_probe(struct platform_device *pdev)
if (irq < 0)
return -EINVAL;
+ raw_spin_lock_init(&xgene_pmu->lock);
+
rc = devm_request_irq(&pdev->dev, irq, xgene_pmu_isr,
IRQF_NOBALANCING | IRQF_NO_THREAD,
dev_name(&pdev->dev), xgene_pmu);
@@ -1881,8 +1883,6 @@ static int xgene_pmu_probe(struct platform_device *pdev)
xgene_pmu->irq = irq;
- raw_spin_lock_init(&xgene_pmu->lock);
-
/* Check for active MCBs and MCUs */
rc = xgene_pmu_probe_active_mcb_mcu_l3c(xgene_pmu, pdev);
if (rc) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0478/1257] svcrdma: Grant credits from the clamped sc_max_requests
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0477/1257] perf: xgene: initialize lock before requesting IRQ Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0479/1257] xfarray: dont crash when sorting if array element crosses a folio Greg Kroah-Hartman
` (520 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
[ Upstream commit b7037e5da3fb81abcd6309daecb112f1d5926760 ]
svc_rdma_accept() computes sc_fc_credits from sc_max_requests before
the Receive Queue depth is checked against the device's max_qp_wr.
When that check lowers sc_max_requests, the credit grant keeps the
original value, so the server advertises more credits than it has
Receives posted. A client that uses the full grant overruns the
Receive Queue, and the connection is lost with an RNR error.
Set sc_fc_credits after the clamp so the grant matches the number
of Receives the server posts.
Fixes: fc2e69db82c1 ("svcrdma: Clean up comment in svc_rdma_accept()")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260828135036.796842-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/svc_rdma_transport.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 927269598ac24..f949601b21447 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -471,7 +471,6 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
newxprt->sc_max_requests = svcrdma_max_requests;
newxprt->sc_max_bc_requests = svcrdma_max_bc_requests;
newxprt->sc_recv_batch = RPCRDMA_MAX_RECV_BATCH;
- newxprt->sc_fc_credits = cpu_to_be32(newxprt->sc_max_requests);
/* Qualify the transport's resource defaults with the
* capabilities of this particular device.
@@ -492,6 +491,8 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
newxprt->sc_max_bc_requests = 2;
}
+ newxprt->sc_fc_credits = cpu_to_be32(newxprt->sc_max_requests);
+
/* Estimate the needed number of rdma_rw contexts. The maximum
* Read and Write chunks have one segment each. Each request
* can involve one Read chunk and either a Write chunk or Reply
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0479/1257] xfarray: dont crash when sorting if array element crosses a folio
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0478/1257] svcrdma: Grant credits from the clamped sc_max_requests Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0480/1257] ASoC: stm: stm32_i2s: request IRQ after regmap initialization Greg Kroah-Hartman
` (519 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
[ Upstream commit 329750292e9dfbb594b375d7b30cf5ddb58b7bb9 ]
LOLLM points out that if an array element crosses a folio boundary,
xfile_get_folio returns a NULL folio pointer. If this happens,
si->folio is also set to NULL, and calling folio_pos/folio_address will
just crash the kernel. Teach this function to handle this condition by
falling back to reading the array element into scratchpad memory.
Cc: stable@vger.kernel.org # v6.6
Fixes: cf36f4f64c2d4e ("xfs: cache pages used for xfarray quicksort convergence")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/scrub/xfarray.c | 69 ++++++++++++++++++++++++++++--------------
1 file changed, 47 insertions(+), 22 deletions(-)
diff --git a/fs/xfs/scrub/xfarray.c b/fs/xfs/scrub/xfarray.c
index dc18c6310cbd8..24e9837211f35 100644
--- a/fs/xfs/scrub/xfarray.c
+++ b/fs/xfs/scrub/xfarray.c
@@ -794,6 +794,46 @@ xfarray_sort_scan_done(
si->folio = NULL;
}
+static int
+xfarray_sort_load_folio(
+ struct xfarray_sortinfo *si,
+ xfarray_idx_t idx,
+ loff_t idx_pos)
+{
+ struct folio *folio;
+ loff_t next_pos;
+
+ folio = xfile_get_folio(si->array->xfile, idx_pos, si->array->obj_size,
+ XFILE_ALLOC);
+ if (IS_ERR(folio))
+ return PTR_ERR(folio);
+ si->folio = folio;
+
+ /* No folio? Get the caller to read into the scratchpad. */
+ if (!si->folio)
+ return 0;
+
+ si->first_folio_idx = xfarray_idx(si->array,
+ folio_pos(si->folio) + si->array->obj_size - 1);
+
+ next_pos = folio_next_pos(si->folio);
+ si->last_folio_idx = xfarray_idx(si->array, next_pos - 1);
+ if (xfarray_pos(si->array, si->last_folio_idx + 1) > next_pos)
+ si->last_folio_idx--;
+
+ /*
+ * If this folio still doesn't cover the desired element, it must cross
+ * a folio boundary. Get the caller to read into the scratchpad.
+ */
+ if (idx < si->first_folio_idx || idx > si->last_folio_idx) {
+ xfarray_sort_scan_done(si);
+ return 0;
+ }
+
+ trace_xfarray_sort_scan(si, idx);
+ return 0;
+}
+
/*
* Cache the folio backing the start of the given array element. If the array
* element is contained entirely within the folio, return a pointer to the
@@ -819,33 +859,18 @@ xfarray_sort_scan(
(idx < si->first_folio_idx || idx > si->last_folio_idx))
xfarray_sort_scan_done(si);
- /* Grab the first folio that backs this array element. */
+ /* Grab the folio that backs this array element. */
if (!si->folio) {
- struct folio *folio;
- loff_t next_pos;
-
- folio = xfile_get_folio(si->array->xfile, idx_pos,
- si->array->obj_size, XFILE_ALLOC);
- if (IS_ERR(folio))
- return PTR_ERR(folio);
- si->folio = folio;
-
- si->first_folio_idx = xfarray_idx(si->array,
- folio_pos(si->folio) + si->array->obj_size - 1);
-
- next_pos = folio_next_pos(si->folio);
- si->last_folio_idx = xfarray_idx(si->array, next_pos - 1);
- if (xfarray_pos(si->array, si->last_folio_idx + 1) > next_pos)
- si->last_folio_idx--;
-
- trace_xfarray_sort_scan(si, idx);
+ error = xfarray_sort_load_folio(si, idx, idx_pos);
+ if (error)
+ return error;
}
/*
- * If this folio still doesn't cover the desired element, it must cross
- * a folio boundary. Read into the scratchpad and we're done.
+ * If we don't have a folio mapping the entire array element, read into
+ * the scratchpad and we're done.
*/
- if (idx < si->first_folio_idx || idx > si->last_folio_idx) {
+ if (!si->folio) {
void *temp = xfarray_scratch(si->array);
error = xfile_load(si->array->xfile, temp, si->array->obj_size,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0480/1257] ASoC: stm: stm32_i2s: request IRQ after regmap initialization
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0479/1257] xfarray: dont crash when sorting if array element crosses a folio Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0481/1257] ASoC: codecs: rt5682s: disable jack detection work on shutdown Greg Kroah-Hartman
` (518 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 1b207c85551fd74854d632116849295b2305245f ]
The ISR accesses the managed regmap, but probe requests the IRQ before
creating it. An early interrupt can reach an uninitialized regmap.
Reverse-order cleanup can free the regmap while the IRQ remains active.
Request the IRQ after regmap initialization so probe unwind and
removal free and synchronize it before releasing the regmap.
The teardown ordering issue was found by static analysis.
Fixes: e4e6ec7b127c ("ASoC: stm32: Add I2S driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20261004043451.1138613-1-mhun512@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/stm/stm32_i2s.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
diff --git a/sound/soc/stm/stm32_i2s.c b/sound/soc/stm/stm32_i2s.c
index 83b51893b37c8..7fcf23bd0aff2 100644
--- a/sound/soc/stm/stm32_i2s.c
+++ b/sound/soc/stm/stm32_i2s.c
@@ -1185,7 +1185,7 @@ static int stm32_i2s_parse_dt(struct platform_device *pdev,
struct device_node *np = pdev->dev.of_node;
struct reset_control *rst;
struct resource *res;
- int irq, ret;
+ int ret;
if (!np)
return -ENODEV;
@@ -1231,16 +1231,6 @@ static int stm32_i2s_parse_dt(struct platform_device *pdev,
return ret;
}
- /* Get irqs */
- irq = platform_get_irq(pdev, 0);
- if (irq < 0)
- return irq;
-
- ret = devm_request_irq(&pdev->dev, irq, stm32_i2s_isr, 0,
- dev_name(&pdev->dev), i2s);
- if (ret)
- return ret;
-
/* Reset */
rst = devm_reset_control_get_optional_exclusive(&pdev->dev, NULL);
if (IS_ERR(rst))
@@ -1265,7 +1255,7 @@ static int stm32_i2s_probe(struct platform_device *pdev)
{
struct stm32_i2s_data *i2s;
u32 val;
- int ret;
+ int irq, ret;
i2s = devm_kzalloc(&pdev->dev, sizeof(*i2s), GFP_KERNEL);
if (!i2s)
@@ -1291,6 +1281,15 @@ static int stm32_i2s_probe(struct platform_device *pdev)
return dev_err_probe(&pdev->dev, PTR_ERR(i2s->regmap),
"Regmap init error\n");
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0)
+ return irq;
+
+ ret = devm_request_irq(&pdev->dev, irq, stm32_i2s_isr, 0,
+ dev_name(&pdev->dev), i2s);
+ if (ret)
+ return ret;
+
ret = snd_dmaengine_pcm_register(&pdev->dev, &stm32_i2s_pcm_config, 0);
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0481/1257] ASoC: codecs: rt5682s: disable jack detection work on shutdown
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0480/1257] ASoC: stm: stm32_i2s: request IRQ after regmap initialization Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0482/1257] dmaengine: loongson2-apb-cmc: fix descriptor leak in prep_slave_sg() Greg Kroah-Hartman
` (517 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit ca552e3140e736ed6704fe5d47439d8f2d40b42e ]
The jack detection and button check works can queue each other. The
shutdown path cancels jack_detect_work first, but jd_check_work can
queue it again after that cancellation returns. Canceling jd_check_work
then leaves jack_detect_work pending or running while the device is
reset and, on removal, its managed resources are released.
Disable and drain both delayed works so neither callback can revive the
other after its cancellation. The I2C remove callback uses the same
shutdown path.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: c07ac3ee76e5 ("ASoC: rt5682s: Fix the wrong jack type detected")
Cc: stable@vger.kernel.org # 6.10+
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20261003041045.650207-1-mhun512@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/rt5682s.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c
index 34997cfb465b6..7a196fab623a9 100644
--- a/sound/soc/codecs/rt5682s.c
+++ b/sound/soc/codecs/rt5682s.c
@@ -3294,8 +3294,8 @@ static void rt5682s_i2c_shutdown(struct i2c_client *client)
struct rt5682s_priv *rt5682s = i2c_get_clientdata(client);
disable_irq(client->irq);
- cancel_delayed_work_sync(&rt5682s->jack_detect_work);
- cancel_delayed_work_sync(&rt5682s->jd_check_work);
+ disable_delayed_work_sync(&rt5682s->jack_detect_work);
+ disable_delayed_work_sync(&rt5682s->jd_check_work);
rt5682s_reset(rt5682s);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0482/1257] dmaengine: loongson2-apb-cmc: fix descriptor leak in prep_slave_sg()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0481/1257] ASoC: codecs: rt5682s: disable jack detection work on shutdown Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0483/1257] floppy: dont store a stack buffer in timeout_message Greg Kroah-Hartman
` (516 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diego Fernando Mancera Gomez,
Frank Li, Vinod Koul, Sasha Levin, Claude Opus 4.8
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
[ Upstream commit 4bbfc1d7e56134336dd1f792f51ee88a600a27ad ]
loongson2_cmc_dma_prep_slave_sg() allocates the descriptor with
kzalloc_flex() before iterating over the scatterlist. If
loongson2_cmc_dma_set_xfer_param() fails inside the loop, the function
returns ERR_PTR(ret) without freeing the descriptor. At this point the
descriptor has not been handed to vchan_tx_prep() yet, so nothing else
will ever free it, leaking it on every failed ->device_prep_slave_sg()
call (e.g. an unsupported transfer direction or bus width).
The neighbouring error path for the num_items check already frees the
descriptor before returning; do the same on the set_xfer_param() failure
path.
Fixes: 1c0028e725f1 ("dmaengine: loongson: New driver for the Loongson Multi-Channel DMA controller")
Link: https://lore.kernel.org/all/20260818094957.7D2221F000E9@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012bUV3WshMSfTq61n1cgh1i
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260905062833.272484-1-diegomancera.dev@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/loongson/loongson2-apb-cmc-dma.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/loongson/loongson2-apb-cmc-dma.c b/drivers/dma/loongson/loongson2-apb-cmc-dma.c
index 1c9a542edc859..60eb4d9616103 100644
--- a/drivers/dma/loongson/loongson2-apb-cmc-dma.c
+++ b/drivers/dma/loongson/loongson2-apb-cmc-dma.c
@@ -404,8 +404,10 @@ loongson2_cmc_dma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
for_each_sg(sgl, sg, sg_len, i) {
ret = loongson2_cmc_dma_set_xfer_param(lchan, direction, &buswidth, sg_dma_len(sg));
- if (ret)
+ if (ret) {
+ kfree(desc);
return ERR_PTR(ret);
+ }
num_items = DIV_ROUND_UP(sg_dma_len(sg), buswidth);
if (num_items >= LOONSON2_CMCDMA_MAX_DATA_ITEMS) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0483/1257] floppy: dont store a stack buffer in timeout_message
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0482/1257] dmaengine: loongson2-apb-cmc: fix descriptor leak in prep_slave_sg() Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0484/1257] floppy: return the drive state flags from the 32-bit FDGETDRVSTAT Greg Kroah-Hartman
` (515 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+874c2707f97fac24b090,
Denis Efremov (Oracle), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Efremov (Oracle) <efremov@linux.com>
[ Upstream commit 66be62ee5d64b6ad1285978644798d8611add931 ]
request_done() formats "request done %d" into a buffer on its stack and
passes it to reschedule_timeout(), which keeps the pointer in
timeout_message. show_floppy() prints timeout_message long after
request_done() has returned, e.g. from result() in the interrupt
handler, and reads a dead stack frame:
BUG: KASAN: stack-out-of-bounds in string+0x39c/0x3d0 lib/vsprintf.c:720
Read of size 1 at addr ffffc900003cfc70 by task swapper/3/0
Call Trace:
<IRQ>
...
show_floppy+0xb1/0x45f drivers/block/floppy.c:1838
result.cold+0x2b/0x30 drivers/block/floppy.c:1183
floppy_interrupt+0x191/0x340 drivers/block/floppy.c:1755
floppy_hardint+0x1a7/0x200 arch/x86/include/asm/floppy.h:66
uptodate is either 0 or 1, so pass one of two string literals instead.
Cc: stable@vger.kernel.org
Fixes: 73507e6cd8dc ("drivers/block/floppy.c: remove unnecessary argument from [__]reschedule_timeout")
Reported-by: syzbot+874c2707f97fac24b090@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=874c2707f97fac24b090
Link: https://patch.msgid.link/20260924094839.3239569-1-efremov@linux.com
Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/floppy.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index f04397b8e381c..02a34de691025 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -2276,11 +2276,10 @@ static void request_done(int uptodate)
{
struct request *req = current_req;
int block;
- char msg[sizeof("request done ") + sizeof(int) * 3];
probing = 0;
- snprintf(msg, sizeof(msg), "request done %d", uptodate);
- reschedule_timeout(MAXTIMEOUT, msg);
+ reschedule_timeout(MAXTIMEOUT,
+ uptodate ? "request done 1" : "request done 0");
if (!req) {
pr_info("floppy.c: no request in request_done\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0484/1257] floppy: return the drive state flags from the 32-bit FDGETDRVSTAT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0483/1257] floppy: dont store a stack buffer in timeout_message Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0485/1257] dmaengine: sh: rz-dmac: Fix off-by-one in residue lmdesc lookup Greg Kroah-Hartman
` (514 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Denis Efremov (Oracle), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Efremov (Oracle) <efremov@linux.com>
[ Upstream commit bb38473f1bcb287567f2fa7980e483a778092504 ]
compat_getdrvstat() copies every field of the drive state to a 32-bit
caller except ->flags, which stays zero. 32-bit FDGETDRVSTAT and
FDPOLLDRVSTAT therefore never report FD_DISK_WRITABLE, FD_DISK_CHANGED
or FD_VERIFY: i386 fdutils (floppycontrol -P, fdmount), and other
32-bit users see every disk as write-protected and never see a disk
change. The compat code in block/compat_ioctl.c copied the field;
it was lost when that code moved into floppy.c
Also declare the field as compat_ulong_t: the 32-bit struct
floppy_drive_struct starts with an unsigned long, and a signed char at
offset 0 only lines up with its low byte on little-endian machines. The
size and offsets of the compat structure, and so FDGETDRVSTAT32, do not
change.
Cc: stable@vger.kernel.org
Fixes: 229b53c9bf4e ("take floppy compat ioctls to sodding floppy.c")
Link: https://patch.msgid.link/20260924112825.3525931-1-efremov@linux.com
Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/floppy.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 02a34de691025..7465e10f36d46 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3600,7 +3600,7 @@ struct compat_floppy_drive_params {
};
struct compat_floppy_drive_struct {
- signed char flags;
+ compat_ulong_t flags;
compat_ulong_t spinup_date;
compat_ulong_t select_date;
compat_ulong_t first_read_date;
@@ -3784,6 +3784,7 @@ static int compat_getdrvstat(int drive, bool poll,
goto Eintr;
process_fd_request();
}
+ v.flags = drive_state[drive].flags;
v.spinup_date = drive_state[drive].spinup_date;
v.select_date = drive_state[drive].select_date;
v.first_read_date = drive_state[drive].first_read_date;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0485/1257] dmaengine: sh: rz-dmac: Fix off-by-one in residue lmdesc lookup
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0484/1257] floppy: return the drive state flags from the 32-bit FDGETDRVSTAT Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0486/1257] dlm: fix send buffer backpressure handling Greg Kroah-Hartman
` (513 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Tommaso Merciai,
Frank Li, Vinod Koul, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
[ Upstream commit 9db8e502b34bc1df8078abd0169a4fa0624de3bb ]
lmdesc->nxla is the address of the next descriptor, so comparing it
against CRLA, which is the address of the current descriptor,
finds the descriptor before the active one, not the active one.
The residue loops below then summed one lmdesc too many on top of
that.
Compare each descriptor's own address to CRLA instead, and add tb
after advancing to the next lmdesc.
Fixes: 21323b118c16 ("dmaengine: sh: rz-dmac: Add device_tx_status() callback")
Fixes: 172bfb57481c ("dmaengine: sh: rz-dmac: Add cyclic DMA support")
Cc: stable@vger.kernel.org
Suggested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260922092037.224884-1-claudiu.beznea@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/sh/rz-dmac.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/dma/sh/rz-dmac.c b/drivers/dma/sh/rz-dmac.c
index ca76f1bb45c41..fdd7131e890ab 100644
--- a/drivers/dma/sh/rz-dmac.c
+++ b/drivers/dma/sh/rz-dmac.c
@@ -937,7 +937,7 @@ static u32 rz_dmac_calculate_residue_bytes_in_vd(struct rz_dmac_chan *channel,
struct rz_dmac *dmac = to_rz_dmac(chan->device);
u32 residue = 0, i = 0;
- while (lmdesc->nxla != crla) {
+ while (rz_dmac_lmdesc_addr(channel, lmdesc) != crla) {
lmdesc = rz_dmac_get_next_lmdesc(channel->lmdesc.base, lmdesc);
if (++i >= DMAC_NR_LMDESC)
return 0;
@@ -948,13 +948,13 @@ static u32 rz_dmac_calculate_residue_bytes_in_vd(struct rz_dmac_chan *channel,
u32 start_lmdesc_addr = rz_dmac_lmdesc_addr(channel, desc->start_lmdesc);
while (lmdesc->nxla != start_lmdesc_addr) {
- residue += lmdesc->tb;
lmdesc = rz_dmac_get_next_lmdesc(channel->lmdesc.base, lmdesc);
+ residue += lmdesc->tb;
}
} else {
while (lmdesc->chcfg & CHCFG_DEM) {
- residue += lmdesc->tb;
lmdesc = rz_dmac_get_next_lmdesc(channel->lmdesc.base, lmdesc);
+ residue += lmdesc->tb;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0486/1257] dlm: fix send buffer backpressure handling
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0485/1257] dmaengine: sh: rz-dmac: Fix off-by-one in residue lmdesc lookup Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0487/1257] PCI/DOE: Fix double free of a duplicate features sysfs name Greg Kroah-Hartman
` (512 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Teigland, Alexander Aring,
Kuniyuki Iwashima, Eric Dumazet, Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@kernel.org>
[ Upstream commit e234d7625598b2eaded84fa99f53c8062650828f ]
lowcomms.c tests and clears SOCKWQ_ASYNC_NOSPACE in con->sock->flags,
but this bit has not been stored there for ten years.
Commit 9cd3e072b0be ("net: rename SOCK_ASYNC_NOSPACE and
SOCK_ASYNC_WAITDATA") mechanically renamed the two dlm users, then
commit ceb5d58b2170 ("net: fix sock_wake_async() rcu protection") moved
the bit from socket->flags to the RCU protected socket_wq->flags, where
it is reachable only through sk_set_bit() and sk_clear_bit(), and is
only maintained for sockets having SOCK_FASYNC set. dlm uses kernel
sockets, which never have SOCK_FASYNC set, and never sets the bit
itself, so the test in send_to_sock() has been false ever since.
The consequence is that when sock_sendmsg() returns -EAGAIN because the
socket send buffer is full, dlm no longer sets CF_APP_LIMITED, does not
increment sk_write_pending, and does not return DLM_IO_END to wait for
lowcomms_write_space(). It returns DLM_IO_RESCHED instead, and
process_send_sockets() immediately requeues the send work. A connection
to a peer that is slow to drain thus keeps cycling through
sock_sendmsg() and -EAGAIN, burning CPU, instead of sleeping until TCP
reports that space is available again.
Test SOCK_NOSPACE instead. This is the bit that lives in socket->flags,
that TCP sets whenever sendmsg() returns -EAGAIN for lack of send buffer
space (tcp_sendmsg_locked() and sk_stream_wait_memory()), and that
lowcomms_write_space() already clears. This restores the semantics dlm
had before the bit moved.
Also remove the clear_bit() of SOCKWQ_ASYNC_NOSPACE from
lowcomms_write_space(), for the same reason.
SCTP connections are deliberately left as they are. SCTP does not set
SOCK_NOSPACE, and it never calls sk->sk_write_space(): sctp_wfree() ends
up in sctp_wake_up_waiters(), which calls sctp_write_space() directly.
lowcomms_write_space() is thus never invoked for an SCTP connection, and
the test added here stays false, so send_to_sock() keeps returning
DLM_IO_RESCHED as it does today. This is the only safe behavior, as
returning DLM_IO_END would wait for a callback that never comes.
Fixes: ceb5d58b2170 ("net: fix sock_wake_async() rcu protection")
Cc: stable@vger.kernel.org
Cc: David Teigland <teigland@redhat.com>
Acked-by: Alexander Aring <aahringo@redhat.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20260929071743.23624-2-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dlm/lowcomms.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 2aff1c7c17de4..abe9ae4c643fa 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -522,10 +522,8 @@ static void lowcomms_write_space(struct sock *sk)
clear_bit(SOCK_NOSPACE, &con->sock->flags);
spin_lock_bh(&con->writequeue_lock);
- if (test_and_clear_bit(CF_APP_LIMITED, &con->flags)) {
+ if (test_and_clear_bit(CF_APP_LIMITED, &con->flags))
con->sock->sk->sk_write_pending--;
- clear_bit(SOCKWQ_ASYNC_NOSPACE, &con->sock->flags);
- }
lowcomms_queue_swork(con);
spin_unlock_bh(&con->writequeue_lock);
@@ -1391,7 +1389,7 @@ static int send_to_sock(struct connection *con)
if (ret == -EAGAIN || ret == 0) {
lock_sock(con->sock->sk);
spin_lock_bh(&con->writequeue_lock);
- if (test_bit(SOCKWQ_ASYNC_NOSPACE, &con->sock->flags) &&
+ if (test_bit(SOCK_NOSPACE, &con->sock->flags) &&
!test_and_set_bit(CF_APP_LIMITED, &con->flags)) {
/* Notify TCP that we're limited by the
* application window size.
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0487/1257] PCI/DOE: Fix double free of a duplicate features sysfs name
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0486/1257] dlm: fix send buffer backpressure handling Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0488/1257] PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow Greg Kroah-Hartman
` (511 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alistair Francis, Donggeun Yoo,
Bjorn Helgaas, Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
[ Upstream commit 624ee129620a054466b6a29d98cd7a40ccc239cd ]
When a DOE feature is reported twice, sysfs_add_file_to_group() fails
with -EEXIST for the second copy and pci_doe_sysfs_feature_populate()
frees that attribute's name, but leaves the pointer in place.
pci_doe_sysfs_feature_remove() frees every name again when the device
is removed, or when a later feature fails to register, so the name is
freed twice:
BUG: KASAN: double-free in pci_doe_sysfs_feature_remove+0x117/0x1b0
Call Trace:
kfree+0x11a/0x420
pci_doe_sysfs_feature_remove+0x117/0x1b0
pci_doe_sysfs_teardown+0x90/0xf0
pci_remove_bus_device+0x128/0x2e0
pci_stop_and_remove_bus_device_locked+0x1d/0x30
remove_store+0xd2/0xf0
Clear the pointer after freeing the name.
Fixes: 2311ab1820fe ("PCI/DOE: Expose DOE features via sysfs")
Suggested-by: Alistair Francis <alistair@alistair23.me>
Assisted-by: LLM
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261003102221.59894-1-donggeunyoo.kernel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/doe.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/doe.c b/drivers/pci/doe.c
index ac95b1d2d9997..6b5d9ba8e9697 100644
--- a/drivers/pci/doe.c
+++ b/drivers/pci/doe.c
@@ -208,8 +208,9 @@ static int pci_doe_sysfs_feature_populate(struct pci_dev *pdev,
pci_warn(pdev, "Failed adding %s to sysfs group\n",
attrs[i].attr.name);
goto fail;
- } else
- kfree(attrs[i].attr.name);
+ }
+ kfree(attrs[i].attr.name);
+ attrs[i].attr.name = NULL;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0488/1257] PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0487/1257] PCI/DOE: Fix double free of a duplicate features sysfs name Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0489/1257] xfs: cross-reference the primary superblock Greg Kroah-Hartman
` (510 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Priyank Rathod, Bjorn Helgaas,
Kuppuswamy Sathyanarayanan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Priyank Rathod <rathodpriyank@google.com>
[ Upstream commit 07938f8a3cbf3e9cc27553b8982e2d56c15b354a ]
When ACPI APEI/GHES processes PCIe AER error records, it allocates memory
for aer_capability_regs (aer_regs) from ghes_estatus_pool and passes it to
aer_recover_queue() to be enqueued into aer_recover_ring.
If kfifo_in_spinlocked() fails due to a buffer overflow,
aer_recover_queue() logged an error message but returned without freeing
aer_regs. Because the entry was rejected and never inserted into the queue,
aer_recover_work_func() could never dequeue or free it, leaking the
allocated ghes_estatus_pool memory.
aer_recover_queue() returns void, so the caller ghes_handle_aer() cannot
free the buffer itself: ownership is transferred to the AER code, which
until now only released it on the success path.
Free aer_regs via ghes_estatus_pool_region_free() when
kfifo_in_spinlocked() fails on buffer overflow.
Fixes: e2abc47a5a1a ("ACPI: APEI: Fix AER info corruption when error status data has multiple sections")
Signed-off-by: Priyank Rathod <rathodpriyank@google.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260928-b4-fix-aer-memleaks-v5-1-ba6b94c9c9a6@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pcie/aer.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
index 732f75a31760f..be332d3f106cb 100644
--- a/drivers/pci/pcie/aer.c
+++ b/drivers/pci/pcie/aer.c
@@ -1426,11 +1426,14 @@ void aer_recover_queue(int domain, unsigned int bus, unsigned int devfn,
};
if (kfifo_in_spinlocked(&aer_recover_ring, &entry, 1,
- &aer_recover_ring_lock))
+ &aer_recover_ring_lock)) {
schedule_work(&aer_recover_work);
- else
+ } else {
pr_err("buffer overflow in recovery for %04x:%02x:%02x.%x\n",
domain, bus, PCI_SLOT(devfn), PCI_FUNC(devfn));
+ ghes_estatus_pool_region_free((unsigned long)aer_regs,
+ sizeof(struct aer_capability_regs));
+ }
}
EXPORT_SYMBOL_GPL(aer_recover_queue);
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0489/1257] xfs: cross-reference the primary superblock
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0488/1257] PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0490/1257] wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz Greg Kroah-Hartman
` (509 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
[ Upstream commit 0c61016006ab08f8346f9e7b1e38559bd4ea499e ]
Make sure we cross-reference the primary superblock against the rest of
the AG 0 space metadata. Drop the unused @bp parameter of
xchk_superblock_xref to avoid complaints about uninitialized variables.
Cc: stable@vger.kernel.org # v4.16
Fixes: 52dc4b44af7419 ("xfs: cross-reference with the bnobt")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--git a/fs/xfs/scrub/agheader.c b/fs/xfs/scrub/agheader.c
index fa5d32ec020ae..1dff6cb1b9362 100644
--- a/fs/xfs/scrub/agheader.c
+++ b/fs/xfs/scrub/agheader.c
@@ -35,8 +35,7 @@ xchk_setup_agheader(
/* Cross-reference with the other btrees. */
STATIC void
xchk_superblock_xref(
- struct xfs_scrub *sc,
- struct xfs_buf *bp)
+ struct xfs_scrub *sc)
{
struct xfs_mount *mp = sc->mp;
xfs_agnumber_t agno = sc->sm->sm_agno;
@@ -106,16 +105,12 @@ xchk_superblock(
struct xfs_dsb *sb;
struct xfs_perag *pag;
size_t sblen;
- xfs_agnumber_t agno;
+ xfs_agnumber_t agno = sc->sm->sm_agno;
uint32_t v2_ok;
__be32 features_mask;
int error;
__be16 vernum_mask;
- agno = sc->sm->sm_agno;
- if (agno == 0)
- return 0;
-
/*
* Grab an active reference to the perag structure. If we can't get
* it, we're racing with something that's tearing down the AG, so
@@ -125,6 +120,9 @@ xchk_superblock(
if (!pag)
return -ENOENT;
+ if (agno == 0)
+ goto out_xref;
+
error = xfs_sb_read_secondary(mp, sc->tp, agno, &bp);
/*
* The superblock verifier can return several different error codes
@@ -430,7 +428,8 @@ xchk_superblock(
if (memchr_inv((char *)sb + sblen, 0, BBTOB(bp->b_length) - sblen))
xchk_block_set_corrupt(sc, bp);
- xchk_superblock_xref(sc, bp);
+out_xref:
+ xchk_superblock_xref(sc);
out_pag:
xfs_perag_put(pag);
return error;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0490/1257] wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0489/1257] xfs: cross-reference the primary superblock Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0491/1257] mm/ksm: mark migration stores with WRITE_ONCE() Greg Kroah-Hartman
` (508 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Arend van Spriel,
Johannes Berg, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit f7463a9c99a506b3308a852f9aaaf2a26b659e95 ]
After a recent change in clang to warn on signed char conversions within
array initializers [1], there is a warning (or error with
CONFIG_WERROR=y / W=e) from nphy_ipa_rxcal_gaintbl_2GHz:
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c:224:18: error: implicit conversion from 'int' to 's8' (aka 'signed char') changes value from 128 to -128 [-Werror,-Wconstant-conversion]
224 | {0, 0, 0, 0, 0, 128},
| ~ ^~~
1 error generated.
This value was introduced in the original staging merge of brcmsmac in
commit a9533e7ea3c4 ("Staging: Add initial release of brcm80211 - Broadcom
802.11n wireless LAN driver.") and it is the same in the proprietary
driver [2]. Presumably it is correct since there have been no reported issues,
so update the value to '-128' to be type correct and clear up the warning.
Cc: stable@vger.kernel.org
Fixes: a9533e7ea3c4 ("Staging: Add initial release of brcm80211 - Broadcom 802.11n wireless LAN driver.")
Link: https://github.com/llvm/llvm-project/commit/a5ef934a8d295dc03be3960f2b3744ec2e53238e [1]
Link: https://lore.kernel.org/1a107e21b08.2873.9b12b7fc0a3841636cfb5e919b41b954@broadcom.com/ [2]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20261005-brcmsmac-clang-24-constant-conversion-v1-1-a30c5692d582@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
index 86cfa3e87a042..9ddd5d519893e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
@@ -221,7 +221,7 @@ static const struct nphy_ipa_txrxgain nphy_ipa_rxcal_gaintbl_5GHz[] = {
};
static const struct nphy_ipa_txrxgain nphy_ipa_rxcal_gaintbl_2GHz[] = {
- {0, 0, 0, 0, 0, 128},
+ {0, 0, 0, 0, 0, -128},
{0, 0, 0, 0, 0, 70},
{0, 0, 0, 0, 0, 20},
{0, 0, 0, 3, 0, 20},
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0491/1257] mm/ksm: mark migration stores with WRITE_ONCE()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0490/1257] wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0492/1257] mm/memcontrol: fix data-race on reading jiffies_64 Greg Kroah-Hartman
` (507 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Andrew Morton, Xu Xin,
David Hildenbrand (Arm), Hugh Dickins, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <nicoyip.dev@gmail.com>
[ Upstream commit d3863210464f69c18615cbe400d48a6e53e770d4 ]
ksm_get_folio() deliberately samples stable_node->kpfn and folio->mapping
without taking the folio lock because the KSM folio may be migrated
concurrently. folio_migrate_ksm() updates the same state using plain
assignments.
The reader can load the old kpfn, then the migrator can store the new
kpfn, execute smp_wmb(), and clear the old folio's mapping before the
reader checks that mapping. Thus the initial kpfn load can overlap its
update and the subsequent mapping load can overlap the clear, with no
common lock. This leaves marked READ_ONCE() accesses racing with plain
stores.
The kernel reported:
BUG: KCSAN: data-race in folio_migrate_ksm / ksm_get_folio
read (marked) to 0xffff8ce401421330 of 8 bytes by task 48 on cpu 3:
ksm_get_folio+0x7f/0x2a0
ksm_scan_thread+0x1635/0x3330
kthread+0x1af/0x1f0
write to 0xffff8ce401421330 of 8 bytes by task 102 on cpu 1:
folio_migrate_ksm+0x6a/0xd0
folio_migrate_flags+0x193/0x420
__migrate_folio.isra.0+0x162/0x1a0
migrate_folio+0x4c/0x70
move_to_new_folio+0xd6/0x170
Use WRITE_ONCE() for both stores to pair them with the existing lockless
reads. This preserves the existing smp_wmb()/smp_rmb() migration protocol
and control flow while preventing compiler transformations of the shared
accesses.
Link: https://lore.kernel.org/20260824112433.191301-1-nicoyip.dev@gmail.com
Fixes: c8d6553b9580 ("ksm: make KSM page migration possible")
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Xu Xin <xu.xin16@zte.com.cn>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/ksm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/mm/ksm.c b/mm/ksm.c
index 49d48d1e09980..fe42c17490b89 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1115,7 +1115,8 @@ static inline void folio_set_stable_node(struct folio *folio,
struct ksm_stable_node *stable_node)
{
VM_WARN_ON_FOLIO(folio_test_anon(folio) && PageAnonExclusive(&folio->page), folio);
- folio->mapping = (void *)((unsigned long)stable_node | FOLIO_MAPPING_KSM);
+ WRITE_ONCE(folio->mapping,
+ (void *)((unsigned long)stable_node | FOLIO_MAPPING_KSM));
}
#ifdef CONFIG_SYSFS
@@ -3316,7 +3317,7 @@ void folio_migrate_ksm(struct folio *newfolio, struct folio *folio)
stable_node = folio_stable_node(folio);
if (stable_node) {
VM_BUG_ON_FOLIO(stable_node->kpfn != folio_pfn(folio), folio);
- stable_node->kpfn = folio_pfn(newfolio);
+ WRITE_ONCE(stable_node->kpfn, folio_pfn(newfolio));
/*
* newfolio->mapping was set in advance; now we need smp_wmb()
* to make sure that the new stable_node->kpfn is visible
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0492/1257] mm/memcontrol: fix data-race on reading jiffies_64
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0491/1257] mm/ksm: mark migration stores with WRITE_ONCE() Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0493/1257] mm/page_isolation: fix UBSAN shift-out-of-bounds warning Greg Kroah-Hartman
` (506 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiayuan Chen, Andrew Morton,
syzbot+ced4d9a8cadb5ef3adae, Muchun Song, Johannes Weiner,
Michal Hocko, Chris Li, Jan Kara, Jens Axboe, Roman Gushchin,
Shakeel Butt, Tejun Heo, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@linux.dev>
[ Upstream commit c20cf1c3c8cdd98618d6fcc794003a0e003ae858 ]
KCSAN reported a data-race between tick_do_update_jiffies64() updating
jiffies_64 and mem_cgroup_flush_stats_ratelimited() reading it directly.
Unlike jiffies, jiffies_64 is not volatile, so raw reads are plain
accesses and can even be torn on 32-bit. Use get_jiffies_64() instead,
and fix the same pattern in mem_cgroup_flush_foreign().
Link: https://lore.kernel.org/20260827025457.116191-1-jiayuan.chen@linux.dev
Fixes: 508bed884767 ("mm: memcg: change flush_next_time to flush_last_time")
Fixes: 97b27821b485 ("writeback, memcg: Implement foreign dirty flushing")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: syzbot+ced4d9a8cadb5ef3adae@syzkaller.appspotmail.com
Acked-by: Muchun Song <muchun.song@linux.dev>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Tejun Heo <tj@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/memcontrol.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 856a7d07586cc..d399710e9799a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -757,7 +757,7 @@ static void __mem_cgroup_flush_stats(struct mem_cgroup *memcg, bool force)
return;
if (mem_cgroup_is_root(memcg))
- WRITE_ONCE(flush_last_time, jiffies_64);
+ WRITE_ONCE(flush_last_time, get_jiffies_64());
css_rstat_flush(&memcg->css);
}
@@ -785,7 +785,7 @@ void mem_cgroup_flush_stats(struct mem_cgroup *memcg)
void mem_cgroup_flush_stats_ratelimited(struct mem_cgroup *memcg)
{
/* Only flush if the periodic flusher is one full cycle late */
- if (time_after64(jiffies_64, READ_ONCE(flush_last_time) + 2*FLUSH_TIME))
+ if (time_after64(get_jiffies_64(), READ_ONCE(flush_last_time) + 2 * FLUSH_TIME))
mem_cgroup_flush_stats(memcg);
}
@@ -3946,7 +3946,7 @@ void mem_cgroup_flush_foreign(struct bdi_writeback *wb)
{
struct mem_cgroup *memcg = mem_cgroup_from_css(wb->memcg_css);
unsigned long intv = msecs_to_jiffies(dirty_expire_interval * 10);
- u64 now = jiffies_64;
+ u64 now = get_jiffies_64();
int i;
for (i = 0; i < MEMCG_CGWB_FRN_CNT; i++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0493/1257] mm/page_isolation: fix UBSAN shift-out-of-bounds warning
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0492/1257] mm/memcontrol: fix data-race on reading jiffies_64 Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0494/1257] mm/page_isolation: guard compound_order() against racing Greg Kroah-Hartman
` (505 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qi Xi, Andrew Morton, Zi Yan,
Johannes Weiner, Kefeng Wang, Michal Hocko, Nanyong Sun,
Suren Baghdasaryan, Vlastimil Babka, Brendan Jackman, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Xi <xiqi2@huawei.com>
[ Upstream commit eba0e6297edd60a85bc96ff5cfb734d066af62dd ]
Patch series "mm/page_isolation: fix UBSAN shift-out-of-bounds in
isolate_single_pageblock", v3.
Patch 1 fixes a UBSAN shift-out-of-bounds warning in the PageBuddy branch
of isolate_single_pageblock() triggered by concurrent buddy allocation.
Patch 2 addresses the same class of issue in the PageCompound branch,
where racy compound_order() and compound_head() reads could lead to
out-of-range shifts or incorrect page skipping.
This patch (of 2):
A contig-range allocation racing with buddy allocation on the adjacent
pageblock can trigger:
UBSAN: shift-out-of-bounds in mm/page_isolation.c:393:15
shift exponent -749042176 is negative
Call trace:
isolate_single_pageblock
start_isolate_page_range
alloc_contig_frozen_range_noprof
alloc_contig_range_noprof
isolate_single_pageblock() first calls set_migratetype_isolate() with
zone->lock held, which marks the pageblock MIGRATE_ISOLATE and moves any
free page straddling the boundary out of the way. Once the lock is
dropped, it scans the MAX_ORDER_NR_PAGES-aligned window [start_pfn,
boundary_pfn) locklessly, only to skip the free pages already handled
above and to detect in-use pages straddling the boundary. Since this
scan only reads page state to decide how far to skip and returns -EBUSY
on a straddling in-use page, it does not take the lock.
The window also covers the adjacent pageblock, whose free pages stay on
the normal movable/CMA freelist and can be allocated concurrently. So
after the scan observes PageBuddy(page), another CPU can allocate the
page, leaving a stale value in page->private that makes "1 << order" shift
out of range.
Use buddy_order_unsafe() with READ_ONCE to read the order, and validate
it is within MAX_PAGE_ORDER before shifting to prevent UBSAN warnings.
Since pageblock_isolate_and_move_free_pages() already handles free pages
straddling boundary_pfn under zone->lock, bail out with -EBUSY instead
of VM_WARN_ON_ONCE() when a PageBuddy page appears to cross the boundary
during the lockless scan.
Link: https://lore.kernel.org/20260825120549.966271-2-xiqi2@huawei.com
Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity")
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nanyong Sun <sunnanyong@huawei.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_isolation.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index e5dfc7bf49446..e4ee998c00f3b 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -388,13 +388,19 @@ static int isolate_single_pageblock(unsigned long boundary_pfn,
}
if (PageBuddy(page)) {
- int order = buddy_order(page);
+ unsigned int order = buddy_order_unsafe(page);
- /* pageblock_isolate_and_move_free_pages() handled this */
- VM_WARN_ON_ONCE(pfn + (1 << order) > boundary_pfn);
-
- pfn += 1UL << order;
- continue;
+ /* buddy_order_unsafe() is racy. Validate the order before shifting. */
+ if (order <= MAX_PAGE_ORDER &&
+ /*
+ * pageblock_isolate_and_move_free_pages() splits
+ * cross-boundary PageBuddy, verify it.
+ */
+ pfn + (1UL << order) <= boundary_pfn) {
+ pfn += 1UL << order;
+ continue;
+ }
+ goto failed;
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0494/1257] mm/page_isolation: guard compound_order() against racing
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0493/1257] mm/page_isolation: fix UBSAN shift-out-of-bounds warning Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0495/1257] zram: fix idle age_sec underflow in idle_store() Greg Kroah-Hartman
` (504 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qi Xi, Andrew Morton, Zi Yan,
Brendan Jackman, Johannes Weiner, Kefeng Wang, Michal Hocko,
Nanyong Sun, Suren Baghdasaryan, Vlastimil Babka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Xi <xiqi2@huawei.com>
[ Upstream commit 4c767c5dd9bc3521fed11e6fe1d52621fe5abf7b ]
The PageCompound branch reads compound_head() without holding a reference.
A racing split or free can cause compound_head() to return a stale
pointer, and compound_nr() reads the order from that stale head, leading
to out-of-range shifts and making the skip distance meaningless.
Read the order explicitly with compound_order() and validate it is within
MAX_FOLIO_ORDER before shifting. Also verify the derived head_pfn against
the legitimate pfn: the head must not be past pfn, must be aligned to
nr_pages, and pfn must fall within the compound page. Bail out with
-EBUSY if any check fails.
Link: https://lore.kernel.org/20260825120549.966271-3-xiqi2@huawei.com
Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity")
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nanyong Sun <sunnanyong@huawei.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_isolation.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index e4ee998c00f3b..5aaad037384e4 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -419,10 +419,28 @@ static int isolate_single_pageblock(unsigned long boundary_pfn,
if (PageCompound(page)) {
struct page *head = compound_head(page);
unsigned long head_pfn = page_to_pfn(head);
- unsigned long nr_pages = compound_nr(head);
+ unsigned int order = compound_order(head);
+ unsigned long nr_pages;
+
+ /* compound_order() is racy. Cap it at MAX_FOLIO_ORDER. */
+ if (order > MAX_FOLIO_ORDER)
+ goto failed;
+
+ nr_pages = 1UL << order;
+
+ /*
+ * compound_head() is also racy, so the derived head_pfn
+ * needs additional checks to make sure it is valid.
+ * Otherwise, just fail the check. pfn comes from
+ * __first_valid_page() as a legitimate PFN, so use it to
+ * check head_pfn.
+ */
+ if (head_pfn > pfn || !IS_ALIGNED(head_pfn, nr_pages) ||
+ pfn - head_pfn >= nr_pages)
+ goto failed;
if (head_pfn + nr_pages <= boundary_pfn ||
- PageHuge(page)) {
+ PageHuge(head)) {
pfn = head_pfn + nr_pages;
continue;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0495/1257] zram: fix idle age_sec underflow in idle_store()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0494/1257] mm/page_isolation: guard compound_order() against racing Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0496/1257] mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus Greg Kroah-Hartman
` (503 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao Jia, Andrew Morton,
Sergey Senozhatsky, Brian Geffon, Jens Axboe, Minchan Kim,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Jia <jiahao1@lixiang.com>
[ Upstream commit 59042a88efe1d5ddc457f192f4c6368909693133 ]
After commit 2e8ff2f51dde ("zram: use u32 for entry ac_time tracking"),
idle_store() computes the idle cutoff as:
cutoff = ktime_sub((u32)ktime_get_boottime_seconds(), age_sec);
Because the left operand is cast to u32, when age_sec exceeds the current
uptime the subtraction wraps modulo 2^32 and the huge result is
zero-extended into the s64 cutoff. mark_idle() then marks every entry as
idle instead of matching nothing. For instance, running
echo 86400 > /sys/block/zramX/idle
on a machine up for only two minutes marks all newly written pages idle
and hands them to idle writeback and recompression.
No slot can have been accessed before the system booted, so an age_sec
that reaches back past uptime cannot match any slot. Return early in that
case, without walking the table or taking any slot locks.
Track the cutoff as time64_t rather than ktime_t. Both cutoff and ac_time
are boot-time values in seconds, so a plain arithmetic comparison against
ac_time in mark_idle() is correct and no ktime helpers are needed.
Link: https://lore.kernel.org/20260828083149.45760-1-jiahao.kernel@gmail.com
Fixes: 2e8ff2f51dde ("zram: use u32 for entry ac_time tracking")
Signed-off-by: Hao Jia <jiahao1@lixiang.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Minchan Kim <minchan@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/zram/zram_drv.c | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index a9b3bb1d3bef3..4ba0f77b2abd8 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -415,7 +415,7 @@ static ssize_t mem_used_max_store(struct device *dev,
* Mark all pages which are older than or equal to cutoff as IDLE.
* Callers should hold the zram init lock in read mode
*/
-static void mark_idle(struct zram *zram, ktime_t cutoff)
+static void mark_idle(struct zram *zram, time64_t cutoff)
{
int is_idle = 1;
unsigned long nr_pages = zram->disksize >> PAGE_SHIFT;
@@ -439,7 +439,7 @@ static void mark_idle(struct zram *zram, ktime_t cutoff)
#ifdef CONFIG_ZRAM_TRACK_ENTRY_ACTIME
is_idle = !cutoff ||
- ktime_after(cutoff, zram->table[index].attr.ac_time);
+ cutoff > zram->table[index].attr.ac_time;
#endif
if (is_idle)
set_slot_flag(zram, index, ZRAM_IDLE);
@@ -453,21 +453,26 @@ static ssize_t idle_store(struct device *dev, struct device_attribute *attr,
const char *buf, size_t len)
{
struct zram *zram = dev_to_zram(dev);
- ktime_t cutoff = 0;
+ time64_t cutoff = 0;
if (!sysfs_streq(buf, "all")) {
/*
* If it did not parse as 'all' try to treat it as an integer
* when we have memory tracking enabled.
*/
+ time64_t uptime;
u32 age_sec;
- if (IS_ENABLED(CONFIG_ZRAM_TRACK_ENTRY_ACTIME) &&
- !kstrtouint(buf, 0, &age_sec))
- cutoff = ktime_sub((u32)ktime_get_boottime_seconds(),
- age_sec);
- else
+ if (!IS_ENABLED(CONFIG_ZRAM_TRACK_ENTRY_ACTIME) ||
+ kstrtouint(buf, 0, &age_sec))
return -EINVAL;
+
+ /* No slot can be older than the system uptime */
+ uptime = ktime_get_boottime_seconds();
+ if (age_sec >= uptime)
+ return len;
+
+ cutoff = uptime - age_sec;
}
guard(rwsem_read)(&zram->dev_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0496/1257] mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0495/1257] zram: fix idle age_sec underflow in idle_store() Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0497/1257] mm/mempolicy: take a cpuset cookie for the interleave node count Greg Kroah-Hartman
` (502 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Hocko, Shakeel Butt,
Rik van Riel, Andrew Morton, Johannes Weiner, Muchun Song,
Roman Gushchin, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <riel@surriel.com>
[ Upstream commit d2f28a1a652e0a43f6f63de9b4e4d8d5f2716803 ]
When drain_all_stock() sets FLUSHING_CACHED_CHARGE before checking
isolation, schedule_drain_work() can drop the work in a separate RCU
critical section, and housekeeping_update()'s synchronize_rcu() can race
that second check, leaving the flag set.
drain_local_stock() only clears the bit for work that ran, so the flag
remains set and the stock is never drained again.
Have schedule_drain_work() return whether the work was queued, and clear
FLUSHING_CACHED_CHARGE in drain_all_stock() when the remote CPU is
isolated, so future drains can retry.
Link: https://lore.kernel.org/20260828135036.7d44361f@fangorn
Fixes: 6a792697a53a ("memcg: do not drain charge pcp caches on remote isolated cpus")
Suggested-by: Michal Hocko <mhocko@suse.com>
Suggested-by: Shakeel Butt <shakeel.butt@linux.dev>
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/memcontrol.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index d399710e9799a..814eb56feb6f5 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2306,7 +2306,7 @@ static bool is_memcg_drain_needed(struct memcg_stock_pcp *stock,
return flush;
}
-static void schedule_drain_work(int cpu, struct work_struct *work)
+static bool schedule_drain_work(int cpu, struct work_struct *work)
{
/*
* Protect housekeeping cpumask read and work enqueue together
@@ -2315,8 +2315,11 @@ static void schedule_drain_work(int cpu, struct work_struct *work)
* pending work on newly isolated CPUs.
*/
guard(rcu)();
- if (!cpu_is_isolated(cpu))
- queue_work_on(cpu, memcg_wq, work);
+ if (cpu_is_isolated(cpu))
+ return false;
+
+ queue_work_on(cpu, memcg_wq, work);
+ return true;
}
/*
@@ -2348,8 +2351,9 @@ void drain_all_stock(struct mem_cgroup *root_memcg)
&memcg_st->flags)) {
if (cpu == curcpu)
drain_local_memcg_stock(&memcg_st->work);
- else
- schedule_drain_work(cpu, &memcg_st->work);
+ else if (!schedule_drain_work(cpu, &memcg_st->work))
+ clear_bit(FLUSHING_CACHED_CHARGE,
+ &memcg_st->flags);
}
if (!test_bit(FLUSHING_CACHED_CHARGE, &obj_st->flags) &&
@@ -2358,8 +2362,9 @@ void drain_all_stock(struct mem_cgroup *root_memcg)
&obj_st->flags)) {
if (cpu == curcpu)
drain_local_obj_stock(&obj_st->work);
- else
- schedule_drain_work(cpu, &obj_st->work);
+ else if (!schedule_drain_work(cpu, &obj_st->work))
+ clear_bit(FLUSHING_CACHED_CHARGE,
+ &obj_st->flags);
}
}
migrate_enable();
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0497/1257] mm/mempolicy: take a cpuset cookie for the interleave node count
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0496/1257] mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0498/1257] mm/huge_memory: skip zone device folios in madvise_free_huge_pmd() Greg Kroah-Hartman
` (501 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
Chelsy Ratnawat, Huang Ying, Alistair Popple, Byungchul Park,
Chenwandun, David Hildenbrand, Joshua Hahn, Matthew Brost,
Rakie Kim, Uladzislau Rezki (Sony), Zi Yan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit bbeeb4a29dc4ca6ac18ab3bafa3728bc984a4cde ]
alloc_pages_bulk_interleave() counts pol->nodes without a cpuset cookie:
nodes = nodes_weight(pol->nodes);
nr_pages_per_node = nr_pages / nodes;
nodemask_t spans several words once MAX_NUMNODES exceeds BITS_PER_LONG, so
a concurrent cpuset rebind can tear that read and yield an empty mask even
though neither version of it was empty. The call then allocates nothing
and returns 0.
Some compilers will hoist the loop entry test above the division,
because nr_pages_per_node is dead when the loop does not run.
682e: call ... <- nodes_weight()
6838: test %eax,%eax
683a: jle 692d <- nodes <= 0 skips the loop
684a: div %rcx
So in most deployments, this div/0 is unreachable - but nothing in the
source guarantees that, it's just not easily exercised.
Take the cookie around the count and bail if the mask really is empty.
Only the count needs it, interleave_nodes() takes the cookie itself so so
a torn read there is already retried.
A rebind landing mid-loop can still leave the count disagreeing with the
mask, so the loop may revisit a node or skip one - but a rebind where
nodes change causes migration, so a handful of misplaced pages isn't
catastrophic in any sense.
Measured on a 72 node VM (NODES_SHIFT=10) with a cgroup v2 cpuset flipping
cpuset.mems between a word 0 and a word 1 node set, and the two word read
artificially widened: 330 zero counts in 130414 calls without the cookie,
and 401 retries with it.
Link: https://lore.kernel.org/20260828193111.1023497-1-gourry@gourry.net
Fixes: c00b6b961099 ("mm/vmalloc: introduce alloc_pages_bulk_array_mempolicy to accelerate memory allocation")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
Closes: https://lore.kernel.org/all/20250907160829.91628-1-chelsyratnawat2001@gmail.com/
Reviewed-by: Huang Ying <ying.huang@linux.alibaba.com>
Assisted-by: Claude:claude-opus-5
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Chenwandun <chenwandun@huawei.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/mempolicy.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 79053ece02cd4..060a0eb269170 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2592,6 +2592,7 @@ static unsigned long alloc_pages_bulk_interleave(gfp_t gfp,
struct mempolicy *pol, unsigned long nr_pages,
struct page **page_array)
{
+ unsigned int cpuset_mems_cookie;
int nodes;
unsigned long nr_pages_per_node;
int delta;
@@ -2599,7 +2600,16 @@ static unsigned long alloc_pages_bulk_interleave(gfp_t gfp,
unsigned long nr_allocated;
unsigned long total_allocated = 0;
- nodes = nodes_weight(pol->nodes);
+ /* count the nodes, retry if a rebind happened during the read */
+ do {
+ cpuset_mems_cookie = read_mems_allowed_begin();
+ nodes = nodes_weight(pol->nodes);
+ } while (read_mems_allowed_retry(cpuset_mems_cookie));
+
+ /* if the nodemask has become invalid, we cannot do anything */
+ if (!nodes)
+ return 0;
+
nr_pages_per_node = nr_pages / nodes;
delta = nr_pages - nodes * nr_pages_per_node;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0498/1257] mm/huge_memory: skip zone device folios in madvise_free_huge_pmd()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0497/1257] mm/mempolicy: take a cpuset cookie for the interleave node count Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0499/1257] mm/madvise: skip zone device folios in cold/pageout PMD range Greg Kroah-Hartman
` (500 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
David Hildenbrand (Arm), Lorenzo Stoakes (ARM), Lance Yang,
Alistair Popple, Balbir Singh, Baolin Wang, Barry Song,
Byungchul Park, Dev Jain, Huang, Ying, Jann Horn, Joshua Hahn,
Liam R. Howlett, Matthew Brost, Rakie Kim, Ryan Roberts,
Vlastimil Babka, Zi Yan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 3a09df924fa2ba75ac80acb9bce4eed79be218fa ]
Patch series "mm: reject zone device folios in more folio walkers", v2.
Several LRU-oriented mm walkers resolve the folio backing a PMD entry (or
a physical pfn) and then reclaim, age, migrate, or lazyfree it without
ever checking for ZONE_DEVICE memory.
This series adds missing folio_is_zone_device() rejections, matching the
checks that comparable walkers already perform.
- mm/huge_memory, mm/madvise: the !pmd_present branch above these sites
only filters device-private entries (which are non-present).
A present zone device PMD (e.g. device-coherent) would still reach the
folio and be lazyfreed / aged / paged out. Add an explicit check.
- mm/mempolicy: queue_folios_pmd() can see a present zone device PMD
(e.g. device-coherent) and queue it for migration.
No crash reproducer - this is a correctness/hardening cleanup found by
inspection. All checks are placed after the folio is resolved and before
it is acted upon, on paths that already hold the relevant page-table lock,
so no locking or refcount changes are involved.
This patch (of 3):
madvise_free_huge_pmd() resolves the folio backing a PMD via pmd_folio()
and marks it lazyfree without checking for zone device memory.
The surrounding guards do not cover every zone device case:
- MADV_FREE only operates on anonymous VMAs (DAX mappings are excluded)
- !pmd_present() branch rejects device-private and migration entries
- present zone device PMD (device coherent THP) is not filtered.
Unlike vm_normal_page_pmd(), it performs no special/pfnmap check,
and would be marked lazyfree here.
Bail out when the folio is a zone device folio.
Link: https://lore.kernel.org/20260817220810.1175596-1-gourry@gourry.net
Link: https://lore.kernel.org/20260817220810.1175596-2-gourry@gourry.net
Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Tested-by: Lance Yang <lance.yang@linux.dev>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Balbir Singh <balbirs@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/huge_memory.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 1e5d68acf62a5..54494c3fa9835 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2423,6 +2423,10 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
}
folio = pmd_folio(orig_pmd);
+
+ if (folio_is_zone_device(folio))
+ goto out;
+
/*
* If other processes are mapping this folio, we couldn't discard
* the folio unless they all do MADV_FREE so let's skip the folio.
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0499/1257] mm/madvise: skip zone device folios in cold/pageout PMD range
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0498/1257] mm/huge_memory: skip zone device folios in madvise_free_huge_pmd() Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0500/1257] mm/mempolicy: skip zone device folios when queueing folios Greg Kroah-Hartman
` (499 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
David Hildenbrand (Arm), Lorenzo Stoakes (ARM), Balbir Singh,
Lance Yang, Alistair Popple, Baolin Wang, Barry Song,
Byungchul Park, Dev Jain, Huang, Ying, Jann Horn, Joshua Hahn,
Liam R. Howlett, Matthew Brost, Rakie Kim, Ryan Roberts,
Vlastimil Babka, Zi Yan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit ab7ace574f3da7f167fe1883116480a00c52150c ]
madvise_cold_or_pageout_pte_range() resolves the folio backing a PMD via
pmd_folio() and ages or reclaims it without checking for zone device
memory.
The surrounding guards do not cover every zone device case:
- can_madv_lru_vma() excludes VM_PFNMAP and VM_HUGETLB VMAs
(so device DAX is filtered)
- !pmd_present() branch above rejects device-private and
migration entries, which are non-present.
- A present zone device PMD - e.g. a device-coherent THP - is
not filtered by any of these, nor by pmd_folio() (unlike
vm_normal_page_pmd(), it performs no special/pfnmap check),
and would be aged or paged out here.
Skip ZONE_DEVICE folios explicitly during MADV_COLD/PAGEOUT.
Link: https://lore.kernel.org/20260817220810.1175596-3-gourry@gourry.net
Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Tested-by: Lance Yang <lance.yang@linux.dev>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/madvise.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/mm/madvise.c b/mm/madvise.c
index eeee82cf2b3f4..73c2901b9adbf 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -404,6 +404,9 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
folio = pmd_folio(orig_pmd);
+ if (folio_is_zone_device(folio))
+ goto huge_unlock;
+
/* Do not interfere with other mappings of this folio */
if (folio_maybe_mapped_shared(folio))
goto huge_unlock;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0500/1257] mm/mempolicy: skip zone device folios when queueing folios
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0499/1257] mm/madvise: skip zone device folios in cold/pageout PMD range Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0501/1257] mm: memcontrol: raise MEMCG_MAX for charges that fail without reclaiming Greg Kroah-Hartman
` (498 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
Balbir Singh, Lorenzo Stoakes (ARM), David Hildenbrand (Arm),
Lance Yang, Alistair Popple, Baolin Wang, Barry Song,
Byungchul Park, Dev Jain, Huang, Ying, Jann Horn, Joshua Hahn,
Liam R. Howlett, Matthew Brost, Rakie Kim, Ryan Roberts,
Vlastimil Babka, Zi Yan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 1f834ba9b42e3f3c298c7e8ef1df21b9947c92b4 ]
queue_folios_pte_range() already pairs vm_normal_folio() with an explicit
folio_is_zone_device() check before adding folios to the migration
pagelist.
vm_normal_folio() alone does not reject zone device memory (a present
device-coherent page in a normal VMA is returned as "normal").
Mirror the explicit check in queue_folios_pmd() as well.
queue_folios_pmd() uses pmd_folio() directly and can encounter a present
zone device PMD - e.g. a device-coherent THP.
This is not filtered by existing checks:
!pmd_present() - only rejects non-present device-private and
migration entries
vma_migratable() - excludes DAX and VM_PFNMAP.
The early return also means such a folio is no longer counted in
qp->nr_failed under MPOL_MF_STRICT. This is the same pattern used by
queue_folios_pte_range() (skipping zone device without failing).
Link: https://lore.kernel.org/20260817220810.1175596-4-gourry@gourry.net
Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Tested-by: Lance Yang <lance.yang@linux.dev>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/mempolicy.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 060a0eb269170..7627d33e509c3 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -662,6 +662,8 @@ static void queue_folios_pmd(pmd_t *pmd, struct mm_walk *walk)
return;
}
folio = pmd_folio(pmdval);
+ if (folio_is_zone_device(folio))
+ return;
if (is_huge_zero_folio(folio)) {
walk->action = ACTION_CONTINUE;
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0501/1257] mm: memcontrol: raise MEMCG_MAX for charges that fail without reclaiming
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0500/1257] mm/mempolicy: skip zone device folios when queueing folios Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0502/1257] mm/huge_memory: do not touch frozen folios in deferred_split_isolate() Greg Kroah-Hartman
` (497 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joe Damato, Andrew Morton,
Shakeel Butt, Johannes Weiner, Michal Hocko, Muchun Song,
Roman Gushchin, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Damato <joe@dama.to>
[ Upstream commit 374f65b1481992eb6b9c6bffd53f3afa5c2e94cf ]
Charges that exceed memory.max and return through the nomem label can
raise no event and simply return -ENOMEM.
A non-blocking charge can hit the limit, get rejected, but is not visible
in memory.events.
This was noticed in a production setting where bpf_mem_alloc() attempted
to refill its per-cpu freelists, which triggered a non-blocking charge
while at the limit.
Commit d6e103a757fa ("mm: memcontrol: do not miss MEMCG_MAX events for
enforced allocations") added raised_max_event to cover charges that are
force charged without ever reaching reclaim, but charges that are rejected
outright were left out. Getting an allocation failure without the
corresponding MEMCG_MAX event is unexpected and makes debugging and
monitoring harder.
Raise the event on the way out for rejected charges as well, by routing
the -ENOMEM return through the same exit path that already covers forced
charges. The existing behavior of raising a MEMCG_MAX event on every
charge/reclaim/retry iteration is left unchanged.
Tested with a module that performs accounted GFP_NOWAIT page allocations
from a task in a cgroup at its memory.max, and measures the resulting
memory.events:max delta. Without this patch the rejected charges raise no
event at all; with it the delta matches the number of rejected charges
exactly. A GFP_KERNEL|__GFP_NORETRY control, which reaches reclaim,
raises the same two events per failed charge before and after, confirming
the existing charge/reclaim/retry accounting is unchanged.
Link: https://lore.kernel.org/20260831174836.3102406-1-joe@dama.to
Fixes: d6e103a757fa ("mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations")
Signed-off-by: Joe Damato <joe@dama.to>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Shakeel Butt <shakeel.butt@linux.dev>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/memcontrol.c | 28 ++++++++++++++++------------
1 file changed, 16 insertions(+), 12 deletions(-)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 814eb56feb6f5..259f9f43b38b1 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2661,10 +2661,11 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
bool raised_max_event = false;
unsigned long pflags;
bool allow_spinning = gfpflags_allow_spinning(gfp_mask);
+ int ret = 0;
retry:
if (consume_stock(memcg, nr_pages))
- return 0;
+ return ret;
if (!allow_spinning)
/* Avoid the refill and flush of the older stock */
@@ -2775,16 +2776,11 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
* put the burden of reclaim on regular allocation requests
* and let these go through as privileged allocations.
*/
- if (!(gfp_mask & (__GFP_NOFAIL | __GFP_HIGH)))
- return -ENOMEM;
+ if (!(gfp_mask & (__GFP_NOFAIL | __GFP_HIGH))) {
+ ret = -ENOMEM;
+ goto out;
+ }
force:
- /*
- * If the allocation has to be enforced, don't forget to raise
- * a MEMCG_MAX event.
- */
- if (!raised_max_event)
- __memcg_memory_event(mem_over_limit, MEMCG_MAX, allow_spinning);
-
/*
* The allocation either can't fail or will lead to more memory
* being freed very soon. Allow memory usage go over the limit
@@ -2794,7 +2790,15 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
if (do_memsw_account())
page_counter_charge(&memcg->memsw, nr_pages);
- return 0;
+out:
+ /*
+ * Don't forget to raise a MEMCG_MAX event for forced or rejected
+ * requests.
+ */
+ if (!raised_max_event)
+ __memcg_memory_event(mem_over_limit, MEMCG_MAX, allow_spinning);
+
+ return ret;
done_restock:
if (batch > nr_pages)
@@ -2853,7 +2857,7 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
!(current->flags & PF_MEMALLOC) &&
gfpflags_allow_blocking(gfp_mask))
__mem_cgroup_handle_over_high(gfp_mask);
- return 0;
+ return ret;
}
static inline int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0502/1257] mm/huge_memory: do not touch frozen folios in deferred_split_isolate()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0501/1257] mm: memcontrol: raise MEMCG_MAX for charges that fail without reclaiming Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0503/1257] mm/page_table_check: skip zero pages Greg Kroah-Hartman
` (496 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kiryl Shutsemau (Meta),
Andrew Morton, Lance Yang, Zi Yan, Johannes Weiner, Usama Arif,
Baolin Wang, David Hildenbrand (Arm), Balbir Singh, Barry Song,
Dev Jain, Hugh Dickins, Kairui Song, Liam R. Howlett,
Lorenzo Stoakes, Ryan Roberts, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau (Meta) <kas@kernel.org>
[ Upstream commit 5da8ec3262bbb40f057f3b0dacc18f37bda06f95 ]
Patch series "Fix deferred_split_isolate() and drop the split workaround",
v2.
deferred_split_isolate() probes each queued folio with folio_try_get().
folio_try_get() failure is treated as a lost race with folio_put().
It leads to wrong results when !folio_try_get() was not caused by
folio_put(): for a frozen folio, PG_partially_mapped gets wrongfully
cleared and the folio dropped from the queue.
It came up in the review of my collapse RFC series:
https://lore.kernel.org/all/20260824131224.73344-1-lance.yang@linux.dev/
The bug is inert in upstream code:
- __folio_split() works around it;
- __folio_migrate_mapping() freezes a folio it is about to replace;
- reclaim freezes only what try_to_unmap() already unmapped.
No cc:stable needed. But my collapse rework steps on it, so it is worth
fixing.
The branch the first patch removes also hid an inert, pre-existing bug in
the zone device path:
https://lore.kernel.org/all/20260827163838.1813081-1-usama.arif@linux.dev/
The first patch fixes deferred_split_isolate().
The second patch removes the workaround for this deferred_split_isolate()
behaviour from __folio_freeze_and_split_unmapped().
Tested in a VM: split_huge_page_test, folio_split_race_test and cow pass.
Also ran a test that leaves 16 partially mapped THPs on the deferred split
queue and drives thp-deferred_split through debugfs, checking
nr_anon_partially_mapped.
This patch (of 2):
deferred_split_isolate() probes each queued folio with folio_try_get().
folio_try_get() failure is treated as a lost race with folio_put(): clear
PG_partially_mapped, correct MTHP_STAT_NR_ANON_PARTIALLY_MAPPED, take the
folio off the queue.
The folio_put() race is the most common case for !folio_try_get(), but it
is not the only option. Another scenario is folio_ref_freeze().
A zero refcount in such cases does not mean the folio is going away. It
means "don't touch me" and current deferred_split_isolate() doesn't
respect it. It can lead to unqueueing folios from the deferred list for
no reason:
CPU 0 CPU 1
--------------------------- ------------------------------
freeze a mapped folio deferred_split_scan()
folio_ref_freeze() folio_try_get() fails
folio_clear_partially_mapped()
NR_ANON_PARTIALLY_MAPPED--
folio off the queue
give up, put it back
folio_ref_unfreeze()
The folio is still partially mapped, but it is no longer a split
candidate. Nothing queues it again until part of it is unmapped once
more.
Skip the folio instead: whoever freezes the folio, owns it and owner is
responsible for its fate. It also covers the folio_put() case:
__folio_put() unqueues the folio via folio_unqueue_deferred_split().
Nothing is lost by skipping. Everything that frees a queued folio
unqueues it first, and folio_unqueue_deferred_split() clears
PG_partially_mapped and brings MTHP_STAT_NR_ANON_PARTIALLY_MAPPED down on
the way:
__folio_put(), folios_put_refs() mm/folio.c
__folio_migrate_mapping() mm/migrate.c
shrink_folio_list() mm/vmscan.c
__folio_freeze_and_split_unmapped() does the same by hand, under the
list_lru lock it holds across the freeze. A freeze that ends in
folio_ref_unfreeze() leaves a folio that is still partially mapped and
still belongs on the queue.
Link: https://lore.kernel.org/20260831091514.1879786-1-kirill@shutemov.name
Link: https://lore.kernel.org/20260831091514.1879786-2-kirill@shutemov.name
Fixes: 8422acdc97ed ("mm: introduce a pageflag for partially mapped folios")
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Lance Yang <lance.yang@linux.dev>
Closes: https://lore.kernel.org/all/20260824131224.73344-1-lance.yang@linux.dev/
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Acked-by: Usama Arif <usama.arif@linux.dev>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Assisted-by: Claude-Code:claude-opus-5
Cc: Balbir Singh <balbirs@nvidia.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Kairui Song <kasong@tencent.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
deferred_split_isolate() probes each queued folio with folio_try_get().
folio_try_get() failure is treated as a lost race with folio_put().
It leads to wrong results when !folio_try_get() was not caused by
folio_put(): for a frozen folio, PG_partially_mapped gets wrongfully
cleared and the folio dropped from the queue.
It came up in the review of my collapse RFC series:
https://lore.kernel.org/all/20260824131224.73344-1-lance.yang@linux.dev/
The bug is inert in upstream code:
- __folio_split() works around it;
- __folio_migrate_mapping() freezes a folio it is about to replace;
- reclaim freezes only what try_to_unmap() already unmapped.
No cc:stable needed. But my collapse rework steps on it, so it is worth
fixing.
The branch the first patch removes also hid an inert, pre-existing bug in
the zone device path:
https://lore.kernel.org/all/20260827163838.1813081-1-usama.arif@linux.dev/
The first patch fixes deferred_split_isolate().
The second patch removes the workaround for this deferred_split_isolate()
behaviour from __folio_freeze_and_split_unmapped().
Tested in a VM: split_huge_page_test, folio_split_race_test and cow pass.
Also ran a test that leaves 16 partially mapped THPs on the deferred split
queue and drives thp-deferred_split through debugfs, checking
nr_anon_partially_mapped.
This patch (of 2):
deferred_split_isolate() probes each queued folio with folio_try_get().
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/huge_memory.c | 19 ++++---------------
1 file changed, 4 insertions(+), 15 deletions(-)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 54494c3fa9835..779c02e0bf6cc 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -4638,22 +4638,11 @@ static enum lru_status deferred_split_isolate(struct list_head *item,
struct folio *folio = container_of(item, struct folio, _deferred_list);
struct list_head *freeable = cb_arg;
- if (folio_try_get(folio)) {
- list_lru_isolate_move(lru, item, freeable);
- return LRU_REMOVED;
- }
+ /* Lost race to folio_put() or the folio is under folio_ref_freeze() */
+ if (!folio_try_get(folio))
+ return LRU_SKIP;
- /*
- * We lost race with folio_put(). Read folio state before the
- * isolate: folio_unqueue_deferred_split() checks list_empty()
- * locklessly, so once removed the folio can be freed any time.
- */
- if (folio_test_partially_mapped(folio)) {
- folio_clear_partially_mapped(folio);
- mod_mthp_stat(folio_order(folio),
- MTHP_STAT_NR_ANON_PARTIALLY_MAPPED, -1);
- }
- list_lru_isolate(lru, item);
+ list_lru_isolate_move(lru, item, freeable);
return LRU_REMOVED;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0503/1257] mm/page_table_check: skip zero pages
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0502/1257] mm/huge_memory: do not touch frozen folios in deferred_split_isolate() Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0504/1257] mm/damon/core: skip applying scheme if region split for quota fails Greg Kroah-Hartman
` (495 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhiling Zou, Ren Wei, Andrew Morton,
Vega, Ye Liu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <roxy520tt@gmail.com>
[ Upstream commit 33afd07412a1efe5b750a3fd5eb0272ebdd12761 ]
page_table_check_set() accounts pages by whether they are PageAnon(). The
shared zero page is a special page, not an ordinary file-backed page.
Read faults on private anonymous mappings can install many read-only PTEs
that point at the zero page, but page_table_check currently accounts them
in file_map_count.
That lets an unprivileged process populate enough zero-page mappings to
overflow file_map_count and trip the BUG_ON() in page_table_check_set().
Skip zero pages in page_table_check accounting. They do not need the
anonymous/file mapping conflict checks that page_table_check performs for
ordinary pages, and this keeps the existing counter size and page_ext
layout unchanged.
Link: https://lore.kernel.org/1f8848512d2e3ded944f8d595c29faee8fdaeab0.1784645969.git.roxy520tt@gmail.com
Fixes: df4e817b7108 ("mm: page table check")
Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
Signed-off-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Cc: Ye Liu <liuye@kylinos.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_table_check.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/page_table_check.c b/mm/page_table_check.c
index 6ffc536359cd0..75818f1bc127e 100644
--- a/mm/page_table_check.c
+++ b/mm/page_table_check.c
@@ -67,7 +67,7 @@ static void page_table_check_clear(unsigned long pfn, unsigned long pgcnt)
struct page *page;
bool anon;
- if (!pfn_valid(pfn))
+ if (!pfn_valid(pfn) || is_zero_pfn(pfn) || is_huge_zero_pfn(pfn))
return;
page = pfn_to_page(pfn);
@@ -102,7 +102,7 @@ static void page_table_check_set(unsigned long pfn, unsigned long pgcnt,
struct page *page;
bool anon;
- if (!pfn_valid(pfn))
+ if (!pfn_valid(pfn) || is_zero_pfn(pfn) || is_huge_zero_pfn(pfn))
return;
page = pfn_to_page(pfn);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0504/1257] mm/damon/core: skip applying scheme if region split for quota fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0503/1257] mm/page_table_check: skip zero pages Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0505/1257] mm/damon/paddr: respect folio end for DAMOS_STAT Greg Kroah-Hartman
` (494 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 90c2fa6adfed7abe0935506a43cdff3a05c1fff0 ]
Patch series "mm/damon: fix DAMOS bugs in core, paddr and vaddr".
Fix misc bugs of DAMOS. Patch 1 makes DAMOS less stress memory allocator
under extreme situation. Patches 2 and 3 fix wrong folios walking in
DAMON_PADDR. Patches 4 and 5 fix wrong folios walking in DAMON_VADDR.
Patches 6-8 handle extreme and unlikely memory situations that can cause
divide by zero and underflow.
All bugs are discovered by Sashiko.
This patch (of 8):
damos_apply_scheme() splits a region and apply the action to the subregion
if it is needed for not violating the quota. The split operation
(damon_split_region_at()) could fail for allocation failure. In the case,
the quota could be violated. From the user's perspective, DAMOS becomes
more aggressive than expected under the extreme situation. Handle the
failure.
The user impact is not critical. The failure of damon_split_region_at()
is unlikely since it is arguably too small to fail. Also DAMOS being
aggressive is limited to the single region. Users can set min_nr_regions
to set the maximum size of each region. If it is reasonably set, the
transient overhead shouldn't be critical.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260901131850.98037-1-sj@kernel.org
Link: https://lore.kernel.org/20260901131850.98037-2-sj@kernel.org
Link: https://lore.kernel.org/20260718171523.87547-1-sj@kernel.org [1]
Fixes: 2b8a248d5873 ("mm/damon/schemes: implement size quota for schemes application speed control")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 5.16.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index 74d22a596fc13..b3390978581a6 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2626,7 +2626,8 @@ static void damos_apply_scheme(struct damon_ctx *c, struct damon_target *t,
c->min_region_sz);
if (!sz)
goto update_stat;
- damon_split_region_at(t, r, sz);
+ if (damon_split_region_at(t, r, sz))
+ goto update_stat;
}
if (damos_core_filter_out(c, t, r, s))
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0505/1257] mm/damon/paddr: respect folio end for DAMOS_STAT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0504/1257] mm/damon/core: skip applying scheme if region split for quota fails Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0506/1257] mm/damon/paddr: respect folio end for DAMOS actions except STAT Greg Kroah-Hartman
` (493 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit ac733f921d4fc02da70a98b175a6055a206b2a36 ]
The function for applying DAMOS_STAT in DAMON physical address space
operation set (paddr), namely damon_pa_stat(), applies DAMOS filters to
folios of the given region. For that, it gets folios of addresses in the
region. It starts from the region start address and advances the address
by the size of the folio of the address until it goes out of the region.
If the start address is in the middle of a large folio, and if the next
folios are small, some of the next folios could be skipped. Fix the issue
by advancing the address to exactly the start address of the next folio.
The user impact is that the DAMOS_STAT-based page level monitoring results
become inaccurate. Since the page level monitoring is supposed to provide
relatively high precision, this is definitely a problem. It is arguably
not critical since it is only monitoring quality degradation.
Link: https://lore.kernel.org/20260901131850.98037-3-sj@kernel.org
Fixes: bdbe1d7bc325 ("mm/damon/paddr: increment pa_stat damon address range by folio size")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.14.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/paddr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/damon/paddr.c b/mm/damon/paddr.c
index 5c6c3a597fd0b..2ab7b3842701e 100644
--- a/mm/damon/paddr.c
+++ b/mm/damon/paddr.c
@@ -379,7 +379,7 @@ static unsigned long damon_pa_stat(struct damon_region *r,
if (!damos_pa_filter_out(s, folio))
*sz_filter_passed += folio_size(folio) / addr_unit;
- addr += folio_size(folio);
+ addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
folio_put(folio);
}
s->last_applied = folio;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0506/1257] mm/damon/paddr: respect folio end for DAMOS actions except STAT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0505/1257] mm/damon/paddr: respect folio end for DAMOS_STAT Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0507/1257] mm/damon/vaddr: respect folio end for DAMOS_STAT Greg Kroah-Hartman
` (492 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 1613ac9edf385c35f171a25610e2706a7e6afad6 ]
A few functions for applying DAMOS actions including pageout, lru_[de]prio
and migrate_{hot,cold} in DAMON physical address space operation set
(paddr) collect folios of the given region by getting the folios of
region-internal addresses. Then, those functions apply the action to the
collected folios at once. The collection starts from the region start
address and advances the address by the size of the folio of the address
until it goes out of the region. If the start address is in the middle of
a large folio, and if the next folios are small, some of the next folios
could be skipped. Fix the issue by advancing the address to exactly the
start address of the next folio.
The user impact is that DAMOS action is applied to less than expected
amount of memory. Given the best effort nature of DAMON, it is no big
problem, but it is clearly a bug that is better to be fixed.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260901131850.98037-4-sj@kernel.org
Link: https://lore.kernel.org/20260517234112.89245-1-sj@kernel.org [1]
Fixes: 3a06696305e7 ("mm/damon/ops: have damon_get_folio return folio even for tail pages")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.15.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/paddr.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/mm/damon/paddr.c b/mm/damon/paddr.c
index 2ab7b3842701e..9ddd1ec8202b7 100644
--- a/mm/damon/paddr.c
+++ b/mm/damon/paddr.c
@@ -264,7 +264,7 @@ static unsigned long damon_pa_pageout(struct damon_region *r,
else
list_add(&folio->lru, &folio_list);
put_folio:
- addr += folio_size(folio);
+ addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
folio_put(folio);
}
if (install_young_filter)
@@ -302,7 +302,7 @@ static inline unsigned long damon_pa_de_activate(
folio_deactivate(folio);
applied += folio_nr_pages(folio);
put_folio:
- addr += folio_size(folio);
+ addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
folio_put(folio);
}
s->last_applied = folio;
@@ -350,7 +350,7 @@ static unsigned long damon_pa_migrate(struct damon_region *r,
folio_is_file_lru(folio));
list_add(&folio->lru, &folio_list);
put_folio:
- addr += folio_size(folio);
+ addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
folio_put(folio);
}
applied = damon_migrate_pages(&folio_list, s->target_nid);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0507/1257] mm/damon/vaddr: respect folio end for DAMOS_STAT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0506/1257] mm/damon/paddr: respect folio end for DAMOS actions except STAT Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0508/1257] mm/damon/vaddr: respect folio end for DAMOS_MIGRATE_{HOT,COLD} Greg Kroah-Hartman
` (491 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 946351a5fc5d4e3afec2bdf735935d17d6c9ceb2 ]
For applying DAMOS_STAT action to a region, DAMON virtual address space
operation set (vaddr) calls walk_page_range[_vma]() for the region. The
pmd walk entry function, namely damon_va_stat_pmd_entry(), applies DAMOS
filters to folios of addresses of the region in the pmd. It starts from
the walking address and advances the address by the size of the folio of
the address until it goes out of the pmd or the region.
Let's suppose it is for the first pmd of the region, and the region start
address is in the middle of a large folio. Also, the next folios are
small. Then, some of the next folios could be skipped. Fix the issue by
advancing the address to exactly the start address of the next folio.
The user impact is that the DAMOS_STAT-based page level monitoring results
become inaccurate. Since the page level monitoring is supposed to provide
relatively high precision, this is definitely a problem. It is arguably
not critical since it is only monitoring quality degradation.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260901131850.98037-5-sj@kernel.org
Link: https://lore.kernel.org/20260514015053.149396-1-sj@kernel.org [1]
Fixes: 63f39737d1e3 ("mm/damon/vaddr: support stat-purpose DAMOS filters")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.18.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/vaddr.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
index 04ee2a2c6a4d6..b1bed5d19a34b 100644
--- a/mm/damon/vaddr.c
+++ b/mm/damon/vaddr.c
@@ -838,6 +838,8 @@ static int damos_va_stat_pmd_entry(pmd_t *pmd, unsigned long addr,
return 0;
for (; addr < next; pte += nr, addr += nr * PAGE_SIZE) {
+ unsigned long page_idx;
+
nr = 1;
ptent = ptep_get(pte);
@@ -851,7 +853,8 @@ static int damos_va_stat_pmd_entry(pmd_t *pmd, unsigned long addr,
if (!damos_va_filter_out(s, folio, vma, addr, pte, NULL))
*sz_filter_passed += folio_size(folio);
- nr = folio_nr_pages(folio);
+ page_idx = folio_page_idx(folio, pte_page(ptent));
+ nr = folio_nr_pages(folio) - page_idx;
s->last_applied = folio;
}
pte_unmap_unlock(start_pte, ptl);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0508/1257] mm/damon/vaddr: respect folio end for DAMOS_MIGRATE_{HOT,COLD}
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0507/1257] mm/damon/vaddr: respect folio end for DAMOS_STAT Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0509/1257] mm/damon/core: handle extreme memory state in damon_get_node_mem_bp() Greg Kroah-Hartman
` (490 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 359093bdffbb3bd4d46d2d76d4a4dd273242c6d1 ]
For applying DAMOS_MIGRATE_{HOT,COLD} actions to a region, DAMON virtual
address space operation set (vaddr) calls walk_page_range[_vma]() for the
region. The pmd walk entry function, namely damon_va_migrate_pmd_entry(),
collects folios of addresses of the region in the pmd. It starts from the
walking address and advances the address by the size of the folio of the
address until it goes out of the pmd or the region.
Let's suppose it is for the first pmd of the region, and the region start
address is in the middle of a large folio. Also, the next folios are
small. Then, some of the next folios could be skipped. Fix the issue by
advancing the address to exactly the start address of the next folio.
The user impact is that DAMOS action is applied to less than expected
amount of memory. Given the best effort nature of DAMON, it is no big
problem, but it is clearly a bug that is better to be fixed.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260901131850.98037-6-sj@kernel.org
Link: https://lore.kernel.org/20260514015053.149396-1-sj@kernel.org [1]
Fixes: 09efc56a3b1c ("mm/damon/vaddr: consistently use only pmd_entry for damos_migrate")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.19.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/vaddr.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
index b1bed5d19a34b..5b4d16c8db628 100644
--- a/mm/damon/vaddr.c
+++ b/mm/damon/vaddr.c
@@ -676,6 +676,8 @@ static int damos_va_migrate_pmd_entry(pmd_t *pmd, unsigned long addr,
return 0;
for (; addr < next; pte += nr, addr += nr * PAGE_SIZE) {
+ unsigned long page_idx;
+
nr = 1;
ptent = ptep_get(pte);
@@ -688,7 +690,8 @@ static int damos_va_migrate_pmd_entry(pmd_t *pmd, unsigned long addr,
continue;
damos_va_migrate_dests_add(folio, walk->vma, addr, dests,
migration_lists);
- nr = folio_nr_pages(folio);
+ page_idx = folio_page_idx(folio, pte_page(ptent));
+ nr = folio_nr_pages(folio) - page_idx;
}
pte_unmap_unlock(start_pte, ptl);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0509/1257] mm/damon/core: handle extreme memory state in damon_get_node_mem_bp()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0508/1257] mm/damon/vaddr: respect folio end for DAMOS_MIGRATE_{HOT,COLD} Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0510/1257] mm/damon/core: handle extreme memory state in get_node_memcg_used_bp() Greg Kroah-Hartman
` (489 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 485a9149ad406e00949327a3231b9084d7073706 ]
In an extreme and unlikely situation, si_meminfo_node() might let the
caller show zero total ram. That could cause a divide by zero in
damon_get_node_mem_bp(). It could also show free memory larger than the
total memory. This could cause underflow and make DAMOS temporarily make
unexpected behavior. Thanks to safety guards in the auto-tuning feedback
loop, that should not be a real problem, though. Fix the problems by
respectively returning 100% and 0% for used and free memory queries in the
corner cases.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260901131850.98037-7-sj@kernel.org
Link: https://lore.kernel.org/20260328133216.9697-1-sj@kernel.org [1]
Fixes: 0e1c773b501f ("mm/damon/core: introduce damos quota goal metrics for memory node utilization")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.16.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index b3390978581a6..c00f1651b04a6 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2829,6 +2829,13 @@ static __kernel_ulong_t damos_get_node_mem_bp(
}
si_meminfo_node(&i, goal->nid);
+ if (!i.totalram || i.totalram < i.freeram) {
+ if (goal->metric == DAMOS_QUOTA_NODE_MEM_USED_BP)
+ return 10000;
+ else /* DAMOS_QUOTA_NODE_MEM_FREE_BP */
+ return 0;
+ }
+
if (goal->metric == DAMOS_QUOTA_NODE_MEM_USED_BP)
numerator = i.totalram - i.freeram;
else /* DAMOS_QUOTA_NODE_MEM_FREE_BP */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0510/1257] mm/damon/core: handle extreme memory state in get_node_memcg_used_bp()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0509/1257] mm/damon/core: handle extreme memory state in damon_get_node_mem_bp() Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0511/1257] mm/damon/core: handle extreme memory state in get_in_active_mem_bp() Greg Kroah-Hartman
` (488 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit c4b1ae3837ff381795f1fcc18d827fce48c4e89b ]
In extreme unlikely situations, total memory might be zero. In less
extreme but still very unlikely situations, lruvec_page_state() calls
might let the caller show used memory larger than total memory. In the
two cases, damos_get_node_memcg_used_bp() could cause division by zero, or
return underflowed value, respectively. Handle the cases by respectively
returning 100% and 0% for used and free memory queries in the corner
cases.
This issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260901131850.98037-8-sj@kernel.org
Link: https://lore.kernel.org/20260329154813.47382-1-sj@kernel.org [1]
Fixes: b74a120bcf50 ("mm/damon/core: implement DAMOS_QUOTA_NODE_MEMCG_USED_BP")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.19.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index c00f1651b04a6..f4b586188c68a 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2876,6 +2876,12 @@ static unsigned long damos_get_node_memcg_used_bp(
mem_cgroup_put(memcg);
si_meminfo_node(&i, goal->nid);
+ if (!i.totalram || i.totalram < used_pages) {
+ if (goal->metric == DAMOS_QUOTA_NODE_MEMCG_USED_BP)
+ return 10000;
+ else /* DAMOS_QUOTA_NODE_MEMCG_FREE_BP */
+ return 0;
+ }
if (goal->metric == DAMOS_QUOTA_NODE_MEMCG_USED_BP)
numerator = used_pages;
else /* DAMOS_QUOTA_NODE_MEMCG_FREE_BP */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0511/1257] mm/damon/core: handle extreme memory state in get_in_active_mem_bp()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0510/1257] mm/damon/core: handle extreme memory state in get_node_memcg_used_bp() Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0512/1257] mm/list_lru: dont copy stale shrinker id from non-memcg-aware shrinkers Greg Kroah-Hartman
` (487 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Usama Arif,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit d9e43f46fb324e0a311146f937f0d214f023dc63 ]
damos_get_in_active_mem_bp() uses the sum of the active and inactive
memory amount as a denominator. In an extreme and unlikely environment,
active and inactive memory might be zero. In this case, hence, it results
in a divide by zero problem. Avoid it by changing the denominator to one
if it is zero, before it is being used.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260901131850.98037-9-sj@kernel.org
Link: https://lore.kernel.org/20260721034756.147011-1-sj@kernel.org [1]
Fixes: 4835e2871321 ("mm/damon/core: introduce [in]active memory ratio damos quota goal metric")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 7.0.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index f4b586188c68a..acbf32232c3f3 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -3028,7 +3028,7 @@ static unsigned int damos_get_in_active_mem_bp(bool active_ratio)
global_node_page_state(NR_LRU_BASE + LRU_ACTIVE_FILE);
inactive = global_node_page_state(NR_LRU_BASE + LRU_INACTIVE_ANON) +
global_node_page_state(NR_LRU_BASE + LRU_INACTIVE_FILE);
- total = active + inactive;
+ total = max(active + inactive, 1);
if (active_ratio)
return mult_frac(active, 10000, total);
return mult_frac(inactive, 10000, total);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0512/1257] mm/list_lru: dont copy stale shrinker id from non-memcg-aware shrinkers
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0511/1257] mm/damon/core: handle extreme memory state in get_in_active_mem_bp() Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0513/1257] mm/damon/tests/core-kunit: test committing psi goal to psi goal Greg Kroah-Hartman
` (486 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qinyun Tan, Andrew Morton,
Muchun Song, Baolin Wang, Wentao Guan, Michal Hocko,
Roman Gushchin, Johannes Weiner, Shakeel Butt, Dave Chinner,
David Hildenbrand, Lance Yang, Michal Koutný, Xunlei Pang,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qinyun Tan <qinyuntan@linux.alibaba.com>
[ Upstream commit 6a100811c7c5fa39d452ff2e380bd14efbc0208e ]
With cgroup.memory=nokmem, shrinker_memcg_alloc() fails with -ENOSYS for
shrinkers without SHRINKER_NONSLAB, and shrinker_alloc() falls back to a
non-memcg-aware shrinker. On this fallback path, shrinker->id is never
assigned and keeps 0 from kzalloc(), which is a valid id belonging to
whichever memcg-aware shrinker registers first.
__list_lru_init() copies shrinker->id unconditionally, so every list_lru
backed by such a fallback shrinker (thp-deferred_split, zswap-shrinker,
workingset shadow nodes, superblock lrus, ...) ends up with
lru->shrinker_id == 0 instead of -1.
Under nokmem the list_lru collapses to the shared per-node lists, but
__list_lru_add() still calls set_shrinker_bit() against the memcg of
the added object. Most list_lru users are unaffected because their
objects resolve to a NULL memcg without kmem accounting, but the THP
deferred split queue holds user folios, which are charged regardless of
nokmem. On a system where no SHRINKER_NONSLAB shrinker registers,
shrinker_nr_max stays 0 and every memcg's shrinker_info has map_nr_max
== 0, so the first folio added by khugepaged triggers on every boot:
WARNING: mm/shrinker.c:212 at set_shrinker_bit+0x99/0xa0
On systems where a SHRINKER_NONSLAB shrinker (btrfs, xfs) did register and
expand the maps, there is no warning; instead bit 0 is set spuriously for
an unrelated shrinker.
shrinker->id is only meaningful while SHRINKER_MEMCG_AWARE is set, and all
readers inside mm/shrinker.c already check the flag before using the id.
Make __list_lru_init() do the same and fall back to -1, so
set_shrinker_bit() is never reached with a bogus id. The stale
shrinker->id itself is left as is; cleaning that up is a separate topic.
Verified on a machine booting with cgroup.memory=nokmem and
CONFIG_TRANSPARENT_HUGEPAGE=y: the warning fires once per boot from
khugepaged, disappears when nokmem is removed from the command line, and
no longer triggers with this fix applied and nokmem set.
Link: https://lore.kernel.org/20260901115104.2944996-1-qinyuntan@linux.alibaba.com
Fixes: fafaeceb89a5e ("mm: switch deferred split shrinker to list_lru")
Signed-off-by: Qinyun Tan <qinyuntan@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Reported-by: Wentao Guan <guanwentao@uniontech.com>
Closes: https://lore.kernel.org/linux-mm/20260904190028.21542-1-guanwentao@uniontech.com/
Tested-by: Wentao Guan <guanwentao@uniontech.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Dave Chinner <david@fromorbit.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Michal Koutný <mkoutny@suse.com>
Cc: Xunlei Pang <xlpang@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/list_lru.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/mm/list_lru.c b/mm/list_lru.c
index 36662d02ff963..96d02ea206a88 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -666,7 +666,12 @@ int __list_lru_init(struct list_lru *lru, bool memcg_aware, struct shrinker *shr
int i;
#ifdef CONFIG_MEMCG
- if (shrinker)
+ /*
+ * If the shrinker fell back to being non-memcg-aware (e.g. with
+ * cgroup.memory=nokmem), its id was never assigned and holds a
+ * stale 0. Don't let set_shrinker_bit() act on it.
+ */
+ if (shrinker && (shrinker->flags & SHRINKER_MEMCG_AWARE))
lru->shrinker_id = shrinker->id;
else
lru->shrinker_id = -1;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0513/1257] mm/damon/tests/core-kunit: test committing psi goal to psi goal
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0512/1257] mm/list_lru: dont copy stale shrinker id from non-memcg-aware shrinkers Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0514/1257] mm/damon/core: handle uninitialized damos_quota_goal->last_psi_total Greg Kroah-Hartman
` (485 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Lian Wang,
Kunwu Chan, Brendan Higgins, David Gow, Quanmin Yan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 938d5db367967e7dec5db0a6fd189112deafb8b6 ]
Patch series "mm/damon: fix misc bugs in kunit, quota goals and sysfs
refresh_ms".
DAMOS quota goals commit unit test is mistakenly not testing a test case
that was designed to test. DAMOS quota goals and DAMON sysfs refresh_ms
file have bugs that can produce non critical but still unexpected
behaviors. Fix the bugs.
Patch 1 fixes the DAMOS quota goals commit unit test to cover a mistakenly
uncovered case. Patches 2 and 3 fix the bugs in DAMOS PSI goal
initialization and eligible_mem_bp online commit, respectively. Patch 4
fixes the bug in DAMON sysfs refresh_ms file handling.
This patch (of 4):
damon_test_commit_quota_goal_for() is set to test committing a new psi
goal on an existing psi goal. However, damon_test_commit_quota_goal() is
mistakenly not covering the test case. Add the test case.
Link: https://lore.kernel.org/20260902002725.108635-1-sj@kernel.org
Link: https://lore.kernel.org/20260902002725.108635-2-sj@kernel.org
Fixes: 99f89debafc5 ("mm/damon/tests/core-kunit: add damos_commit_quota_goal() test")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lian Wang <lianux.mm@gmail.com>
Tested-by: Lian Wang <lianux.mm@gmail.com>
Reviewed-by: Kunwu Chan <kunwu.chan@gmail.com>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Quanmin Yan <yanquanmin1@huawei.com>
Cc: <stable@vger.kernel.org> # 6.19.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/tests/core-kunit.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index 4a536d41cdb2d..b643f9a83f14a 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -787,6 +787,13 @@ static void damos_test_commit_quota_goal(struct kunit *test)
.last_psi_total = 456,
};
+ damos_test_commit_quota_goal_for(test, &dst,
+ &(struct damos_quota_goal) {
+ .metric = DAMOS_QUOTA_SOME_MEM_PSI_US,
+ .target_value = 234,
+ .current_value = 345,
+ .last_psi_total = 567,
+ });
damos_test_commit_quota_goal_for(test, &dst,
&(struct damos_quota_goal){
.metric = DAMOS_QUOTA_USER_INPUT,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0514/1257] mm/damon/core: handle uninitialized damos_quota_goal->last_psi_total
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0513/1257] mm/damon/tests/core-kunit: test committing psi goal to psi goal Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0515/1257] mm/damon/core: keep the temporal tuner quota over an unmeasured PSI round Greg Kroah-Hartman
` (484 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Lian Wang,
Kunwu Chan, Brendan Higgins, David Gow, Quanmin Yan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 29c6084658af41b5b1fefd873d26d441830ced34 ]
When DAMOS_QUOTA_SOME_MEM_PSI_US metric damos quota goal is set, the PSI
delta for the feedback loop is calculated using
damos_quota_goal->last_psi_total. However, it is initialized only after
the first feedback loop. The first iteration of the loop uses the
uninitialized value. As a result, the feedback loop can change the
effective quota in an unexpected way at the first iteration.
The user impact of the issue is not big, because the issue impacts only
the first iteration of the feedback loop. The feedback loop also has an
internal cap of the quota adjustment. The wrong adjustment will soon be
corrected over a few iterations. For this reason, doing no initialization
at commit time was intentional. It is also explicitly commented. That
said, nobody likes behaviors that are unexpected or difficult to be
expected.
Check last_psi_total initialization and skip the tuning round when it is
not initialized. For this, initialize last_psi_total with U64_MAX in the
goal creation and the goal commit time. U64_MAX means the field is not
initialized. The tuning round shows the value and adjusts it to guarantee
the current quota is maintained for the round, and last_psi_total is
correctly initialized on the next round.
Before this change, committing a new PSI goal on an existing PSI goal with
goal-only DAMON sysfs command (commit_schemes_quota_goals) just worked.
After this change, the tuning round right after the commit will be
unnecessarily skipped, because last_psi_total is unconditionally marked as
not initialized in the damos_commit_quota_goal_union(). This is an
intended tradeoff for simplicity. Skipping just one round of tuning is no
problem. Meanwhile it makes both the code and the behavior simple to
understand.
Also update the quota goal commit unit test for changed last_psi_total
setup behavior.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260902002725.108635-3-sj@kernel.org
Link: https://lore.kernel.org/20260718005316.89585-1-sj@kernel.org [1]
Fixes: 2dbb60f789cb ("mm/damon/core: implement PSI metric DAMOS quota goal")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lian Wang <lianux.mm@gmail.com>
Tested-by: Lian Wang <lianux.mm@gmail.com>
Reviewed-by: Kunwu Chan <kunwu.chan@gmail.com>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Quanmin Yan <yanquanmin1@huawei.com>
Cc: <stable@vger.kernel.org> # 6.9.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 13 +++++++++++--
mm/damon/tests/core-kunit.h | 9 +++------
2 files changed, 14 insertions(+), 8 deletions(-)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index acbf32232c3f3..0463e7ec0e14b 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -635,6 +635,8 @@ struct damos_quota_goal *damos_new_quota_goal(
return NULL;
goal->metric = metric;
goal->target_value = target_value;
+ if (metric == DAMOS_QUOTA_SOME_MEM_PSI_US)
+ goal->last_psi_total = U64_MAX;
INIT_LIST_HEAD(&goal->list);
return goal;
}
@@ -1122,6 +1124,9 @@ static void damos_commit_quota_goal_union(
struct damos_quota_goal *dst, struct damos_quota_goal *src)
{
switch (dst->metric) {
+ case DAMOS_QUOTA_SOME_MEM_PSI_US:
+ dst->last_psi_total = U64_MAX;
+ break;
case DAMOS_QUOTA_NODE_MEM_USED_BP:
case DAMOS_QUOTA_NODE_MEM_FREE_BP:
dst->nid = src->nid;
@@ -1145,7 +1150,6 @@ static int damos_commit_quota_goal(
dst->target_value = src->target_value;
if (dst->metric == DAMOS_QUOTA_USER_INPUT)
dst->current_value = src->current_value;
- /* keep last_psi_total as is, since it will be updated in next cycle */
damos_commit_quota_goal_union(dst, src);
return 0;
}
@@ -3045,7 +3049,12 @@ static void damos_set_quota_goal_current_value(struct damon_ctx *c,
break;
case DAMOS_QUOTA_SOME_MEM_PSI_US:
now_psi_total = damos_get_some_mem_psi_total();
- goal->current_value = now_psi_total - goal->last_psi_total;
+ /* uninitialized last_psi_total; make no effect this round */
+ if (goal->last_psi_total == U64_MAX)
+ goal->current_value = goal->target_value;
+ else
+ goal->current_value = now_psi_total -
+ goal->last_psi_total;
goal->last_psi_total = now_psi_total;
break;
case DAMOS_QUOTA_NODE_MEM_USED_BP:
diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index b643f9a83f14a..65443aba03300 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -751,19 +751,16 @@ static void damos_test_commit_quota_goal_for(struct kunit *test,
struct damos_quota_goal *dst,
struct damos_quota_goal *src)
{
- u64 dst_last_psi_total = 0;
-
- if (dst->metric == DAMOS_QUOTA_SOME_MEM_PSI_US)
- dst_last_psi_total = dst->last_psi_total;
damos_commit_quota_goal(dst, src);
KUNIT_EXPECT_EQ(test, dst->metric, src->metric);
KUNIT_EXPECT_EQ(test, dst->target_value, src->target_value);
if (src->metric == DAMOS_QUOTA_USER_INPUT)
KUNIT_EXPECT_EQ(test, dst->current_value, src->current_value);
- if (dst_last_psi_total && src->metric == DAMOS_QUOTA_SOME_MEM_PSI_US)
- KUNIT_EXPECT_EQ(test, dst->last_psi_total, dst_last_psi_total);
switch (dst->metric) {
+ case DAMOS_QUOTA_SOME_MEM_PSI_US:
+ KUNIT_EXPECT_EQ(test, dst->last_psi_total, U64_MAX);
+ break;
case DAMOS_QUOTA_NODE_MEM_USED_BP:
case DAMOS_QUOTA_NODE_MEM_FREE_BP:
KUNIT_EXPECT_EQ(test, dst->nid, src->nid);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0515/1257] mm/damon/core: keep the temporal tuner quota over an unmeasured PSI round
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0514/1257] mm/damon/core: handle uninitialized damos_quota_goal->last_psi_total Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0516/1257] mm/damon/core: copy nid for eligible_mem_bp damos quota goal commit Greg Kroah-Hartman
` (483 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, SJ Park,
Andrew Morton, Kunwu Chan, Lian Wang, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit df7d9a0f8d916eeea375430ae3360724afecde15 ]
The patch in mm-unstable of subject "mm/damon/core: handle uninitialized
damos_quota_goal->last_psi_total" scores a PSI quota goal without a
previous sample as achieved. This leaves the consist tuner's input
unchanged, but the temporal tuner sets its quota to zero for an achieved
goal. A running scheme with a nonzero temporal quota therefore loses a
charge window after a quota-goal commit.
Use the effective quota to preserve the temporal tuner's previous
goal-achievement state during an unmeasured round, as SJ suggested [1].
Score the goal as achieved when the effective quota is zero and as not
achieved otherwise. A new scheme's initially zero quota stays zero, and
the consist tuner's behavior is unchanged.
Move the PSI current-value calculation and last_psi_total update into a
helper that takes the current PSI total. This lets a unit test cover the
unmeasured and measured rounds without depending on system memory
pressure.
Link: https://lore.kernel.org/20260923055139.2982-1-sj@kernel.org
Link: https://lore.kernel.org/damon/20260916001311.101024-1-sj@kernel.org/ [1]
Fixes: 2dbb60f789cb ("mm/damon/core: implement PSI metric DAMOS quota goal")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: SJ Park <sj@kernel.org>
Reviewed-by: SJ Park <sj@kernel.org>
Reviewed-by: Kunwu Chan <kunwu.chan@gmail.com>
Assisted-by: LLM
Cc: Lian Wang <lianux.mm@gmail.com>
Cc: <stable@vger.kernel.org> # 6.9.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 30 +++++++++++++++++++++++-------
1 file changed, 23 insertions(+), 7 deletions(-)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index 0463e7ec0e14b..2edd906787a35 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2813,6 +2813,28 @@ static inline u64 damos_get_some_mem_psi_total(void)
#endif /* CONFIG_PSI */
+static void damos_set_psi_current_val(u64 now_psi_total,
+ struct damos_quota_goal *goal, struct damos *s)
+{
+ u64 last_psi_total = goal->last_psi_total;
+
+ goal->last_psi_total = now_psi_total;
+ if (last_psi_total != U64_MAX) {
+ goal->current_value = now_psi_total - last_psi_total;
+ return;
+ }
+ /* uninitialized last_psi_total; make no effect this round */
+ if (s->quota.goal_tuner == DAMOS_QUOTA_GOAL_TUNER_CONSIST) {
+ goal->current_value = goal->target_value;
+ return;
+ }
+ /* let temporal tuner show the same achievement as in the last round */
+ if (!s->quota.esz)
+ goal->current_value = goal->target_value;
+ else
+ goal->current_value = 0;
+}
+
#ifdef CONFIG_NUMA
static bool invalid_mem_node(int nid)
{
@@ -3049,13 +3071,7 @@ static void damos_set_quota_goal_current_value(struct damon_ctx *c,
break;
case DAMOS_QUOTA_SOME_MEM_PSI_US:
now_psi_total = damos_get_some_mem_psi_total();
- /* uninitialized last_psi_total; make no effect this round */
- if (goal->last_psi_total == U64_MAX)
- goal->current_value = goal->target_value;
- else
- goal->current_value = now_psi_total -
- goal->last_psi_total;
- goal->last_psi_total = now_psi_total;
+ damos_set_psi_current_val(now_psi_total, goal, s);
break;
case DAMOS_QUOTA_NODE_MEM_USED_BP:
case DAMOS_QUOTA_NODE_MEM_FREE_BP:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0516/1257] mm/damon/core: copy nid for eligible_mem_bp damos quota goal commit
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0515/1257] mm/damon/core: keep the temporal tuner quota over an unmeasured PSI round Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0517/1257] mm/damon/sysfs: set next refresh jiffies per sysfs context Greg Kroah-Hartman
` (482 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Lian Wang,
Kunwu Chan, Brendan Higgins, David Gow, Quanmin Yan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit d4a8b5ac2ec28f55bba9fad07b69bf375cd42704 ]
damos_commit_quota_goal_union() is not updating the ->nid union field when
the goal metric is DAMOS_QUOTA_NODE_ELIGIBLE_MEM_BP. Hence, if a DAMOS
quota goal of the type is online committed in a way that it will reuse
other quota goal's memory space, the new goal will work with a garbage nid
value. As a result, the DAMOS scheme can show unexpected aggressiveness.
Do the update.
The user impact is not catastrophic. No leak or crash happens. Doing the
quota goal online commit that can reproduce the issue is expected to be
not common. This issue was not found by real users but the AI review.
That said, the issue can reliably be reproduced.
This issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260902002725.108635-4-sj@kernel.org
Link: https://lore.kernel.org/20260827045035.94611-1-sj@kernel.org [1]
Fixes: 9138e27a3bc3 ("mm/damon: add node_eligible_mem_bp goal metric")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lian Wang <lianux.mm@gmail.com>
Tested-by: Lian Wang <lianux.mm@gmail.com>
Reviewed-by: Kunwu Chan <kunwu.chan@gmail.com>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Quanmin Yan <yanquanmin1@huawei.com>
Cc: <stable@vger.kernel.org> # 7.2.x
value. As a result, the DAMOS scheme can show unexpected aggressiveness.
Do the update.
The user impact is not catastrophic. No leak or crash happens. Doing the
quota goal online commit that can reproduce the issue is expected to be
not common. This issue was not found by real users but the AI review.
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index 2edd906787a35..0a0fdff279d86 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -1136,6 +1136,9 @@ static void damos_commit_quota_goal_union(
dst->nid = src->nid;
dst->memcg_id = src->memcg_id;
break;
+ case DAMOS_QUOTA_NODE_ELIGIBLE_MEM_BP:
+ dst->nid = src->nid;
+ break;
default:
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0517/1257] mm/damon/sysfs: set next refresh jiffies per sysfs context
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0516/1257] mm/damon/core: copy nid for eligible_mem_bp damos quota goal commit Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0518/1257] mm: hugetlb: return -ENOSPC on memcg charge failure Greg Kroah-Hartman
` (481 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Lian Wang,
Kunwu Chan, Brendan Higgins, David Gow, Quanmin Yan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit b9100ecb5411d2de79175ed534df72ec41e94998 ]
When 'refresh_ms' is set, DAMON sysfs interface periodically updates
auto-tuned parameters and DAMOS stats. The timestamp for the next refresh
is initialized when a DAMON context starts, and updated in its
damon_call() callback function. That is, each DAMON context updates it.
However, the timestamp is a global variable that is shared with all the
contexts. When there are multiple DAMON contexts having different
refresh_ms, the update frequency will be changed, depending on the order
of the contexts. When there are multiple kdamonds, it will be even more
chaotic. Fix the problem by having the timestamp per each context.
The user impact is not very critical. It does not leak, corrupt or crash.
The update will not be faster or slower than the lowest and largest
refresh_ms values of the contexts, respectively. The user can also
manually ask the updates on demand using kdamond state commands. That
said, clearly this is a bug and can easily be reproduced.
Link: https://lore.kernel.org/20260902002725.108635-5-sj@kernel.org
Fixes: 9fd7bb5083d1 ("mm/damon/sysfs: change next_update_jiffies to a global variable")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lian Wang <lianux.mm@gmail.com>
Tested-by: Lian Wang <lianux.mm@gmail.com>
Reviewed-by: Kunwu Chan <kunwu.chan@gmail.com>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Quanmin Yan <yanquanmin1@huawei.com>
Cc: <stable@vger.kernel.org> # 6.18.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/sysfs.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
index e3858ffab4b22..f05b256c90ee7 100644
--- a/mm/damon/sysfs.c
+++ b/mm/damon/sysfs.c
@@ -1789,6 +1789,7 @@ struct damon_sysfs_kdamond {
struct damon_sysfs_contexts *contexts;
struct damon_ctx *damon_ctx;
unsigned int refresh_ms;
+ unsigned long next_refresh_jiffies;
};
static struct damon_sysfs_kdamond *damon_sysfs_kdamond_alloc(void)
@@ -2215,17 +2216,15 @@ static struct damon_ctx *damon_sysfs_build_ctx(
return ctx;
}
-static unsigned long damon_sysfs_next_update_jiffies;
-
static int damon_sysfs_repeat_call_fn(void *data)
{
struct damon_sysfs_kdamond *sysfs_kdamond = data;
if (!sysfs_kdamond->refresh_ms)
return 0;
- if (time_before(jiffies, damon_sysfs_next_update_jiffies))
+ if (time_before(jiffies, sysfs_kdamond->next_refresh_jiffies))
return 0;
- damon_sysfs_next_update_jiffies = jiffies +
+ sysfs_kdamond->next_refresh_jiffies = jiffies +
msecs_to_jiffies(sysfs_kdamond->refresh_ms);
if (!mutex_trylock(&damon_sysfs_lock))
@@ -2273,8 +2272,8 @@ static int damon_sysfs_turn_damon_on(struct damon_sysfs_kdamond *kdamond)
}
kdamond->damon_ctx = ctx;
- damon_sysfs_next_update_jiffies =
- jiffies + msecs_to_jiffies(kdamond->refresh_ms);
+ kdamond->next_refresh_jiffies = jiffies +
+ msecs_to_jiffies(kdamond->refresh_ms);
repeat_call_control->fn = damon_sysfs_repeat_call_fn;
repeat_call_control->data = kdamond;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0518/1257] mm: hugetlb: return -ENOSPC on memcg charge failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0517/1257] mm/damon/sysfs: set next refresh jiffies per sysfs context Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0519/1257] mm: hugetlb: drop refcount before freeing " Greg Kroah-Hartman
` (480 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ackerley Tng, Andrew Morton,
Muchun Song, Joshua Hahn, Alex Shi, David Hildenbrand,
David Rientjes, Dongliang Mu, Frank van der Linden, Hongxiang Lou,
James Houghton, Johannes Weiner, Jonathan Corbet, Liam R. Howlett,
Lorenzo Stoakes, Ma Wupeng, Miaohe Lin, Michal Hocko,
Mike Rapoport, Nhat Pham, Oscar Salvador, Peter Xu,
Roman Gushchin, Shakeel Butt, Suren Baghdasaryan,
Vishal Annapurve, Vlastimil Babka, Yanteng Si, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ackerley Tng <ackerleytng@google.com>
[ Upstream commit 956aeff185e7e16b989202bde0bb29859adba99d ]
Patch series "Fix bugs in HugeTLB allocation when
mem_cgroup_charge_hugetlb() fails", v2.
In hugetlb_alloc_folio(), when mem_cgroup_charge_hugetlb() fails, there
are 2 issues:
1. free_huge_folio() expects a non-refcounted folio and will
VM_BUG_ON_FOLIO().
2. -ENOMEM is returned, causing an infinite loop retrying the fault.
This patch (of 2):
When mem_cgroup_charge_hugetlb() fails with -ENOMEM, alloc_hugetlb_folio()
currently propagates this error. This results in the page fault handler
returning VM_FAULT_OOM.
Because HugeTLB allocations are high-order and use __GFP_RETRY_MAYFAIL,
they bypass the OOM killer. Returning VM_FAULT_OOM to the #PF handler
without triggering the OOM killer (or having it make progress) leads to an
infinite loop of retrying the fault.
Avoid this loop by returning -ENOSPC when charging fails, which maps to
VM_FAULT_SIGBUS, terminating the process cleanly.
Make mem_cgroup_charge_hugetlb() fault handling use a common error
handling path, the same handling used for
hugetlb_cgroup_uncharge_cgroup{,_rsvd}(), which also don't trigger the OOM
killer and hence opt to terminate the process with a SIGBUS.
Link: https://lore.kernel.org/20260909-hugetlb-alloc-folio-memcg-charge-error-handling-v2-1-4b4a8a19a7f7@google.com
Fixes: 991135774c0e ("memcg/hugetlb: introduce mem_cgroup_charge_hugetlb")
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Alex Shi <alexs@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Dongliang Mu <dzm91@hust.edu.cn>
Cc: Frank van der Linden <fvdl@google.com>
Cc: Hongxiang Lou <louhongxiang@huawei.com>
Cc: James Houghton <jthoughton@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Ma Wupeng <mawupeng1@huawei.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Peter Xu <peterx@redhat.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vishal Annapurve <vannapurve@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Yanteng Si <si.yanteng@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 86928d76ef12d..7a8f605881d86 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2834,7 +2834,6 @@ void wait_for_freed_hugetlb_folios(void)
*
* Return: A pointer to the allocated folio, or an ERR_PTR on failure.
* -ENOSPC if cgroup charging fails or no folio is available.
- * -ENOMEM if mem cgroup charging fails.
*/
struct folio *hugetlb_alloc_folio(struct hstate *h,
struct mempolicy_interpreted *mpoli, u8 alloc_flags)
@@ -2907,7 +2906,11 @@ struct folio *hugetlb_alloc_folio(struct hstate *h,
* were committed to the folio and freeing the folio
* would have cleared those up.
*/
- return ERR_PTR(ret);
+ /*
+ * Return -ENOSPC, since retrying the fault is futile:
+ * the OOM killer is not triggered for HugeTLB.
+ */
+ return ERR_PTR(-ENOSPC);
}
return folio;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0519/1257] mm: hugetlb: drop refcount before freeing on memcg charge failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0518/1257] mm: hugetlb: return -ENOSPC on memcg charge failure Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0520/1257] resource: fix lost wakeup when waiting for a muxed region Greg Kroah-Hartman
` (479 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ackerley Tng, Andrew Morton,
Muchun Song, Joshua Hahn, Alex Shi, David Hildenbrand,
David Rientjes, Dongliang Mu, Frank van der Linden, Hongxiang Lou,
James Houghton, Johannes Weiner, Jonathan Corbet, Liam R. Howlett,
Lorenzo Stoakes, Ma Wupeng, Miaohe Lin, Michal Hocko,
Mike Rapoport, Nhat Pham, Oscar Salvador, Peter Xu,
Roman Gushchin, Shakeel Butt, Suren Baghdasaryan,
Vishal Annapurve, Vlastimil Babka, Yanteng Si, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ackerley Tng <ackerleytng@google.com>
[ Upstream commit e95d29c5df84f19881cd30b491fc81aa98f44b45 ]
When mem_cgroup_charge_hugetlb(folio, gfp) returns -ENOMEM, the folio has
its refcount set to 1 via folio_ref_unfreeze(folio, 1).
The error path calls free_huge_folio(folio) directly, which expects a
refcount of 0. Hence, VM_BUG_ON_FOLIO(folio_ref_count(folio), folio) is
triggered.
Even with CONFIG_DEBUG_VM disabled, returning a folio with refcount 1 to
the freelist can corrupt allocator state later.
Use folio_put(folio) instead of free_huge_folio(folio) to properly drop
the reference before freeing it.
Link: https://lore.kernel.org/20260909-hugetlb-alloc-folio-memcg-charge-error-handling-v2-2-4b4a8a19a7f7@google.com
Fixes: 991135774c0e ("memcg/hugetlb: introduce mem_cgroup_charge_hugetlb")
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Alex Shi <alexs@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Dongliang Mu <dzm91@hust.edu.cn>
Cc: Frank van der Linden <fvdl@google.com>
Cc: Hongxiang Lou <louhongxiang@huawei.com>
Cc: James Houghton <jthoughton@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Ma Wupeng <mawupeng1@huawei.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Peter Xu <peterx@redhat.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vishal Annapurve <vannapurve@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Yanteng Si <si.yanteng@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 7a8f605881d86..930e40ac77077 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2900,7 +2900,7 @@ struct folio *hugetlb_alloc_folio(struct hstate *h,
lruvec_stat_mod_folio(folio, NR_HUGETLB, nr_pages);
if (ret == -ENOMEM) {
- free_huge_folio(folio);
+ folio_put(folio);
/*
* Skip uncharging hugetlb_cgroup since the charges
* were committed to the folio and freeing the folio
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0520/1257] resource: fix lost wakeup when waiting for a muxed region
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0519/1257] mm: hugetlb: drop refcount before freeing " Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0521/1257] fat: fix fat_ent_write() for reverting the value Greg Kroah-Hartman
` (478 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, DAI RENJIE, Andrew Morton,
Bradley Morgan, Mark Brown, Kees Cook, Bjorn Helgaas, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: DAI RENJIE <drj19981414013@gmail.com>
[ Upstream commit 405c00e43a9c72a0b9b318cc2d2e298386ffb58e ]
A task waiting for a muxed region can sleep forever in
TASK_UNINTERRUPTIBLE even though the region it waits for is already free.
__request_region_locked() queues itself on muxed_resource_wait and drops
resource_lock before setting TASK_UNINTERRUPTIBLE, while
__release_region() wakes the queue after dropping the same lock. A wakeup
landing in between finds TASK_RUNNING, does not match TASK_NORMAL and is
discarded; callers hold a muxed region only across a bounded transaction,
so no further release is coming. The task is unkillable and its caller
never returns.
The window is one store wide, but an interrupt is enough to hold the
waiter in it, and the machine this was seen on runs PREEMPT_DYNAMIC in its
voluntary default. Since v6.11 spd5118 exports the DDR5 sensors of AMD
boards through i2c-piix4, which takes a muxed region per SMBus
transaction; a third of the in-tree users of request_muxed_region() are
hwmon drivers, so reading a world-readable attribute is all an
unprivileged user needs to drive the contention. The blocked task sleeps
holding the i2c adapter bus lock, and 27 more piled up behind it.
Reproduced by building a kernel with the two orderings selectable at
runtime and a 2ms delay inside the window. Switching only that knob, a
two-thread barriered reproducer loses the wakeup 200 times out of 200
before the fix and 0 out of 200 after it; without the delay it goes 20000
times through the wait path and loses none.
Fix it by setting the task state before dropping resource_lock, as
prepare_to_wait() does: the releasing side needs resource_lock to unlink
the resource, so it cannot reach the wakeup before the state is published.
Link: https://lore.kernel.org/20260821-b4-resource-muxed-lost-wakeup-v1-1-37eb6473a76c@gmail.com
Fixes: 8b6d043b7ee2 ("resource: shared I/O region support")
Signed-off-by: DAI RENJIE <drj19981414013@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: Claude:claude-opus-5
Cc: Mark Brown <broonie@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/resource.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/resource.c b/kernel/resource.c
index 08bd7579cf403..a98fd2b29ceac 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -1350,8 +1350,8 @@ static int __request_region_locked(struct resource *res, struct resource *parent
}
if (conflict->flags & flags & IORESOURCE_MUXED) {
add_wait_queue(&muxed_resource_wait, &wait);
- write_unlock(&resource_lock);
set_current_state(TASK_UNINTERRUPTIBLE);
+ write_unlock(&resource_lock);
schedule();
remove_wait_queue(&muxed_resource_wait, &wait);
write_lock(&resource_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0521/1257] fat: fix fat_ent_write() for reverting the value
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0520/1257] resource: fix lost wakeup when waiting for a muxed region Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0522/1257] fault-inject: fix dentry leak Greg Kroah-Hartman
` (477 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, OGAWA Hirofumi, Andrew Morton,
syzbot+e64c6472a3d96a75172a, syzbot+26461e903494e689c24f, Yemu Lu,
Ren Wei, Yuan Tan, Yifan Wu, Juefei Pu, Xin Liu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
[ Upstream commit 63c4b67ee163b2a67a7561314bf2106d6c79c53c ]
commit 64d9183203ee ("fat: restore original value when fat_ent_write
failed") try to revert the fatent value to old value when got the error on
mirror FAT.
However it didn't work if the error is when writing the fatent bh. In
that case, the bh is cleared the uptodate flag, so reuse bh is invalid.
Fix this by reverting the fatent only if got the error on mirror FAT.
Link: https://lore.kernel.org/87ik4yz9fv.fsf_-_@mail.parknet.co.jp
Fixes: 64d9183203ee ("fat: restore original value when fat_ent_write failed")
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: syzbot+e64c6472a3d96a75172a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e64c6472a3d96a75172a
Reported-by: syzbot+26461e903494e689c24f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=26461e903494e689c24f
Cc: Yemu Lu <prcups@krgm.moe>
Cc: Ren Wei <n05ec@lzu.edu.cn>
Cc: Yuan Tan <yuantan098@gmail.com>
Cc: Yifan Wu <yifanwucs@gmail.com>
Cc: Juefei Pu <tomapufckgml@gmail.com>
Cc: Xin Liu <bird@lzu.edu.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fat/fat.h | 2 +-
fs/fat/fatent.c | 21 ++++++++++++++++++---
fs/fat/file.c | 3 ++-
fs/fat/misc.c | 6 ++----
4 files changed, 23 insertions(+), 9 deletions(-)
diff --git a/fs/fat/fat.h b/fs/fat/fat.h
index 61338413d9f3e..fbd207c55859e 100644
--- a/fs/fat/fat.h
+++ b/fs/fat/fat.h
@@ -392,7 +392,7 @@ extern void fat_ent_access_init(struct super_block *sb);
extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent,
int entry);
extern int fat_ent_write(struct inode *inode, struct fat_entry *fatent,
- int new, int wait);
+ int new, int old, int wait);
extern int fat_alloc_clusters(struct inode *inode, int *cluster,
int nr_cluster);
extern int fat_free_clusters(struct inode *inode, int cluster);
diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
index f0801d99dd62a..df23fc85f3130 100644
--- a/fs/fat/fatent.c
+++ b/fs/fat/fatent.c
@@ -413,7 +413,7 @@ static int fat_mirror_bhs(struct super_block *sb, struct buffer_head **bhs,
}
int fat_ent_write(struct inode *inode, struct fat_entry *fatent,
- int new, int wait)
+ int new, int old, int wait)
{
struct super_block *sb = inode->i_sb;
const struct fatent_operations *ops = MSDOS_SB(sb)->fatent_ops;
@@ -422,10 +422,25 @@ int fat_ent_write(struct inode *inode, struct fat_entry *fatent,
ops->ent_put(fatent, new);
if (wait) {
err = fat_sync_bhs(fatent->bhs, fatent->nr_bhs);
- if (err)
+ if (err) {
+ /*
+ * bhs are not uptodate after I/O error. So we
+ * can't simply re-dirty to revert. And it
+ * would not have value to write again on I/O
+ * error.
+ */
return err;
+ }
}
- return fat_mirror_bhs(sb, fatent->bhs, fatent->nr_bhs);
+
+ err = fat_mirror_bhs(sb, fatent->bhs, fatent->nr_bhs);
+ if (err) {
+ /* Try to revert if got the error on mirror FAT */
+ ops->ent_put(fatent, old);
+ if (wait)
+ fat_sync_bhs(fatent->bhs, fatent->nr_bhs);
+ }
+ return err;
}
static inline int fat_ent_next(struct msdos_sb_info *sbi,
diff --git a/fs/fat/file.c b/fs/fat/file.c
index 1c835ca5f21a5..6c475c53334c6 100644
--- a/fs/fat/file.c
+++ b/fs/fat/file.c
@@ -363,7 +363,8 @@ static int fat_free(struct inode *inode, int skip)
__func__, MSDOS_I(inode)->i_pos);
ret = -EIO;
} else if (ret > 0) {
- err = fat_ent_write(inode, &fatent, FAT_ENT_EOF, wait);
+ err = fat_ent_write(inode, &fatent, FAT_ENT_EOF, ret,
+ wait);
if (err)
ret = err;
}
diff --git a/fs/fat/misc.c b/fs/fat/misc.c
index e79762cf19754..c44296756eae6 100644
--- a/fs/fat/misc.c
+++ b/fs/fat/misc.c
@@ -133,11 +133,9 @@ int fat_chain_add(struct inode *inode, int new_dclus, int nr_cluster)
ret = fat_ent_read(inode, &fatent, last);
if (ret >= 0) {
int wait = inode_needs_sync(inode);
- int old = ret;
- ret = fat_ent_write(inode, &fatent, new_dclus, wait);
- if (ret < 0)
- fat_ent_write(inode, &fatent, old, wait);
+ ret = fat_ent_write(inode, &fatent, new_dclus, ret,
+ wait);
fatent_brelse(&fatent);
}
if (ret < 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0522/1257] fault-inject: fix dentry leak
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0521/1257] fat: fix fat_ent_write() for reverting the value Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0523/1257] USB: gadgetfs: do not WARN about excessively large memory allocations Greg Kroah-Hartman
` (476 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Liang, Andrew Morton,
Akinbou Mita, Dennis Dalessandro, Jason Gunthorpe,
Leon Romanovsky, Vlastimil Babka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Liang <mliang@purestorage.com>
[ Upstream commit ceb43516a9aae0d969a4ec5ab40d45bd09e64229 ]
fault_create_debugfs_attr() has always taken an extra dentry reference on
the created directory (attr->dname = dget(dir)) so that fail_dump() could
print the name via %pd from any context. Nothing anywhere in the tree
ever calls dput() on attr->dname.
For callers with a matching teardown, that unmatched reference causes one
dentry plus its attached inode to leak per fault_create_debugfs_attr /
debugfs_remove_recursive cycle. simple_recursive_removal() drops
debugfs's own +1 ref on the child dentry, but the dget()'d ref keeps its
refcount at 1: the dentry ends up unhashed but pinned, and its inode is
never freed.
Boot-once callers (mm/failslab, block/blk-core, etc.) leak exactly once at
init and never destroy the tree, so the impact there is bounded. But
per-lifecycle callers (drivers/nvme, drivers/infiniband/hw/hfi1,
drivers/mmc, drivers/iommu/iommufd, drivers/media, drivers/misc,
drivers/gpu/drm/msm, drivers/crypto, net/sunrpc) leak on every
create/destroy cycle.
We observed this in production: an NVMe/RDMA host repeatedly reconnecting
to a target that rejected the CRTO Property Get went through ~50 nvme
controller create/destroy cycles per second, and dentry and inode_cache
grew by ~13k pinned objects per 240 s -- unrecoverable through
drop_caches. Byte math matched a per-cycle 1-dentry / 1-inode leak from
the "fault_inject" directory dentry.
Fix this by not holding any external reference in fault_attr. Embed the
directory name as a fixed-size char array (FAULT_ATTR_DNAME_LEN, 64 bytes)
inside struct fault_attr, copied by strscpy() at
fault_create_debugfs_attr() time. fail_dump() prints it via %s.
Advantages of an embedded array over kstrdup() + kfree() paired with a new
destroy API:
- Zero API footprint. No new export and no caller changes required:
callers already own their fault_attr's memory and free it when
they are done, and now that suffices.
- No allocation on the create path.
- fault_create_debugfs_attr() cannot fail from the name-copy step.
- No lifetime coupling between attr->dname and debugfs; the string
is valid for exactly as long as the containing struct.
The 64-byte length accommodates every in-tree caller with generous
headroom (the longest current name is "fail_dma_array_full", 19 chars).
The user-visible fail_dump() format changes from "name %pd" to "name %s",
but the printed content is identical -- %pd on the created directory
renders the same string that was passed in as @name.
drivers/infiniband/hw/hfi1/fault.c drops a now-invalid "attr.dname = NULL"
statement; the surrounding kzalloc() already zero-initialises the array.
Link: https://lore.kernel.org/20260821181527.3271414-1-mliang@purestorage.com
Fixes: 6adc4a22f20b ("fault-inject: add ratelimit option")
Signed-off-by: Michael Liang <mliang@purestorage.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Akinbou Mita <akinobu.mita@gmail.com>
Cc: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/fault.c | 1 -
include/linux/fault-inject.h | 10 ++++++++--
lib/fault-inject.c | 7 +++++--
3 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/fault.c b/drivers/infiniband/hw/hfi1/fault.c
index 4ab72ef03ba11..941a0b96590b6 100644
--- a/drivers/infiniband/hw/hfi1/fault.c
+++ b/drivers/infiniband/hw/hfi1/fault.c
@@ -216,7 +216,6 @@ int hfi1_fault_init_debugfs(struct hfi1_ibdev *ibd)
ibd->fault->attr.interval = 1;
ibd->fault->attr.require_end = ULONG_MAX;
ibd->fault->attr.stacktrace_depth = 32;
- ibd->fault->attr.dname = NULL;
ibd->fault->attr.verbose = 0;
ibd->fault->enable = false;
ibd->fault->opcode = false;
diff --git a/include/linux/fault-inject.h b/include/linux/fault-inject.h
index 58fd14c822708..5c74748a53f38 100644
--- a/include/linux/fault-inject.h
+++ b/include/linux/fault-inject.h
@@ -18,6 +18,13 @@ enum fault_flags {
#include <linux/configfs.h>
#include <linux/ratelimit.h>
+/*
+ * Length of the debugfs directory name embedded in struct fault_attr.
+ * Chosen to accommodate every in-tree caller of fault_create_debugfs_attr()
+ * (the longest is "fail_dma_array_full", 19 chars) with generous headroom.
+ */
+#define FAULT_ATTR_DNAME_LEN 64
+
/*
* For explanation of the elements of this struct, see
* Documentation/fault-injection/fault-injection.rst
@@ -37,7 +44,7 @@ struct fault_attr {
unsigned long count;
struct ratelimit_state ratelimit_state;
- struct dentry *dname;
+ char dname[FAULT_ATTR_DNAME_LEN];
};
#define FAULT_ATTR_INITIALIZER { \
@@ -47,7 +54,6 @@ struct fault_attr {
.stacktrace_depth = 32, \
.ratelimit_state = RATELIMIT_STATE_INIT_DISABLED, \
.verbose = 2, \
- .dname = NULL, \
}
#define DECLARE_FAULT_ATTR(name) struct fault_attr name = FAULT_ATTR_INITIALIZER
diff --git a/lib/fault-inject.c b/lib/fault-inject.c
index 999053fa133e3..02916ef2761c6 100644
--- a/lib/fault-inject.c
+++ b/lib/fault-inject.c
@@ -5,6 +5,7 @@
#include <linux/debugfs.h>
#include <linux/sched.h>
#include <linux/stat.h>
+#include <linux/string.h>
#include <linux/types.h>
#include <linux/fs.h>
#include <linux/export.h>
@@ -64,7 +65,7 @@ static void fail_dump(struct fault_attr *attr)
{
if (attr->verbose > 0 && __ratelimit(&attr->ratelimit_state)) {
printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n"
- "name %pd, interval %lu, probability %lu, "
+ "name %s, interval %lu, probability %lu, "
"space %d, times %d\n", attr->dname,
attr->interval, attr->probability,
atomic_read(&attr->space),
@@ -261,7 +262,9 @@ struct dentry *fault_create_debugfs_attr(const char *name,
debugfs_create_xul("reject-end", mode, dir, &attr->reject_end);
#endif /* CONFIG_FAULT_INJECTION_STACKTRACE_FILTER */
- attr->dname = dget(dir);
+ if (strscpy(attr->dname, name, sizeof(attr->dname)) == -E2BIG)
+ pr_warn("FAULT_INJECTION: name '%s' truncated to '%s'\n",
+ name, attr->dname);
return dir;
}
EXPORT_SYMBOL_GPL(fault_create_debugfs_attr);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0523/1257] USB: gadgetfs: do not WARN about excessively large memory allocations
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0522/1257] fault-inject: fix dentry leak Greg Kroah-Hartman
@ 2026-11-07 13:46 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0524/1257] init: fix early boot crash with bare hostname parameter Greg Kroah-Hartman
` (475 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zi Yan, Andrew Morton,
syzbot+805630f1453e490427fa, Alan Stern, Vlastimil Babka (SUSE),
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zi Yan <ziy@nvidia.com>
[ Upstream commit a156148976eac47bee7210097afbb609cafe88b6 ]
GadgetFS passes an excessively large user input len to kmalloc and kmalloc
gives a WARN (see below for details). Suppress it by passing __GFP_NOWARN
to kmalloc used by both ep_write_iter() and ep_read_iter(). Follow the
same method as commit 4f2629ea67e72 ("USB: usbfs: Don't WARN about
excessively large memory allocations").
kmalloc is used to allocate physically contiguous memory for kernel
allocations. For requests larger than KMALLOC_MAX_CACHE_SIZE, kmalloc
uses the page allocator and can only support up to KMALLOC_MAX_SIZE. For
request sizes bigger than KMALLOC_MAX_SIZE, the page allocator can emit a
WARN because kmalloc allocates an order greater than MAX_PAGE_ORDER.
Link: https://lore.kernel.org/DKTTMAS94IMH.2C6ERY0ZIVWVZ@nvidia.com
Fixes: b3c466ce5129 ("page allocator: do not sanity check order in the fast path")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a820ebc.9ebadd4d.20b15e.001b.GAE@google.com/
Tested-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/legacy/inode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index ce61348d9f2b7..d15a48bdd7596 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -613,7 +613,7 @@ ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
return -EBADMSG;
}
- buf = kmalloc(len, GFP_KERNEL);
+ buf = kmalloc(len, GFP_KERNEL | __GFP_NOWARN);
if (unlikely(!buf)) {
mutex_unlock(&epdata->lock);
return -ENOMEM;
@@ -675,7 +675,7 @@ ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
return -EBADMSG;
}
- buf = kmalloc(len, GFP_KERNEL);
+ buf = kmalloc(len, GFP_KERNEL | __GFP_NOWARN);
if (unlikely(!buf)) {
mutex_unlock(&epdata->lock);
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0524/1257] init: fix early boot crash with bare hostname parameter
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2026-11-07 13:46 ` [PATCH 7.3 0523/1257] USB: gadgetfs: do not WARN about excessively large memory allocations Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0525/1257] ocfs2: exit recovery thread on mount error path Greg Kroah-Hartman
` (474 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Andrew Morton,
Dan Moulding, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <blum@kernel.org>
[ Upstream commit b6bec5b63a5b812145e53aaad1e63661c7214f93 ]
When a bare hostname parameter is specified on the kernel command line
without the '=' separator, early parameter parsing passes NULL to
early_hostname(), which dereferences it in strscpy() and can crash the
system during early boot.
Reject NULL values in early_hostname() and return -EINVAL instead.
Link: https://lore.kernel.org/20260826100904.296151-2-blum@kernel.org
Fixes: 5a704629f2c1 ("init: add "hostname" kernel parameter")
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Dan Moulding <dmoulding@me.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
init/version.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/init/version.c b/init/version.c
index 94c96f6fbfe6a..0bd5c45aabc46 100644
--- a/init/version.c
+++ b/init/version.c
@@ -23,6 +23,9 @@ static int __init early_hostname(char *arg)
size_t maxlen = bufsize - 1;
ssize_t arglen;
+ if (!arg)
+ return -EINVAL;
+
arglen = strscpy(init_uts_ns.name.nodename, arg, bufsize);
if (arglen < 0) {
pr_warn("hostname parameter exceeds %zd characters and will be truncated",
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0525/1257] ocfs2: exit recovery thread on mount error path
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0524/1257] init: fix early boot crash with bare hostname parameter Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0526/1257] ocfs2: free replay slots in ocfs2_recovery_exit() Greg Kroah-Hartman
` (473 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Changwei Ge, Joel Becker, Jun Piao, Junxiao Bi,
Mark Fasheh, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 6163a859649e9432e9c79c541f36dbf3bba9172f ]
When a mount fails after the cluster connection has been established, e.g.
in ocfs2_mount_volume(), ocfs2_fill_super() unwinds via
out_debugfs/out_super and frees the osb without disabling recovery.
A node failure event can concurrently launch the recovery thread, which
blocks in __ocfs2_wait_on_mount() waiting for the volume state to become
VOLUME_MOUNTED or VOLUME_DISABLED. As the mount error path neither sets
VOLUME_DISABLED nor wakes osb_mount_event, the thread can never make
progress: the kthread leaks and stays blocked on the wait queue embedded
in the freed osb, which may then be accessed as freed memory.
Fix it by setting VOLUME_DISABLED and waking osb_mount_event on this path
so the thread bails out, and replace the plain kfree(osb->recovery_map)
with ocfs2_recovery_exit(), which waits for a running recovery thread to
exit before the recovery map is freed.
Link: https://lore.kernel.org/20260828112825.666097-1-joseph.qi@linux.alibaba.com
Fixes: f1e75d128b46 ("ocfs2: rewrite error handling of ocfs2_fill_super")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/super.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index acce465f45b02..736cc1fa8b23e 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1170,8 +1170,17 @@ static int ocfs2_fill_super(struct super_block *sb, struct fs_context *fc)
out_debugfs:
debugfs_remove_recursive(osb->osb_debug_root);
out_super:
+ /*
+ * A recovery thread launched by a node failure event may still be
+ * waiting for the volume to be mounted. Set VOLUME_DISABLED and
+ * wake it up, then wait for it to exit before osb is freed,
+ * otherwise the kthread would leak and stay blocked on the wait
+ * queue embedded in the freed osb.
+ */
+ atomic_set(&osb->vol_state, VOLUME_DISABLED);
+ wake_up(&osb->osb_mount_event);
ocfs2_release_system_inodes(osb);
- kfree(osb->recovery_map);
+ ocfs2_recovery_exit(osb);
ocfs2_delete_osb(osb);
kfree(osb);
out:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0526/1257] ocfs2: free replay slots in ocfs2_recovery_exit()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0525/1257] ocfs2: exit recovery thread on mount error path Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0527/1257] selftests/core: fix unshare_test with large fs.nr_open Greg Kroah-Hartman
` (472 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Changwei Ge, Joel Becker, Jun Piao, Junxiao Bi,
Mark Fasheh, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 1ddadc6d41c1a29fd8fad1891bdcd2956e08b7f0 ]
Commit ce2fcf1516d6 ("ocfs2: fix memory leak in ocfs2_mount_volume()")
added ocfs2_free_replay_slots() calls to the mount error paths
out_dismount and out_check_volume to fix a leak of osb->replay_map.
However these calls are unlocked while the bail path of the recovery
thread, which is woken up by out_dismount right before the call, also
frees the replay slots under osb->recovery_lock. Both sides can thus
observe a non-NULL osb->replay_map and trigger a double free.
Fix this by moving ocfs2_free_replay_slots() into ocfs2_recovery_exit()
after ocfs2_recovery_disable(), which waits for a running recovery thread
to exit under osb->recovery_lock, and drop the unlocked call sites. Both
ocfs2_dismount_volume() and the out_super path of ocfs2_fill_super() call
ocfs2_recovery_exit(), so the replay slots are freed on every path. Since
super.c no longer references it, make ocfs2_free_replay_slots() static
again.
Link: https://lore.kernel.org/20260828112825.666097-2-joseph.qi@linux.alibaba.com
Fixes: ce2fcf1516d6 ("ocfs2: fix memory leak in ocfs2_mount_volume()")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/journal.c | 3 ++-
fs/ocfs2/journal.h | 1 -
fs/ocfs2/super.c | 5 +----
3 files changed, 3 insertions(+), 6 deletions(-)
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index d8afbc1a76bb8..a3938a03e93bf 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -156,7 +156,7 @@ static void ocfs2_queue_replay_slots(struct ocfs2_super *osb,
replay_map->rm_state = REPLAY_DONE;
}
-void ocfs2_free_replay_slots(struct ocfs2_super *osb)
+static void ocfs2_free_replay_slots(struct ocfs2_super *osb)
{
struct ocfs2_replay_map *replay_map = osb->replay_map;
@@ -243,6 +243,7 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb)
/* XXX: Should we bug if there are dirty entries? */
kfree(rm);
+ ocfs2_free_replay_slots(osb);
}
static int __ocfs2_recovery_map_test(struct ocfs2_super *osb,
diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
index f8b3b2a3d6309..19fc920d26b1c 100644
--- a/fs/ocfs2/journal.h
+++ b/fs/ocfs2/journal.h
@@ -151,7 +151,6 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb);
void ocfs2_recovery_disable_quota(struct ocfs2_super *osb);
int ocfs2_compute_replay_slots(struct ocfs2_super *osb);
-void ocfs2_free_replay_slots(struct ocfs2_super *osb);
/*
* Journal Control:
* Initialize, Load, Shutdown, Wipe a journal.
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 736cc1fa8b23e..169c576f06bf5 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1163,7 +1163,6 @@ static int ocfs2_fill_super(struct super_block *sb, struct fs_context *fc)
out_dismount:
atomic_set(&osb->vol_state, VOLUME_DISABLED);
wake_up(&osb->osb_mount_event);
- ocfs2_free_replay_slots(osb);
ocfs2_dismount_volume(sb, 1);
goto out;
@@ -1777,14 +1776,12 @@ static int ocfs2_mount_volume(struct super_block *sb)
status = ocfs2_truncate_log_init(osb);
if (status < 0) {
mlog_errno(status);
- goto out_check_volume;
+ goto out_system_inodes;
}
ocfs2_super_unlock(osb, 1);
return 0;
-out_check_volume:
- ocfs2_free_replay_slots(osb);
out_system_inodes:
if (osb->local_alloc_state == OCFS2_LA_ENABLED)
ocfs2_shutdown_local_alloc(osb);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0527/1257] selftests/core: fix unshare_test with large fs.nr_open
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0526/1257] ocfs2: free replay slots in ocfs2_recovery_exit() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0528/1257] xor: add missing vzeroupper to AVX code Greg Kroah-Hartman
` (471 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Khorenko, Eva Kurchatova,
Andrew Morton, Shuah Khan, Wei Yang, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khorenko <khorenko@virtuozzo.com>
[ Upstream commit df0b7e0ea59c43708cff8c7e34da5e2f8d430e5e ]
The test assumes fs.nr_open is close to the default 1048576, but some
systems set it much higher (e.g. 1073741816). This is systemd's doing:
since systemd v240 (2018), PID 1 bumps fs.nr_open and fs.file-max to their
largest possible values on boot, as file descriptors are already accounted
for by memcg [1].
In that case, dup2() to nr_open + 64 requires the kernel to allocate a
file descriptor table with ~1 billion entries, which fails with ENOMEM.
On a kernel that already carries 04a2c4b4511d1, dup2() no longer fails
with ENOMEM. The allocation is now rejected up front and the caller
gets EMFILE instead, without the WARNING, but the test still fails.
Cap the nr_open value used for the test's own arithmetic to a known
reasonable base value (1048576) and restore the true original value once
the test has completed.
Link: https://lore.kernel.org/20260814165709.513263-1-khorenko@virtuozzo.com
Link: https://github.com/systemd/systemd/commit/a8b627aaed409a15260c25988970c795bf963812 [1]
Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/core/unshare_test.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/core/unshare_test.c b/tools/testing/selftests/core/unshare_test.c
index ffce75a6c228f..d40e963dd5205 100644
--- a/tools/testing/selftests/core/unshare_test.c
+++ b/tools/testing/selftests/core/unshare_test.c
@@ -40,6 +40,14 @@ TEST(unshare_EMFILE)
ASSERT_EQ(sscanf(buf, "%d", &nr_open), 1);
+ /*
+ * Cap nr_open for the duration of the test to avoid ENOMEM from a
+ * huge fd table allocation; buf/n keep the real original value so
+ * fs.nr_open can be restored to it once the test is done.
+ */
+ if (nr_open > 1024 * 1024)
+ nr_open = 1024 * 1024;
+
ASSERT_EQ(0, getrlimit(RLIMIT_NOFILE, &rlimit));
/* bump fs.nr_open */
@@ -73,10 +81,13 @@ TEST(unshare_EMFILE)
if (pid == 0) {
int err;
+ char buf3[32];
+ ssize_t n3;
- /* restore fs.nr_open */
+ /* restore fs.nr_open to the (possibly capped) test baseline */
+ n3 = sprintf(buf3, "%d\n", nr_open);
lseek(fd, 0, SEEK_SET);
- write(fd, buf, n);
+ write(fd, buf3, n3);
/* ... and now unshare(CLONE_FILES) must fail with EMFILE */
err = unshare(CLONE_FILES);
EXPECT_EQ(err, -1)
@@ -89,6 +100,10 @@ TEST(unshare_EMFILE)
EXPECT_EQ(waitpid(pid, &status, 0), pid);
EXPECT_EQ(true, WIFEXITED(status));
EXPECT_EQ(0, WEXITSTATUS(status));
+
+ /* restore the real fs.nr_open value */
+ lseek(fd, 0, SEEK_SET);
+ write(fd, buf, n);
}
TEST_HARNESS_MAIN
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0528/1257] xor: add missing vzeroupper to AVX code
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0527/1257] selftests/core: fix unshare_test with large fs.nr_open Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0529/1257] raid6: add missing vzeroupper to AVX2 code Greg Kroah-Hartman
` (470 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Biggers, Andrew Morton,
Christoph Hellwig, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
[ Upstream commit 7b8fc26c40d6cf4c6751a045c9e42bbb7e78d81b ]
Since the AVX optimized XOR code uses YMM registers, execute vzeroupper
before returning from it. This is needed to avoid degrading the
performance of any later SSE code that may happen to be executed.
Link: https://lore.kernel.org/20260831212248.213805-1-ebiggers@kernel.org
Fixes: ea4d26ae24e5 ("raid5: add AVX optimized RAID5 checksumming")
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/raid/xor/x86/xor-avx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/raid/xor/x86/xor-avx.c b/lib/raid/xor/x86/xor-avx.c
index f7777d7aa269b..95b21e7225e8d 100644
--- a/lib/raid/xor/x86/xor-avx.c
+++ b/lib/raid/xor/x86/xor-avx.c
@@ -147,6 +147,7 @@ static void xor_gen_avx(void *dest, void **srcs, unsigned int src_cnt,
{
kernel_fpu_begin();
xor_gen_avx_inner(dest, srcs, src_cnt, bytes);
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0529/1257] raid6: add missing vzeroupper to AVX2 code
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0528/1257] xor: add missing vzeroupper to AVX code Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0530/1257] raid6: add missing vzeroupper to AVX-512 code Greg Kroah-Hartman
` (469 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Biggers, Andrew Morton,
Christoph Hellwig, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
[ Upstream commit 24f1241cdb056fd630e6710a916e0f7c8c910a70 ]
Since the AVX2 optimized RAID6 code uses YMM registers, execute vzeroupper
before returning from it. This is needed to avoid degrading the
performance of any later SSE code that may happen to be executed.
Link: https://lore.kernel.org/20260831212308.213855-1-ebiggers@kernel.org
Fixes: 2c935842bdb4 ("lib/raid6: Add AVX2 optimized gen_syndrome functions")
Fixes: 7056741fd9fc ("lib/raid6: Add AVX2 optimized recovery functions")
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/raid/raid6/x86/avx2.c | 6 ++++++
lib/raid/raid6/x86/recov_avx2.c | 2 ++
2 files changed, 8 insertions(+)
diff --git a/lib/raid/raid6/x86/avx2.c b/lib/raid/raid6/x86/avx2.c
index 7d829c669ea79..3cc2fe7ac42c5 100644
--- a/lib/raid/raid6/x86/avx2.c
+++ b/lib/raid/raid6/x86/avx2.c
@@ -67,6 +67,7 @@ static void raid6_avx21_gen_syndrome(int disks, size_t bytes, void **ptrs)
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -115,6 +116,7 @@ static void raid6_avx21_xor_syndrome(int disks, int start, int stop,
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -175,6 +177,7 @@ static void raid6_avx22_gen_syndrome(int disks, size_t bytes, void **ptrs)
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -243,6 +246,7 @@ static void raid6_avx22_xor_syndrome(int disks, int start, int stop,
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -334,6 +338,7 @@ static void raid6_avx24_gen_syndrome(int disks, size_t bytes, void **ptrs)
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -444,6 +449,7 @@ static void raid6_avx24_xor_syndrome(int disks, int start, int stop,
asm volatile("vmovntdq %%ymm14,%0" : "=m" (q[d+96]));
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
diff --git a/lib/raid/raid6/x86/recov_avx2.c b/lib/raid/raid6/x86/recov_avx2.c
index a714a780a2d8f..820871046e305 100644
--- a/lib/raid/raid6/x86/recov_avx2.c
+++ b/lib/raid/raid6/x86/recov_avx2.c
@@ -176,6 +176,7 @@ static void raid6_2data_recov_avx2(int disks, size_t bytes, int faila,
#endif
}
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -293,6 +294,7 @@ static void raid6_datap_recov_avx2(int disks, size_t bytes, int faila,
#endif
}
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0530/1257] raid6: add missing vzeroupper to AVX-512 code
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0529/1257] raid6: add missing vzeroupper to AVX2 code Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0531/1257] fork: honor task_structs declared alignment Greg Kroah-Hartman
` (468 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Biggers, Andrew Morton,
Christoph Hellwig, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
[ Upstream commit b82cf9e49c1be7cf1fd8e1bd806b0cdd25ab8127 ]
Since the AVX-512 optimized RAID6 code uses ZMM registers, execute
vzeroupper before returning from it. This is needed to avoid degrading
the performance of any later SSE code that may happen to be executed.
Link: https://lore.kernel.org/20260831212316.213896-1-ebiggers@kernel.org
Fixes: e0a491c12968 ("lib/raid6: Add AVX512 optimized gen_syndrome functions")
Fixes: 13c520b2993c ("lib/raid6: Add AVX512 optimized recovery functions")
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/raid/raid6/x86/avx512.c | 6 ++++++
lib/raid/raid6/x86/recov_avx512.c | 2 ++
2 files changed, 8 insertions(+)
diff --git a/lib/raid/raid6/x86/avx512.c b/lib/raid/raid6/x86/avx512.c
index e671eb5bde63e..772bfc4af6dfd 100644
--- a/lib/raid/raid6/x86/avx512.c
+++ b/lib/raid/raid6/x86/avx512.c
@@ -78,6 +78,7 @@ static void raid6_avx5121_gen_syndrome(int disks, size_t bytes, void **ptrs)
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -137,6 +138,7 @@ static void raid6_avx5121_xor_syndrome(int disks, int start, int stop,
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -208,6 +210,7 @@ static void raid6_avx5122_gen_syndrome(int disks, size_t bytes, void **ptrs)
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -292,6 +295,7 @@ static void raid6_avx5122_xor_syndrome(int disks, int start, int stop,
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -396,6 +400,7 @@ static void raid6_avx5124_gen_syndrome(int disks, size_t bytes, void **ptrs)
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -529,6 +534,7 @@ static void raid6_avx5124_xor_syndrome(int disks, int start, int stop,
"m" (q[d+128]), "m" (q[d+192]));
}
asm volatile("sfence" : : : "memory");
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
const struct raid6_calls raid6_avx512x4 = {
diff --git a/lib/raid/raid6/x86/recov_avx512.c b/lib/raid/raid6/x86/recov_avx512.c
index ec72d5a30c01e..299a3f044d616 100644
--- a/lib/raid/raid6/x86/recov_avx512.c
+++ b/lib/raid/raid6/x86/recov_avx512.c
@@ -211,6 +211,7 @@ static void raid6_2data_recov_avx512(int disks, size_t bytes, int faila,
#endif
}
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
@@ -353,6 +354,7 @@ static void raid6_datap_recov_avx512(int disks, size_t bytes, int faila,
#endif
}
+ asm volatile("vzeroupper");
kernel_fpu_end();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0531/1257] fork: honor task_structs declared alignment
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0530/1257] raid6: add missing vzeroupper to AVX-512 code Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0532/1257] ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to system inodes Greg Kroah-Hartman
` (467 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Andrew Morton,
Bradley Morgan, Ingo Molnar, Kees Cook, Peter Zijlstra,
Vlastimil Babka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 9decb604dc064099a6249150f0c4909525ed657c ]
Since commit cb7ca40a3882 ("x86/fpu: Make task_struct::thread constant
size"), struct task_struct is declared __attribute__((aligned(64))) on all
architectures.
But fork_init() still sets the task_struct slab cache's alignment to
align = max(L1_CACHE_BYTES, ARCH_MIN_TASKALIGN)
which is smaller than 64 on architectures whose cache lines are below 64
bytes: e.g. 32 on ARMv5.
In practice plain SLUB happens to hand out 64-byte-aligned objects anyway.
With CONFIG_SLUB_DEBUG_ON the red-zone padding shifts objects to the
requested alignment.
With CONFIG_UBSAN_ALIGNMENT=y a boot on QEMU versatilepb (ARM926EJ-S,
v7.2-rc2, gcc 13.3) floods the console with reports like:
UBSAN: misaligned-access in include/linux/sched.h:2087:9
member access within misaligned address c295d7e0 for type 'struct task_struct'
which requires 64 byte alignment
CPU: 0 UID: 0 PID: 15 Comm: pr/ttyAMA-1 Not tainted 7.2.0-rc2 #1 VOLUNTARY
Set the slab alignment to at least the type's declared alignment.
Link: https://lore.kernel.org/20260710123957.31774-1-kmehltretter@gmail.com
Fixes: cb7ca40a3882 ("x86/fpu: Make task_struct::thread constant size")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Bradley Morgan <include@grrlz.net>
Assisted-by: Claude:claude-fable-5
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/fork.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index 26b666e98bb8a..8ad34646962d2 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -858,7 +858,8 @@ void __init fork_init(void)
#ifndef ARCH_MIN_TASKALIGN
#define ARCH_MIN_TASKALIGN 0
#endif
- int align = max_t(int, L1_CACHE_BYTES, ARCH_MIN_TASKALIGN);
+ int align = max3(L1_CACHE_BYTES, ARCH_MIN_TASKALIGN,
+ __alignof__(struct task_struct));
unsigned long useroffset, usersize;
/* create a slab on which task_structs can be allocated */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0532/1257] ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to system inodes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0531/1257] fork: honor task_structs declared alignment Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0533/1257] ocfs2: skip uninitialized lockres in ocfs2_mark_lockres_freeing() Greg Kroah-Hartman
` (466 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Changwei Ge, Heming Zhao, Joel Becker, Jun Piao, Junxiao Bi,
Mark Fasheh, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 25bf9e549360b656a6763232e0e9e58a00c3aff7 ]
Patch series "ocfs2: validate suballoc slot and bit of metadata blocks", v3.
The ocfs2 metadata validators trust the on-disk suballoc slot and bit
without checking them against the slot range of the mounted filesystem and
the capacity of the block group bitmap. A corrupted image can carry
OCFS2_INVALID_SLOT or another out-of-range slot, or a suballoc bit beyond
the bitmap, and once the corresponding inode, extent block, xattr block,
dir index root or refcount block gets freed, the bad value goes straight
into ocfs2_get_system_file_inode() or _ocfs2_free_suballoc_bits() and hits
a BUG_ON() or runs off the end of local_system_inodes[].
This series rejects such values at read time, in the existing validators,
so corrupted objects fail with -EROFS (and a read-only remount) instead of
crashing:
patch 1 restricts OCFS2_INVALID_SLOT dinodes to system inodes,
completing fe7a283b3916 ("ocfs2: add suballoc slot check in
ocfs2_validate_inode_block()"), and turns the "system file
state is ambiguous" BUG_ON() in ocfs2_read_locked_inode() into
an ocfs2_error();
patch 2 rejects oversized dinode suballoc bits;
patch 3 validates the suballoc slot and bit of xattr and dir index
blocks;
patch 4 validates the suballoc slot and bit of extent and refcount
blocks.
The checks only enforce what the kernel and mkfs.ocfs2 already write: a
valid slot from meta_ac->ac_alloc_slot and a bit within the block group
bitmap, with system inodes carrying OCFS2_INVALID_SLOT plus
OCFS2_SYSTEM_FL and extent blocks using slot 0. Nothing changes for
healthy filesystems.
Each new check was exercised under QEMU by corrupting the field in
question with an out-of-range value; with the series applied the access
fails with -EROFS and the filesystem remounts read-only instead of hitting
the BUG_ON().
This patch (of 4):
ocfs2_validate_inode_block() currently permits i_suballoc_slot to be
OCFS2_INVALID_SLOT for any dinode. Only system inodes created by
mkfs.ocfs2 are allocated from the global allocator and thus legitimately
carry this value; regular inodes are always allocated from a per-slot
suballocator and hence must have a valid slot.
If a corrupted regular inode with OCFS2_INVALID_SLOT is accepted,
ocfs2_remove_inode() will pass the slot to ocfs2_get_system_file_inode()
and get_local_system_inode() will hit BUG_ON(slot == OCFS2_INVALID_SLOT)
when the inode is deleted. This can be triggered by an unprivileged user
unlinking such a corrupted file.
Reject OCFS2_INVALID_SLOT for non-system dinodes during validation, while
still accepting it for system inodes. Note that a crafted dinode carrying
OCFS2_SYSTEM_FL passes the check above, yet a plain lookup of it still
used to BUG() in ocfs2_read_locked_inode() ("system file state is
ambiguous"). Since i_flags comes from disk, handle that mismatch with
ocfs2_error() instead of BUG_ON() as well.
Link: https://lore.kernel.org/20260901125221.1634686-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20260901125221.1634686-2-joseph.qi@linux.alibaba.com
Fixes: fe7a283b3916 ("ocfs2: add suballoc slot check in ocfs2_validate_inode_block()")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/inode.c | 37 ++++++++++++++++++++++++++++---------
1 file changed, 28 insertions(+), 9 deletions(-)
diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index 180107a11046c..9228d6ef23c24 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -638,14 +638,18 @@ static int ocfs2_read_locked_inode(struct inode *inode,
fe = (struct ocfs2_dinode *) bh->b_data;
/*
- * This is a code bug. Right now the caller needs to
- * understand whether it is asking for a system file inode or
- * not so the proper lock names can be built.
+ * The caller must know whether it is asking for a system file inode
+ * or not so the proper lock names can be built. Since i_flags comes
+ * from disk, a mismatch is filesystem corruption instead of a code
+ * bug, so handle it with ocfs2_error() rather than BUG_ON().
*/
- mlog_bug_on_msg(!!(fe->i_flags & cpu_to_le32(OCFS2_SYSTEM_FL)) !=
- !!(args->fi_flags & OCFS2_FI_FLAG_SYSFILE),
- "Inode %llu: system file state is ambiguous\n",
- (unsigned long long)args->fi_blkno);
+ if (!!(fe->i_flags & cpu_to_le32(OCFS2_SYSTEM_FL)) !=
+ !!(args->fi_flags & OCFS2_FI_FLAG_SYSFILE)) {
+ status = ocfs2_error(osb->sb,
+ "Inode %llu: system file state is ambiguous\n",
+ (unsigned long long)args->fi_blkno);
+ goto bail;
+ }
if (S_ISCHR(le16_to_cpu(fe->i_mode)) ||
S_ISBLK(le16_to_cpu(fe->i_mode)))
@@ -1520,8 +1524,23 @@ int ocfs2_validate_inode_block(struct super_block *sb,
goto bail;
}
- if (le16_to_cpu(di->i_suballoc_slot) != (u16)OCFS2_INVALID_SLOT &&
- (u32)le16_to_cpu(di->i_suballoc_slot) > OCFS2_SB(sb)->max_slots - 1) {
+ /*
+ * Only system inodes created by mkfs.ocfs2 are allocated from the
+ * global allocator and thus legitimately carry OCFS2_INVALID_SLOT.
+ * Regular inodes are always allocated from a per-slot suballocator.
+ * If a regular inode with OCFS2_INVALID_SLOT was accepted here,
+ * deleting it would pass the slot to get_local_system_inode() via
+ * ocfs2_remove_inode() and trigger BUG_ON(slot == OCFS2_INVALID_SLOT).
+ */
+ if (le16_to_cpu(di->i_suballoc_slot) == (u16)OCFS2_INVALID_SLOT) {
+ if (!(le32_to_cpu(di->i_flags) & OCFS2_SYSTEM_FL)) {
+ rc = ocfs2_error(sb,
+ "Invalid dinode %llu: suballoc slot %u for non-system inode\n",
+ (unsigned long long)bh->b_blocknr,
+ le16_to_cpu(di->i_suballoc_slot));
+ goto bail;
+ }
+ } else if ((u32)le16_to_cpu(di->i_suballoc_slot) > OCFS2_SB(sb)->max_slots - 1) {
rc = ocfs2_error(sb, "Invalid dinode %llu: suballoc slot %u\n",
(unsigned long long)bh->b_blocknr,
le16_to_cpu(di->i_suballoc_slot));
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0533/1257] ocfs2: skip uninitialized lockres in ocfs2_mark_lockres_freeing()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0532/1257] ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to system inodes Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0534/1257] KVM: arm64: timers: Compute an offset-applied CVAL from the current count Greg Kroah-Hartman
` (465 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton, ZW Tang,
Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao,
Heming Zhao, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 6a3ed6b290513859bd27d9fcb67739347d6315fa ]
A hard readonly mount skips ocfs2_dlm_init(), so the per-osb lock
resources are never initialized and osb->cconn stays NULL. Before commit
550842cc60987 ("ocfs2: fix freeing uninitialized resource on
ocfs2_dlm_shutdown") ocfs2_dismount_volume() only called
ocfs2_dlm_shutdown() when osb->cconn was set. It now calls it
unconditionally, so unmounting a hard readonly mount drops the osb locks
and takes the never initialized l_lock in ocfs2_mark_lockres_freeing().
With lockdep enabled this triggers:
INFO: trying to register non-static key. The code is fine but needs
lockdep annotation, or maybe you didn't initialize this object before use?
turning off the locking correctness validator.
ocfs2_drop_lock() and ocfs2_lock_res_free() already skip lock resources
without OCFS2_LOCK_INITIALIZED. Add the same check to
ocfs2_mark_lockres_freeing(), which is reachable before them through
ocfs2_simple_drop_lockres(), so an uninitialized lockres is never touched.
Link: https://lore.kernel.org/20260903104744.2164235-1-joseph.qi@linux.alibaba.com
Fixes: 550842cc6098 ("ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: ZW Tang <tangzw515@gmail.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/dlmglue.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 54e8f81119fb1..1a83241b6d41f 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -3527,6 +3527,10 @@ void ocfs2_mark_lockres_freeing(struct ocfs2_super *osb,
struct ocfs2_mask_waiter mw;
unsigned long flags, flags2;
+ /* We didn't get anywhere near actually using this lockres. */
+ if (!(lockres->l_flags & OCFS2_LOCK_INITIALIZED))
+ return;
+
ocfs2_init_mask_waiter(&mw);
spin_lock_irqsave(&lockres->l_lock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0534/1257] KVM: arm64: timers: Compute an offset-applied CVAL from the current count
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0533/1257] ocfs2: skip uninitialized lockres in ocfs2_mark_lockres_freeing() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0535/1257] wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff Greg Kroah-Hartman
` (464 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zenghui Yu, Fuad Tabba, Marc Zyngier,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fuad Tabba <fuad.tabba@linux.dev>
[ Upstream commit 49930b1b557ceb698e0ab7f985ea41c99dc8bf22 ]
When the hardware won't apply a timer's offset, KVM programs CVAL +
offset and lets it compare that against the raw counter. The compare is
unsigned (IsTimerConditionMet, DDI0487M_c J1.4.3.29):
condition_met = (UInt(PhysicalCountInt() - offset) -
UInt(compare_value)) >= 0;
so adding the offset to both sides holds only while both sums wrap or
neither does. A guest whose counter is ahead of the host's by more than
CVAL has an expired timer that never fires, and one behind it can have
a far-future timer fire at once.
On a CNTPOFF_EL2 host the first case livelocks: each entry reloads the
guest's CVAL, the timer fires, and the exit rewrites it as CVAL + offset
before the host can take the interrupt. Without CNTPOFF_EL2 the timer
hangs until the vCPU is next loaded, which is what Zenghui reported on
a Kunpeng920.
Program the value from the current count instead: CVAL + offset while
the deadline is ahead, 0 once the timer has expired for the guest, ~0
past the counter's wrap. KVM recomputes it at load, at exit and on a
trapped CVAL write, and an expired timer stays expired in between. The
value can't be inverted, so with an offset timer_save_state() keeps the
memory copy, and kvm_hyp_handle_timer() returns that copy for a guest
hypervisor's read of its physical CVAL rather than subtracting the
offset back out.
Fixes: c605ee245097 ("KVM: arm64: timers: Allow physical offset without CNTPOFF_EL2")
Fixes: 9404673293b0 ("KVM: arm64: timers: Correctly handle TGE flip with CNTPOFF_EL2")
Fixes: 0bc9a9e85fcf ("KVM: arm64: Work around x1e's CNTVOFF_EL2 bogosity")
Reported-by: Zenghui Yu <yuzenghui@huawei.com>
Closes: https://lore.kernel.org/r/460258be-0102-e922-c342-4e87cd94b9e5@huawei.com
Cc: stable@vger.kernel.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261007074343.324269-2-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/arch_timer.c | 27 ++++++++++++---------------
arch/arm64/kvm/hyp/vhe/switch.c | 11 ++++++-----
include/kvm/arm_arch_timer.h | 15 +++++++++++++++
3 files changed, 33 insertions(+), 20 deletions(-)
diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c
index 6ac3321f4c575..9278b5383c044 100644
--- a/arch/arm64/kvm/arch_timer.c
+++ b/arch/arm64/kvm/arch_timer.c
@@ -528,17 +528,11 @@ static void timer_save_state(struct arch_timer_context *ctx)
goto out;
switch (index) {
- u64 cval;
-
case TIMER_VTIMER:
case TIMER_HVTIMER:
timer_set_ctl(ctx, read_sysreg_el0(SYS_CNTV_CTL));
- cval = read_sysreg_el0(SYS_CNTV_CVAL);
-
- if (has_broken_cntvoff())
- cval -= timer_get_offset(ctx);
-
- timer_set_cval(ctx, cval);
+ if (!has_broken_cntvoff() || !timer_get_offset(ctx))
+ timer_set_cval(ctx, read_sysreg_el0(SYS_CNTV_CVAL));
/* Disable the timer */
write_sysreg_el0(0, SYS_CNTV_CTL);
@@ -564,11 +558,12 @@ static void timer_save_state(struct arch_timer_context *ctx)
case TIMER_PTIMER:
case TIMER_HPTIMER:
timer_set_ctl(ctx, read_sysreg_el0(SYS_CNTP_CTL));
- cval = read_sysreg_el0(SYS_CNTP_CVAL);
-
- cval -= timer_get_offset(ctx);
-
- timer_set_cval(ctx, cval);
+ /*
+ * With an offset, memory already holds the guest's CVAL (the
+ * trap handler or __deactivate_traps() wrote it).
+ */
+ if (!timer_get_offset(ctx))
+ timer_set_cval(ctx, read_sysreg_el0(SYS_CNTP_CVAL));
/* Disable the timer */
write_sysreg_el0(0, SYS_CNTP_CTL);
@@ -647,7 +642,8 @@ static void timer_restore_state(struct arch_timer_context *ctx)
offset = timer_get_offset(ctx);
if (has_broken_cntvoff()) {
set_cntvoff(0);
- cval += offset;
+ if (offset)
+ cval = timer_apply_offset(cval, offset, kvm_phys_timer_read());
} else {
set_cntvoff(offset);
}
@@ -660,7 +656,8 @@ static void timer_restore_state(struct arch_timer_context *ctx)
cval = timer_get_cval(ctx);
offset = timer_get_offset(ctx);
set_cntpoff(offset);
- cval += offset;
+ if (offset)
+ cval = timer_apply_offset(cval, offset, kvm_phys_timer_read());
write_sysreg_el0(cval, SYS_CNTP_CVAL);
isb();
write_sysreg_el0(timer_get_ctl(ctx), SYS_CNTP_CTL);
diff --git a/arch/arm64/kvm/hyp/vhe/switch.c b/arch/arm64/kvm/hyp/vhe/switch.c
index 7875911c05063..14aada311bac4 100644
--- a/arch/arm64/kvm/hyp/vhe/switch.c
+++ b/arch/arm64/kvm/hyp/vhe/switch.c
@@ -175,7 +175,8 @@ static void __deactivate_traps(struct kvm_vcpu *vcpu)
offset = read_sysreg_s(SYS_CNTPOFF_EL2);
if (map.direct_ptimer && offset) {
- write_sysreg_el0(val + offset, SYS_CNTP_CVAL);
+ val = timer_apply_offset(val, offset, arch_timer_read_cntpct_el0());
+ write_sysreg_el0(val, SYS_CNTP_CVAL);
isb();
}
}
@@ -296,10 +297,10 @@ static bool kvm_hyp_handle_timer(struct kvm_vcpu *vcpu, u64 *exit_code)
break;
case SYS_CNTP_CVAL_EL0:
if (vcpu_el2_e2h_is_set(vcpu)) {
- val = read_sysreg_el0(SYS_CNTP_CVAL);
-
- if (!has_cntpoff())
- val -= timer_get_offset(vcpu_hptimer(vcpu));
+ if (!has_cntpoff() && timer_get_offset(vcpu_hptimer(vcpu)))
+ val = __vcpu_sys_reg(vcpu, CNTHP_CVAL_EL2);
+ else
+ val = read_sysreg_el0(SYS_CNTP_CVAL);
} else {
val = __vcpu_sys_reg(vcpu, CNTP_CVAL_EL0);
}
diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h
index bc6f2fdd7ad33..80f96ea59f1ae 100644
--- a/include/kvm/arm_arch_timer.h
+++ b/include/kvm/arm_arch_timer.h
@@ -195,4 +195,19 @@ static inline void timer_set_offset(struct arch_timer_context *ctxt, u64 offset)
WRITE_ONCE(*ctxt->offset.vm_offset, offset);
}
+/*
+ * CVAL to program when the hardware won't apply the timer's offset, so that
+ * its compare against the raw counter matches the guest's at 'now'. An
+ * expired timer stays expired; one past the wrap never fires.
+ */
+static inline u64 timer_apply_offset(u64 cval, u64 offset, u64 now)
+{
+ u64 hw = cval + offset;
+
+ if (now - offset >= cval)
+ return 0;
+
+ return hw > now ? hw : U64_MAX;
+}
+
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0535/1257] wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0534/1257] KVM: arm64: timers: Compute an offset-applied CVAL from the current count Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0536/1257] wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs Greg Kroah-Hartman
` (463 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devin Wittmayer, Mark Anthony Agarro,
Felix Fietkau, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Anthony Agarro <markanthonyagarro@gmail.com>
[ Upstream commit fbd12e8dabc8a9d2e81f427906749b4cff85d641 ]
mt76x02_mac_process_tx_rate() extracts the rate index straight from
the hardware's raw TX-status word with no bounds check for the
HT/HT_GF/VHT cases, and mt76x02_mac_fill_tx_status() ignores its
return value. A stale or corrupt hardware index reaches mac80211's
minstrel_ht rate control, whose per-group rate array is a fixed 10
entries (MCS_GROUP_RATES), causing an out-of-bounds write.
Validate the index in mt76x02_mac_process_tx_rate() (HT: 0-31,
VHT: MCS nibble 0-9) and have mt76x02_mac_fill_tx_status() bail out
cleanly on failure instead of passing an invalid index through.
Fixes: 7c1f88812690 ("mt76: unify send_tx_status and related helpers")
Cc: stable@vger.kernel.org
Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Mark Anthony Agarro <markanthonyagarro@gmail.com>
Link: https://patch.msgid.link/20260826092755.480190-1-markanthonyagarro@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt76x02_mac.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
index 21f8b1e64101b..231685bb62d2a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -302,10 +302,14 @@ mt76x02_mac_process_tx_rate(struct ieee80211_tx_rate *txrate, u16 rate,
txrate->flags |= IEEE80211_TX_RC_GREEN_FIELD;
fallthrough;
case MT_PHY_TYPE_HT:
+ if (idx > 31)
+ return -EINVAL;
txrate->flags |= IEEE80211_TX_RC_MCS;
txrate->idx = idx;
break;
case MT_PHY_TYPE_VHT:
+ if ((idx & 0xf) > 9)
+ return -EINVAL;
txrate->flags |= IEEE80211_TX_RC_VHT_MCS;
txrate->idx = idx;
break;
@@ -493,18 +497,21 @@ mt76x02_mac_fill_tx_status(struct mt76x02_dev *dev, struct mt76x02_sta *msta,
first_rate = st->rate & ~MT_PKTID_RATE;
first_rate |= st->pktid & MT_PKTID_RATE;
- mt76x02_mac_process_tx_rate(&rate[0], first_rate,
- dev->mphy.chandef.chan->band);
+ if (mt76x02_mac_process_tx_rate(&rate[0], first_rate,
+ dev->mphy.chandef.chan->band))
+ return;
} else if (rate[0].idx < 0) {
if (!msta)
return;
- mt76x02_mac_process_tx_rate(&rate[0], msta->wcid.tx_info,
- dev->mphy.chandef.chan->band);
+ if (mt76x02_mac_process_tx_rate(&rate[0], msta->wcid.tx_info,
+ dev->mphy.chandef.chan->band))
+ return;
}
- mt76x02_mac_process_tx_rate(&last_rate, st->rate,
- dev->mphy.chandef.chan->band);
+ if (mt76x02_mac_process_tx_rate(&last_rate, st->rate,
+ dev->mphy.chandef.chan->band))
+ return;
for (i = 0; i < ARRAY_SIZE(info->status.rates); i++) {
retry--;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0536/1257] wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0535/1257] wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0537/1257] wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory Greg Kroah-Hartman
` (462 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Orly Orge, Inanix,
Mark Anthony Agarro, Devin Wittmayer, Felix Fietkau, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Anthony Agarro <markanthonyagarro@gmail.com>
[ Upstream commit f7517b3d8b7f1008e07edcb8bb692c6ca53ef23b ]
Tearing down a monitor interface oopses:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:mt76_connac_mcu_uni_add_bss+0x144/0x370 [mt76_connac_lib]
Call Trace:
mt7615_remove_interface+0x6a/0x200 [mt7615_common]
drv_remove_interface+0x60/0x140 [mac80211]
ieee80211_del_virtual_monitor+0x8f/0xc0 [mac80211]
ieee80211_do_open+0x550/0x7d0 [mac80211]
ieee80211_open+0xaa/0xb0 [mac80211]
__dev_open+0x11b/0x280
mt7615_remove_interface() tears down BSS and STA state for every vif type.
On MT7663 with offload firmware that reaches mt76_connac_mcu_uni_add_bss(),
which has no monitor case in its iftype switch. It takes WARN_ON(1), then
copies ETH_ALEN from vif->bss_conf.bssid, which is NULL for a monitor vif.
mt76_connac_mcu_bss_basic_tlv() in the same file handles this. It has an
NL80211_IFTYPE_MONITOR case and it copies phy->macaddr in place of the
bssid. The uni variant has neither.
There is nothing to tear down. mt7615_add_interface() only calls
mt7615_mcu_add_dev_info(). The BSS and STA state comes from beacon enable
in mt7615_bss_info_changed(), from mt7615_set_key() and from
mt7615_mac_sta_add(), so a monitor vif never has any.
Reported on mt7615e going from monitor back to managed, and on mt7663u on
an "ip link set down", both through ieee80211_del_virtual_monitor().
Fixes: d9852ab2f362 ("mt76: mt7615: keep mcu_add_bss_info enabled till interface removal")
Cc: stable@vger.kernel.org
Reported-by: Orly Orge <orlyorge2004@gmail.com>
Closes: https://lore.kernel.org/linux-wireless/CANj5C4mTOHs6riyWee=dFdkE5p=714J8xs-x3hq3ewQ+r6O_Nw@mail.gmail.com/
Reported-by: Inanix <contact@inanix.fr>
Closes: https://github.com/morrownr/mt76/issues/79
Tested-by: Inanix <contact@inanix.fr>
Signed-off-by: Mark Anthony Agarro <markanthonyagarro@gmail.com>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20260813152059.15747-1-lucid_duck@justthetip.ca
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7615/main.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
index 67f56e428d9a1..175e847f49efd 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
@@ -254,8 +254,10 @@ static void mt7615_remove_interface(struct ieee80211_hw *hw,
mt7615_mutex_acquire(dev);
- mt7615_mcu_add_bss_info(phy, vif, NULL, false);
- mt7615_mcu_sta_add(phy, vif, NULL, false);
+ if (vif->type != NL80211_IFTYPE_MONITOR) {
+ mt7615_mcu_add_bss_info(phy, vif, NULL, false);
+ mt7615_mcu_sta_add(phy, vif, NULL, false);
+ }
mt76_testmode_reset(phy->mt76, true);
if (vif == phy->monitor_vif)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0537/1257] wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0536/1257] wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0538/1257] wifi: mt76: fix memory leak in USB TX path Greg Kroah-Hartman
` (461 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devin Wittmayer, Eason Lai,
Felix Fietkau, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eason Lai <eason.lai@mediatek.com>
[ Upstream commit f5dd4833463ed45794027e33928539b3c532f82d ]
Using __skb_pad() instead of skb_pad() in mt76_skb_adjust_pad()
to prevent double-free, as the caller handles cleanup.
Free the MCU message skb in __mt76x02u_mcu_send_msg() as well, which
relied on skb_pad() to release it.
Fixes: 808f2767d421 ("wifi: mt76: mt792x: Fix memory leak in SDIO TX path")
Cc: stable@vger.kernel.org
Closes: https://github.com/morrownr/mt76/issues/83
Co-developed-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Eason Lai <eason.lai@mediatek.com>
Link: https://patch.msgid.link/20260914021920.32246-2-eason.lai@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c | 2 +-
drivers/net/wireless/mediatek/mt76/tx.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
index 968c73e06a5f9..6f931d483bd6d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
@@ -90,7 +90,7 @@ __mt76x02u_mcu_send_msg(struct mt76_dev *dev, struct sk_buff *skb,
MT_MCU_MSG_TYPE_CMD;
ret = mt76x02u_skb_dma_info(skb, CPU_TX_PORT, info);
if (ret)
- return ret;
+ goto out;
ret = mt76u_bulk_msg(dev, skb->data, skb->len, NULL, 500,
MT_EP_OUT_INBAND_CMD);
diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index 3c623df2e741a..156d283243d3c 100644
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -885,7 +885,7 @@ int mt76_skb_adjust_pad(struct sk_buff *skb, int pad)
}
}
- if (skb_pad(last, pad))
+ if (__skb_pad(last, pad, false))
return -ENOMEM;
__skb_put(last, pad);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0538/1257] wifi: mt76: fix memory leak in USB TX path
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0537/1257] wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0539/1257] wifi: mt76: mt7615: restore DBDC state after ext PHY failure Greg Kroah-Hartman
` (460 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devin Wittmayer, Eason Lai,
Hans Buchheim, Sergei Melnichenko, Felix Fietkau, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eason Lai <eason.lai@mediatek.com>
[ Upstream commit 82856da2d3b6a30011f4db6ea5f34c13484e0ef8 ]
When errors occur in mt76u_tx_queue_skb(), the skb is not properly
freed, leading to memory leaks. This happens when:
- The queue is full
- tx_prepare_skb() drops zero-length frames (such as WMM NULL frames)
to prevent hardware TX hangs
- Buffer setup fails
Fix by properly releasing the skb with ieee80211_tx_status_ext() when
the queue is full or tx_prepare_skb() fails, and using
mt76_tx_complete_skb() when mt76u_tx_setup_buffers() fails (since
tx_prepare_skb() has already succeeded and may have allocated resources
that need cleanup)
Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer")
Cc: stable@vger.kernel.org
Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Closes: https://github.com/morrownr/mt76/issues/83
Signed-off-by: Eason Lai <eason.lai@mediatek.com>
Tested-by: Hans Buchheim <hbuchheim@gmail.com>
Reported-by: Sergei Melnichenko <sergei.melnichenko@gmail.com>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20260914021920.32246-3-eason.lai@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/usb.c | 31 ++++++++++++++++++++----
1 file changed, 26 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index a9af3aa6b80a9..dfc12f6944a74 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -893,6 +893,9 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
enum mt76_txq_id qid, struct sk_buff *skb,
struct mt76_wcid *wcid, struct ieee80211_sta *sta)
{
+ struct ieee80211_tx_status status = {
+ .sta = sta,
+ };
struct mt76_tx_info tx_info = {
.skb = skb,
};
@@ -900,17 +903,27 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
u16 idx = q->head;
int err;
- if (q->queued == q->ndesc)
- return -ENOSPC;
+ if (q->queued == q->ndesc) {
+ err = -ENOSPC;
+ goto err_free_skb;
+ }
skb->prev = skb->next = NULL;
err = dev->drv->tx_prepare_skb(dev, NULL, qid, wcid, sta, &tx_info);
if (err < 0)
- return err;
+ goto err_free_skb;
err = mt76u_tx_setup_buffers(dev, tx_info.skb, q->entry[idx].urb);
- if (err < 0)
- return err;
+ if (err < 0) {
+ /*
+ * mt76_tx_status_skb_get() walks the idr and dereferences
+ * a freed skb. This SKB is not counted in non-AQL counter
+ * due to error return, so using 0xffff as wcid to keep
+ * balanced.
+ */
+ mt76_tx_complete_skb(dev, 0xffff, tx_info.skb);
+ goto err_ret;
+ }
mt76u_fill_bulk_urb(dev, USB_DIR_OUT, q->ep, q->entry[idx].urb,
mt76u_complete_tx, &q->entry[idx]);
@@ -921,6 +934,14 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
q->queued++;
return idx;
+
+err_free_skb:
+ status.skb = tx_info.skb;
+ spin_lock_bh(&dev->rx_lock);
+ ieee80211_tx_status_ext(dev->hw, &status);
+ spin_unlock_bh(&dev->rx_lock);
+err_ret:
+ return err;
}
static void mt76u_tx_kick(struct mt76_dev *dev, struct mt76_queue *q)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0539/1257] wifi: mt76: mt7615: restore DBDC state after ext PHY failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0538/1257] wifi: mt76: fix memory leak in USB TX path Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0540/1257] wifi: mt76: take rcu_read_lock in the USB/SDIO tx completion path Greg Kroah-Hartman
` (459 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Felix Fietkau, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 7907d5270dc5c13b6a95754c08a77d5b06bbc786 ]
mt7615_register_ext_phy() limits the primary PHY to DBDC capabilities
before allocating and registering the secondary PHY. If allocation,
EEPROM override, or PHY registration fails, it returns without restoring
the primary PHY capabilities. The EEPROM override failure also leaks the
newly allocated ieee80211_hw.
Route all failures through common labels that free the secondary hardware
when it was allocated and restore the primary PHY capabilities.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 0f2173f093b3 ("mt76: mt7615: add support for registering a second wiphy via debugfs")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260910215441.76683-1-mhun512@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7615/init.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
index e437e088b2e91..665b0f1e939f1 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
@@ -541,8 +541,10 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
mt7615_cap_dbdc_enable(dev);
mphy = mt76_alloc_phy(&dev->mt76, sizeof(*phy), &mt7615_ops, MT_BAND1);
- if (!mphy)
- return -ENOMEM;
+ if (!mphy) {
+ ret = -ENOMEM;
+ goto error;
+ }
phy = mphy->priv;
phy->dev = dev;
@@ -572,7 +574,7 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
ret = mt76_eeprom_override(mphy);
if (ret)
- return ret;
+ goto error_free_hw;
/* second phy can only handle 5 GHz */
mphy->cap.has_5ghz = true;
@@ -590,7 +592,14 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
ret = mt76_register_phy(mphy, true, mt76_rates,
ARRAY_SIZE(mt76_rates));
if (ret)
- ieee80211_free_hw(mphy->hw);
+ goto error_free_hw;
+
+ return 0;
+
+error_free_hw:
+ ieee80211_free_hw(mphy->hw);
+error:
+ mt7615_cap_dbdc_disable(dev);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0540/1257] wifi: mt76: take rcu_read_lock in the USB/SDIO tx completion path
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0539/1257] wifi: mt76: mt7615: restore DBDC state after ext PHY failure Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0541/1257] wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path Greg Kroah-Hartman
` (458 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devin Wittmayer, Felix Fietkau,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devin Wittmayer <lucid_duck@justthetip.ca>
[ Upstream commit a7871a7ae5a8625f0ba0a89454ac734c383dd538 ]
The USB and SDIO completion path reads a station pointer that RCU
protects, without holding the read lock. Lockdep catches it on the
first association:
mt76.h:1305 suspicious rcu_dereference_check() usage!
no locks held by mt76-usb-status/1254.
mt7925_usb_sdio_tx_complete_skb+0x119/0x130 [mt7925_common]
mt76_queue_tx_complete+0x27/0x60 [mt76]
mt76u_status_worker+0xed/0x1e0 [mt76_usb]
mt7925/mac.c:856 suspicious rcu_dereference_check() usage!
mt7925_tx_check_aggr.part.0+0xc2/0xe0 [mt7925_common]
mt7925_usb_sdio_tx_complete_skb+0xa0/0x130 [mt7925_common]
mt7921 does the same, and warns once instead of twice because its
aggregation check reads the default link directly. The DMA path makes
the same reads but completes from softirq, so it stays quiet.
Take the read lock around the lookup and the check.
Tested on 7.2-rc5 with lockdep, fresh module load per arm, 4000
packets each and no change to the link:
splats before after
MT7925 Netgear A9000 2 0
MT7921 Alfa 1 0
mt7921e same kernel 0 0
Fixes: dc66a129adf1 ("wifi: mt76: add a wrapper for wcid access with validation")
Fixes: c22769de2509 ("wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete")
Cc: stable@vger.kernel.org
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20261003233056.94497-1-lucid_duck@justthetip.ca
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 3 +++
drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 3 +++
2 files changed, 6 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
index e69978184f68c..ad1352ddf1fcc 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
@@ -831,11 +831,14 @@ void mt7921_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,
u16 idx;
idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
+
+ rcu_read_lock();
wcid = __mt76_wcid_ptr(mdev, idx);
sta = wcid_to_sta(wcid);
if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))
mt76_connac2_tx_check_aggr(sta, txwi);
+ rcu_read_unlock();
skb_pull(e->skb, headroom);
mt76_tx_complete_skb(mdev, e->wcid, e->skb);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
index 3b82c9de26c5b..2e34e950e111d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
@@ -1688,11 +1688,14 @@ void mt7925_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,
u16 idx;
idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
+
+ rcu_read_lock();
wcid = __mt76_wcid_ptr(mdev, idx);
sta = wcid_to_sta(wcid);
if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))
mt7925_tx_check_aggr(sta, e->skb, wcid);
+ rcu_read_unlock();
skb_pull(e->skb, headroom);
mt76_tx_complete_skb(mdev, e->wcid, e->skb);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0541/1257] wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0540/1257] wifi: mt76: take rcu_read_lock in the USB/SDIO tx completion path Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0542/1257] wifi: mt76: move the channel survey when the channel changes Greg Kroah-Hartman
` (457 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devin Wittmayer, Felix Fietkau,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devin Wittmayer <lucid_duck@justthetip.ca>
[ Upstream commit 9f299215d1d835aeeee8b269dad09e1be06f856e ]
Every other teardown path cancels this work, PCIe unbind included. USB
unbind does not: PCIe has its own unregister hook for it, while USB
shares a generic one and the stop callback that would have covered it is
replaced in probe.
That cancel came in commit 81faf578320d ("wifi: mt76: mt7925: cancel
mlo_pm_work on stop"), whose last line says it covers both buses. That's
mine and it's a boo-boo.
Give the USB path its own stop that cancels the work first.
Two-link MLO on a Netgear A9000, work armed then the interface down:
stock patched
stop ran 3/3 3/3
work still ran 3/3 0/3
Skipping the stop entirely leaves both builds running it, so the zero is
the cancel.
Fixes: 276a56883257 ("wifi: mt76: mt7925: update the power-saving flow")
Cc: stable@vger.kernel.org
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20261003234944.96066-1-lucid_duck@justthetip.ca
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
index 1757023ea70d5..db6fd014447bd 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
@@ -147,6 +147,15 @@ static int mt7925u_mac_reset(struct mt792x_dev *dev)
return err;
}
+static void mt7925u_stop(struct ieee80211_hw *hw, bool suspend)
+{
+ struct mt792x_dev *dev = mt792x_hw_dev(hw);
+
+ cancel_delayed_work_sync(&dev->mlo_pm_work);
+
+ mt792xu_stop(hw, suspend);
+}
+
static int mt7925u_probe(struct usb_interface *usb_intf,
const struct usb_device_id *id)
{
@@ -193,7 +202,7 @@ static int mt7925u_probe(struct usb_interface *usb_intf,
if (!ops)
return -ENOMEM;
- ops->stop = mt792xu_stop;
+ ops->stop = mt7925u_stop;
mdev = mt76_alloc_device(&usb_intf->dev, sizeof(*dev), ops, &drv_ops);
if (!mdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0542/1257] wifi: mt76: move the channel survey when the channel changes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0541/1257] wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0543/1257] wifi: mt76: mt7615: cancel reset work during unregister Greg Kroah-Hartman
` (456 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris, Devin Wittmayer,
Felix Fietkau, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devin Wittmayer <lucid_duck@justthetip.ca>
[ Upstream commit 68342a7bd7e5e273e2969e3c0f4c62ee3d006ce8 ]
mt7921 and mt7925 report every survey counter against one channel and
never mark the one in use. With firmware channel management, both use
channel contexts and never call __mt76_set_channel(), so
phy->chan_state, phy->chandef and phy->main_chandef keep the first
channel of the band.
Update them when a context is assigned or changed, after booking the
time spent on the old channel. This also makes the legacy rate lookup
in mt76_connac2_mac_fill_txs() and mt7925_mac_add_txs_skb() use the
band of the current channel.
With two channel contexts (multi-channel or MLO), the survey follows
the context that was assigned or changed last, since the driver reads
the band 0 counters only.
Tested on MT7922 over PCIe, MT7921AU and MT7925 over USB.
Fixes: 41ac53c899bd ("wifi: mt76: mt7921: introduce chanctx support")
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Cc: stable@vger.kernel.org
Reported-by: Chris <hoopyfrood42@gmail.com>
Closes: https://lore.kernel.org/linux-wireless/CAHaeJsT8O8Nhq351hFp3NAL8e0iU85N-LBdYZ9nYHFHVy7t_hQ@mail.gmail.com/
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20261001003501.2425492-1-lucid_duck@justthetip.ca
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mac80211.c | 14 ++++++++++++++
drivers/net/wireless/mediatek/mt76/mt76.h | 2 ++
drivers/net/wireless/mediatek/mt76/mt7921/main.c | 1 +
drivers/net/wireless/mediatek/mt76/mt7925/main.c | 2 ++
drivers/net/wireless/mediatek/mt76/mt792x_core.c | 1 +
5 files changed, 20 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index abbe65cbcd89e..3467eb6cea0b5 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -1045,6 +1045,20 @@ void mt76_update_survey(struct mt76_phy *phy)
}
EXPORT_SYMBOL_GPL(mt76_update_survey);
+void mt76_phy_chandef_set(struct mt76_phy *phy,
+ struct cfg80211_chan_def *chandef)
+{
+ if (!chandef->chan)
+ return;
+
+ mt76_update_survey(phy);
+
+ phy->chandef = *chandef;
+ phy->main_chandef = *chandef;
+ phy->chan_state = mt76_channel_state(phy, chandef->chan);
+}
+EXPORT_SYMBOL_GPL(mt76_phy_chandef_set);
+
int __mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,
bool offchannel)
{
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 2ade848fe3bbb..e9bbec1269fac 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -1555,6 +1555,8 @@ void mt76_sta_ps_transition(struct mt76_dev *dev, struct mt76_wcid *wcid,
bool mt76_has_tx_pending(struct mt76_phy *phy);
int mt76_update_channel(struct mt76_phy *phy);
void mt76_update_survey(struct mt76_phy *phy);
+void mt76_phy_chandef_set(struct mt76_phy *phy,
+ struct cfg80211_chan_def *chandef);
void mt76_update_survey_active_time(struct mt76_phy *phy, ktime_t time);
int mt76_get_survey(struct ieee80211_hw *hw, int idx,
struct survey_info *survey);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
index 68a059504e838..3577c4cebb2e0 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
@@ -1423,6 +1423,7 @@ mt7921_change_chanctx(struct ieee80211_hw *hw,
} else {
mt76_connac_mcu_uni_set_chctx(mvif->phy->mt76, &mvif->bss_conf.mt76, ctx);
}
+ mt76_phy_chandef_set(mvif->phy->mt76, &ctx->def);
mt792x_mutex_release(phy->dev);
}
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
index 549f9c06b3636..e3e9e0be558e2 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -2063,6 +2063,7 @@ mt7925_change_chanctx(struct ieee80211_hw *hw,
link_conf, ctx);
}
}
+ mt76_phy_chandef_set(mvif->phy->mt76, &ctx->def);
mt792x_mutex_release(phy->dev);
}
@@ -2411,6 +2412,7 @@ static int mt7925_assign_vif_chanctx(struct ieee80211_hw *hw,
mconf->mt76.ctx = ctx;
mctx->bss_conf = mconf;
+ mt76_phy_chandef_set(mvif->phy->mt76, &ctx->def);
mutex_unlock(&dev->mt76.mutex);
return 0;
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_core.c b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
index 0ad33f74c2285..f56f03bfe3874 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_core.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
@@ -472,6 +472,7 @@ int mt792x_assign_vif_chanctx(struct ieee80211_hw *hw,
mutex_lock(&dev->mt76.mutex);
mvif->bss_conf.mt76.ctx = ctx;
mctx->bss_conf = &mvif->bss_conf;
+ mt76_phy_chandef_set(&dev->mphy, &ctx->def);
mutex_unlock(&dev->mt76.mutex);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0543/1257] wifi: mt76: mt7615: cancel reset work during unregister
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0542/1257] wifi: mt76: move the channel survey when the channel changes Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0544/1257] wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits() Greg Kroah-Hartman
` (455 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Felix Fietkau,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 5b779c63fb1e20e6729d3241b78be7502759296d ]
The MCU error interrupt handler queues reset_work on the device workqueue.
Device removal can reach mt76_unregister_device() while that work is still
pending, since the workqueue is not destroyed until mt76_free_device().
If reset_work runs in this window, it operates on an unregistered hw and
can requeue mac_work after ieee80211_unregister_hw() has torn the device
down. Cancel it before unregistering the device so it cannot outlive the
registered hw.
Fixes: 61c4fa721968 ("mt76: mt7615: implement hardware reset support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Link: https://patch.msgid.link/20260927101041.957362-1-yaojiale02@163.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
index a9178e077fd6d..7d8580720cd88 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
@@ -116,6 +116,7 @@ void mt7615_unregister_device(struct mt7615_dev *dev)
mcu_running = mt7615_wait_for_mcu_init(dev);
mt7615_unregister_ext_phy(dev);
+ cancel_work_sync(&dev->reset_work);
mt76_unregister_device(&dev->mt76);
if (mcu_running)
mt7615_mcu_exit(dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0544/1257] wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0543/1257] wifi: mt76: mt7615: cancel reset work during unregister Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0545/1257] wifi: mt76: mt792x: fix negative errno truncation in offload capability Greg Kroah-Hartman
` (454 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Felix Fietkau,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 8d604c899f7bd1a76a2eb21c0b706c02878abd36 ]
mt76_find_power_limits_node() and mt76_find_channel_node() return nodes
with the reference held, but mt76_get_rate_power_limits() overwrites the
"txpower-<band>" node reference and never releases the channel node
reference, leaking both.
Drop the intermediate and the channel node reference on every exit path,
and take a reference on the fallback node returned by
mt76_find_power_limits_node() so the caller's of_node_put() is balanced.
Fixes: 22b980badc0f ("mt76: add functions for parsing rate power limits from DT")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917121944.2150737-1-vulab@iscas.ac.cn
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/eeprom.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c
index afdb73661866e..93552f6f7f340 100644
--- a/drivers/net/wireless/mediatek/mt76/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/eeprom.c
@@ -231,12 +231,14 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
struct property *regd = of_find_property(cur, "regdomain", NULL);
if (!country && !regd) {
- fallback = cur;
+ of_node_put(fallback);
+ fallback = of_node_get(cur);
continue;
}
if (mt76_string_prop_find(country, dev->alpha2) ||
mt76_string_prop_find(regd, region_name)) {
+ of_node_put(fallback);
of_node_put(np);
return cur;
}
@@ -429,7 +431,7 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
s8 target_power)
{
struct mt76_dev *dev = phy->dev;
- struct device_node *np;
+ struct device_node *np, *band_np;
const s8 *val;
char name[16];
char band;
@@ -459,15 +461,18 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
band = '6';
break;
default:
+ of_node_put(np);
return target_power;
}
snprintf(name, sizeof(name), "txpower-%cg", band);
- np = of_get_child_by_name(np, name);
- if (!np)
+ band_np = of_get_child_by_name(np, name);
+ of_node_put(np);
+ if (!band_np)
return target_power;
- np = mt76_find_channel_node(np, chan);
+ np = mt76_find_channel_node(band_np, chan);
+ of_node_put(band_np);
if (!np)
return target_power;
@@ -514,6 +519,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
ARRAY_SIZE(dest->path.ru_bf), val, len, target_power,
txs_delta, &max_power, n_chains, MT76_SKU_BACKOFF);
+ of_node_put(np);
+
return max_power;
}
EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0545/1257] wifi: mt76: mt792x: fix negative errno truncation in offload capability
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0544/1257] wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0546/1257] wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2() Greg Kroah-Hartman
` (453 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yi Cong, Felix Fietkau, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Cong <yicong@kylinos.cn>
[ Upstream commit d0115096429ca090a592770c7645f9553a839954 ]
Returning a negative errno as u8 turned -ENOENT into 0xfe, wrongly
enabling CNM and NAN caps. Return int and default to no caps on error.
Fixes: e8a264ccd2de ("wifi: mt76: mt7921: move init shared code in mt792x-lib module")
Cc: stable@vger.kernel.org
Signed-off-by: Yi Cong <yicong@kylinos.cn>
Link: https://patch.msgid.link/20260824021429.43761-1-cong.yi@linux.dev
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt792x_core.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_core.c b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
index f56f03bfe3874..3ce6c6ceac81c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_core.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
@@ -858,7 +858,7 @@ int mt792x_init_wiphy(struct ieee80211_hw *hw)
}
EXPORT_SYMBOL_GPL(mt792x_init_wiphy);
-static u8
+static int
mt792x_get_offload_capability(struct device *dev, const char *fw_wm)
{
const struct mt76_connac2_fw_trailer *hdr;
@@ -927,13 +927,20 @@ mt792x_get_mac80211_ops(struct device *dev,
void *drv_data, u8 *fw_features)
{
struct ieee80211_ops *ops;
+ int ret;
ops = devm_kmemdup(dev, mac80211_ops, sizeof(struct ieee80211_ops),
GFP_KERNEL);
if (!ops)
return NULL;
- *fw_features = mt792x_get_offload_capability(dev, drv_data);
+ ret = mt792x_get_offload_capability(dev, drv_data);
+ if (ret < 0) {
+ dev_warn(dev, "failed to read firmware offload caps: %d\n", ret);
+ *fw_features = 0;
+ } else {
+ *fw_features = ret;
+ }
if (mt792x_needs_cnm_runtime(drv_data))
*fw_features |= MT792x_FW_CAP_CNM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0546/1257] wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0545/1257] wifi: mt76: mt792x: fix negative errno truncation in offload capability Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0547/1257] clocksource/drivers/fttmr010: Fix clk reference leak in error paths Greg Kroah-Hartman
` (452 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Linlin Yang, Felix Fietkau,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linlin Yang <yanglinlin@kylinos.cn>
[ Upstream commit d92bac6b6af2602516ee82ae112709c71af27cf6 ]
pci_get_device() increments the reference count on the returned
struct pci_dev. In mt7996_pci_init_hif2(), three pci_get_device()
calls are made but their return values are only checked for NULL
and then discarded. pci_dev_put() is never called, causing a PCI
device reference count leak.
Fix this by storing the return value and calling pci_dev_put()
before returning, following the same pattern already used in the
sibling driver mt7915/pci.c.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Signed-off-by: Linlin Yang <yanglinlin@kylinos.cn>
Link: https://patch.msgid.link/20260824092937.683240-1-yanglinlin@kylinos.cn
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
index b7d9193e042f4..a7c23b33dde0b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
@@ -63,12 +63,18 @@ static void mt7996_put_hif2(struct mt7996_hif *hif)
static struct mt7996_hif *mt7996_pci_init_hif2(struct pci_dev *pdev)
{
+ struct pci_dev *tmp_pdev;
+
hif_idx++;
- if (!pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID_2, NULL) &&
- !pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID_2, NULL) &&
- !pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID_2, NULL))
+ tmp_pdev = pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID_2, NULL);
+ if (!tmp_pdev)
+ tmp_pdev = pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID_2, NULL);
+ if (!tmp_pdev)
+ tmp_pdev = pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID_2, NULL);
+ if (!tmp_pdev)
return NULL;
+ pci_dev_put(tmp_pdev);
writel(hif_idx | MT_PCIE_RECOG_ID_SEM,
pcim_iomap_table(pdev)[0] + MT_PCIE_RECOG_ID);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0547/1257] clocksource/drivers/fttmr010: Fix clk reference leak in error paths
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0546/1257] wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0548/1257] clocksource/drivers/digicolor: Fix clk reference leak on request_irq failure Greg Kroah-Hartman
` (451 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Daniel Lezcano,
Linus Walleij, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 277e5657237a92e279ee28da2f5c07902cc6aa0b ]
fttmr010_common_init() obtains the PCLK reference with
of_clk_get_by_name() but never calls clk_put(). If clk_prepare_enable()
fails the reference is leaked directly, and every error path that jumps
to out_disable_clock only calls clk_disable_unprepare(), which releases
the prepare/enable state but not the reference obtained from
of_clk_get_by_name().
Add clk_put() to the clk_prepare_enable() failure path and to the
out_disable_clock label so the clock reference is no longer leaked. The
success path keeps PCLK enabled for the lifetime of the timer and is
left untouched.
Fixes: dd98442e17a6 ("clocksource/drivers/fttmr010: Drop Gemini specifics")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260915045426.1726805-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-fttmr010.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/clocksource/timer-fttmr010.c b/drivers/clocksource/timer-fttmr010.c
index 308f94bfbaed2..c2553851e8d6f 100644
--- a/drivers/clocksource/timer-fttmr010.c
+++ b/drivers/clocksource/timer-fttmr010.c
@@ -292,6 +292,7 @@ static int __init fttmr010_common_init(struct device_node *np,
ret = clk_prepare_enable(clk);
if (ret) {
pr_err("failed to enable PCLK\n");
+ clk_put(clk);
return ret;
}
@@ -432,6 +433,7 @@ static int __init fttmr010_common_init(struct device_node *np,
kfree(fttmr010);
out_disable_clock:
clk_disable_unprepare(clk);
+ clk_put(clk);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0548/1257] clocksource/drivers/digicolor: Fix clk reference leak on request_irq failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0547/1257] clocksource/drivers/fttmr010: Fix clk reference leak in error paths Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0549/1257] spi: stm32: fix double free of SRAM buffer on MDMA fallback Greg Kroah-Hartman
` (450 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Daniel Lezcano,
Baruch Siach, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 9cc2e18b32f12d26ae6729c62a03640423956b17 ]
digicolor_timer_init() obtains the timer clock with of_clk_get() and
enables it, but the request_irq() failure path returns without releasing
the clock reference, leaking both the enable/prepare state and the
reference itself.
Disable and put the clock before returning on the request_irq() failure
path. The success path keeps the clock enabled for the lifetime of the
timer and is left untouched.
Fixes: 9b8bb7736b78 ("clocksource: Driver for Conexant Digicolor SoC timer")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Acked-by: Baruch Siach <baruch@tkos.co.il>
Link: https://patch.msgid.link/20260915045242.1726702-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-digicolor.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/clocksource/timer-digicolor.c b/drivers/clocksource/timer-digicolor.c
index 559aa96089c34..46e0c329957a2 100644
--- a/drivers/clocksource/timer-digicolor.c
+++ b/drivers/clocksource/timer-digicolor.c
@@ -190,6 +190,8 @@ static int __init digicolor_timer_init(struct device_node *node)
&dc_timer_dev.ce);
if (ret) {
pr_warn("request of timer irq %d failed (%d)\n", irq, ret);
+ clk_disable_unprepare(clk);
+ clk_put(clk);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0549/1257] spi: stm32: fix double free of SRAM buffer on MDMA fallback
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0548/1257] clocksource/drivers/digicolor: Fix clk reference leak on request_irq failure Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0550/1257] aoe: pull in the headers each received packet type reads Greg Kroah-Hartman
` (449 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pin-Hao Chen, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pin-Hao Chen <billy920225@gmail.com>
[ Upstream commit 0c5b0c3eb1d6daa1117dacd32589196f52109cab ]
When the "rxm2m" MDMA channel cannot be obtained, the driver frees the
SRAM buffer and falls back to DMA-only mode. However, sram_rx_buf is
left pointing to the freed buffer.
As a result, stm32_spi_unprepare_msg() may clear the released SRAM
area, while stm32_spi_remove() or a later probe error path may free the
buffer again, triggering BUG_ON() in gen_pool_free_owner().
The probe error path also checks sram_pool instead of sram_rx_buf. If
the SRAM allocation failed and a later probe step fails,
gen_pool_free() may therefore be called with an unallocated buffer.
Clear sram_rx_buf after freeing it on the MDMA fallback path and use
the buffer pointer to determine whether cleanup is needed.
Fixes: d17dd2f1d8a1 ("spi: stm32: use STM32 DMA with STM32 MDMA to enhance DDR use")
Cc: stable@vger.kernel.org
Signed-off-by: Pin-Hao Chen <billy920225@gmail.com>
Link: https://patch.msgid.link/20261005220528.7199-1-billy920225@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-stm32.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index be88e62075af6..605b847d87738 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -2511,6 +2511,7 @@ static int stm32_spi_probe(struct platform_device *pdev)
gen_pool_free(spi->sram_pool,
(unsigned long)spi->sram_rx_buf,
spi->sram_rx_buf_size);
+ spi->sram_rx_buf = NULL;
dev_warn(&pdev->dev,
"failed to request rx mdma channel, DMA only\n");
}
@@ -2548,7 +2549,7 @@ static int stm32_spi_probe(struct platform_device *pdev)
if (spi->mdma_rx)
dma_release_channel(spi->mdma_rx);
err_pool_free:
- if (spi->sram_pool)
+ if (spi->sram_rx_buf)
gen_pool_free(spi->sram_pool, (unsigned long)spi->sram_rx_buf,
spi->sram_rx_buf_size);
if (spi->dma_rx)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0550/1257] aoe: pull in the headers each received packet type reads
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0549/1257] spi: stm32: fix double free of SRAM buffer on MDMA fallback Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0551/1257] PCI/sysfs: Pass the device name length in UTF-16 code units Greg Kroah-Hartman
` (448 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit e1274a6bc40a4618f6fbaebbdc51cca865d51bed ]
aoenet_rcv() only pulls the AoE and ATA headers into the skb head when
the packet is long enough to hold both. A shorter packet goes through
unpulled, and aoenet_rcv() reads the AoE header from it anyway. CFG
responses go on to aoecmd_cfg_rsp(), which reads the config header
after it, and ATA responses get queued for ktiocomplete(), which
skb_pull()s both headers. Ethernet pads frames to 60 bytes, so this
mostly takes a virtual link, but nothing stops a short frame from
getting here.
Pull the AoE header up front and drop the packet if it isn't there,
then pull the ATA or config header in the switch arm that hands the
packet on, so each path gets the headers it reads. This also replaces
the open-coded __pskb_pull_tail() with pskb_may_pull().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261007-b4-aoe-short-packets-v1-1-db5155f7bb9c@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/aoe/aoenet.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
index 66e617664c143..cd7c735bb43b7 100644
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -131,9 +131,7 @@ static int
aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt, struct net_device *orig_dev)
{
struct aoe_hdr *h;
- struct aoe_atahdr *ah;
u32 n;
- int sn;
if (dev_net(ifp) != &init_net)
goto exit;
@@ -144,12 +142,8 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
if (!is_aoe_netif(ifp))
goto exit;
skb_push(skb, ETH_HLEN); /* (1) */
- sn = sizeof(*h) + sizeof(*ah);
- if (skb->len >= sn) {
- sn -= skb_headlen(skb);
- if (sn > 0 && !__pskb_pull_tail(skb, sn))
- goto exit;
- }
+ if (!pskb_may_pull(skb, sizeof(*h)))
+ goto exit;
h = (struct aoe_hdr *) skb->data;
n = get_unaligned_be32(&h->tag);
if ((h->verfl & AOEFL_RSP) == 0 || (n & 1<<31))
@@ -171,10 +165,14 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
switch (h->cmd) {
case AOECMD_ATA:
+ if (!pskb_may_pull(skb, sizeof(*h) + sizeof(struct aoe_atahdr)))
+ goto exit;
/* ata_rsp may keep skb for later processing or give it back */
skb = aoecmd_ata_rsp(skb);
break;
case AOECMD_CFG:
+ if (!pskb_may_pull(skb, sizeof(*h) + sizeof(struct aoe_cfghdr)))
+ goto exit;
aoecmd_cfg_rsp(skb);
break;
default:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0551/1257] PCI/sysfs: Pass the device name length in UTF-16 code units
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0550/1257] aoe: pull in the headers each received packet type reads Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0552/1257] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM Greg Kroah-Hartman
` (447 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
[ Upstream commit af5ca2d75147bf283239e8ef0fbf6e5e0488ca91 ]
Currently, dsm_label_utf16s_to_utf8s() passes the ACPI buffer length to
utf16s_to_utf8s() unchanged. The Device Name _DSM may return the device
name as a buffer holding a UTF-16 string, and the ACPI length counts bytes
while the converter counts wchar_t elements. The converter therefore
receives a count twice the number of code units the buffer holds, and that
count is its only bound on the input.
A NUL code unit ends the conversion early, so a name that carries one is
converted correctly and the error stays hidden. ACPICA zeroes the entire
result allocation, and the padding placed after the buffer supplies that
NUL for most lengths. Lengths that leave no padding, or a single byte of
it, do not, and the conversion then runs up to its own length in bytes past
the end of the allocation. The bytes beyond the allocation are decoded
into the "label" attribute, which is world readable.
Divide the buffer length by the size of wchar_t so that the converter
receives a count of code units. The division truncates, so the converter
is never told to read more bytes than the buffer holds, including for an
odd length.
Reaching the out of bounds read needs firmware that returns the name as a
buffer and omits the terminator.
Fixes: 6058989bad05 ("PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs")
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260814070522.2327975-5-kwilczynski@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci-label.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c
index 0c64465196404..c224619b9a266 100644
--- a/drivers/pci/pci-label.c
+++ b/drivers/pci/pci-label.c
@@ -144,7 +144,7 @@ static int dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf)
int len;
len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer,
- obj->buffer.length,
+ obj->buffer.length / sizeof(wchar_t),
UTF16_LITTLE_ENDIAN,
buf, PAGE_SIZE - 1);
buf[len++] = '\n';
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0552/1257] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0551/1257] PCI/sysfs: Pass the device name length in UTF-16 code units Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0553/1257] wifi: rtw89: usb: shorten the RX aggregation hold on RTL8922AU over USB 3 Greg Kroah-Hartman
` (446 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Ping-Ke Shih,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 6c17c57d45ef1652d80f79a9834597b25412fd26 ]
__rtw89_wow_parse_akm() computes a pointer to the IE area from an
association request frame:
ies = mgmt->u.assoc_req.variable;
but then passes skb->len as the IE data length to cfg80211_find_ie().
Since skb->len covers the entire frame including the 28-byte management
header and fixed fields, cfg80211_find_ie() may read past the end of the
actual IE data.
Fix by computing the correct IE data length as skb->len minus the
header offset, and validating the minimum frame length before parsing.
Fixes: 92790c4e50d2 ("wifi: rtw89: wow: parsing Auth Key Management from associate request")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20261007161721.261452-3-tristmd@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/wow.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
index 2dfa24c54e7d7..178c59692b13f 100644
--- a/drivers/net/wireless/realtek/rtw89/wow.c
+++ b/drivers/net/wireless/realtek/rtw89/wow.c
@@ -16,10 +16,14 @@ void __rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)
{
struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
struct rtw89_wow_param *rtw_wow = &rtwdev->wow;
+ size_t hdr_len = offsetof(struct ieee80211_mgmt, u.assoc_req.variable);
const u8 *rsn, *ies = mgmt->u.assoc_req.variable;
struct rtw89_rsn_ie *rsn_ie;
- rsn = cfg80211_find_ie(WLAN_EID_RSN, ies, skb->len);
+ if (skb->len < hdr_len)
+ return;
+
+ rsn = cfg80211_find_ie(WLAN_EID_RSN, ies, skb->len - hdr_len);
if (!rsn)
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0553/1257] wifi: rtw89: usb: shorten the RX aggregation hold on RTL8922AU over USB 3
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0552/1257] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0554/1257] ALSA: hda/realtek: Fix silent speakers on Lenovo Legion S7 15IMH05 Greg Kroah-Hartman
` (445 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nick Morrow, Devin Wittmayer,
Ping-Ke Shih, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devin Wittmayer <lucid_duck@justthetip.ca>
[ Upstream commit 83de3a16c7b37064a59305040ba9b0f93b832794 ]
The RTL8922AU holds received frames for up to a millisecond before
handing them to the host, a value carried over from the RTL8852CU.
On USB 3 that adds up to a millisecond of round trip, and under load
at 160 MHz the access point drops to lower rates and download suffers.
Shorten the hold on USB 3 only. On USB 2 the bus is the limit, and a
slow host needs the long hold to keep up.
RTL8922AU on USB 3 at 160 MHz, power save off for the round trip:
x86, 6 GHz x86, 5 GHz Pi 5, 6 GHz
before after before after before after
TCP down, 1 flow 613 1002 579 948 587 1010 Mbps
TCP down, 8 flows 656 1187 629 1080 605 1122 Mbps
round trip 2.33 1.29 2.25 1.18 1.42 0.84 ms
busiest core, UDP 200M 8.4 12.8 8.3 12.9 2.1 3.3 %
RTL8922AU on USB 2, Raspberry Pi 1 B+ at 5 GHz, 80 MHz:
long hold short hold
TCP up, 1 flow 102.3 87.7 Mbps
CPU, UDP 20M 50.5 77.4 %
loss, UDP 50M 3.8 85.7 %
Fixes: 32cee8a9bb66 ("wifi: rtw89: usb: Enable RX aggregation for RTL8922AU")
Reported-by: Nick Morrow <morrownr@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20261007210958.56528-1-lucid_duck@justthetip.ca
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/usb.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c
index aafa8b9e93dfc..22a1a988f3073 100644
--- a/drivers/net/wireless/realtek/rtw89/usb.c
+++ b/drivers/net/wireless/realtek/rtw89/usb.c
@@ -819,10 +819,15 @@ static void rtw89_usb_rx_agg_cfg_v2(struct rtw89_dev *rtwdev)
static void rtw89_usb_rx_agg_cfg_v3(struct rtw89_dev *rtwdev)
{
- const u32 rxagg_0 = FIELD_PREP_CONST(B_BE_RXAGG_0_EN, 1) |
- FIELD_PREP_CONST(B_BE_RXAGG_0_NUM_TH, 255) |
- FIELD_PREP_CONST(B_BE_RXAGG_0_TIME_32US_TH, 32) |
- FIELD_PREP_CONST(B_BE_RXAGG_0_BUF_SZ_1K, 20);
+ struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev);
+ u32 rxagg_0 = FIELD_PREP_CONST(B_BE_RXAGG_0_EN, 1) |
+ FIELD_PREP_CONST(B_BE_RXAGG_0_NUM_TH, 255) |
+ FIELD_PREP_CONST(B_BE_RXAGG_0_BUF_SZ_1K, 20);
+
+ if (rtwusb->udev->speed == USB_SPEED_SUPER)
+ rxagg_0 |= FIELD_PREP_CONST(B_BE_RXAGG_0_TIME_32US_TH, 1);
+ else
+ rxagg_0 |= FIELD_PREP_CONST(B_BE_RXAGG_0_TIME_32US_TH, 32);
rtw89_write32(rtwdev, R_BE_RXAGG_0_V1, rxagg_0);
rtw89_write32(rtwdev, R_BE_RXAGG_1_V1, 0x1F);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0554/1257] ALSA: hda/realtek: Fix silent speakers on Lenovo Legion S7 15IMH05
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0553/1257] wifi: rtw89: usb: shorten the RX aggregation hold on RTL8922AU over USB 3 Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0555/1257] crypto: algif_skcipher - rewind rounded output bytes Greg Kroah-Hartman
` (444 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matej Sochan, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matej Sochan <matej.sochan@gmail.com>
[ Upstream commit 1c36207da79455402d981125fa09716991364e66 ]
The speakers on the Legion S7 15IMH05 (PCI SSID 17aa:3811, ALC287) stay
silent after a cold boot with the current quirk, which applies
ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS. They only start working after a
suspend/resume cycle.
The amplifier setup is sent through COEF 0x24/0x26 on NID 0x20. On this
machine the first pass of that sequence appears to only wake the
amplifiers. Sending the identical sequence a second time makes both
speakers work, provided the second write comes a few milliseconds after
the first: back-to-back writes leave the speakers silent, a 7 ms gap
makes only the right speaker work, and 8 ms or more is reliable. A dump
of all COEF registers of NID 0x20 taken before and after the second
write shows no difference.
Add a dedicated fixup that writes the sequence, waits 20 ms to keep a
margin over the measured minimum, and writes it again on every codec
init. It chains to the same AUTOMUTE fixup as before. To share the
sequence, move the verbs of ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS into a
named array; this has no functional change for the other users of that
fixup.
Fixes: 67f4c61a73e9 ("ALSA: hda/realtek: Add quirk for Legion S7 15IMH")
Cc: stable@vger.kernel.org
Link: https://github.com/CachyOS/linux-cachyos/issues/792
Signed-off-by: Matej Sochan <matej.sochan@gmail.com>
Link: https://patch.msgid.link/20261007-legion-s7-v1-1-8ea7fb7ee766@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 92 +++++++++++++++++++------------
1 file changed, 56 insertions(+), 36 deletions(-)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 1623cf926c713..c66dd4a003f39 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -4290,6 +4290,7 @@ enum {
ALC236_FIXUP_HP_LIMIT_INT_MIC_BOOST,
ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS,
ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
+ ALC287_FIXUP_LEGION_S7_15IMH05_AMP,
ALC287_FIXUP_YOGA7_14ITL_SPEAKERS,
ALC298_FIXUP_LENOVO_C940_DUET7,
ALC287_FIXUP_LENOVO_YOGA_BOOK_9I,
@@ -4437,6 +4438,53 @@ static void alc700_fixup_intel_hades_canyon(struct hda_codec *codec,
alc_update_coef_idx(codec, 0x1b, 0x0400, 0x0400);
}
+static const struct hda_verb legion_amp_verbs[] = {
+ /* left speaker */
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x1a },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+
+ /* right speaker */
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x42 },
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x2a },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+ {}
+};
+
+static void alc287_fixup_legion_s7_amp(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+{
+ if (action != HDA_FIXUP_ACT_INIT)
+ return;
+
+ snd_hda_sequence_write(codec, legion_amp_verbs);
+ /*
+ * The amplifiers accept the setup only a few ms after the first
+ * write (8 ms is the measured minimum on the test machine), so
+ * keep a margin.
+ */
+ msleep(20);
+ snd_hda_sequence_write(codec, legion_amp_verbs);
+}
+
static const struct hda_fixup alc269_fixups[] = {
[ALC298_FIXUP_RAZER_BLADE16_2025_PINS] = {
.type = HDA_FIXUP_PINS,
@@ -6486,41 +6534,13 @@ static const struct hda_fixup alc269_fixups[] = {
},
[ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS] = {
.type = HDA_FIXUP_VERBS,
- //.v.verbs = legion_15imhg05_coefs,
- .v.verbs = (const struct hda_verb[]) {
- // set left speaker Legion 7i.
- { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
-
- { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x1a },
- { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
-
- { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
-
- // set right speaker Legion 7i.
- { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x42 },
-
- { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x2a },
- { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
-
- { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
- { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
- {}
- },
+ .v.verbs = legion_amp_verbs,
+ .chained = true,
+ .chain_id = ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
+ },
+ [ALC287_FIXUP_LEGION_S7_15IMH05_AMP] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc287_fixup_legion_s7_amp,
.chained = true,
.chain_id = ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
},
@@ -8206,7 +8226,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
HDA_CODEC_QUIRK(0x17aa, 0x38d5, "Lenovo Yoga Pro 9 16IMH9", ALC287_FIXUP_TAS2781_I2C),
HDA_CODEC_QUIRK(0x17aa, 0x38d6, "Lenovo Yoga Pro 9 16IMH9", ALC287_FIXUP_TAS2781_I2C),
HDA_CODEC_QUIRK(0x17aa, 0x3855, "Legion 7 16ITHG6", ALC287_FIXUP_LEGION_16ITHG6),
- SND_PCI_QUIRK(0x17aa, 0x3811, "Legion S7 15IMH05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS),
+ SND_PCI_QUIRK(0x17aa, 0x3811, "Legion S7 15IMH05", ALC287_FIXUP_LEGION_S7_15IMH05_AMP),
SND_PCI_QUIRK(0x17aa, 0x3813, "Legion 7i 15IMHG05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS),
SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940 / Yoga Duet 7", ALC298_FIXUP_LENOVO_C940_DUET7),
SND_PCI_QUIRK(0x17aa, 0x3819, "Lenovo 13s Gen2 ITL", ALC287_FIXUP_13S_GEN2_SPEAKERS),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0555/1257] crypto: algif_skcipher - rewind rounded output bytes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0554/1257] ALSA: hda/realtek: Fix silent speakers on Lenovo Legion S7 15IMH05 Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0556/1257] ALSA: hda/hdmi: clamp num_cvts against cvt_nids[] in hdmi_read_pin_conn Greg Kroah-Hartman
` (443 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daehyeon Ko, Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit 2f90facc7b94934653eb7ebfadcc25d503b89196 ]
af_alg_get_rsgl() advances the receive iterator by the unrounded RX
scatterlist length. For a continuing skcipher request,
_skcipher_recvmsg() then rounds its local length down to a whole chunksize
without restoring the iterator.
A later chunk starts after bytes which the provider never wrote, while the
syscall returns only the processed length. When copy_splice_read()
supplies non-zeroed pages and publishes that return as a dense prefix, the
gap exposes stale bytes from a previous page lifetime.
With unprivileged xts(aes), a 31-byte MSG_MORE request followed by one
final byte advances a 47-byte destination while returning 32 bytes. A
hardened v7.2-rc5 image retained all 15 seeded stale bytes in 4,829 of
4,829 records. With init_on_alloc enabled, all 72,345 gap bytes observed
were zero.
Rewind the iterator by the tail excluded during rounding, before rejecting
a zero processed length. The crypto request uses only the rounded length;
af_alg_free_resources() releases the entire RX list before another receive
iteration.
The fixed target-like kernel returned byte-identical dense 48-byte output
in 4,771 of 4,771 rounds. The unmodified kernel returned the vulnerable
32-byte short record in 2,409 of 2,409 rounds.
Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/algif_skcipher.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 1e61fe6e24b99..291dbd6989325 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -135,12 +135,16 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
* full block size buffers.
*/
if (ctx->more || len < ctx->used) {
- if (len < bs) {
+ size_t excess = len % bs;
+
+ len -= excess;
+ iov_iter_revert(&msg->msg_iter, excess);
+
+ if (!len) {
err = -EINVAL;
goto free;
}
- len -= len % bs;
cflags |= CRYPTO_SKCIPHER_REQ_NOTFINAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0556/1257] ALSA: hda/hdmi: clamp num_cvts against cvt_nids[] in hdmi_read_pin_conn
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0555/1257] crypto: algif_skcipher - rewind rounded output bytes Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0557/1257] ALSA: hda/hdmi: clamp sad_count in ELD proc write handler Greg Kroah-Hartman
` (442 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 6cf3ab38b0d53d41f00fe594b2986849bdf994ae ]
hdmi_add_cvt() stores each converter's NID into the fixed-size
spec->cvt_nids[] array (used only by the Intel Haswell pin-connection
fixup), but only when spec->num_cvts is still within
ARRAY_SIZE(cvt_nids); the num_cvts counter itself is incremented
unconditionally regardless of whether the store happened. A codec
that reports more converters than cvt_nids[] can hold therefore ends
up with num_cvts > ARRAY_SIZE(cvt_nids).
hdmi_read_pin_conn(), on the intel_hsw_fixup path, copies num_cvts
elements from cvt_nids[] with memcpy(), so once num_cvts exceeds the
array size this reads past cvt_nids[] and writes the resulting
garbage NIDs into per_pin->mux_nids[].
Clamp the copy length to the actual size of cvt_nids[] instead of
trusting num_cvts, which is also used unbounded as the size of the
separate, dynamically-sized spec->cvts array and must not be
truncated at the source.
Fixes: bce0d2a80e42 ("ALSA: hda - Allow unlimited pins and converters in patch_hdmi.c")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261008085122.9442-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/hdmi/hdmi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/hda/codecs/hdmi/hdmi.c b/sound/hda/codecs/hdmi/hdmi.c
index 1e7a05c877331..8020178b62960 100644
--- a/sound/hda/codecs/hdmi/hdmi.c
+++ b/sound/hda/codecs/hdmi/hdmi.c
@@ -983,7 +983,8 @@ static int hdmi_read_pin_conn(struct hda_codec *codec, int pin_idx)
snd_hda_set_dev_select(codec, pin_nid, dev_id);
if (spec->intel_hsw_fixup) {
- conns = spec->num_cvts;
+ /* spec->cvt_nids[] only has ARRAY_SIZE(spec->cvt_nids) slots */
+ conns = min_t(int, spec->num_cvts, ARRAY_SIZE(spec->cvt_nids));
memcpy(per_pin->mux_nids, spec->cvt_nids,
sizeof(hda_nid_t) * conns);
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0557/1257] ALSA: hda/hdmi: clamp sad_count in ELD proc write handler
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (555 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0556/1257] ALSA: hda/hdmi: clamp num_cvts against cvt_nids[] in hdmi_read_pin_conn Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0558/1257] fanotify: report names longer than NAME_MAX Greg Kroah-Hartman
` (441 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit b3e7ddd694f8429217ba509b55b910a0e4361dfb ]
snd_hdmi_write_eld_info() parses a "sad_count N" line from the
root-writable ELD proc interface and assigns N directly to
e->sad_count with no upper bound, unlike the per-index "sadN_*" lines
a few lines below which are already bounded to ELD_MAX_SAD.
snd_hdmi_eld_update_pcm_info() later iterates
"for (i = 0; i < e->sad_count; i++)" over the fixed
e->sad[ELD_MAX_SAD] array, so an oversized sad_count read from the
proc file causes it to walk past the array.
Reject sad_count values above ELD_MAX_SAD, matching the existing
per-index guard.
Fixes: acb059938810 ("ALSA: hda - ELD proc interface write updates")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261008085133.9528-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/hdmi/eld.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sound/hda/codecs/hdmi/eld.c b/sound/hda/codecs/hdmi/eld.c
index 1464fd1c675bc..fc6fe1b0873c3 100644
--- a/sound/hda/codecs/hdmi/eld.c
+++ b/sound/hda/codecs/hdmi/eld.c
@@ -155,9 +155,11 @@ void snd_hdmi_write_eld_info(struct hdmi_eld *eld,
e->aud_synch_delay = val;
else if (!strcmp(name, "speakers"))
e->spk_alloc = val;
- else if (!strcmp(name, "sad_count"))
+ else if (!strcmp(name, "sad_count")) {
+ if (val > ELD_MAX_SAD)
+ continue;
e->sad_count = val;
- else if (!strncmp(name, "sad", 3)) {
+ } else if (!strncmp(name, "sad", 3)) {
sname = name + 4;
n = name[3] - '0';
if (name[4] >= '0' && name[4] <= '9') {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0558/1257] fanotify: report names longer than NAME_MAX
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (556 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0557/1257] ALSA: hda/hdmi: clamp sad_count in ELD proc write handler Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0559/1257] ext4: only update tune mount options when requested Greg Kroah-Hartman
` (440 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Goergens, Jan Kara,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
[ Upstream commit ff05910cb1b77c2b229c5e6e260c6173a17b579b ]
fanotify keeps the length of a reported name in a u8, so it drops any
name longer than NAME_MAX and warns:
WARNING: fs/notify/fanotify/fanotify.h:217 at fanotify_handle_event+0x2e82/0x39f0
Such names are legitimate on some filesystems. vfat mounted with utf8
takes up to 255 UTF-16 characters, which are up to 765 bytes of UTF-8,
and FUSE accepts names up to PATH_MAX - 1. readdir() and inotify report
them in full. fanotify sends the event without the name, and for
FAN_RENAME it trips a second warning in copy_fid_info_to_user(), after
which read() fails with EFAULT and the event is lost.
When syzbot hit this, Jan suggested accommodating names up to PATH_MAX
[1], the limit readdir() already applies to a name
(verify_dirent_name()). Store the name lengths as u16, which keeps
struct fanotify_info at 8 bytes, and drop without a warning only names
of PATH_MAX bytes or more, which no path can refer to. An event with
such a name can exceed a page, so allocate name events with kvmalloc(),
as Jan also suggested. Names up to NAME_MAX are reported exactly as
before, and the record format is unchanged: an event with a long name is
just longer.
Link: https://lore.kernel.org/all/20241112115059.ecvomkalee5m4i4i@quack3/ [1]
Fixes: 2d9374f09513 ("fanotify: use macros to get the offset to fanotify_info buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Link: https://patch.msgid.link/20260926020851.2938961-1-matthias.goergens@gmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/notify/fanotify/fanotify.c | 7 +++++--
fs/notify/fanotify/fanotify.h | 21 ++++++++++++---------
2 files changed, 17 insertions(+), 11 deletions(-)
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index a208a7ec1692a..71b3a2361929c 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -648,6 +648,9 @@ static struct fanotify_event *fanotify_alloc_name_event(struct inode *dir,
unsigned long name2_len = name2 ? name2->len : 0;
unsigned int len, size;
+ if (WARN_ON_ONCE(name_len >= PATH_MAX || name2_len >= PATH_MAX))
+ return NULL;
+
/* Reserve terminating null byte even for empty name */
size = sizeof(*fne) + name_len + name2_len + 2;
if (dir_fh_len)
@@ -656,7 +659,7 @@ static struct fanotify_event *fanotify_alloc_name_event(struct inode *dir,
size += FANOTIFY_FH_HDR_LEN + dir2_fh_len;
if (child_fh_len)
size += FANOTIFY_FH_HDR_LEN + child_fh_len;
- fne = kmalloc(size, gfp);
+ fne = kvmalloc(size, gfp);
if (!fne)
return NULL;
@@ -1050,7 +1053,7 @@ static void fanotify_free_fid_event(struct fanotify_event *event)
static void fanotify_free_name_event(struct fanotify_event *event)
{
- kfree(FANOTIFY_NE(event));
+ kvfree(FANOTIFY_NE(event));
}
static void fanotify_free_error_event(struct fsnotify_group *group,
diff --git a/fs/notify/fanotify/fanotify.h b/fs/notify/fanotify/fanotify.h
index 3710543dbf827..87ba788574bff 100644
--- a/fs/notify/fanotify/fanotify.h
+++ b/fs/notify/fanotify/fanotify.h
@@ -43,9 +43,16 @@ struct fanotify_info {
u8 dir_fh_totlen;
u8 dir2_fh_totlen;
u8 file_fh_totlen;
- u8 name_len;
- u8 name2_len;
- u8 pad[3];
+ u8 pad;
+ /*
+ * Deliberately not limited to NAME_MAX: some filesystems return longer
+ * names (vfat up to 255 UTF-16 characters, as Windows allows, which is
+ * up to 765 bytes of UTF-8; FUSE up to PATH_MAX - 1), and readdir() and
+ * inotify report them in full. Only names of PATH_MAX bytes or more,
+ * which no path can refer to, are dropped.
+ */
+ u16 name_len;
+ u16 name2_len;
unsigned char buf[];
/*
* (struct fanotify_fh) dir_fh starts at buf[0]
@@ -168,7 +175,7 @@ static inline char *fanotify_info_name2(struct fanotify_info *info)
static inline void fanotify_info_init(struct fanotify_info *info)
{
BUILD_BUG_ON(FANOTIFY_FH_HDR_LEN + MAX_HANDLE_SZ > U8_MAX);
- BUILD_BUG_ON(NAME_MAX > U8_MAX);
+ BUILD_BUG_ON(PATH_MAX > U16_MAX);
info->dir_fh_totlen = 0;
info->dir2_fh_totlen = 0;
@@ -214,8 +221,7 @@ static inline void fanotify_info_set_file_fh(struct fanotify_info *info,
static inline void fanotify_info_copy_name(struct fanotify_info *info,
const struct qstr *name)
{
- if (WARN_ON_ONCE(name->len > NAME_MAX) ||
- WARN_ON_ONCE(info->name2_len > 0))
+ if (WARN_ON_ONCE(info->name2_len > 0))
return;
info->name_len = name->len;
@@ -225,9 +231,6 @@ static inline void fanotify_info_copy_name(struct fanotify_info *info,
static inline void fanotify_info_copy_name2(struct fanotify_info *info,
const struct qstr *name)
{
- if (WARN_ON_ONCE(name->len > NAME_MAX))
- return;
-
info->name2_len = name->len;
strscpy(fanotify_info_name2(info), name->name, name->len + 1);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0559/1257] ext4: only update tune mount options when requested
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (557 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0558/1257] fanotify: report names longer than NAME_MAX Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0560/1257] ext4: fix fast commit replay failing on a read-only mount Greg Kroah-Hartman
` (439 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, guzebing, Darrick J. Wong,
Theodore Tso, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: guzebing <guzebing1612@gmail.com>
[ Upstream commit 981eec6c300bd4e84ffac8f3c28b762d00f13e9c ]
EXT4_IOC_SET_TUNE_SB_PARAM uses set_flags to indicate which superblock
fields the caller wants to update. ext4_sb_setparams() checks set_flags
before updating the other supported fields, but always copied mount_opts
into the on-disk s_mount_opts field.
As a result, callers that do not set EXT4_TUNE_FL_MOUNT_OPTS can still
clear or alter the on-disk default mount options through their unused
mount_opts buffer. This can affect subsequent mounts by changing the
filesystem's stored default mount options.
Only copy mount_opts into s_mount_opts when EXT4_TUNE_FL_MOUNT_OPTS is set,
matching the set_flags semantics used by the other tuneable superblock
fields.
Cc: stable@kernel.org
Fixes: 04a91570ac67 ("ext4: implemet new ioctls to set and get superblock parameters")
Signed-off-by: guzebing <guzebing1612@gmail.com>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Link: https://patch.msgid.link/20260810151200.1405562-1-guzebing1612@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/ioctl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index c8387e6a2c6e9..1f6d7afb62ec7 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -1362,7 +1362,8 @@ static void ext4_sb_setparams(struct ext4_sb_info *sbi,
es->s_encoding = cpu_to_le16(params->encoding);
if (params->set_flags & EXT4_TUNE_FL_ENCODING_FLAGS)
es->s_encoding_flags = cpu_to_le16(params->encoding_flags);
- strscpy_pad(es->s_mount_opts, params->mount_opts);
+ if (params->set_flags & EXT4_TUNE_FL_MOUNT_OPTS)
+ strscpy_pad(es->s_mount_opts, params->mount_opts);
if (params->set_flags & EXT4_TUNE_FL_EDIT_FEATURES) {
es->s_feature_compat |=
cpu_to_le32(params->set_feature_compat_mask);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0560/1257] ext4: fix fast commit replay failing on a read-only mount
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (558 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0559/1257] ext4: only update tune mount options when requested Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0561/1257] ext4: reject delalloc to nodelalloc before applying remount options Greg Kroah-Hartman
` (438 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hsiu-Hsien Lee, Jan Kara,
Theodore Tso, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsiu-Hsien Lee <swinds24@gmail.com>
[ Upstream commit e1a881ea4674876721cab97680d1d8308f90e9a4 ]
A filesystem with fast_commit that needs recovery cannot be mounted
read-only:
EXT4-fs (dm-0): INFO: recovery required on readonly filesystem
EXT4-fs (dm-0): write access will be enabled during recovery
WARNING: CPU: 22 PID: 5544 at fs/ext4/ext4_jbd2.c:73
ext4_journal_check_start
__ext4_journal_start_sb
__ext4_unlink
ext4_fc_replay
do_one_pass
jbd2_journal_recover
jbd2_journal_load
__ext4_fill_super
JBD2: journal recovery failed
EXT4-fs (dm-0): error loading journal
Fast commit replay runs ext4 metadata operations instead of writing
blocks through the buffer cache: ext4_fc_replay_{unlink,link,create}()
reach __ext4_unlink() and __ext4_link(), which start a handle.
ext4_journal_check_start() returns -EROFS on a read-only sb, and as
that is not -ENOENT it propagates out of jbd2_journal_recover() and
kills the whole recovery. The EXT4_FC_REPLAY check that would hand
out a no-journal handle sits after the sb_rdonly() test, so replay can
never complete read-only.
ext4_load_journal() has already promised that write access will be
enabled during recovery, so make that true for the superblock as well:
clear SB_RDONLY across jbd2_journal_load() when recovery is needed on a
read-only mount and the devices are writable, as ext4_orphan_cleanup()
does. Unlike ext4_handle_error(), which avoids SB_RDONLY because it
would need s_umount, the sb here is still inside ext4_fill_super() and
not published, so nothing can observe it.
The failure is not clean either: the replay handlers passing a NULL
handle (ext4_fc_replay_inode(), _add_range(), _del_range()) never hit
ext4_journal_check_start() and do write, leaving a partially applied
fast commit behind.
Reproducer, where the unlink only ever reaches the fast commit area:
mke2fs -q -F -t ext4 -O fast_commit -b 4096 /dev/sdb3 262144
mount /dev/sdb3 /mnt
dd if=/dev/zero of=/mnt/victim bs=4k count=1 conv=fsync
sync # victim now in a full commit
rm /mnt/victim
dd if=/dev/zero of=/mnt/trigger bs=4k count=1 conv=fsync
<crash, or snapshot the device while mounted and write it back>
mount -o ro /dev/sdb3 /mnt
Without this patch that mount fails; with it recovery completes and
victim is gone, i.e. the UNLINK record was really replayed.
Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
Cc: stable@vger.kernel.org
Signed-off-by: Hsiu-Hsien Lee <swinds24@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260812044353.1018268-1-swinds24@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/super.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 3ace06b4f9e3a..e790a71475011 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -6133,6 +6133,7 @@ static int ext4_load_journal(struct super_block *sb,
int err = 0;
int really_read_only;
int journal_dev_ro;
+ bool enable_write = false;
if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
return -EFSCORRUPTED;
@@ -6189,6 +6190,7 @@ static int ext4_load_journal(struct super_block *sb,
}
ext4_msg(sb, KERN_INFO, "write access will "
"be enabled during recovery");
+ enable_write = true;
}
}
@@ -6205,7 +6207,19 @@ static int ext4_load_journal(struct super_block *sb,
if (save)
memcpy(save, ((char *) es) +
EXT4_S_ERR_START, EXT4_S_ERR_LEN);
+ /*
+ * Fast commit replay performs regular ext4 metadata updates
+ * (see ext4_fc_replay()) which refuse to run on a read-only
+ * superblock. We promised write access above, so make that
+ * true for the duration of the recovery, the same way
+ * ext4_orphan_cleanup() does. The superblock is not published
+ * yet, so nothing can observe the transient state.
+ */
+ if (enable_write)
+ sb->s_flags &= ~SB_RDONLY;
err = jbd2_journal_load(journal);
+ if (enable_write)
+ sb->s_flags |= SB_RDONLY;
if (save && memcmp(((char *) es) + EXT4_S_ERR_START,
save, EXT4_S_ERR_LEN)) {
memcpy(((char *) es) + EXT4_S_ERR_START,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0561/1257] ext4: reject delalloc to nodelalloc before applying remount options
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (559 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0560/1257] ext4: fix fast commit replay failing on a read-only mount Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0562/1257] jbd2: dont advance j_fc_off before the buffer is recorded Greg Kroah-Hartman
` (437 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, guzebing, Ojaswin Mujoo, Jan Kara,
Theodore Tso, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: guzebing <guzebing1612@gmail.com>
[ Upstream commit 26a3ff309c91986dbedb05d0e0f0050ea0aa629c ]
Commit 97f5ec3b166d ("ext4: prevent delalloc to nodelalloc on
remount") rejects switching a mounted filesystem from delalloc to
nodelalloc. However, it performs the check after ext4_apply_options()
has already cleared EXT4_MOUNT_DELALLOC in the live superblock. The
failure path eventually restores the bit, but leaves a window where
other CPUs can observe nodelalloc.
test_opt() reads s_mount_opt directly without a lock shared with
remount. If a concurrent truncate's __es_remove_extent() hits this
window and observes nodelalloc, it sets count_reserved to false.
Delayed extent status entries are then removed without calculating
their cluster reservations, leaving reserved at zero.
ext4_es_remove_extent() therefore calls ext4_da_release_space() with
zero, leaving i_reserved_data_blocks and s_dirtyclusters_counter
elevated. When the inode is later evicted after unlink,
ext4_destroy_inode() reports:
i_reserved_data_blocks (...) not cleared!
CPU 0 CPU 1
ksys_truncate()
...
ext4_es_remove_extent()
ext4_reconfigure()
ext4_check_opt_consistency()
__ext4_remount()
ext4_apply_options()
clear EXT4_MOUNT_DELALLOC
__es_remove_extent()
test_opt() sees !DELALLOC
count_reserved = false
reject delalloc -> nodelalloc
restore EXT4_MOUNT_DELALLOC
remove delayed ES
ext4_da_release_space(0)
Follow the pre-apply validation approach used by
ext4_check_quota_consistency() and reject the transition in
ext4_check_opt_consistency(), before ext4_apply_options() changes live
state. Use mask_s_mount_opt to determine whether delalloc/nodelalloc
was specified and ctx_test_mount_opt() to check the final parsed value.
Fixes: 97f5ec3b166d ("ext4: prevent delalloc to nodelalloc on remount")
Cc: stable@vger.kernel.org
Signed-off-by: guzebing <guzebing1612@gmail.com>
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260814034855.1573759-1-guzebing1612@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/super.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index e790a71475011..a8c4a227edf16 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2840,6 +2840,14 @@ static int ext4_check_opt_consistency(struct fs_context *fc,
}
if (is_remount) {
+ if (test_opt(sb, DELALLOC) &&
+ (ctx->mask_s_mount_opt & EXT4_MOUNT_DELALLOC) &&
+ !ctx_test_mount_opt(ctx, EXT4_MOUNT_DELALLOC)) {
+ ext4_msg(sb, KERN_ERR,
+ "can't disable delalloc during remount");
+ return -EINVAL;
+ }
+
if (!sbi->s_journal &&
ctx_test_mount_opt(ctx, EXT4_MOUNT_DATA_ERR_ABORT)) {
ext4_msg(NULL, KERN_WARNING,
@@ -6712,13 +6720,6 @@ static int __ext4_remount(struct fs_context *fc, struct super_block *sb)
goto restore_opts;
}
- if ((old_opts.s_mount_opt & EXT4_MOUNT_DELALLOC) &&
- !test_opt(sb, DELALLOC)) {
- ext4_msg(sb, KERN_ERR, "can't disable delalloc during remount");
- err = -EINVAL;
- goto restore_opts;
- }
-
sb->s_flags = (sb->s_flags & ~SB_POSIXACL) |
(test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0562/1257] jbd2: dont advance j_fc_off before the buffer is recorded
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (560 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0561/1257] ext4: reject delalloc to nodelalloc before applying remount options Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0563/1257] ext4: skip extra isize expansion while unmounting Greg Kroah-Hartman
` (436 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Yu Junzhe, Daejun Park,
Jan Kara, Theodore Tso, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daejun Park <daejun7.park@samsung.com>
[ Upstream commit 9f359c031885bb50add7d23c7a5a0e9755b134c9 ]
jbd2_fc_get_buf() increments journal->j_fc_off before jbd2_journal_bmap()
and __getblk() have had a chance to fail. When either does, the slot
j_fc_wbuf[fc_off] is never assigned, but j_fc_off already counts it.
ext4 then fails the fast commit and falls back, and the fallback path
reaches jbd2_fc_release_bufs() via ext4_fc_commit ->
jbd2_fc_end_commit_fallback -> __jbd2_fc_end_commit -> ext4_fc_cleanup.
That walks down from j_fc_off - 1 and put_bh()es every slot until it
sees NULL, so it also touches the slot that was never written.
j_fc_wbuf comes from a plain kmalloc() and is never zeroed, so a slot
used for the first time holds uninitialised heap data.
Advance j_fc_off only after the buffer head has been stored. That
restores the invariant that j_fc_off covers exactly the filled slots,
which is what jbd2_fc_release_bufs() relies on: the live buffers of the
current fast commit sit above the NULLs the previous one released, so
stopping at the first NULL is correct.
Reproduced on a KASAN kernel with an ext4 fast_commit filesystem on a
loop device, truncating the backing file under the live mount so that
only the journal's fast-commit region falls past the end of the device.
__getblk() then fails for the first fast-commit block while the rest of
the journal is still addressable, so the journal is not aborted and the
fast commit reaches the fallback path. j_fc_wbuf was poisoned to make
the read of the never-written slot visible:
BUG: KASAN: wild-memory-access in jbd2_fc_release_bufs+0x6b/0xd0
Write of size 4 at addr 5a5a5a5a5a5a5ab2 by task sync/961
jbd2_fc_release_bufs+0x6b/0xd0
ext4_fc_cleanup+0x97/0x830
__jbd2_fc_end_commit+0x37/0xc0
ext4_fc_commit+0x524/0x560
ext4_sync_file+0x3c4/0x4b0
__x64_sys_fsync+0x20/0x30
With this patch the same run leaves j_fc_off at 0 across repeated
__getblk() failures and completes cleanly.
Fixes: ff780b91efe9 ("jbd2: add fast commit machinery")
Cc: stable@kernel.org
Reported-by: Yu Junzhe <junzheyu1@gmail.com>
Closes: https://lore.kernel.org/linux-ext4/7e4b109d-64c3-444f-a5dc-93c2ca4576cc@gmail.com/
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260819060939epcms2p37bb8589b2f8a52a2b14bef38fadcf69d@epcms2p3
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jbd2/journal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 00f5a98f3d4fe..55b4ce0102289 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -843,7 +843,6 @@ int jbd2_fc_get_buf(journal_t *journal, struct buffer_head **bh_out)
fc_off = journal->j_fc_off;
blocknr = journal->j_fc_first + fc_off;
- journal->j_fc_off++;
ret = jbd2_journal_bmap(journal, blocknr, &pblock);
if (ret)
return ret;
@@ -853,6 +852,7 @@ int jbd2_fc_get_buf(journal_t *journal, struct buffer_head **bh_out)
return -ENOMEM;
journal->j_fc_wbuf[fc_off] = bh;
+ journal->j_fc_off++;
*bh_out = bh;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0563/1257] ext4: skip extra isize expansion while unmounting
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (561 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0562/1257] jbd2: dont advance j_fc_off before the buffer is recorded Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0564/1257] ext4: dont report delalloc data as a hole on indirect-mapped inodes Greg Kroah-Hartman
` (435 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+4b03894b6ec5753ddf24,
Hemanth Selam, Jan Kara, Jun Nie, Theodore Tso, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hemanth Selam <hemanth.selam@gmail.com>
[ Upstream commit 418adcde99032194416248168df810535a1a93f9 ]
syzbot reports a WARN from ext4_xattr_inode_create() reached through the
unmount path:
EXT4-fs warning (device loop0): ext4_xattr_inode_create:1485: refuse to
create EA inode when umounting
WARNING: fs/ext4/xattr.c:1486 at ext4_xattr_inode_lookup_create
ext4_xattr_block_set
ext4_expand_extra_isize_ea
__ext4_expand_extra_isize
__ext4_mark_inode_dirty
ext4_dirty_inode
__mark_inode_dirty
sync_lazytime
iput
dentry_kill
shrink_dentry_list
shrink_dcache_for_umount
generic_shutdown_super
kill_block_super
ext4_kill_sb
shrink_dcache_for_umount() clears s_root before generic_shutdown_super()
clears SB_ACTIVE, so during the dcache shrink the last iput() of a
lazytime inode still redirties it and reaches the isize expansion. The
expansion can move xattrs out to a block, and creating the EA inode for
them needs s_root, which ext4_xattr_inode_create() refuses without.
ext4_try_to_expand_extra_isize() already declines to expand when the
superblock is not active, but that test does not cover this window.
Decline while s_root is gone as well. The expansion is best effort and
__ext4_mark_inode_dirty() ignores its return value, so nothing else
changes; the inode can be expanded on a later mount.
Running the syzbot reproducer for 60 seconds produced 3583 splats before
this change and none after it, with the same number of mount cycles.
Cc: stable@kernel.org
Reported-by: syzbot+4b03894b6ec5753ddf24@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b03894b6ec5753ddf24
Fixes: f31173c19901 ("ext4: refuse to create ea block when umounted")
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Jun Nie <jun.nie@linaro.org>
Link: https://patch.msgid.link/20260824094512.2436628-1-hemanth.selam@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/inode.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 206c6245c6192..fb0548b3355c5 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -6600,8 +6600,14 @@ static int ext4_try_to_expand_extra_isize(struct inode *inode,
* When !SB_ACTIVE, iput triggers write_inode_now() which acquires
* s_writepages_rwsem, causing a deadlock with the caller's active
* jbd2 handle (lock order: s_writepages_rwsem -> jbd2_handle).
+ *
+ * Skip it while unmounting as well. shrink_dcache_for_umount()
+ * clears s_root before generic_shutdown_super() clears SB_ACTIVE, and
+ * the last iput() of a lazytime inode in that window redirties it and
+ * lands here. Moving xattrs out to a block then needs a new EA inode,
+ * which ext4_xattr_inode_create() refuses without s_root.
*/
- if (unlikely(!(inode->i_sb->s_flags & SB_ACTIVE)))
+ if (unlikely(!(inode->i_sb->s_flags & SB_ACTIVE) || !inode->i_sb->s_root))
return -EBUSY;
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0564/1257] ext4: dont report delalloc data as a hole on indirect-mapped inodes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (562 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0563/1257] ext4: skip extra isize expansion while unmounting Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0565/1257] ext4: fix ABBA deadlock in ext4_rmdir() Greg Kroah-Hartman
` (434 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Monakov, Jan Kara,
Daejun Park, Zhang Yi, Theodore Tso, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daejun Park <daejun7.park@samsung.com>
[ Upstream commit aed43f47e1edeee1454eea86006a8c09480e5ed3 ]
When a plain lookup finds no block, ext4_ind_map_blocks() sizes the hole
it reports by counting the empty subtrees under 'partial' in the on-disk
indirect tree. That count knows nothing about delayed allocation, so a
range holding delalloc data that has not been written back yet is
reported as a plain hole. The extent-mapped path does not have this
problem: it trims the hole it found at the first delayed extent before
returning it.
ext4_map_blocks() consults the extent status tree before it calls into
the mapping layer, so a query that starts exactly on the delayed block
still finds it. A query that starts earlier does not, because the hole
reported for the earlier block already spans the delayed one. On a
4k-block filesystem, lseek(SEEK_DATA) from offset 0 on a file whose only
data block is at logical block N and is still dirty returns:
N = 0..11 direct blocks N << 12
N = 12 first single-indirect block N << 12
N = 13..1035 inside that indirect block -1 ENXIO
N = 1036 first double-indirect block N << 12
Blocks 12 and 1036 survive because the query lands on the delayed block
itself. Blocks 13..1035 are swallowed by the 1024-block hole reported
for block 12. fiemap loses the same data for the same reason.
An ext3 filesystem mounted as ext4 hits this during ordinary use: ext3
inodes stay indirect mapped, while mount -t ext4 turns on delayed
allocation even though mounting ext3 with -o delalloc is explicitly
rejected. install(1) from coreutils uses SEEK_DATA to locate data in
its source file, so installing a sparse file that has not been written
back silently produces a destination of the right size holding none of
the data:
truncate -s 1G img && mkfs.ext3 -F img && mount -t ext4 img mnt
echo | dd of=mnt/src bs=1 count=1 seek=64K
install mnt/src mnt/dst
cmp mnt/src mnt/dst # differ: char 65537
Reconciling a hole with the extent status tree does not depend on how
the hole was found, so instead of open coding it a second time, split
the delalloc handling out of ext4_ext_determine_insert_hole() into
ext4_determine_insert_hole(), which takes the hole the caller located,
and call that from ext4_ind_map_blocks() as well. All the special cases
and the comments explaining them stay in one place.
Two things change for indirect-mapped inodes. They now cache the holes
they report, as the extent-mapped path already does: ext4_punch_hole()
already puts EXTENT_STATUS_HOLE on such inodes, ext4_map_blocks() and
ext4_da_map_blocks() already handle a cached hole, the latter by
replacing it with the delayed extent, and consecutive hole entries
merge, so the tree does not grow with the length of a scan. And when a
delayed extent covers the queried block itself - a race, since
ext4_map_blocks() found nothing in the tree just before - the hole is
now reported only up to the end of that extent instead of in full.
The indirect path passes hole_start == lblk, so the "delalloc extent in
front of the queried range" case cannot be reached there:
__es_tree_search() never returns an extent ending before the block it
was searched for.
With this the sweep above returns N << 12 for every N, while the
nodelalloc and extent-mapped controls are unchanged. generic/225,
generic/285, generic/448 and generic/490 pass on ext4 made both with and
without the extent feature. generic/286 and generic/436 pass on
extent-mapped ext4 and are skipped without it, since they need
fallocate.
Fixes: facab4d9711e ("ext4: return hole from ext4_map_blocks()")
Reported-by: Alexander Monakov <amonakov@ispras.ru>
Closes: https://lore.kernel.org/linux-ext4/594c17d9-c00f-e485-96fb-cedf27ce3aa3@ispras.ru/
Suggested-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20260827084829epcms2p6ecc0c39a71d0c3eebf9cb1ade77314f6@epcms2p6
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/ext4.h | 3 +++
fs/ext4/extents.c | 26 +++++++++++++-------------
fs/ext4/indirect.c | 17 +++++++++++++++++
3 files changed, 33 insertions(+), 13 deletions(-)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index af70bb26bb54b..859227f361620 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -3907,6 +3907,9 @@ extern void ext4_ext_tree_init(handle_t *handle, struct inode *inode);
extern int ext4_ext_index_trans_blocks(struct inode *inode, int extents);
extern int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
struct ext4_map_blocks *map, int flags);
+ext4_lblk_t ext4_determine_insert_hole(struct inode *inode, ext4_lblk_t lblk,
+ ext4_lblk_t hole_start,
+ ext4_lblk_t hole_len);
extern int ext4_ext_truncate(handle_t *, struct inode *);
extern int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
ext4_lblk_t end);
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 3bf0a6cdbec2e..c36beaf7a4252 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4190,21 +4190,19 @@ static int get_implied_cluster_alloc(struct super_block *sb,
}
/*
- * Determine hole length around the given logical block, first try to
- * locate and expand the hole from the given @path, and then adjust it
- * if it's partially or completely converted to delayed extents, insert
- * it into the extent cache tree if it's indeed a hole, finally return
- * the length of the determined extent.
+ * Adjust the hole [@hole_start, @hole_start + @hole_len) the caller found
+ * around the queried block @lblk if it's partially or completely converted
+ * to delayed extents, insert it into the extent cache tree if it's indeed a
+ * hole, finally return the length of the determined extent starting at
+ * @lblk. @hole_start must not be behind @lblk.
*/
-static ext4_lblk_t ext4_ext_determine_insert_hole(struct inode *inode,
- struct ext4_ext_path *path,
- ext4_lblk_t lblk)
+ext4_lblk_t ext4_determine_insert_hole(struct inode *inode, ext4_lblk_t lblk,
+ ext4_lblk_t hole_start,
+ ext4_lblk_t hole_len)
{
- ext4_lblk_t hole_start, len;
+ ext4_lblk_t len = hole_len;
struct extent_status es;
- hole_start = lblk;
- len = ext4_ext_find_hole(inode, path, &hole_start);
again:
ext4_es_find_extent_range(inode, &ext4_es_is_delayed, hole_start,
hole_start + len - 1, &es);
@@ -4371,9 +4369,11 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
* we couldn't try to create block if flags doesn't contain EXT4_GET_BLOCKS_CREATE
*/
if ((flags & EXT4_GET_BLOCKS_CREATE) == 0) {
- ext4_lblk_t len;
+ ext4_lblk_t hole_start = map->m_lblk, len;
- len = ext4_ext_determine_insert_hole(inode, path, map->m_lblk);
+ len = ext4_ext_find_hole(inode, path, &hole_start);
+ len = ext4_determine_insert_hole(inode, map->m_lblk,
+ hole_start, len);
map->m_pblk = 0;
map->m_len = min_t(unsigned int, map->m_len, len);
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index 5aec759eed705..a495080df7109 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -586,6 +586,23 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
for (i = partial - chain + 1; i < depth; i++)
count = count * epb + (epb - offsets[i] - 1);
count++;
+
+ /*
+ * The count knows nothing about delayed allocation, so let
+ * the common helper reconcile it with the extent status
+ * tree. Only when the lookup really did find a hole:
+ * ext4_get_branch() also returns a non-NULL partial when it
+ * failed, and caching a hole for a range it could not read
+ * would answer every later read from that cache instead of
+ * retrying. Clamp the count first, a subtree can be bigger
+ * than the logical block space when the block size is large.
+ */
+ if (!err) {
+ count = umin(count, EXT_MAX_BLOCKS - map->m_lblk);
+ count = ext4_determine_insert_hole(inode, map->m_lblk,
+ map->m_lblk, count);
+ }
+
/* Fill in size of a hole we found */
map->m_pblk = 0;
map->m_len = umin(map->m_len, count);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0565/1257] ext4: fix ABBA deadlock in ext4_rmdir()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (563 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0564/1257] ext4: dont report delalloc data as a hole on indirect-mapped inodes Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0566/1257] ext4: fix out-of-bounds read in ext4_get_group_info() Greg Kroah-Hartman
` (433 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Sarthak Kukreti,
Sergey Senozhatsky, Jan Kara, Baokun Li, Zhang Yi, Theodore Tso,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <senozhatsky@chromium.org>
[ Upstream commit 19e16597f9baf1b5719a3a6c710486446f6808fd ]
We observe the following ABBA deadlock (casefolding enabled):
INFO: task jbd2/dm-13-8:447 blocked for more than 720 seconds.
task:jbd2/dm-13-8 state:D stack:0 pid:447 tgid:447 ppid:2
Call Trace:
<TASK>
__schedule+0xc2c/0xe60
schedule+0x40/0xe0
jbd2_journal_wait_updates+0x8f/0xf0
jbd2_journal_commit_transaction+0x321/0x1850
kjournald2+0xa9/0x230
kthread+0x226/0x2a0
ret_from_fork+0x101/0x1e0
ret_from_fork_asm+0x1a/0x30
INFO: task Thread-10:4161 blocked for more than 720 seconds.
task:Thread-10 state:D stack:0 pid:4161 tgid:3848 ppid:540
Call Trace:
<TASK>
__schedule+0xc2c/0xe60
schedule+0x40/0xe0
wait_transaction_locked+0x8c/0xd0
start_this_handle+0x252/0x870
jbd2__journal_start+0x120/0x280
__ext4_journal_start_sb+0x11a/0x250
ext4_evict_inode+0x208/0x760
iput+0x222/0x5c0
dput+0x293/0x690
____fput+0x145/0x2b0
task_work_run+0x7a/0xb0
exit_to_user_mode_loop+0xc0/0xd0
do_syscall_64+0x14b/0xf10
entry_SYSCALL_64_after_hwframe+0x76/0x7e
NMI backtrace for cpu 0
CPU: 0 UID: 1010216 PID: 4160 Comm: Thread-7
RIP: 0010:d_walk+0x0/0x290
[..]
Call Trace:
<TASK>
shrink_dcache_parent+0xb2/0x100
d_invalidate+0x50/0x110
ext4_rmdir+0x3a2/0x3d0
vfs_rmdir+0x9d/0x1d0
do_rmdir+0xf0/0x330
__x64_sys_unlinkat+0x34/0x50
do_syscall_64+0x61/0xf10
The problem is that ext4_rmdir() calls d_invalidate() before stopping
the jbd2 transaction handle. Because d_invalidate() traverses child
dentries it can encounter dying or in-use dentries. If a concurrent
thread executing __dentry_kill() on a child dentry invokes ext4_evict_inode(),
it requests a new transaction handle via ext4_journal_start(), which
waits for all running handles to close. However, the thread executing
ext4_rmdir() still holds its active transaction handle while looping
in shrink_dcache_parent() waiting for the dying child dentry to complete
eviction.
Stop transaction handle in ext4_rmdir() before calling d_invalidate().
Cc: stable@kernel.org
Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups")
Co-developed-by: Sarthak Kukreti <sarthakkukreti@google.com>
Signed-off-by: Sarthak Kukreti <sarthakkukreti@google.com>
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20260827125158.4030598-1-senozhatsky@chromium.org
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/namei.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index a6386c1d237f1..231a274b814ec 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3209,19 +3209,20 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
ext4_fc_track_unlink(handle, dentry);
retval = ext4_mark_inode_dirty(handle, dir);
+end_rmdir:
+ brelse(bh);
+ if (handle)
+ ext4_journal_stop(handle);
+
/* VFS negative dentries are incompatible with Encoding and
* Case-insensitiveness. Eventually we'll want avoid
* invalidating the dentries here, alongside with returning the
* negative dentries at ext4_lookup(), when it is better
* supported by the VFS for the CI case.
*/
- if (IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
+ if (!retval && IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
d_invalidate(dentry);
-end_rmdir:
- brelse(bh);
- if (handle)
- ext4_journal_stop(handle);
return retval;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0566/1257] ext4: fix out-of-bounds read in ext4_get_group_info()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (564 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0565/1257] ext4: fix ABBA deadlock in ext4_rmdir() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0567/1257] nilfs2: validate directory position after llseek in readdir Greg Kroah-Hartman
` (432 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Theodore Tso, Andreas Dilger,
Baokun Li, Jan Kara, Ojaswin Mujoo, Ritesh Harjani (IBM),
Zhang Yi, Jinjie Ruan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
[ Upstream commit b067d3c1f90b536e9aa9f48b19580475a0b34f0f ]
A plain read of s_groups_count in ext4_get_group_info() allows CPU
load-load reordering. On weak memory models, speculative prefetch of
s_group_info prior to the boundary check could lead to an out-of-bounds
read if a concurrent online resize expands the array and increments
s_groups_count.
The data race occurs between the ioctl configuration path (holding the
resize lock via ext4_resize_begin) and the lockless metadata lookup path:
CPU 0 (Writer, Resize Lock) CPU 1 (Reader, Lockless)
--------------------------- ------------------------
ext4_ioctl()
[EXT4_IOC_GROUP_ADD]
ext4_ioctl_group_add()
ext4_resize_begin() // Takes lock
ext4_group_add()
ext4_mb_alloc_groupinfo()
// Publishes expanded array via RCU
rcu_assign_pointer(s_group_info, ...)
ext4_flex_group_add()
ext4_update_super()
ext4_get_group_info()
// Speculative / out-of-order read
[Loads old/smaller s_group_info pointer]
[Plain C store / smp_wmb()]
sbi->s_groups_count += ...;
// Reads new s_groups_count,
// boundary check passes
if (group >= s_groups_count)
// Out-of-bounds array access!
sbi_array_rcu_deref(..., s_group_info)
Fix this by using ext4_get_groups_count() to enforce acquire semantics.
Cc: stable@vger.kernel.org
Cc: "Theodore Ts'o" <tytso@mit.edu>
Cc: Andreas Dilger <adilger.kernel@dilger.ca>
Cc: Baokun Li <libaokun@linux.alibaba.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Zhang Yi <yi.zhang@huawei.com>
Fixes: 5354b2af3406 ("ext4: allow ext4_get_group_info() to fail")
Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40huawei.com
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Link: https://patch.msgid.link/20260902074805.398540-8-ruanjinjie@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/balloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 52f4c5169f914..778fe8788f06e 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -329,7 +329,7 @@ struct ext4_group_info *ext4_get_group_info(struct super_block *sb,
struct ext4_group_info **grp_info;
long indexv, indexh;
- if (unlikely(group >= EXT4_SB(sb)->s_groups_count))
+ if (unlikely(group >= ext4_get_groups_count(sb)))
return NULL;
if (unlikely(!EXT4_SB(sb)->s_group_info))
return NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0567/1257] nilfs2: validate directory position after llseek in readdir
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (565 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0566/1257] ext4: fix out-of-bounds read in ext4_get_group_info() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0568/1257] riscv: cfi: Bounds check restore token before swap Greg Kroah-Hartman
` (431 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jake Labelle, Ryusuke Konishi,
Viacheslav Dubeyko, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jake Labelle <southampton.jake.labelle@gmail.com>
[ Upstream commit de7f49c12566cc5c7437a2f26c6c754b9d4d5648 ]
nilfs_readdir() uses ctx->pos, which userspace can set to an arbitrary
value via llseek, as an offset into the directory folio and parses
whatever bytes sit there as a directory entry. A position pointing
into the middle of an entry -- or at unused bytes of a corrupted image
that the page validator never inspected -- makes dir_emit() copy up to
255 (name_len) bytes from a bogus entry, possibly reading past the end
of the folio and returning unrelated memory contents to userspace.
Snap unaligned positions onto a valid entry boundary by walking the
rec_len chain from the chunk start before parsing, as ext2 does in
ext2_validate_entry().
[ryusuke: fixed offset wrap-around in nilfs_validate_entry() and
conformed AI tag to guidelines]
Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations")
Assisted-by: Claude:claude-mythos-5
Signed-off-by: Jake Labelle <southampton.jake.labelle@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/dir.c | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c
index 8b53802b6ebd7..7686ca9228fc8 100644
--- a/fs/nilfs2/dir.c
+++ b/fs/nilfs2/dir.c
@@ -231,11 +231,27 @@ static struct nilfs_dir_entry *nilfs_next_entry(struct nilfs_dir_entry *p)
nilfs_rec_len_from_disk(p->rec_len));
}
+static inline unsigned int
+nilfs_validate_entry(char *base, unsigned int offset, unsigned int mask)
+{
+ struct nilfs_dir_entry *de = (struct nilfs_dir_entry *)(base + offset);
+ struct nilfs_dir_entry *p =
+ (struct nilfs_dir_entry *)(base + (offset & mask));
+
+ while ((char *)p < (char *)de) {
+ if (p->rec_len == 0)
+ break;
+ p = nilfs_next_entry(p);
+ }
+ return (char *)p - base;
+}
+
static int nilfs_readdir(struct file *file, struct dir_context *ctx)
{
loff_t pos = ctx->pos;
struct inode *inode = file_inode(file);
struct super_block *sb = inode->i_sb;
+ unsigned int chunk_size = nilfs_chunk_size(inode);
unsigned int offset = pos & ~PAGE_MASK;
unsigned long n = pos >> PAGE_SHIFT;
unsigned long npages = dir_pages(inode);
@@ -254,6 +270,24 @@ static int nilfs_readdir(struct file *file, struct dir_context *ctx)
ctx->pos += PAGE_SIZE - offset;
return -EIO;
}
+ /*
+ * ctx->pos comes from userspace via llseek and may point
+ * into the middle of an entry -- or at unvalidated bytes
+ * of a crafted image. offset is only nonzero here on the
+ * very first iteration (subsequent pages always start at
+ * offset 0, which -- like any chunk boundary -- is always
+ * a legitimate entry start, since no rec_len chain crosses
+ * a chunk boundary). Snap a non-chunk-aligned offset onto
+ * a real entry boundary by walking the chain from the
+ * enclosing chunk's start, as ext2 does; otherwise
+ * dir_emit() copies name_len bytes from a fake entry,
+ * reading past the end of the folio.
+ */
+ if (offset & (chunk_size - 1)) {
+ offset = nilfs_validate_entry(kaddr, offset,
+ ~(chunk_size - 1));
+ ctx->pos = ((loff_t)n << PAGE_SHIFT) + offset;
+ }
de = (struct nilfs_dir_entry *)(kaddr + offset);
limit = kaddr + nilfs_last_byte(inode, n) -
NILFS_DIR_REC_LEN(1);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0568/1257] riscv: cfi: Bounds check restore token before swap
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (566 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0567/1257] nilfs2: validate directory position after llseek in readdir Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0569/1257] riscv: cfi: Only write envcfg CSR when task is current Greg Kroah-Hartman
` (430 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Holland, Paul Walmsley,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <samuel.holland@sifive.com>
[ Upstream commit df333b72c0e14d6cffec72ce9a00503f12d1e28d ]
Currently the user-provided shadow stack restore token is not checked
before being used as the address in ssamoswap.d. While an invalid
restore token will be caught and raise SIGSEGV, this happens after
writing 4 bytes of zeroes anywhere in the address space. Check that the
restore token is at least a valid user address before the swap to ensure
we do not scribble over kernel memory.
Fixes: 66c9c713de59 ("riscv/signal: save and restore the shadow stack on a signal")
Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Link: https://patch.msgid.link/20261007155748.291814-1-samuel.holland@sifive.com
Cc: stable@vger.kernel.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/usercfi.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/riscv/kernel/usercfi.c b/arch/riscv/kernel/usercfi.c
index dec0ba5eff5ea..23c4d6d9d8cbc 100644
--- a/arch/riscv/kernel/usercfi.c
+++ b/arch/riscv/kernel/usercfi.c
@@ -206,10 +206,13 @@ int save_user_shstk(struct task_struct *tsk, unsigned long *saved_shstk_ptr)
*/
int restore_user_shstk(struct task_struct *tsk, unsigned long shstk_ptr)
{
+ unsigned long __user *token_ptr = (unsigned long __user *)shstk_ptr;
unsigned long token = 0;
- token = amo_user_shstk((unsigned long __user *)shstk_ptr, 0);
+ if (!access_ok(token_ptr, sizeof(token)))
+ return -EFAULT;
+ token = amo_user_shstk(token_ptr, 0);
if (token == -1)
return -EFAULT;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0569/1257] riscv: cfi: Only write envcfg CSR when task is current
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (567 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0568/1257] riscv: cfi: Bounds check restore token before swap Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0570/1257] md: dont hand out the array before md_alloc() has added mddev->kobj Greg Kroah-Hartman
` (429 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Holland, Paul Walmsley,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <samuel.holland@sifive.com>
[ Upstream commit ca47e289113552fcbd7ab9268cee1f0c27d35590 ]
set_shstk_status() and set_indir_lp_status() take a task argument, which
lets them operate on tasks other than current, but they always write the
envcfg CSR for the current task. Fix this with the envcfg_update_bits()
helper, which only writes the envcfg CSR when operating on current.
Fixes: 61a0200211d31e ("riscv: Implement arch-agnostic shadow stack prctls")
Fixes: 8a9e22d2ca5855 ("riscv: Implement indirect branch tracking prctls")
Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Link: https://patch.msgid.link/20261007155748.291814-2-samuel.holland@sifive.com
Cc: stable@vger.kernel.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/usercfi.c | 15 +++------------
1 file changed, 3 insertions(+), 12 deletions(-)
diff --git a/arch/riscv/kernel/usercfi.c b/arch/riscv/kernel/usercfi.c
index 23c4d6d9d8cbc..86141e5bab822 100644
--- a/arch/riscv/kernel/usercfi.c
+++ b/arch/riscv/kernel/usercfi.c
@@ -15,6 +15,7 @@
#include <linux/syscalls.h>
#include <linux/prctl.h>
#include <asm/csr.h>
+#include <asm/switch_to.h>
#include <asm/usercfi.h>
unsigned long riscv_nousercfi __read_mostly;
@@ -66,12 +67,7 @@ void set_shstk_status(struct task_struct *task, bool enable)
task->thread_info.user_cfi_state.ubcfi_en = enable ? 1 : 0;
- if (enable)
- task->thread.envcfg |= ENVCFG_SSE;
- else
- task->thread.envcfg &= ~ENVCFG_SSE;
-
- csr_write(CSR_ENVCFG, task->thread.envcfg);
+ envcfg_update_bits(task, ENVCFG_SSE, enable ? ENVCFG_SSE : 0);
}
void set_shstk_lock(struct task_struct *task, bool lock)
@@ -96,12 +92,7 @@ void set_indir_lp_status(struct task_struct *task, bool enable)
task->thread_info.user_cfi_state.ufcfi_en = enable ? 1 : 0;
- if (enable)
- task->thread.envcfg |= ENVCFG_LPE;
- else
- task->thread.envcfg &= ~ENVCFG_LPE;
-
- csr_write(CSR_ENVCFG, task->thread.envcfg);
+ envcfg_update_bits(task, ENVCFG_LPE, enable ? ENVCFG_LPE : 0);
}
void set_indir_lp_lock(struct task_struct *task, bool lock)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0570/1257] md: dont hand out the array before md_alloc() has added mddev->kobj
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (568 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0569/1257] riscv: cfi: Only write envcfg CSR when task is current Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0571/1257] mm/hugetlb: charge folios to the target mms memcg Greg Kroah-Hartman
` (428 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+95eeb4ada2349a2170ea, Yu Kuai,
Yogesh Gaur, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yogesh Gaur <yogeshgaur.83@gmail.com>
[ Upstream commit d1472ca2ca5de8ecd2b358411eb14c031404ecf0 ]
md_alloc() publishes the gendisk before it is done setting the mddev up:
disk->private_data = mddev;
...
error = add_disk(disk);
if (error)
goto out_put_disk;
kobject_init(&mddev->kobj, &md_ktype);
error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
add_disk() makes /dev/mdN openable. mddev comes from mddev_alloc() and
is zeroed, so anything that gets in between add_disk() and kobject_add()
sees an mddev->kobj that has never been through kobject_init() - no
ktype, no kref, state_initialized clear.
syzbot opens the array in that window and issues ADD_NEW_DISK:
kobject: '(null)' (ffff8880120640f0): is not initialized, yet
kobject_get() is being called.
WARNING: lib/kobject.c:642 at kobject_add_internal+0xea/0xcd0 lib/kobject.c:225
kobject_add_varg lib/kobject.c:374 [inline]
kobject_add+0x163/0x240 lib/kobject.c:426
bind_rdev_to_array+0x80c/0xdd0 drivers/md/md.c:2621
md_add_new_disk+0xe3b/0x1850 drivers/md/md.c:7684
md_ioctl+0x200a/0x2610 drivers/md/md.c:8499
bind_rdev_to_array() is not the only way in. md_run() calls
sysfs_create_group(&mddev->kobj, &md_redundancy_group), and
internal_create_group() has its own WARN_ON(!kobj->sd), so RUN_ARRAY in
the same window warns too.
Every ioctl that can reach mddev->kobj runs under reconfig_mutex, so
hold it across add_disk() and kobject_add(). An ioctl issued in the
window now waits for md_alloc() to finish instead of seeing a
half-built mddev, and opening the array still succeeds. The ioctls
md_ioctl() serves without the mutex only read array state and return
-ENODEV on an array with no disks.
Hoisting kobject_init() above add_disk() is not an option: commit
ca39f7502425 ("md: fix mddev->kobj lifetime") moved it below add_disk()
so that md_alloc()'s error paths, which free the mddev directly, never
see an initialised kobject.
Fixes: ca39f7502425 ("md: fix mddev->kobj lifetime")
Reported-by: syzbot+95eeb4ada2349a2170ea@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6aaf3284.514bccd6.255447.0003.GAE@google.com/
Suggested-by: Yu Kuai <yukuai@fygo.io>
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Link: https://patch.msgid.link/20261006122904.1538-1-yogeshgaur.83@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 1caa92b40f9a7..d8ecf76d4a5f1 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6388,12 +6388,22 @@ struct mddev *md_alloc(dev_t dev, char *name)
disk->events |= DISK_EVENT_MEDIA_CHANGE;
mddev->gendisk = disk;
+
+ /*
+ * add_disk() makes the array openable before mddev->kobj exists.
+ * Hold reconfig_mutex until kobject_add() is done so that ioctls
+ * issued in between wait instead of using an uninitialised kobj.
+ */
+ mddev_lock_nointr(mddev);
error = add_disk(disk);
- if (error)
+ if (error) {
+ mddev_unlock(mddev);
goto out_put_disk;
+ }
kobject_init(&mddev->kobj, &md_ktype);
error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
+ mddev_unlock(mddev);
if (error) {
/*
* The disk is already live at this point. Clear the hold flag
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0571/1257] mm/hugetlb: charge folios to the target mms memcg
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (569 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0570/1257] md: dont hand out the array before md_alloc() has added mddev->kobj Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0572/1257] mm/memory: constrain generic_access_phys() to page boundary Greg Kroah-Hartman
` (427 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinmeng Zhou, Andrew Morton,
Muchun Song, Hongfu Li, David Hildenbrand, Johannes Weiner,
Michal Hocko, Nhat Pham, Oscar Salvador, Roman Gushchin,
Shakeel Butt, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinmeng Zhou <jinmengzhou22@gmail.com>
[ Upstream commit c2deb1356d82c9d54bd2fcf1241cc97eb66fd81f ]
HugeTLB folios are currently charged to the memcg of the allocating task.
This gives the wrong result when a userfaultfd handler populates a HugeTLB
VMA that belongs to another process. The UFFDIO_COPY ioctl operates on
the userfaultfd context's mm, but get_mem_cgroup_from_current() charges
the folio to the handler's memcg instead.
This can be reproduced by placing the faulting process and its userfaultfd
handler in different memory cgroups. Have the target process register a
HugeTLB mapping with userfaultfd, trigger a missing fault, and let the
handler resolve it with UFFDIO_COPY. The hugepage usage is then reported
in the handler's memory.current instead of the target's.
The generic userfaultfd population path avoids this problem by charging
folios to dst_vma->vm_mm.
Pass the target mm through hugetlb_alloc_folio() and charge the folio by
using get_mem_cgroup_from_mm(). This preserves the existing charge timing
and error handling while making HugeTLB userfaultfd population consistent
with the generic path.
Link: https://lore.kernel.org/20260903075048.3316-1-zhoujinmeng@bytedance.com
Fixes: 8cba9576df60 ("hugetlb: memcg: account hugetlb-backed memory in memory controller")
Signed-off-by: Jinmeng Zhou <zhoujinmeng@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Hongfu Li <lihongfu@kylinos.cn>
Cc: David Hildenbrand <david@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/hugetlb.h | 3 ++-
include/linux/memcontrol.h | 8 +++++---
mm/hugetlb.c | 9 ++++++---
mm/memcontrol.c | 6 ++++--
4 files changed, 17 insertions(+), 9 deletions(-)
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 16c4c4caa126c..45ada75dc04e9 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -699,7 +699,8 @@ enum hugetlb_alloc_flag {
#define HUGETLB_ALLOC_USE_GLOBAL_RESERVATIONS BIT(HUGETLB_ALLOC_USE_GLOBAL_RESERVATIONS_BIT)
struct folio *hugetlb_alloc_folio(struct hstate *h,
- struct mempolicy_interpreted *mpoli, u8 alloc_flags);
+ struct mempolicy_interpreted *mpoli, struct mm_struct *mm,
+ u8 alloc_flags);
struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,
unsigned long addr, bool cow_from_owner);
struct folio *alloc_hugetlb_folio_nodemask(struct hstate *h, int preferred_nid,
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 7d1c0ce189a88..362af58e50a43 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -662,7 +662,8 @@ static inline int mem_cgroup_charge(struct folio *folio, struct mm_struct *mm,
return __mem_cgroup_charge(folio, mm, gfp);
}
-int mem_cgroup_charge_hugetlb(struct folio* folio, gfp_t gfp);
+int mem_cgroup_charge_hugetlb(struct folio *folio, struct mm_struct *mm,
+ gfp_t gfp);
int mem_cgroup_swapin_charge_folio(struct folio *folio, unsigned short id,
struct mm_struct *mm, gfp_t gfp);
@@ -1156,9 +1157,10 @@ static inline int mem_cgroup_charge(struct folio *folio,
return 0;
}
-static inline int mem_cgroup_charge_hugetlb(struct folio* folio, gfp_t gfp)
+static inline int mem_cgroup_charge_hugetlb(struct folio *folio,
+ struct mm_struct *mm, gfp_t gfp)
{
- return 0;
+ return 0;
}
static inline int mem_cgroup_swapin_charge_folio(struct folio *folio,
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 930e40ac77077..1c2b5825b5614 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2827,6 +2827,7 @@ void wait_for_freed_hugetlb_folios(void)
* hugetlb_alloc_folio - Allocate a hugetlb folio.
* @h: Hugetlb state control block.
* @mpoli: Interpreted memory policy to use for allocation.
+ * @mm: Memory descriptor of the allocation target.
* @alloc_flags: Flags controlling the allocation behavior.
*
* Allocates a hugetlb folio and handles cgroup charging and global hstate
@@ -2836,7 +2837,8 @@ void wait_for_freed_hugetlb_folios(void)
* -ENOSPC if cgroup charging fails or no folio is available.
*/
struct folio *hugetlb_alloc_folio(struct hstate *h,
- struct mempolicy_interpreted *mpoli, u8 alloc_flags)
+ struct mempolicy_interpreted *mpoli, struct mm_struct *mm,
+ u8 alloc_flags)
{
bool charge_hugetlb_cgroup_rsvd = alloc_flags &
HUGETLB_ALLOC_CHARG_CGROUP_RSVD;
@@ -2891,7 +2893,8 @@ struct folio *hugetlb_alloc_folio(struct hstate *h,
spin_unlock_irq(&hugetlb_lock);
- ret = mem_cgroup_charge_hugetlb(folio, gfp | __GFP_RETRY_MAYFAIL);
+ ret = mem_cgroup_charge_hugetlb(folio, mm,
+ gfp | __GFP_RETRY_MAYFAIL);
/*
* Unconditionally increment NR_HUGETLB here because if
* mem_cgroup_charge_hugetlb failed, freeing the page will
@@ -3034,7 +3037,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,
.nodemask = nodemask,
};
- folio = hugetlb_alloc_folio(h, &mpoli, alloc_flags);
+ folio = hugetlb_alloc_folio(h, &mpoli, vma->vm_mm, alloc_flags);
mpol_cond_put(mpol);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 259f9f43b38b1..1f03f5e775554 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5242,6 +5242,7 @@ int __mem_cgroup_charge(struct folio *folio, struct mm_struct *mm, gfp_t gfp)
/**
* mem_cgroup_charge_hugetlb - charge the memcg for a hugetlb folio
* @folio: folio being charged
+ * @mm: mm context of the allocation target
* @gfp: reclaim mode
*
* This function is called when allocating a huge page folio, after the page has
@@ -5251,9 +5252,10 @@ int __mem_cgroup_charge(struct folio *folio, struct mm_struct *mm, gfp_t gfp)
* Returns ENOMEM if the memcg is already full.
* Returns 0 if either the charge was successful, or if we skip the charging.
*/
-int mem_cgroup_charge_hugetlb(struct folio *folio, gfp_t gfp)
+int mem_cgroup_charge_hugetlb(struct folio *folio, struct mm_struct *mm,
+ gfp_t gfp)
{
- struct mem_cgroup *memcg = get_mem_cgroup_from_current();
+ struct mem_cgroup *memcg = get_mem_cgroup_from_mm(mm);
int ret = 0;
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0572/1257] mm/memory: constrain generic_access_phys() to page boundary
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (570 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0571/1257] mm/hugetlb: charge folios to the target mms memcg Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0573/1257] mm: memcg: redirect stats updates of dying memcgs for all hierarchies Greg Kroah-Hartman
` (426 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luxiao Xu, Ren Wei, Andrew Morton,
Vega, David Hildenbrand, Grazvydas Ignotas, Liam R. Howlett,
Lorenzo Stoakes, Michal Hocko, Mike Rapoport, Suren Baghdasaryan,
Vlastimil Babka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luxiao Xu <rakukuip@gmail.com>
[ Upstream commit ae0298a5fbeff32951c0d31398ccec97ec6aa0ea ]
This patch addresses an issue in generic_access_phys() where accessing
memory across page boundaries in PFNMAP VMAs assumes physical pages are
contiguous, which can lead to accessing unintended physical memory or
exceeding VMA boundaries.
generic_access_phys() improperly validates the memory access range: it
only validates the start address using follow_pfnmap_start() and passes
PAGE_ALIGN(len + offset) to ioremap_prot().
This poses two problems:
1. In PFNMAP VMAs, consecutive virtual pages are not guaranteed to be
physically contiguous, and individual PTEs may have different access
permissions or writability.
2. The mapping may cross VMA boundaries if len extends beyond vma->vm_end.
Constrain the access in generic_access_phys() to at most the current page
boundary (PAGE_SIZE - offset) and map only a single PAGE_SIZE via
ioremap_prot(). Since the caller __access_remote_vm() already loops over
the requested length and handles partial transfers, it will naturally
iterate over the remaining pages.
Also add a missing (resource_size_t) cast during PFN re-validation to
avoid truncation on 32-bit PAE systems.
Link: https://lore.kernel.org/e06e28a46c2a176238f03b5740df0913e57c2861.1788842306.git.rakukuip@gmail.com
Fixes: 9cb12d7b4cca ("mm/memory.c: actually remap enough memory")
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Vega <vega@nebusec.ai>
Suggested-by: David Hildenbrand <david@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Assisted-by: LLM
Cc: Grazvydas Ignotas <notasas@gmail.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/memory.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/mm/memory.c b/mm/memory.c
index 8b0c2c735d3de..4f8199de44afb 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -7164,6 +7164,12 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
bool writable;
struct follow_pfnmap_args args = { .vma = vma, .address = addr };
+ /*
+ * Limit access to one page at a time, as that's what follow_pfnmap_start()
+ * guarantees; expect the caller to retry to read larger ranges.
+ */
+ len = min_t(int, len, PAGE_SIZE - offset);
+
retry:
if (follow_pfnmap_start(&args))
return -EINVAL;
@@ -7175,7 +7181,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
if ((write & FOLL_WRITE) && !writable)
return -EINVAL;
- maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot);
+ maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot);
if (!maddr)
return -ENOMEM;
@@ -7183,7 +7189,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
goto out_unmap;
if ((pgprot_val(prot) != pgprot_val(args.pgprot)) ||
- (phys_addr != (args.pfn << PAGE_SHIFT)) ||
+ (phys_addr != ((resource_size_t)args.pfn << PAGE_SHIFT)) ||
(writable != args.writable)) {
follow_pfnmap_end(&args);
iounmap(maddr);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0573/1257] mm: memcg: redirect stats updates of dying memcgs for all hierarchies
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (571 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0572/1257] mm/memory: constrain generic_access_phys() to page boundary Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0574/1257] mm: workingset: use lruvec_page_state_local() to count lru pages Greg Kroah-Hartman
` (425 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Zhu, Andrew Morton, Shakeel Butt,
Axel Rasmussen, Barry Song, David Hildenbrand, Johannes Weiner,
Kairui Song, Lorenzo Stoakes, Michal Hocko, Muchun Song,
Roman Gushchin, Wei Xu, Yuanchu Xie, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Zhu <zhuhui@kylinos.cn>
[ Upstream commit 7ee68fff2ba6740558cab195925b3a7ff7a1480f ]
Patch series "mm: workingset: fix the shadow node budget under MGLRU", v5.
Commit 7404bd37cfbe ("mm: workingset: use lruvec_lru_size() to get the
number of lru pages") broke the workingset shadow node budget under MGLRU:
lruvec_lru_size() reads mz->lru_zone_size, which MGLRU never maintains, so
count_shadow_nodes() sees the evictable LRU lists as empty and the shadow
shrinker reclaims eviction tokens almost as fast as they are created,
losing thrashing protection.
Patch 1 extends the dying-mcg stat redirection (previously cgroup v1 only)
to all hierarchies, addressing the reparenting race that motivated
7404bd37cfbe.
Patch 2 then switches count_shadow_nodes() back to
lruvec_page_state_local(), which both classic LRU and MGLRU maintain.
Patch 3 recovers the performance. Patch 1 added an unconditional
rcu_read_lock() to the stat update fast path; patch 3 checks
memcg_is_dying() first and takes the RCU lock only on the rare dying path.
Patch 4 closes an accounting gap that patch 2 makes visible: on cgroup v2,
reparent_state_local() never moves the dying memcg's non-hierarchical
lruvec stats to the parent, so the parent receives the uncharges without
the matching charges and its state_local underflows. Patch 4 reparents
those stats, mirroring cgroup v1.
Performance testing
===================
The test script and the raw results are available at [1].
Environment: 10-vCPU QEMU guest, 8 GiB RAM, cgroup v2; 7 runs per
configuration, medians reported. Workloads:
w1-anon-churn: single-threaded anon fault/charge loop in a memcg
(MADV_DONTNEED + re-fault, no reclaim). Every touch
is a real fault with charge and memcg stat updates,
so it stresses exactly the fast path patch 1 changes.
This is the meaningful signal: it is not reclaim-bound,
so the small fast-path overhead is not drowned out.
w2-file-churn: file read loop under memory.high pressure
(reclaim-bound; the differences below are within
run-to-run noise and are shown for completeness only).
w3-reparent: reparent accounting sanity check.
w1-anon-churn (pages/s):
classic LRU MGLRU
base 4393028 4377122
patches 1-2 4385996 (-0.2%) 4352887 (-0.6%)
patches 1-3 4381832 (-0.3%) 4377053 (+0.0%)
w2-file-churn (MB/s):
classic LRU MGLRU
base 8277 8226
patches 1-2 8226 (-0.6%) 8123 (-1.3%)
patches 1-3 8157 (-1.4%) 8294 (+0.8%)
w3-reparent passed on all kernels.
The small overhead visible with patches 1-2 comes from the redirection
added by patch 1; patch 3 brings w1 back to the base level in both LRU
configurations. The w2-file-churn differences are within run-to-run
noise: that workload is reclaim-bound and too noisy to expose the small
fast-path overhead, so w1-anon-churn is the meaningful signal. Patch 4
only touches the memcg offline path and is not exercised by these
workloads.
This patch (of 4):
get_non_dying_memcg_start() redirects the stat updates of a dying memcg to
its closest non-dying ancestor, but only on cgroup v1; on cgroup v2 the
stats keep being accounted to the dying memcg itself.
A later patch in this series restores lruvec_page_state_local() in
count_shadow_nodes() to fix the broken workingset shadow node budget under
MGLRU. count_shadow_nodes() is the only reader of those non-hierarchical
state_locals on cgroup v2: when a memcg is offlined, its pages are
reparented to the ancestor but their stat updates keep being accounted to
the dying memcg, so count_shadow_nodes() computes a wrong shadow node
budget and workingset thrashing protection is lost. This is user visible
as premature reclaim of hot page cache and degraded performance under
memory pressure. Apply the redirection to all hierarchies to fix this.
Offlining is rare, so the added cost on the stat update fast path is
limited to an rcu_read_lock() and a css_is_dying() check; the upward walk
happens only while a memcg is dying.
Link: https://lore.kernel.org/cover.1789096175.git.zhuhui@kylinos.cn
Link: https://lore.kernel.org/c1ef4ef6a84cac479e573f4423b734dc8176f7d5.1789096175.git.zhuhui@kylinos.cn
Link: https://gist.github.com/teawater/32f373ec41d185d840455eb167321a5a [1]
Fixes: 7404bd37cfbe ("mm: workingset: use lruvec_lru_size() to get the number of lru pages")
Signed-off-by: Hui Zhu <zhuhui@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/memcontrol.c | 30 +++++-------------------------
1 file changed, 5 insertions(+), 25 deletions(-)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 1f03f5e775554..af61dacf0d180 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -845,20 +845,14 @@ static long memcg_state_val_in_pages(int idx, long val)
return val < 0 ? -res : res;
}
-#ifdef CONFIG_MEMCG_V1
/*
- * Used in mod_memcg_state() and mod_memcg_lruvec_state() to avoid race with
- * reparenting of non-hierarchical state_locals.
+ * Used in mod_memcg_state() and mod_memcg_lruvec_state() to avoid race
+ * with reparenting of non-hierarchical state_locals. Offlining a
+ * memcg is rare, so do the redirection for all cgroup hierarchies.
*/
-static inline struct mem_cgroup *get_non_dying_memcg_start(struct mem_cgroup *memcg,
- bool *rcu_locked)
+static inline struct mem_cgroup *
+get_non_dying_memcg_start(struct mem_cgroup *memcg, bool *rcu_locked)
{
- /* Rebinding can cause this value to be changed at runtime */
- if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) {
- *rcu_locked = false;
- return memcg;
- }
-
rcu_read_lock();
*rcu_locked = true;
@@ -870,22 +864,8 @@ static inline struct mem_cgroup *get_non_dying_memcg_start(struct mem_cgroup *me
static inline void get_non_dying_memcg_end(bool rcu_locked)
{
- if (!rcu_locked)
- return;
-
rcu_read_unlock();
}
-#else
-static inline struct mem_cgroup *get_non_dying_memcg_start(struct mem_cgroup *memcg,
- bool *rcu_locked)
-{
- return memcg;
-}
-
-static inline void get_non_dying_memcg_end(bool rcu_locked)
-{
-}
-#endif
static void __mod_memcg_state(struct mem_cgroup *memcg,
enum memcg_stat_item idx, long val)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0574/1257] mm: workingset: use lruvec_page_state_local() to count lru pages
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (572 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0573/1257] mm: memcg: redirect stats updates of dying memcgs for all hierarchies Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0575/1257] mm: memcg: skip the RCU lock when the memcg is not dying Greg Kroah-Hartman
` (424 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Zhu, Andrew Morton, Shakeel Butt,
Barry Song, Kairui Song, Axel Rasmussen, David Hildenbrand,
Johannes Weiner, Lorenzo Stoakes, Michal Hocko, Muchun Song,
Roman Gushchin, Wei Xu, Yuanchu Xie, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Zhu <zhuhui@kylinos.cn>
[ Upstream commit c7a37bac3ccc2732993705d3c3488b278b422ec6 ]
Commit 7404bd37cfbe ("mm: workingset: use lruvec_lru_size() to get the
number of lru pages") switched count_shadow_nodes() to lruvec_lru_size().
With CONFIG_MEMCG enabled, lruvec_lru_size() reads mz->lru_zone_size,
which only the classic LRU paths maintain. MGLRU accounts its pages
through __update_lru_size(), which skips that array, so with MGLRU on the
four evictable LRU lists are always seen as empty. The shadow node budget
(pages >> 3) then collapses to slab plus unevictable pages, and the
workingset shadow shrinker reclaims eviction tokens almost as fast as they
are created, losing thrashing protection.
lruvec_page_state_local() reads lruvec_stats->state_local instead, which
both classic LRU and MGLRU maintain. Switch back to it. The reparenting
race this re-exposes on cgroup v2 is closed by the preceding patch that
redirects dying-memcg stat updates for all hierarchies.
Link: https://lore.kernel.org/2ed42f96aca124856ea30f774afb55cbe6d8ba58.1789096175.git.zhuhui@kylinos.cn
Fixes: 7404bd37cfbe ("mm: workingset: use lruvec_lru_size() to get the number of lru pages")
Signed-off-by: Hui Zhu <zhuhui@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Kairui Song <kasong@tencent.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/workingset.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/mm/workingset.c b/mm/workingset.c
index 7ac2b88c80ae5..8412f4840ae35 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -688,10 +688,9 @@ static unsigned long count_shadow_nodes(struct shrinker *shrinker,
mem_cgroup_flush_stats_ratelimited(sc->memcg);
lruvec = mem_cgroup_lruvec(sc->memcg, NODE_DATA(sc->nid));
-
for (pages = 0, i = 0; i < NR_LRU_LISTS; i++)
- pages += lruvec_lru_size(lruvec, i, MAX_NR_ZONES - 1);
-
+ pages += lruvec_page_state_local(lruvec,
+ NR_LRU_BASE + i);
pages += lruvec_page_state_local(
lruvec, NR_SLAB_RECLAIMABLE_B) >> PAGE_SHIFT;
pages += lruvec_page_state_local(
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0575/1257] mm: memcg: skip the RCU lock when the memcg is not dying
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (573 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0574/1257] mm: workingset: use lruvec_page_state_local() to count lru pages Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0576/1257] mm: memcg: reparent non-hierarchical lruvec stats on cgroup v2 Greg Kroah-Hartman
` (423 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Zhu, Andrew Morton, Shakeel Butt,
Axel Rasmussen, Barry Song, David Hildenbrand, Johannes Weiner,
Kairui Song, Lorenzo Stoakes, Michal Hocko, Muchun Song,
Roman Gushchin, Wei Xu, Yuanchu Xie, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Zhu <zhuhui@kylinos.cn>
[ Upstream commit 7c0a645068deaf4c3a8c619ddbb8b84c477f9a9a ]
get_non_dying_memcg_start() takes rcu_read_lock() on every stat update,
but the lock only protects the upward walk to a non-dying ancestor, which
happens solely while a memcg is being offlined. The dying check itself
reads the CSS_DYING flag of a memcg the caller already holds a reference
to, so it is safe without the lock.
Check memcg_is_dying() first and return immediately when the memcg is
alive, taking the RCU lock only on the rare dying path. On an anon
fault/charge churn workload in a memcg this recovers the ~0.6% overhead
added by the previous patch (4368077 vs 4343159 pages/s before, back to
~4377000 pages/s after).
Link: https://lore.kernel.org/9ffdbdfc96312e3e13cb8f056bfe26649492d949.1789096175.git.zhuhui@kylinos.cn
Fixes: 7404bd37cfbe ("mm: workingset: use lruvec_lru_size() to get the number of lru pages")
Signed-off-by: Hui Zhu <zhuhui@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/memcontrol.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index af61dacf0d180..ed371b1ddab87 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -853,6 +853,17 @@ static long memcg_state_val_in_pages(int idx, long val)
static inline struct mem_cgroup *
get_non_dying_memcg_start(struct mem_cgroup *memcg, bool *rcu_locked)
{
+ /*
+ * Fast path: the caller holds a reference to @memcg, so reading
+ * its CSS_DYING flag without the RCU lock is safe. The RCU lock
+ * is only needed to walk up to a non-dying ancestor, which
+ * happens only while a memcg is actually being offlined.
+ */
+ if (!memcg_is_dying(memcg)) {
+ *rcu_locked = false;
+ return memcg;
+ }
+
rcu_read_lock();
*rcu_locked = true;
@@ -864,6 +875,9 @@ get_non_dying_memcg_start(struct mem_cgroup *memcg, bool *rcu_locked)
static inline void get_non_dying_memcg_end(bool rcu_locked)
{
+ if (!rcu_locked)
+ return;
+
rcu_read_unlock();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0576/1257] mm: memcg: reparent non-hierarchical lruvec stats on cgroup v2
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (574 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0575/1257] mm: memcg: skip the RCU lock when the memcg is not dying Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0577/1257] mm/execmem: free ROX cache chunks only when they span an entire vm area Greg Kroah-Hartman
` (422 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Zhu, Andrew Morton,
Axel Rasmussen, Barry Song, David Hildenbrand, Johannes Weiner,
Kairui Song, Lorenzo Stoakes, Michal Hocko, Muchun Song,
Roman Gushchin, Shakeel Butt, Wei Xu, Yuanchu Xie, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Zhu <zhuhui@kylinos.cn>
[ Upstream commit 154c16a783b75105347cf5ed7731afc887308120 ]
On cgroup v2, reparent_state_local() returns early and never moves the
dying memcg's non-hierarchical state_local base counts to its parent.
Meanwhile memcg_reparent_objcgs() rewrites objcg->memcg to the parent, so
when the reparented folios are freed later, the negative deltas land on
the parent's lruvec. The parent therefore receives the uncharges without
ever having received the matching charges, and its state_local
(NR_LRU_BASE + lru, MEMCG_SOCK, NR_SLAB_RECLAIMABLE_B,
NR_SLAB_UNRECLAIMABLE_B) permanently underflows. Since
lruvec_page_state_local() clamps negative values to zero, the underflow
masks the parent's own legitimate pages.
count_shadow_nodes() is the only reader of these non-hierarchical
state_locals on cgroup v2, so the underflow directly distorts the
workingset shadow node budget.
Fix this by reparenting the lruvec state_locals on cgroup v2 as well,
mirroring what cgroup v1 already does. Only the lruvec stats consumed by
count_shadow_nodes() are moved; the memcg-level stats are left alone
because on v2 they are exposed through the rstat hierarchical tree and are
not read from state_local.
Link: https://lore.kernel.org/4a7a64eed2b145ad535fedaea3624f8310c29d5b.1789096175.git.zhuhui@kylinos.cn
Fixes: 8285917d6f38 ("mm: memcontrol: prepare for reparenting non-hierarchical stats")
Signed-off-by: Hui Zhu <zhuhui@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/memcontrol-v1.h | 5 +++--
mm/memcontrol.c | 42 ++++++++++++++++++++++++++++--------------
2 files changed, 31 insertions(+), 16 deletions(-)
diff --git a/mm/memcontrol-v1.h b/mm/memcontrol-v1.h
index 1e394269c613d..0578b7076764d 100644
--- a/mm/memcontrol-v1.h
+++ b/mm/memcontrol-v1.h
@@ -25,6 +25,9 @@ int memory_stat_show(struct seq_file *m, void *v);
struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg,
unsigned int n);
+void reparent_memcg_lruvec_state_local(struct mem_cgroup *memcg,
+ struct mem_cgroup *parent, int idx);
+
/* Cgroup v1-specific declarations */
#ifdef CONFIG_MEMCG_V1
@@ -73,8 +76,6 @@ void reparent_memcg1_lruvec_state_local(struct mem_cgroup *memcg, struct mem_cgr
void reparent_memcg_state_local(struct mem_cgroup *memcg,
struct mem_cgroup *parent, int idx);
-void reparent_memcg_lruvec_state_local(struct mem_cgroup *memcg,
- struct mem_cgroup *parent, int idx);
void memcg1_account_kmem(struct mem_cgroup *memcg, int nr_pages);
static inline bool memcg1_tcpmem_active(struct mem_cgroup *memcg)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index ed371b1ddab87..a3f16cbfdc6e2 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -232,14 +232,29 @@ static inline struct obj_cgroup *__memcg_reparent_objcgs(struct mem_cgroup *memc
return objcg;
}
-#ifdef CONFIG_MEMCG_V1
static void __mem_cgroup_flush_stats(struct mem_cgroup *memcg, bool force);
-static inline void reparent_state_local(struct mem_cgroup *memcg, struct mem_cgroup *parent)
+/*
+ * Reparent the non-hierarchical lruvec stats that count_shadow_nodes() reads
+ * to approximate the shadow node budget. They are not exposed to userspace
+ * on cgroup v2, but they must follow the reparented folios; otherwise the
+ * ancestor would only receive the negative deltas when the folios are freed
+ * without ever having received the positive base, and its local stats would
+ * permanently underflow.
+ */
+static void reparent_v2_lruvec_state_local(struct mem_cgroup *memcg, struct mem_cgroup *parent)
{
- if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
- return;
+ int i;
+
+ for (i = 0; i < NR_LRU_LISTS; i++)
+ reparent_memcg_lruvec_state_local(memcg, parent, NR_LRU_BASE + i);
+
+ reparent_memcg_lruvec_state_local(memcg, parent, NR_SLAB_RECLAIMABLE_B);
+ reparent_memcg_lruvec_state_local(memcg, parent, NR_SLAB_UNRECLAIMABLE_B);
+}
+static inline void reparent_state_local(struct mem_cgroup *memcg, struct mem_cgroup *parent)
+{
/*
* Reparent stats exposed non-hierarchically. Flush @memcg's stats first
* to read its stats accurately , and conservatively flush @parent's
@@ -248,17 +263,18 @@ static inline void reparent_state_local(struct mem_cgroup *memcg, struct mem_cgr
*/
__mem_cgroup_flush_stats(memcg, true);
- /* The following counts are all non-hierarchical and need to be reparented. */
- reparent_memcg1_state_local(memcg, parent);
- reparent_memcg1_lruvec_state_local(memcg, parent);
+ if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) {
+ reparent_v2_lruvec_state_local(memcg, parent);
+ } else {
+#ifdef CONFIG_MEMCG_V1
+ /* The following counts are all non-hierarchical and need to be reparented. */
+ reparent_memcg1_state_local(memcg, parent);
+ reparent_memcg1_lruvec_state_local(memcg, parent);
+#endif
+ }
__mem_cgroup_flush_stats(parent, true);
}
-#else
-static inline void reparent_state_local(struct mem_cgroup *memcg, struct mem_cgroup *parent)
-{
-}
-#endif
static inline void reparent_locks(struct mem_cgroup *memcg, struct mem_cgroup *parent, int nid)
{
@@ -570,7 +586,6 @@ unsigned long lruvec_page_state_local(struct lruvec *lruvec,
return x;
}
-#ifdef CONFIG_MEMCG_V1
static void __mod_memcg_lruvec_state(struct mem_cgroup_per_node *pn,
enum node_stat_item idx, long val);
@@ -592,7 +607,6 @@ void reparent_memcg_lruvec_state_local(struct mem_cgroup *memcg,
__mod_memcg_lruvec_state(parent_pn, idx, value);
}
}
-#endif
/* Subset of vm_event_item to report for memcg event stats */
static const unsigned int memcg_vm_event_stat[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0577/1257] mm/execmem: free ROX cache chunks only when they span an entire vm area
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (575 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0576/1257] mm: memcg: reparent non-hierarchical lruvec stats on cgroup v2 Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0578/1257] mm/nommu: reject wrapping ranges in access_remote_vm() Greg Kroah-Hartman
` (421 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Rapoport (Microsoft),
Andrew Morton, Benjamin Tissoires, Jiri Kosina, Luis Chamberalin,
Uladzislau Rezki (Sony), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <rppt@kernel.org>
[ Upstream commit 52d95a55a0113408acd2d4ce0294a72c527f5092 ]
Patch series "mm/execmem: fixes and cleanups for the ROX cache".
Sashiko review of the ROX cache refill path asked what happens when the
PMD_SIZE allocation fails there. Pulling that thread uncovered a bit more
than the fallback.
Patch 1 fixes a real bug, although rare bug: execmem_cache_clean() can
free a chunk that is still partially in use, because a PMD sized and PMD
aligned free range in the middle of a larger chunk looks exactly like a
chunk that nobody uses.
Patch 2 handles maple tree allocation failures in the cache. They are
unlikely, but silently dropping an area from the tree is not a great way
to deal with them.
Patch 3 deals with the fallback that started all this. The cache exists
to keep the direct map free of unnecessary splits, and the fallback
happily filled it with base page mapped areas that could never be freed
from the cache again. Ask vmalloc for a huge mapping or nothing, and
serve whatever does not fit outside the cache.
Patches 4 and 5 convert the ROX cache to scope based cleanup.
The series was tested on x86 with module load/unload cycles, with PTDUMP
confirming that the cache is using 2M mappings, and with nohugevmalloc to
exercise the uncached fallback.
This patch (of 5):
When execmem refills the ROX cache, it vmalloc()s multiples of PMD_SIZE
aligned to PMD_SIZE. For every such allocation vmalloc creates a vm area.
The first part of the vmalloc()ed chunk is returned to the allocation that
triggered the cache refill and the remaining part is added to the cache
and handed out for subsequent allocations with execmem_alloc().
When only the first part is freed, the entire vm area remains in the ROX
cache and can be handed out again.
In the case when the first allocation is larger than PMD_SIZE and the
second allocation from the freed first part of the chunk is exactly
PMD_SIZE, execmem_cache_clean() will free the entire chunk while part of
it is still in use.
For example:
/*
* vmalloc(4M), return p0 to the caller
* add [p0 + 3M, p0 + 4M) to the cache
*/
p0 = execmem_alloc(3M);
/* return p0 + 3M from the cache to the caller */
p1 = execmem_alloc(1M);
/* put [p0, p0 + 3M) back into the cache */
execmem_free(p0);
/* return p0 from the cache to the caller */
p2 = execmem_alloc(2M);
/* return p0 + 2M from the cache to the caller */
p3 = execmem_alloc(1M);
/* bah! execmem_cache_clean() frees the entire 4M chunk */
execmem_free(p2);
Make sure that the ranges that execmem_cache_clean() frees cover the
entire vm area.
Link: https://lore.kernel.org/20260903-execmem-rox-cache-pmd-v1-v1-0-11beb2a3d249@kernel.org
Link: https://lore.kernel.org/20260903-execmem-rox-cache-pmd-v1-v1-1-11beb2a3d249@kernel.org
Fixes: 2e45474ab14f ("execmem: add support for cache of large ROX pages")
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: copilot:claude-opus-5
Cc: Benjamin Tissoires <bentiss@kernel.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Luis Chamberalin <mcgrof@kernel.org>
Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/execmem.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/mm/execmem.c b/mm/execmem.c
index 74a178a87e758..33e4e68f655f0 100644
--- a/mm/execmem.c
+++ b/mm/execmem.c
@@ -165,9 +165,11 @@ static void execmem_cache_clean(struct work_struct *work)
mutex_lock(mutex);
mas_for_each(&mas, area, ULONG_MAX) {
+ struct vm_struct *vm = find_vm_area(area);
size_t size = mas_range_len(&mas);
- if (IS_ALIGNED(size, PMD_SIZE) &&
+ if (vm && get_vm_area_size(vm) == size &&
+ IS_ALIGNED(size, PMD_SIZE) &&
IS_ALIGNED(mas.index, PMD_SIZE)) {
struct vm_struct *vm = find_vm_area(area);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0578/1257] mm/nommu: reject wrapping ranges in access_remote_vm()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (576 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0577/1257] mm/execmem: free ROX cache chunks only when they span an entire vm area Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0579/1257] mm/hugetlb: fix subpool minimum reservation rollback Greg Kroah-Hartman
` (420 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anastasios Papagiannis,
Andrew Morton, Lorenzo Stoakes (ARM), Liam R. Howlett,
Hajime Tazaki, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
[ Upstream commit 51a8de81fd2edbf87d8046e352060329bb216fad ]
The NOMMU implementation of access_process_vm() rejects address ranges
whose end wraps around, but access_remote_vm() bypasses this check even
though both functions delegate to __access_remote_vm().
Move the wraparound check into __access_remote_vm() so it applies to both
entry points.
This is originally reported in [1].
Link: https://lore.kernel.org/20260909064231.18693-1-tasos.papagiannnis@gmail.com
Fixes: f55f199b7d76 ("NOMMU: implement access_remote_vm")
Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Closes: https://lore.kernel.org/bpf/4ef240a5bea36ff84df9589671367832860795159386a4c8fba546a0fa8b786f@mail.kernel.org/ [1]
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Hajime Tazaki <thehajime@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/nommu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/mm/nommu.c b/mm/nommu.c
index 498e01ee40b05..ed44510e37707 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1674,6 +1674,9 @@ static int __access_remote_vm(struct mm_struct *mm, unsigned long addr,
struct vm_area_struct *vma;
int write = gup_flags & FOLL_WRITE;
+ if (addr + len < addr)
+ return 0;
+
if (mmap_read_lock_killable(mm))
return 0;
@@ -1727,9 +1730,6 @@ int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, in
{
struct mm_struct *mm;
- if (addr + len < addr)
- return 0;
-
mm = get_task_mm(tsk);
if (!mm)
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0579/1257] mm/hugetlb: fix subpool minimum reservation rollback
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (577 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0578/1257] mm/nommu: reject wrapping ranges in access_remote_vm() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0580/1257] mm/zswap: publish the initial pool with list_add_rcu() Greg Kroah-Hartman
` (419 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinmeng Zhou, Andrew Morton,
Muchun Song, Ackerley Tng, David Hildenbrand, Ma Wupeng,
Oscar Salvador, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinmeng Zhou <jinmengzhou22@gmail.com>
[ Upstream commit e4949a80f3b07e52dca76c34ce353633927a28a5 ]
When a reservation request is partially covered by a subpool minimum and
the remaining global reservation fails, the error path first calls
hugepage_subpool_put_pages() for the subpool-backed portion. It removes
the failed global portion from used_hpages only afterwards.
hugepage_subpool_put_pages() uses used_hpages to decide whether rsv_hpages
should be restored. Since used_hpages still includes the global portion,
it can remain at or above min_hpages and prevent that restoration. It
then reports the subpool reservation as releasable, causing
hugetlb_acct_memory() to incorrectly decrement h->resv_huge_pages.
This was reproduced with four 2 MB huge pages and a hugetlbfs mount with
size=10M,min_size=8M. After a successful three-page reservation, a
two-page reservation which needed one subpool page and one global page
failed with -ENOMEM. HugePages_Rsvd incorrectly dropped from four to
three even though the subpool minimum was still four pages.
Roll back the failed global portion from used_hpages first, so that
hugepage_subpool_put_pages() evaluates the minimum reservation against the
current usage and returns the correct global adjustment.
Link: https://lore.kernel.org/20260907132055.26696-1-zhoujinmeng@bytedance.com
Fixes: a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool")
Signed-off-by: Jinmeng Zhou <zhoujinmeng@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Tested-by: Ackerley Tng <ackerleytng@google.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Ma Wupeng <mawupeng1@huawei.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 1c2b5825b5614..8dec4f5fc1e6e 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6837,15 +6837,6 @@ long hugetlb_reserve_pages(struct inode *inode,
out_put_pages:
spool_resv = chg - gbl_reserve;
- if (spool_resv) {
- /* put sub pool's reservation back, chg - gbl_reserve */
- gbl_resv = hugepage_subpool_put_pages(spool, spool_resv);
- /*
- * subpool's reserved pages can not be put back due to race,
- * return to hstate.
- */
- hugetlb_acct_memory(h, -gbl_resv);
- }
/* Restore used_hpages for pages that failed global reservation */
if (gbl_reserve && spool) {
unsigned long flags;
@@ -6855,6 +6846,15 @@ long hugetlb_reserve_pages(struct inode *inode,
spool->used_hpages -= gbl_reserve;
unlock_or_release_subpool(spool, flags);
}
+ if (spool_resv) {
+ /* put sub pool's reservation back, chg - gbl_reserve */
+ gbl_resv = hugepage_subpool_put_pages(spool, spool_resv);
+ /*
+ * subpool's reserved pages can not be put back due to race,
+ * return to hstate.
+ */
+ hugetlb_acct_memory(h, -gbl_resv);
+ }
out_uncharge_cgroup:
hugetlb_cgroup_uncharge_cgroup_rsvd(hstate_index(h),
chg * pages_per_huge_page(h), h_cg);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0580/1257] mm/zswap: publish the initial pool with list_add_rcu()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (578 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0579/1257] mm/hugetlb: fix subpool minimum reservation rollback Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0581/1257] mm/memcg: clear folio memcg after changing per memcg stats Greg Kroah-Hartman
` (418 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Longlong Xia, Andrew Morton, Sashiko,
Yosry Ahmed, Nhat Pham, Chengming Zhou, Johannes Weiner,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longlong Xia <xialonglong@kylinos.cn>
[ Upstream commit c1dd5e24a82d19bff8eef50ba8205d4776584aff ]
zswap_setup() publishes the pool on the zswap_pools list with a plain
list_add(), but the list is walked by concurrent RCU readers holding
nothing but rcu_read_lock() through zswap_total_pages(), e.g.
/proc/meminfo and the shrinker count path.
CPU 0 (writer) CPU 1 (reader)
-------------- --------------
zswap_pool_create():
pool->zs_pool = zs_create_pool(); (1)
list_add() -> __list_add():
WRITE_ONCE(zswap_pools.next,
&pool->list); (2) zswap_total_pages():
pool = READ_ONCE( (a)
zswap_pools.next);
zs_get_total_pages( (b)
pool->zs_pool);
If (2) becomes visible to CPU 1 before (1), CPU 1 finds the pool at (a)
but dereferences a wild pointer at (b). Publish the node with
list_add_rcu().
Link: https://lore.kernel.org/20260908012801.1864430-1-xialonglong2025@163.com
Fixes: 91cdcd8d624b ("mm: zswap: optimize zswap pool size tracking")
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260906133601.3563324-1-xialonglong2025%40163.com
Acked-by: Yosry Ahmed <yosry@kernel.org>
Acked-by: Nhat Pham <nphamcs@gmail.com>
Assisted-by: Zcode:GLM-5.3
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/zswap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/zswap.c b/mm/zswap.c
index 37f34e406c8e3..cb5a0855fd2a7 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -1803,7 +1803,7 @@ static int zswap_setup(void)
pool = __zswap_pool_create_fallback();
if (pool) {
pr_info("loaded using pool %s\n", pool->tfm_name);
- list_add(&pool->list, &zswap_pools);
+ list_add_rcu(&pool->list, &zswap_pools);
zswap_has_pool = true;
static_branch_enable(&zswap_ever_enabled);
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0581/1257] mm/memcg: clear folio memcg after changing per memcg stats
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (579 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0580/1257] mm/zswap: publish the initial pool with list_add_rcu() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0582/1257] mm/page_counter: avoid integer overflow in effective_protection() Greg Kroah-Hartman
` (417 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bingfang Guo, Andrew Morton,
Kairui Song, Axel Rasmussen, Baoquan He, Barry Song, Chris Li,
David Hildenbrand, Johannes Weiner, Kemeng Shi, Lorenzo Stoakes,
Michal Hocko, Nhat Pham, Shakeel Butt, Wei Xu, Yuanchu Xie,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bingfang Guo <bingfangguo@tencent.com>
[ Upstream commit 0b1b457ecc4f636d85e1a0fade05f3dee264f59a ]
I notice extremely high swapcached count in the per memcg level
memory.stat when running tests with cgroupv1 setup by swapping pages in
and out. It seems that the counter never gets decreased so the value is
rather useless and confusing to users reading it. So I think fixing it so
that the value can reflect the actual swapcache usage correctly could be
helpful.
__memcg1_swapout() transfers the memsw charge of a folio to its swap entry
and clears folio->memcg_data as part of that. In the vmscan swapout path
it runs before __swap_cache_del_folio(), which then decrements the
swapcache stats through lruvec_stat_mod_folio(). Since folio->memcg_data
has already been cleared, folio_memcg() returns NULL and the NR_SWAPCACHE
decrement only updates the node-level counter instead of the memcg's
lruvec, leaking the per-memcg swapcache count.
Users using swaps will read totally meaningless swapcache value from
per memcg memory.stat, like 200GB of swapcache on a 64GB setup, which
is quite confusing and may trigger monitoring alerts, if any.
Move the __memcg1_swapout() call into __swap_cache_del_folio(), after the
NR_FILE_PAGES and NR_SWAPCACHE updates but before
__swap_cache_do_del_folio() removes the folio from the swap cache. This
keeps the stats attributed to the folio's memcg while still recording the
swap cgroup with a valid folio->swap. Add a swapout parameter so the
plain swap_cache_del_folio() path is left unchanged.
Link: https://lore.kernel.org/20260910-memcg-swapcache-stats-fix-v5-1-033f510ba748@tencent.com
Fixes: 2732acda82c9 ("mm, swap: use swap cache as the swap in synchronize layer")
Signed-off-by: Bingfang Guo <bingfangguo@tencent.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Kairui Song <kasong@tencent.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Barry Song <baohua@kernel.org>
Cc: Chris Li <chrisl@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/swap.h | 6 ++++--
mm/swap_state.c | 13 ++++++++++---
mm/vmscan.c | 3 +--
3 files changed, 15 insertions(+), 7 deletions(-)
diff --git a/mm/swap.h b/mm/swap.h
index 90a551a88df63..c9202516b413e 100644
--- a/mm/swap.h
+++ b/mm/swap.h
@@ -319,7 +319,8 @@ struct folio *swap_cache_alloc_folio(swp_entry_t target_entry, gfp_t gfp_mask,
void __swap_cache_add_folio(struct swap_cluster_info *ci,
struct folio *folio, swp_entry_t entry);
void __swap_cache_del_folio(struct swap_cluster_info *ci,
- struct folio *folio, swp_entry_t entry, void *shadow);
+ struct folio *folio, swp_entry_t entry, void *shadow,
+ bool swapout);
void __swap_cache_replace_folio(struct swap_cluster_info *ci,
struct folio *old, struct folio *new);
@@ -453,7 +454,8 @@ static inline void swap_cache_del_folio(struct folio *folio)
}
static inline void __swap_cache_del_folio(struct swap_cluster_info *ci,
- struct folio *folio, swp_entry_t entry, void *shadow)
+ struct folio *folio, swp_entry_t entry, void *shadow,
+ bool swapout)
{
}
diff --git a/mm/swap_state.c b/mm/swap_state.c
index f3961fdd857dc..cb574030b814f 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -306,21 +306,28 @@ static void __swap_cache_do_del_folio(struct swap_cluster_info *ci,
* @folio: The folio.
* @entry: The first swap entry that the folio corresponds to.
* @shadow: shadow value to be filled in the swap cache.
+ * @swapout: whether this folio is being reclaimed after swapout.
*
* Removes a folio from the swap cache and fills a shadow in place.
* This won't put the folio's refcount. The caller has to do that.
*
* Context: Caller must ensure the folio is locked and in the swap cache
* using the index of @entry, and lock the cluster that holds the entries.
+ * If @swapout is set, the folio should be in reclaim path and IRQs
+ * should be disabled.
*/
void __swap_cache_del_folio(struct swap_cluster_info *ci, struct folio *folio,
- swp_entry_t entry, void *shadow)
+ swp_entry_t entry, void *shadow, bool swapout)
{
unsigned long nr_pages = folio_nr_pages(folio);
- __swap_cache_do_del_folio(ci, folio, entry, shadow);
node_stat_mod_folio(folio, NR_FILE_PAGES, -nr_pages);
lruvec_stat_mod_folio(folio, NR_SWAPCACHE, -nr_pages);
+
+ if (swapout)
+ __memcg1_swapout(folio, ci);
+
+ __swap_cache_do_del_folio(ci, folio, entry, shadow);
}
/**
@@ -339,7 +346,7 @@ void swap_cache_del_folio(struct folio *folio)
swp_entry_t entry = folio->swap;
ci = swap_cluster_lock(__swap_entry_to_info(entry), swp_offset(entry));
- __swap_cache_del_folio(ci, folio, entry, NULL);
+ __swap_cache_del_folio(ci, folio, entry, NULL, false);
swap_cluster_unlock(ci);
folio_ref_sub(folio, folio_nr_pages(folio));
diff --git a/mm/vmscan.c b/mm/vmscan.c
index f11491ee9ed5c..17ab01693ae8d 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -735,8 +735,7 @@ static int __remove_mapping(struct address_space *mapping, struct folio *folio,
if (reclaimed && !mapping_exiting(mapping))
shadow = workingset_eviction(folio, target_memcg);
- __memcg1_swapout(folio, ci);
- __swap_cache_del_folio(ci, folio, swap, shadow);
+ __swap_cache_del_folio(ci, folio, swap, shadow, true);
swap_cluster_unlock_irq(ci);
} else {
void (*free_folio)(struct folio *);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0582/1257] mm/page_counter: avoid integer overflow in effective_protection()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (580 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0581/1257] mm/memcg: clear folio memcg after changing per memcg stats Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0583/1257] mm/mglru: fix ineffective memory protection for non-kswapd reclaim Greg Kroah-Hartman
` (416 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Barry Song, Johannes Weiner,
Ridong Chen, Andrew Morton, Axel Rasmussen, Chris Down,
David Hildenbrand, Kairui Song, Lorenzo Stoakes, Michal Hocko,
Muchun Song, Roman Gushchin, Shakeel Butt, Tejun Heo, Wei Xu,
Yuanchu Xie, Yu Zhao, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ridong Chen <chenridong@xiaomi.com>
[ Upstream commit 7809ce47b05671e1fa6d74bead892d6ad6c1403b ]
Patch series "mm/mglru: fix ineffective memory protection for non-kswapd
reclaim", v4.
For MGLRU, memory.min/low is not honored during non-kswapd global reclaim
(global direct reclaim and root-level memory.reclaim), because these paths
shrink memcgs using stale protection (emin/elow).
Patch 2 is the actual fix. Patch 1 is a prerequisite: an integer overflow
in effective_protection(), spotted by the sashiko review tool, which patch
2's new caller would also be exposed to.
This patch (of 2):
effective_protection() scales a parent's protection by a ratio of page
counts, e.g. for recursive protection:
(parent_effective - siblings_protected) * (usage - protected)
/ (parent_usage - siblings_protected)
The multiply is done at unsigned long width before dividing. On systems
with >= 16TB RAM the product can exceed 2^64 and wrap, giving a bogus
protection value and silently breaking memory.min/low enforcement.
Use mul_u64_u64_div_u64() to multiply in a 128-bit intermediate. Because
usage and parent_usage are not read atomically (a child is charged before
its parent), usage - protected can briefly exceed the divisor, making the
quotient overflow 64 bits and trap (#DE on x86). Cap it so the ratio
stays <= 1.
Reported by the sashiko review tool [1].
Link: https://lore.kernel.org/20260907025445.1836238-1-ridong.chen@linux.dev
Link: https://lore.kernel.org/20260907025445.1836238-2-ridong.chen@linux.dev
Link: https://sashiko.dev/#/patchset/20260826133054.88529-1-ridong.chen@linux.dev?part=1 [1]
Fixes: bc50bcc6e00b ("mm: memcontrol: clean up and document effective low/min calculations")
Fixes: 8a931f801340 ("mm: memcontrol: recursive memory.low protection")
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Ridong Chen <chenridong@xiaomi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: Claude:claude-opus-4-8
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Chris Down <chris@chrisdown.name>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Tejun Heo <tj@kernel.org>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Yu Zhao <yuzhao@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_counter.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/mm/page_counter.c b/mm/page_counter.c
index 661e0f2a5127a..ea0d1646cff85 100644
--- a/mm/page_counter.c
+++ b/mm/page_counter.c
@@ -8,6 +8,7 @@
#include <linux/page_counter.h>
#include <linux/atomic.h>
#include <linux/kernel.h>
+#include <linux/math64.h>
#include <linux/string.h>
#include <linux/sched.h>
#include <linux/bug.h>
@@ -356,7 +357,8 @@ static unsigned long effective_protection(unsigned long usage,
* otherwise get a smaller chunk than what they claimed.
*/
if (siblings_protected > parent_effective)
- return protected * parent_effective / siblings_protected;
+ return mul_u64_u64_div_u64(protected, parent_effective,
+ siblings_protected);
/*
* Ok, utilized protection of all children is within what the
@@ -397,13 +399,20 @@ static unsigned long effective_protection(unsigned long usage,
if (parent_effective > siblings_protected &&
parent_usage > siblings_protected &&
usage > protected) {
- unsigned long unclaimed;
+ unsigned long parent_unclaimed, parent_unprotected, unprotected;
- unclaimed = parent_effective - siblings_protected;
- unclaimed *= usage - protected;
- unclaimed /= parent_usage - siblings_protected;
+ parent_unclaimed = parent_effective - siblings_protected;
+ parent_unprotected = parent_usage - siblings_protected;
- ep += unclaimed;
+ /*
+ * The usages aren't read atomically, so a child can transiently
+ * appear to use more than its parent, making the ratio exceed 1
+ * and the quotient overflow 64 bits (#DE on x86). Cap it.
+ */
+ unprotected = min(usage - protected, parent_unprotected);
+
+ ep += mul_u64_u64_div_u64(parent_unclaimed, unprotected,
+ parent_unprotected);
}
return ep;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0583/1257] mm/mglru: fix ineffective memory protection for non-kswapd reclaim
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (581 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0582/1257] mm/page_counter: avoid integer overflow in effective_protection() Greg Kroah-Hartman
@ 2026-11-07 13:47 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0584/1257] mm/zswap: enable zswap_ever_enabled in zswap_pool_create() Greg Kroah-Hartman
` (415 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ridong Chen, Andrew Morton,
Barry Song, Johannes Weiner, Axel Rasmussen, Chris Down,
David Hildenbrand, Kairui Song, Lorenzo Stoakes, Michal Hocko,
Muchun Song, Roman Gushchin, Shakeel Butt, Tejun Heo, Wei Xu,
Yuanchu Xie, Yu Zhao, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ridong Chen <chenridong@xiaomi.com>
[ Upstream commit 15da1e4978dd4ea8f5faa6e15ee967ba4ad9a30a ]
For MGLRU, memory.min/low is not honored during global proactive reclaim
(writing to the root memory.reclaim) and global direct reclaim, because
these paths shrink memcgs using stale protection (emin/elow). It can be
reproduced as follows:
# echo 7 > /sys/kernel/mm/lru_gen/enabled
# cd /sys/fs/cgroup
# mkdir -p a/b
# echo 100M > a/memory.min
# echo +memory > a/cgroup.subtree_control
# echo 100M > a/b/memory.min
# echo $$ > a/b/cgroup.procs
# dd if=/dev/zero of=/tmp/testfile bs=1M count=200
# cat a/b/memory.current
222650368
# echo 500M > memory.reclaim
-bash: echo: write error: Resource temporarily unavailable
# cat a/b/memory.current
6070272
memory.min is 100M, yet reclaim drops a/b down to 6M, breaking the
protection. The traditional LRU path is not affected because
shrink_node() calls mem_cgroup_calculate_protection() for each memcg it
visits during a top-down tree walk.
Commit 30d77b7eef01 ("mm/mglru: fix ineffective protection calculation")
moved the protection computation into lru_gen_age_node(), which only runs
for kswapd. Non-kswapd global reclaim reaches shrink_one() through
lru_gen_shrink_node() -> shrink_many() without any protection computation,
so emin/elow are whatever a previous kswapd run left behind - or zero if
kswapd never ran on this node. Relying on a prior kswapd pass is not
correct either: a memcg's emin/elow are derived from its ancestors'
memory.min/low settings and from children_min_usage, both of which change
over time, so emin/elow go stale even after kswapd has run and must be
recomputed at the point of reclaim.
Introduce mem_cgroup_calculate_protection_path() which computes emin/elow
along the root-to-target path only, by iterating through the cgroup
ancestors array top-down. This avoids the full tree traversal that would
be needed with mem_cgroup_calculate_protection(), limiting the cost to
O(depth) per memcg - typically 3-5 levels.
Call it from shrink_one() for the non-kswapd path so that each memcg about
to be shrunk has correct protection values.
Link: https://lore.kernel.org/20260907025445.1836238-3-ridong.chen@linux.dev
Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists")
Signed-off-by: Ridong Chen <chenridong@xiaomi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Assisted-by: Claude:claude-opus-4-8
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Chris Down <chris@chrisdown.name>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Tejun Heo <tj@kernel.org>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Yu Zhao <yuzhao@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/memcontrol.h | 10 +++++++++
mm/memcontrol.c | 45 ++++++++++++++++++++++++++++++++++++++
mm/vmscan.c | 8 ++++++-
3 files changed, 62 insertions(+), 1 deletion(-)
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 362af58e50a43..bf057d80e2c6e 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -1892,6 +1892,16 @@ static inline bool memcg_is_dying(struct mem_cgroup *memcg)
}
#endif /* CONFIG_MEMCG */
+#if defined(CONFIG_MEMCG) && defined(CONFIG_LRU_GEN)
+void mem_cgroup_calculate_protection_path(struct mem_cgroup *root,
+ struct mem_cgroup *memcg);
+#else
+static inline void mem_cgroup_calculate_protection_path(struct mem_cgroup *root,
+ struct mem_cgroup *memcg)
+{
+}
+#endif
+
#if defined(CONFIG_MEMCG) && defined(CONFIG_ZSWAP)
bool obj_cgroup_may_zswap(struct obj_cgroup *objcg);
void obj_cgroup_charge_zswap(struct obj_cgroup *objcg, size_t size);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index a3f16cbfdc6e2..0c7a506873eed 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5215,6 +5215,51 @@ void mem_cgroup_calculate_protection(struct mem_cgroup *root,
page_counter_calculate_protection(&root->memory, &memcg->memory, recursive_protection);
}
+#ifdef CONFIG_LRU_GEN
+/**
+ * mem_cgroup_calculate_protection_path - compute protection along a path
+ * @root: the top ancestor of the sub-tree being checked (NULL for root_mem_cgroup)
+ * @memcg: the target memory cgroup
+ *
+ * Walk the ancestor path from @root down to @memcg and compute the effective
+ * protection at each level. This is safe for isolated queries because it
+ * ensures parents are computed before children.
+ */
+void mem_cgroup_calculate_protection_path(struct mem_cgroup *root,
+ struct mem_cgroup *memcg)
+{
+ bool recursive_protection =
+ cgrp_dfl_root.flags & CGRP_ROOT_MEMORY_RECURSIVE_PROT;
+ struct cgroup *cg;
+ int root_level, i;
+
+ if (mem_cgroup_disabled())
+ return;
+
+ if (!root)
+ root = root_mem_cgroup;
+
+ if (memcg == root)
+ return;
+
+ root_level = root->css.cgroup->level;
+ cg = memcg->css.cgroup;
+
+ rcu_read_lock();
+ for (i = root_level + 1; i <= cg->level; i++) {
+ struct mem_cgroup *cur;
+
+ cur = mem_cgroup_from_css(cgroup_css(cg->ancestors[i],
+ &memory_cgrp_subsys));
+ if (cur)
+ page_counter_calculate_protection(&root->memory,
+ &cur->memory,
+ recursive_protection);
+ }
+ rcu_read_unlock();
+}
+#endif /* CONFIG_LRU_GEN */
+
static int charge_memcg(struct folio *folio, struct mem_cgroup *memcg,
gfp_t gfp)
{
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 17ab01693ae8d..59f4a805fd53c 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -5101,7 +5101,13 @@ static int shrink_one(struct lruvec *lruvec, struct scan_control *sc)
struct mem_cgroup *memcg = lruvec_memcg(lruvec);
struct pglist_data *pgdat = lruvec_pgdat(lruvec);
- /* lru_gen_age_node() called mem_cgroup_calculate_protection() */
+ /*
+ * For kswapd, mem_cgroup_calculate_protection() has already
+ * been called during the top-down cgroup traversal.
+ */
+ if (!current_is_kswapd())
+ mem_cgroup_calculate_protection_path(NULL, memcg);
+
if (mem_cgroup_below_min(NULL, memcg))
return MEMCG_LRU_YOUNG;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0584/1257] mm/zswap: enable zswap_ever_enabled in zswap_pool_create()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (582 preceding siblings ...)
2026-11-07 13:47 ` [PATCH 7.3 0583/1257] mm/mglru: fix ineffective memory protection for non-kswapd reclaim Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0585/1257] mm/mempolicy: use vm_normal_folio_pmd() in queue_folios_pmd() Greg Kroah-Hartman
` (414 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Longlong Xia, Andrew Morton,
Yosry Ahmed, Chengming Zhou, Johannes Weiner, Nhat Pham,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longlong Xia <xialonglong@kylinos.cn>
[ Upstream commit 91b4edb993e1549afdc3c2495216734b9f13f00e ]
If zswap is enabled by default at boot and pool creation fails, then a
pool is later created by updating the compressor, data written to zswap is
corrupted on swapin.
Enable the static key in zswap_pool_create(), covering boot-time and
runtime pool creation with a single site.
Verified with fault injection on a stock kernel (compressor builtin,
CONFIG_ZSWAP_DEFAULT_ON=n):
1. Boot with zswap.enabled=1; pool creation fails, init completes
pool-less (static key off).
2. Echo an available compressor name to zswap.compressor.
3. Enable zswap.
4. madvise(MADV_PAGEOUT) a pattern-verified 512 MiB region, then
fault it back in and verify.
Step 4 reads back 131072/131072 zeroed pages (zswpin=0, zswpout=131072)
without this patch; all pages intact (zswpin=131072) with it.
Link: https://lore.kernel.org/20260906135938.3568108-1-xialonglong2025@163.com
Fixes: 2d4d2b1cfb85 ("mm: zswap: add zswap_never_enabled()")
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Yosry Ahmed <yosry@kernel.org>
Acked-by: Yosry Ahmed <yosry@kernel.org>
Assisted-by: Zcode:GLM-5.3
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/zswap.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/zswap.c b/mm/zswap.c
index cb5a0855fd2a7..e6e6377a62a0b 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -324,6 +324,8 @@ static struct zswap_pool *zswap_pool_create(char *compressor)
zswap_pool_debug("created", pool);
+ static_branch_enable(&zswap_ever_enabled);
+
return pool;
ref_fail:
@@ -1805,7 +1807,6 @@ static int zswap_setup(void)
pr_info("loaded using pool %s\n", pool->tfm_name);
list_add_rcu(&pool->list, &zswap_pools);
zswap_has_pool = true;
- static_branch_enable(&zswap_ever_enabled);
} else {
pr_err("pool creation failed\n");
zswap_enabled = false;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0585/1257] mm/mempolicy: use vm_normal_folio_pmd() in queue_folios_pmd()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (583 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0584/1257] mm/zswap: enable zswap_ever_enabled in zswap_pool_create() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0586/1257] mm/madvise: use vm_normal_folio_pmd() in cold/pageout PMD range Greg Kroah-Hartman
` (413 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
sashiko-bot, David Hildenbrand (Arm), Zi Yan, Liam R. Howlett,
Lorenzo Stoakes, Vlastimil Babka, Jann Horn, Joshua Hahn,
Rakie Kim, Ying Huang, Peter Xu, Jason Gunthorpe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 9057170a941f0c5f4058f6fb9ab5d5fc9fcc9e83 ]
Patch series "mm: stop calling pmd_folio() on special PMDs", v3.
Two page table walkers resolve the folio behind a PMD with pmd_folio(),
which is only valid for a PMD mapping a refcounted struct page:
madvise_cold_or_pageout_pte_range() mm/madvise.c
queue_folios_pmd() mm/mempolicy.c
vmf_insert_pfn_pmd() installs special PMDs holding a raw pfn that need not
have a memmap entry at all. Both walkers can reach one and fault on the
first folio field read. The PTE halves of both already use
vm_normal_folio(); these two patches make the PMD halves match.
The four callers of vmf_insert_pfn_pmd(), and which walker each reaches:
drivers/vfio/pci/vfio_pci_core.c VM_PFNMAP mempolicy
drivers/gpu/drm/drm_gem_shmem_helper.c VM_PFNMAP mempolicy
drivers/gpu/drm/panthor/panthor_gem.c VM_PFNMAP mempolicy
drivers/hv/mshv_vtl_main.c VM_MIXEDMAP both
can_madv_lru_vma() rejects VM_PFNMAP, so only mshv_vtl_low reaches the
madvise walker, and that needs CAP_SYS_ADMIN. queue_pages_walk_ops
supplies its own ->test_walk, so walk_page_test()'s generic VM_PFNMAP skip
never runs and vfio-pci is reachable by any process holding the device fd.
Hence the different stable tags.
One behaviour change: mbind(MPOL_MF_STRICT) over a PMD mapped VM_PFNMAP
region now returns 0 rather than -EIO. The PTE loop already returned 0
there. drm_gem_shmem and panthor are where this is observable, since they
PMD map pages that do have a memmap entry and so never faulted.
Reproducer
==========
No hardware needed. An out of tree module stands in for the drivers
above: three misc devices, each with a ->huge_fault calling
vmf_insert_pfn_pmd(), plus VM_HUGEPAGE so the fault path takes the PMD
branch.
/dev/pmdspec_mixed VM_MIXEDMAP, pfn at the 1 TiB mark, no memmap
/dev/pmdspec_pfnmap VM_PFNMAP, pfn at the 1 TiB mark, no memmap
/dev/pmdspec_real VM_PFNMAP, real alloc_pages(PMD_ORDER) on node 0
Userspace maps the device into a PMD aligned window, reads one byte to
fault the PMD in, checks a module parameter to confirm it went in, then
issues the operation.
vng --run <bzImage> --user root --memory 4G --verbose \
--append "numa=fake=2" \
--exec "insmod pmdspec.ko && ./pmdspec_test <subtest>"
numa=fake=2 gives a node 1 to bind to; the module allocates its real page
on node 0, which is what makes queue_folio_required() true.
subtest operation parent series
--------------------------------------------------------------------
madv_cold madvise(MADV_COLD) oops ret=0
madv_pageout madvise(MADV_PAGEOUT) oops ret=0
mbind_mixed mbind(MPOL_BIND, n1, MPOL_MF_MOVE) oops ret=0
mbind_pfnmap mbind(MPOL_BIND, n1, MPOL_MF_STRICT) oops ret=0
mbind_real mbind(MPOL_BIND, n1, MPOL_MF_STRICT) -EIO ret=0
Two things the table shows that are easy to miss in the code:
- mbind_mixed passes only MPOL_MF_MOVE. MPOL_MF_STRICT is not needed for
a VM_MIXEDMAP vma: walk_page_test() only skips VM_PFNMAP, and
vma_migratable() is true for VM_MIXEDMAP.
- mbind_real demonstrates the user visible change (-EIO -> 0)
This patch (of 2):
mmap a VM_PFNMAP region whose ->huge_fault installs a PMD through
vmf_insert_pfn_pmd() - a vfio-pci MMIO BAR does this - then
mbind(p, len, MPOL_BIND, &mask, maxnode, MPOL_MF_STRICT);
With a stand-in module for the driver:
BUG: unable to handle page fault for address: fffff96dc0000008
RIP: 0010:queue_folios_pte_range+0xaf/0x440
walk_pgd_range+0x52b/0xaf0
__walk_page_range+0x6a/0x1d0
walk_page_range_mm_unsafe+0x193/0x230
queue_pages_range+0x64/0xa0
do_mbind+0x25e/0x640
queue_folios_pmd(), inlined above, calls pmd_folio() on that PMD. The pfn
is raw MMIO with no memmap entry, so the folio lands in unpopulated
vmemmap. Neither guard stops the walk:
walk_page_test() skips VM_PFNMAP, but queue_pages_walk_ops
supplies ->test_walk, so it never runs
queue_pages_test_walk() honours vma_migratable(), but only while
MPOL_MF_STRICT is clear
A VM_MIXEDMAP vma needs neither flag, being vma_migratable(), so plain
mbind(MPOL_MF_MOVE) reaches this too - and there the bad folio carries on
into migrate_folio_add() and folio_isolate_lru(). mshv_vtl_low is such a
mapping.
Use vm_normal_folio_pmd() and skip on NULL, as the PTE loop in
queue_folios_pte_range() already does with vm_normal_folio(). This also
filters the huge zero PMD, so its separate check is no longer needed.
mbind(MPOL_MF_STRICT) over a PMD mapped VM_PFNMAP region now returns 0
rather than -EIO. The PTE loop already returned 0 there.
Link: https://lore.kernel.org/20260926105110.2156652-1-gourry@gourry.net
Link: https://lore.kernel.org/20260926105110.2156652-2-gourry@gourry.net
Fixes: 3c8e44c9b369 ("mm: mark special bits for huge pfn mappings when inject")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260817220810.1175596-1-gourry%40gourry.net
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Assisted-by: LLM
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/mempolicy.c | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 7627d33e509c3..b63d7f410d145 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -650,7 +650,8 @@ static inline bool queue_folio_required(struct folio *folio,
return node_isset(nid, *qp->nmask) == !(flags & MPOL_MF_INVERT);
}
-static void queue_folios_pmd(pmd_t *pmd, struct mm_walk *walk)
+static void queue_folios_pmd(pmd_t *pmd, unsigned long addr,
+ struct mm_walk *walk)
{
struct folio *folio;
struct queue_pages *qp = walk->private;
@@ -661,13 +662,9 @@ static void queue_folios_pmd(pmd_t *pmd, struct mm_walk *walk)
qp->nr_failed++;
return;
}
- folio = pmd_folio(pmdval);
- if (folio_is_zone_device(folio))
+ folio = vm_normal_folio_pmd(walk->vma, addr, pmdval);
+ if (!folio || folio_is_zone_device(folio))
return;
- if (is_huge_zero_folio(folio)) {
- walk->action = ACTION_CONTINUE;
- return;
- }
if (!queue_folio_required(folio, qp))
return;
if (!(qp->flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) ||
@@ -700,7 +697,7 @@ static int queue_folios_pte_range(pmd_t *pmd, unsigned long addr,
ptl = pmd_trans_huge_lock(pmd, vma);
if (ptl) {
- queue_folios_pmd(pmd, walk);
+ queue_folios_pmd(pmd, addr, walk);
spin_unlock(ptl);
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0586/1257] mm/madvise: use vm_normal_folio_pmd() in cold/pageout PMD range
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (584 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0585/1257] mm/mempolicy: use vm_normal_folio_pmd() in queue_folios_pmd() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0587/1257] clk: imx: Fix clock reference leak in imx_get_clk_hw_by_name() Greg Kroah-Hartman
` (412 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
sashiko-bot, Lorenzo Stoakes (ARM), David Hildenbrand (Arm),
Zi Yan, Liam R. Howlett, Vlastimil Babka, Jann Horn, Joshua Hahn,
Rakie Kim, Ying Huang, Peter Xu, Jason Gunthorpe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 0bd719cb607ef14bcd554e044bbd80dd901b9996 ]
mmap a VM_MIXEDMAP region whose ->huge_fault installs a PMD through
vmf_insert_pfn_pmd() - mshv_vtl_low does this, and needs CAP_SYS_ADMIN
to open - then:
madvise(p, PMD_SIZE, MADV_PAGEOUT);
With a stand-in module for the driver:
BUG: unable to handle page fault for address: fffff587c0000008
RIP: 0010:madvise_cold_or_pageout_pte_range+0x410/0x9b0
walk_pgd_range+0x52b/0xaf0
__walk_page_range+0x6a/0x1d0
walk_page_range_vma_unsafe+0x8e/0x120
madvise_pageout+0xb2/0x180
madvise_vma_behavior+0x46b/0xa90
do_madvise+0x108/0x190
__x64_sys_madvise+0x26/0x30
Nothing validates the pfn on the way in:
can_madv_lru_vma() rejects VM_PFNMAP, but not VM_MIXEDMAP
can_fault() *pfn = vmf->pgoff & ~(mask >> PAGE_SHIFT);
vmf_insert_pfn_pmd() no pfn_valid() check
pmd_folio() pfn_to_page() -> unpopulated vmemmap
Even with a valid pfn the path is wrong. The mapping carries no rmap, so
folio_maybe_mapped_shared() sees mapcount 0, and the walker goes on to
folio_deactivate(), or folio_isolate_lru() plus reclaim_pages(), against a
folio this mapping does not own.
Use vm_normal_folio_pmd() and skip on NULL, as the PTE half of this same
walker already does with vm_normal_folio(). This also filters the huge
zero PMD, so its separate check is no longer needed.
Link: https://lore.kernel.org/20260926105110.2156652-3-gourry@gourry.net
Fixes: 3c8e44c9b369 ("mm: mark special bits for huge pfn mappings when inject")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260817220810.1175596-1-gourry%40gourry.net
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Assisted-by: LLM
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: <stable@vger.kernel.org> # v6.19+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/madvise.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/mm/madvise.c b/mm/madvise.c
index 73c2901b9adbf..95287c495e462 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -393,16 +393,15 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
return 0;
orig_pmd = *pmd;
- if (is_huge_zero_pmd(orig_pmd))
- goto huge_unlock;
-
if (unlikely(!pmd_present(orig_pmd))) {
VM_WARN_ON_ONCE(!pmd_is_migration_entry(orig_pmd) &&
!pmd_is_device_private_entry(orig_pmd));
goto huge_unlock;
}
- folio = pmd_folio(orig_pmd);
+ folio = vm_normal_folio_pmd(vma, addr, orig_pmd);
+ if (!folio)
+ goto huge_unlock;
if (folio_is_zone_device(folio))
goto huge_unlock;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0587/1257] clk: imx: Fix clock reference leak in imx_get_clk_hw_by_name()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (585 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0586/1257] mm/madvise: use vm_normal_folio_pmd() in cold/pageout PMD range Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0588/1257] clk: imx: Fix clock reference leak in imx_obtain_fixed_clock_hw() Greg Kroah-Hartman
` (411 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Abel Vesa, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 8e177ca735761a1f03e1dedffd7ab00d6d0540ae ]
imx_get_clk_hw_by_name() obtains a consumer clock with
of_clk_get_by_name(), extracts the hardware pointer with __clk_get_hw()
and returns it without ever calling clk_put(), leaking the consumer
reference on both return paths.
Extract the hardware pointer first and drop the clock reference with
clk_put() before returning.
Fixes: 3b315214e091 ("clk: imx: implement new clk_hw based APIs")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260915055515.1730145-1-vulab@iscas.ac.cn
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/imx/clk.c b/drivers/clk/imx/clk.c
index f38506830ccf3..e113e30514fa2 100644
--- a/drivers/clk/imx/clk.c
+++ b/drivers/clk/imx/clk.c
@@ -119,12 +119,16 @@ struct clk_hw *imx_obtain_fixed_of_clock(struct device_node *np,
struct clk_hw *imx_get_clk_hw_by_name(struct device_node *np, const char *name)
{
struct clk *clk;
+ struct clk_hw *hw;
clk = of_clk_get_by_name(np, name);
if (IS_ERR(clk))
return ERR_PTR(-ENOENT);
- return __clk_get_hw(clk);
+ hw = __clk_get_hw(clk);
+ clk_put(clk);
+
+ return hw;
}
EXPORT_SYMBOL_GPL(imx_get_clk_hw_by_name);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0588/1257] clk: imx: Fix clock reference leak in imx_obtain_fixed_clock_hw()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (586 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0587/1257] clk: imx: Fix clock reference leak in imx_get_clk_hw_by_name() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0589/1257] xen/gntdev: prevent private mappings from becoming writable Greg Kroah-Hartman
` (410 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Abel Vesa, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 52d4d1b26a5bc64de95099d0a3dd8b90dba1f3a3 ]
imx_obtain_fixed_clock_hw() obtains the clock through
imx_obtain_fixed_clock_from_dt(), which creates a consumer reference
via of_clk_get_from_provider(). The reference is discarded right after
__clk_get_hw() returns the hardware pointer, leaking it.
Keep the imx_clk_fixed() fallback unchanged and drop the DT-obtained
consumer reference with clk_put() once the hardware pointer has been
extracted.
Fixes: a4a4069f4523 ("clk: imx: Add imx_obtain_fixed_clock clk_hw based variant")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260915055631.1730231-1-vulab@iscas.ac.cn
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/imx/clk.c b/drivers/clk/imx/clk.c
index e113e30514fa2..49e51e949f71d 100644
--- a/drivers/clk/imx/clk.c
+++ b/drivers/clk/imx/clk.c
@@ -95,11 +95,16 @@ struct clk_hw *imx_obtain_fixed_clock_hw(
const char *name, unsigned long rate)
{
struct clk *clk;
+ struct clk_hw *hw;
clk = imx_obtain_fixed_clock_from_dt(name);
if (IS_ERR(clk))
- clk = imx_clk_fixed(name, rate);
- return __clk_get_hw(clk);
+ return __clk_get_hw(imx_clk_fixed(name, rate));
+
+ hw = __clk_get_hw(clk);
+ clk_put(clk);
+
+ return hw;
}
struct clk_hw *imx_obtain_fixed_of_clock(struct device_node *np,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0589/1257] xen/gntdev: prevent private mappings from becoming writable
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (587 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0588/1257] clk: imx: Fix clock reference leak in imx_obtain_fixed_clock_hw() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0590/1257] soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms() Greg Kroah-Hartman
` (409 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdifatah Suruur, Juergen Gross,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdifatah Suruur <suruurism@gmail.com>
[ Upstream commit 2176dea8d8c19cb43a9b3651bfa1cb21eab1b31a ]
gntdev_mmap() rejects writable private (non-shared) mappings of foreign
grant pages, because a private writable mapping takes the COW path on
pages that have no proper struct-page backing. However, VM_MAYWRITE is
left set, so userspace can map the grant read-only and then upgrade the
mapping to writable with mprotect(), hitting the same COW path the
check was written to prevent.
Clear VM_MAYWRITE for private mappings, as i915 does for its read-only
objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor
(CVE-2024-53071) and ptp: vmclock (commit
a5edadbae57e2298a56cf7a4e774a027905a331f).
Fixes: ab31523c2fcac ("xen/gntdev: allow usermode to map granted pages")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260819084217.1577-1-suruurism@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/gntdev.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 1dcc4675580ed..b71f5bae25b63 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -1066,6 +1066,13 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
if ((vma->vm_flags & VM_WRITE) && !(vma->vm_flags & VM_SHARED))
return -EINVAL;
+ /*
+ * Private mappings of foreign grant pages must never become
+ * writable: they would take the COW path on granted pages.
+ */
+ if (!(vma->vm_flags & VM_SHARED))
+ vm_flags_clear(vma, VM_MAYWRITE);
+
pr_debug("map %d+%d at %lx (pgoff %lx)\n",
index, count, vma->vm_start, vma->vm_pgoff);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0590/1257] soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (588 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0589/1257] xen/gntdev: prevent private mappings from becoming writable Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0591/1257] soc: fsl: dpio: Fix cleanup on IRQ registration failure Greg Kroah-Hartman
` (408 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Herve Codina,
Christophe Leroy (CS GROUP), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 46201d760c48e771fa2febfcb0787f22c3b71387 ]
The error cleanup loop puts l1rsync_clk and l1rclk_clk a second time
and never puts l1tsync_clk or l1tclk_clk, because the branches that
guard the transmit clocks use the receive clock field names.
Use the matching field in each branch so every clock acquired by
tsa_of_parse_tdms() is released exactly once.
Fixes: 1d4ba0b81c1c ("soc: fsl: cpm1: Add support for TSA")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Link: https://lore.kernel.org/r/20260917152719.2160395-1-vulab@iscas.ac.cn
[chleroy: Fixed the same in tsa_remove()]
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/fsl/qe/tsa.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/soc/fsl/qe/tsa.c b/drivers/soc/fsl/qe/tsa.c
index 4a88e54d25b94..502e2ffe86898 100644
--- a/drivers/soc/fsl/qe/tsa.c
+++ b/drivers/soc/fsl/qe/tsa.c
@@ -865,12 +865,12 @@ static int tsa_of_parse_tdms(struct tsa *tsa, struct device_node *np)
clk_put(tsa->tdm[i].l1rclk_clk);
}
if (tsa->tdm[i].l1tsync_clk) {
- clk_disable_unprepare(tsa->tdm[i].l1rsync_clk);
- clk_put(tsa->tdm[i].l1rsync_clk);
+ clk_disable_unprepare(tsa->tdm[i].l1tsync_clk);
+ clk_put(tsa->tdm[i].l1tsync_clk);
}
if (tsa->tdm[i].l1tclk_clk) {
- clk_disable_unprepare(tsa->tdm[i].l1rclk_clk);
- clk_put(tsa->tdm[i].l1rclk_clk);
+ clk_disable_unprepare(tsa->tdm[i].l1tclk_clk);
+ clk_put(tsa->tdm[i].l1tclk_clk);
}
}
return ret;
@@ -1039,12 +1039,12 @@ static void tsa_remove(struct platform_device *pdev)
clk_put(tsa->tdm[i].l1rclk_clk);
}
if (tsa->tdm[i].l1tsync_clk) {
- clk_disable_unprepare(tsa->tdm[i].l1rsync_clk);
- clk_put(tsa->tdm[i].l1rsync_clk);
+ clk_disable_unprepare(tsa->tdm[i].l1tsync_clk);
+ clk_put(tsa->tdm[i].l1tsync_clk);
}
if (tsa->tdm[i].l1tclk_clk) {
- clk_disable_unprepare(tsa->tdm[i].l1rclk_clk);
- clk_put(tsa->tdm[i].l1rclk_clk);
+ clk_disable_unprepare(tsa->tdm[i].l1tclk_clk);
+ clk_put(tsa->tdm[i].l1tclk_clk);
}
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0591/1257] soc: fsl: dpio: Fix cleanup on IRQ registration failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (589 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0590/1257] soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0592/1257] soc: fsl: dpio: Free the IRQ before releasing the I/O object Greg Kroah-Hartman
` (407 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Ioana Ciornei, Christophe Leroy (CS GROUP), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 45ecea8c55521d424513178fb612cefffb09a9f5 ]
IRQ registration happens after dpaa2_io_create(), but its failure path
only releases the IRQ resources and the MC portal. The I/O object stays
allocated and published in the service list and per-CPU lookup table,
while devres unmaps its portal registers after probe fails.
Call dpaa2_io_down() on IRQ registration failure to remove the object
from those lookup structures and free it. Reorder the error labels so
that a failed dpaa2_io_create() still skips this cleanup.
Remove unregister_dpio_irq_handlers() from the probe error path, since
no IRQ handler or affinity hint has been installed when registration
fails.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: fe8fe7723a3a ("soc: fsl: dpio: register dpio irq handlers after dpio create")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20261002194802.375497-2-mhun512@gmail.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/fsl/dpio/dpio-driver.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
index d5198ffc44550..8d3134622a285 100644
--- a/drivers/soc/fsl/dpio/dpio-driver.c
+++ b/drivers/soc/fsl/dpio/dpio-driver.c
@@ -244,9 +244,9 @@ static int dpaa2_dpio_probe(struct fsl_mc_device *dpio_dev)
return 0;
-err_dpaa2_io_create:
- unregister_dpio_irq_handlers(dpio_dev);
err_register_dpio_irq:
+ dpaa2_io_down(priv->io);
+err_dpaa2_io_create:
fsl_mc_free_irqs(dpio_dev);
err_allocate_irqs:
dpio_disable(dpio_dev->mc_io, 0, dpio_dev->mc_handle);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0592/1257] soc: fsl: dpio: Free the IRQ before releasing the I/O object
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (590 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0591/1257] soc: fsl: dpio: Fix cleanup on IRQ registration failure Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0593/1257] xen/privcmd: Only claim ioreqs matching an ioeventfd Greg Kroah-Hartman
` (406 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Ioana Ciornei, Christophe Leroy (CS GROUP), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit a7831c657c90e8f9165f6bbe0cc56262fee075e8 ]
The DPIO interrupt handler accesses priv->io, but dpaa2_dpio_remove()
releases that object before tearing down the interrupts. The IRQ was
requested with devm_request_irq(), and unregister_dpio_irq_handlers()
only clears its affinity hint. fsl_mc_free_irqs() returns IRQ resources
to the MC resource pool without freeing the handler. An interrupt can
therefore access the freed I/O object before devres releases the IRQ.
Explicitly free the managed IRQ in unregister_dpio_irq_handlers() before
returning its resource to the pool, and perform IRQ teardown before
releasing the I/O object. This also waits for an in-flight handler while
the object is still valid.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: 993fec7e11ca ("bus: fsl-mc: dpio: add the DPAA2 DPIO object driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20261002194802.375497-3-mhun512@gmail.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/fsl/dpio/dpio-driver.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
index 8d3134622a285..d8f28fb7c37aa 100644
--- a/drivers/soc/fsl/dpio/dpio-driver.c
+++ b/drivers/soc/fsl/dpio/dpio-driver.c
@@ -88,6 +88,7 @@ static void unregister_dpio_irq_handlers(struct fsl_mc_device *dpio_dev)
/* clear the affinity hint */
irq_set_affinity_hint(irq->virq, NULL);
+ devm_free_irq(&dpio_dev->dev, irq->virq, &dpio_dev->dev);
}
static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
@@ -276,10 +277,10 @@ static void dpaa2_dpio_remove(struct fsl_mc_device *dpio_dev)
priv = dev_get_drvdata(dev);
cpu = dpaa2_io_get_cpu(priv->io);
- dpaa2_io_down(priv->io);
-
dpio_teardown_irqs(dpio_dev);
+ dpaa2_io_down(priv->io);
+
cpumask_set_cpu(cpu, cpus_unused_mask);
err = dpio_open(dpio_dev->mc_io, 0, dpio_dev->obj_desc.id,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0593/1257] xen/privcmd: Only claim ioreqs matching an ioeventfd
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (591 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0592/1257] soc: fsl: dpio: Free the IRQ before releasing the I/O object Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0594/1257] xen/gntdev: Fix gntdev_dmabuf ref leak in dmabuf_exp_wait_released() Greg Kroah-Hartman
` (405 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Juergen Gross,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 908019e5999161ca89da310c05ddbf7fc89c129e ]
The ioeventfd handler shares its event channel with the userspace device
model. It must only claim requests that match a registered ioeventfd.
Other requests are left for userspace.
ioeventfd_interrupt() currently marks every MMIO write INPROCESS before
looking for a match. For an unmatched request it drops the lock and
restores READY. Userspace may see INPROCESS and skip it. Restoring READY
does not send another notification. If userspace handles the request at
the same time, the READY store may overwrite its state.
Find a matching ioeventfd before changing the request state.
The lock now protects only the ioeventfd list. Use explicit virt_*mb()
barriers for the ioreq shared with Xen.
Fixes: f0d7db7b3324 ("xen: privcmd: Add support for ioeventfd")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260821084112.2374949-1-den@valinux.co.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/privcmd.c | 47 +++++++++++++++++--------------------------
1 file changed, 18 insertions(+), 29 deletions(-)
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 7cfc28f1bb86f..c67ec6d282cf5 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -1169,51 +1169,40 @@ static irqreturn_t ioeventfd_interrupt(int irq, void *dev_id)
struct privcmd_kernel_ioreq *kioreq = port->kioreq;
struct ioreq *ioreq = &kioreq->ioreq[port->vcpu];
struct privcmd_kernel_ioeventfd *kioeventfd;
- unsigned int state = STATE_IOREQ_READY;
+ bool matched = false;
- if (ioreq->state != STATE_IOREQ_READY ||
- ioreq->type != IOREQ_TYPE_COPY || ioreq->dir != IOREQ_WRITE)
+ if (ioreq->state != STATE_IOREQ_READY)
return IRQ_NONE;
- /*
- * We need a barrier, smp_mb(), here to ensure reads are finished before
- * `state` is updated. Since the lock implementation ensures that
- * appropriate barrier will be added anyway, we can avoid adding
- * explicit barrier here.
- *
- * Ideally we don't need to update `state` within the locks, but we do
- * that here to avoid adding explicit barrier.
- */
+ /* Xen publishes the request before changing its state to READY. */
+ virt_rmb();
- spin_lock(&kioreq->lock);
- ioreq->state = STATE_IOREQ_INPROCESS;
+ if (ioreq->type != IOREQ_TYPE_COPY || ioreq->dir != IOREQ_WRITE)
+ return IRQ_NONE;
+ spin_lock(&kioreq->lock);
list_for_each_entry(kioeventfd, &kioreq->ioeventfds, list) {
if (ioreq->addr == kioeventfd->addr + VIRTIO_MMIO_QUEUE_NOTIFY &&
ioreq->size == kioeventfd->addr_len &&
(ioreq->data & QUEUE_NOTIFY_VQ_MASK) == kioeventfd->vq) {
+ /* Finish reading the request before claiming it. */
+ virt_mb();
+ ioreq->state = STATE_IOREQ_INPROCESS;
eventfd_signal(kioeventfd->eventfd);
- state = STATE_IORESP_READY;
+ matched = true;
break;
}
}
spin_unlock(&kioreq->lock);
- /*
- * We need a barrier, smp_mb(), here to ensure writes are finished
- * before `state` is updated. Since the lock implementation ensures that
- * appropriate barrier will be added anyway, we can avoid adding
- * explicit barrier here.
- */
-
- ioreq->state = state;
-
- if (state == STATE_IORESP_READY) {
- notify_remote_via_evtchn(port->port);
- return IRQ_HANDLED;
- }
+ if (!matched)
+ return IRQ_NONE;
- return IRQ_NONE;
+ /* Publish the response only after signaling the eventfd. */
+ virt_wmb();
+ ioreq->state = STATE_IORESP_READY;
+ notify_remote_via_evtchn(port->port);
+ return IRQ_HANDLED;
}
static void ioreq_free(struct privcmd_kernel_ioreq *kioreq)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0594/1257] xen/gntdev: Fix gntdev_dmabuf ref leak in dmabuf_exp_wait_released()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (592 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0593/1257] xen/privcmd: Only claim ioreqs matching an ioeventfd Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0595/1257] xen/pcifront: check that an AER callback exists before calling it Greg Kroah-Hartman
` (404 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Juergen Gross,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 6f165abe2b40ede71c98956cd74cd17c18505e75 ]
dmabuf_exp_wait_released() takes a reference on the exported
gntdev_dmabuf with dmabuf_exp_wait_obj_get_dmabuf() and passes it to
dmabuf_exp_wait_obj_new(), which drops that reference after adding the
wait object to the wait list. When the wait object allocation fails,
dmabuf_exp_wait_obj_new() returns ERR_PTR(-ENOMEM) early and the
reference is never dropped, leaking a reference to the exported
gntdev_dmabuf.
Drop the reference on the allocation failure path so the reference is
consumed whether the wait object is created or not.
Fixes: 932d6562179e ("xen/gntdev: Add initial support for dma-buf UAPI")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260916170956.2086505-1-vulab@iscas.ac.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/gntdev-dmabuf.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c
index 83b0df4608941..df1883aca850e 100644
--- a/drivers/xen/gntdev-dmabuf.c
+++ b/drivers/xen/gntdev-dmabuf.c
@@ -96,8 +96,10 @@ dmabuf_exp_wait_obj_new(struct gntdev_dmabuf_priv *priv,
struct gntdev_dmabuf_wait_obj *obj;
obj = kzalloc_obj(*obj);
- if (!obj)
+ if (!obj) {
+ kref_put(&gntdev_dmabuf->u.exp.refcount, dmabuf_exp_release);
return ERR_PTR(-ENOMEM);
+ }
init_completion(&obj->completion);
obj->gntdev_dmabuf = gntdev_dmabuf;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0595/1257] xen/pcifront: check that an AER callback exists before calling it
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (593 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0594/1257] xen/gntdev: Fix gntdev_dmabuf ref leak in dmabuf_exp_wait_released() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0596/1257] xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf() Greg Kroah-Hartman
` (403 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yehyeong Lee, Juergen Gross,
Bjorn Helgaas, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit 3b4854b69ee70fffb2fa7acac09e715a7efcbae1 ]
pcifront_common_process() handles an AER request from the backend by
dispatching on aer_op.cmd to the bound driver's PCI error handler. It
only checks that err_handler and err_handler->error_detected are present,
then for the mmio_enabled, slot_reset and resume commands it calls the
corresponding callback unconditionally. Those three callbacks are
optional -- the PCI core NULL-checks each of them individually before
use -- and many drivers (for example igb, igc, ice and ixgbevf) install
error_detected without all of them.
aer_op.cmd comes from the shared ring, so a malicious or buggy backend
can send XEN_PCI_OP_aer_mmio (or _slotreset/_resume) for a device whose
driver leaves that callback NULL and make the frontend call through a
NULL pointer, crashing the guest.
Check each callback before calling it. When mmio_enabled or slot_reset is
absent, return PCI_ERS_RESULT_RECOVERED so recovery proceeds, as the PCI
core does for a missing callback; returning PCI_ERS_RESULT_NONE would
instead make xen-pciback tear the guest domain down.
Fixes: 956a9202cd12 ("xen-pcifront: Xen PCI frontend driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Reviewed-by: Juergen Gross <jgross@suse.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20261006023443.338194-1-yhlee@isslab.korea.ac.kr>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/xen-pcifront.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
index cffc32d660327..5c6f7796d204a 100644
--- a/drivers/pci/xen-pcifront.c
+++ b/drivers/pci/xen-pcifront.c
@@ -599,11 +599,16 @@ static pci_ers_result_t pcifront_common_process(int cmd,
case XEN_PCI_OP_aer_detected:
return pdrv->err_handler->error_detected(pcidev, state);
case XEN_PCI_OP_aer_mmio:
- return pdrv->err_handler->mmio_enabled(pcidev);
+ if (pdrv->err_handler->mmio_enabled)
+ return pdrv->err_handler->mmio_enabled(pcidev);
+ return PCI_ERS_RESULT_RECOVERED;
case XEN_PCI_OP_aer_slotreset:
- return pdrv->err_handler->slot_reset(pcidev);
+ if (pdrv->err_handler->slot_reset)
+ return pdrv->err_handler->slot_reset(pcidev);
+ return PCI_ERS_RESULT_RECOVERED;
case XEN_PCI_OP_aer_resume:
- pdrv->err_handler->resume(pcidev);
+ if (pdrv->err_handler->resume)
+ pdrv->err_handler->resume(pcidev);
return PCI_ERS_RESULT_NONE;
default:
dev_err(&pdev->xdev->dev,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0596/1257] xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (594 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0595/1257] xen/pcifront: check that an AER callback exists before calling it Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0597/1257] iommu/dma: Catch scatterlist length overflows Greg Kroah-Hartman
` (402 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Juergen Gross,
Jiqian Chen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit cfaf31becde901f7a2376d36db628f8be0bc7283 ]
pcistub_get_gsi_from_sbdf() obtains the stub device with
pcistub_device_find(), which returns it with its kref incremented, and
returns psdev->gsi without dropping that reference again. The caller
cannot release it either, so every lookup leaks one reference to the
stub device.
Release the reference after reading gsi.
Fixes: 2fae6bb7be32 ("xen/privcmd: Add new syscall to get gsi from dev")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jiqian Chen <Jiqian.Chen@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260916171141.2086627-1-vulab@iscas.ac.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/xen-pciback/pci_stub.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 79a2b5dfd6941..d1a335233aab0 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -234,13 +234,16 @@ static int pcistub_get_gsi_from_sbdf(unsigned int sbdf)
int bus = PCI_BUS_NUM(sbdf);
int slot = PCI_SLOT(sbdf);
int func = PCI_FUNC(sbdf);
+ int gsi;
psdev = pcistub_device_find(domain, bus, slot, func);
-
if (!psdev)
return -ENODEV;
- return psdev->gsi;
+ gsi = psdev->gsi;
+ pcistub_device_put(psdev);
+
+ return gsi;
}
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0597/1257] iommu/dma: Catch scatterlist length overflows
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (595 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0596/1257] xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0598/1257] drm/ttm: return an error when kmapping a BO without pages Greg Kroah-Hartman
` (401 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Karas, Robin Murphy,
Sebastian Brzezinka, Joerg Roedel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Karas <krzysztof.karas@intel.com>
[ Upstream commit 1c8f6308e557f32412e9d4678b3f029f47f6d9aa ]
It is possible, when a very large mapping uses only one
scatterlist, that padding overflows scatterlist's length field.
This results in:
1) silently wrapping the value
2) smaller than desired mappings produced by iommu_map_sg
3) leaving mapped bytes in memory (no iommu_unmap)
Address this issue by adding overflow detection for scatterlist
length field.
Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/dma-iommu.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 68ee57800fefc..795a0d6248ceb 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -1477,6 +1477,11 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
sg_dma_len(s) = s_length;
s->offset -= s_iova_off;
s_length = iova_align(iovad, s_length + s_iova_off);
+ if (overflows_type(s_length, s->length)) {
+ ret = -EOVERFLOW;
+
+ goto out_restore_sg;
+ }
s->length = s_length;
/*
@@ -1493,7 +1498,20 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
* time through here (i.e. before it has a meaningful value).
*/
if (pad_len && pad_len < s_length - 1) {
- prev->length += pad_len;
+ unsigned int new_prev_len;
+
+ /*
+ * For large mappings spanning multiple GBs we
+ * may not be able to fit all needed padding into
+ * sg->length.
+ */
+ if (check_add_overflow(prev->length, pad_len, &new_prev_len)) {
+ ret = -EOVERFLOW;
+
+ goto out_restore_sg;
+ }
+
+ prev->length = new_prev_len;
iova_len += pad_len;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0598/1257] drm/ttm: return an error when kmapping a BO without pages
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (596 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0597/1257] iommu/dma: Catch scatterlist length overflows Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0599/1257] ALSA: usb-audio: Add mic resolution quirk for Logitech Webcam C200 Greg Kroah-Hartman
` (400 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Jesse Zhang,
Arunpravin Paneer Selvam, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <Jesse.Zhang@amd.com>
[ Upstream commit fd485d47437ba1700dd47205a63b9f389a00aa36 ]
ttm_tt objects for imported sg tables (ttm_bo_type_sg, set up by
ttm_sg_tt_init() with TTM_TT_FLAG_EXTERNAL) only have DMA addresses and
no pages array. ttm_bo_kmap() and ttm_bo_vmap() still dereference
ttm->pages for them, so a driver that tries to CPU map such a BO oopses
instead of getting an error:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:ttm_bo_kmap+0x26c/0x300 [ttm]
Call Trace:
amdgpu_bo_kmap+0x89/0xb0 [amdgpu]
amdgpu_userq_fence_read_wptr+0x116/0x170 [amdgpu]
amdgpu_userq_signal_ioctl+0x3fe/0xbb0 [amdgpu]
Return -EINVAL in that case, like ttm_bo_kmap_try_from_panic() already
checks for a missing pages array.
Fixes: 75a57669cbc8 ("drm/ttm: add ttm_sg_tt_init")
Cc: stable@vger.kernel.org
Suggested-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Link: https://patch.msgid.link/20261009103419.4122940-1-Jesse.Zhang@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/ttm/ttm_bo_util.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index bd0b23ac2cc4b..f9458a4d5a09d 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -356,6 +356,10 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
if (ret)
return ret;
+ /* Imported sg tables only come with DMA addresses, no pages to map. */
+ if (!ttm->pages)
+ return -EINVAL;
+
if (num_pages == 1 && ttm->caching == ttm_cached &&
!(man->use_tt && (ttm->page_flags & TTM_TT_FLAG_DECRYPTED))) {
/*
@@ -419,7 +423,7 @@ EXPORT_SYMBOL(ttm_bo_kmap_try_from_panic);
*
* Returns
* -ENOMEM: Out of memory.
- * -EINVAL: Invalid range.
+ * -EINVAL: Invalid range or the BO has no pages to map.
*/
int ttm_bo_kmap(struct ttm_buffer_object *bo,
unsigned long start_page, unsigned long num_pages,
@@ -493,7 +497,7 @@ EXPORT_SYMBOL(ttm_bo_kunmap);
*
* Returns
* -ENOMEM: Out of memory.
- * -EINVAL: Invalid range.
+ * -EINVAL: Invalid range or the BO has no pages to map.
*/
int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
{
@@ -537,6 +541,9 @@ int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
if (ret)
return ret;
+ if (!ttm->pages)
+ return -EINVAL;
+
/*
* We need to use vmap to get the desired page protection
* or to make the buffer object look contiguous.
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0599/1257] ALSA: usb-audio: Add mic resolution quirk for Logitech Webcam C200
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (597 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0598/1257] drm/ttm: return an error when kmapping a BO without pages Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0600/1257] wifi: ath12k: validate MAC/PHY capability count before saving Greg Kroah-Hartman
` (399 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olivier Kaloudoff, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
[ Upstream commit 874323b68c93c6808e034dc0113681e822e6fb42 ]
The C200 (046d:0802) reports a mic capture volume range of
1536..7680 with a resolution of 1 (6144 steps), triggering
"Warning! Unlikely big volume step count (=6144), linear volume or
wrong cval->res?" at probe and exposing a uselessly fine-grained
mixer control. This is the same firmware behavior as the other
UVC-era Logitech webcams already carrying QUIRK_FLAG_MIC_RES_384
(C500, C600, C210, C270, C310, C510, C525, ...), so apply the same
quirk: CTL_MSG_DELAY_1M (which the Logitech VENDOR_FLG would provide
if the device-specific entry did not short-circuit the lookup) plus
MIC_RES_384.
Verified on real hardware: with the quirk the warning disappears and
the driver logs "set resolution quirk: cval->res = 384".
Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261008230844.11246-1-olivier.kaloudoff@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/quirks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index a54fabce7920d..b9e89e94e95f5 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2251,6 +2251,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_DISABLE_AUTOSUSPEND),
DEVICE_FLG(0x045e, 0x070f, /* MS LifeChat LX-3000 Headset */
QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE),
+ DEVICE_FLG(0x046d, 0x0802, /* Logitech Webcam C200 */
+ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
DEVICE_FLG(0x046d, 0x0807, /* Logitech Webcam C500 */
QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
DEVICE_FLG(0x046d, 0x0808, /* Logitech Webcam C600 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0600/1257] wifi: ath12k: validate MAC/PHY capability count before saving
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (598 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0599/1257] ALSA: usb-audio: Add mic resolution quirk for Logitech Webcam C200 Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0601/1257] USB: cdc-acm: fix urb leak on disconnect Greg Kroah-Hartman
` (398 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiale Yao, Rameshkumar Sundaram,
Baochen Qiang, Jeff Johnson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 86f2537877d6029487811bc3e0cd9e086a196000 ]
Firmware supplies the hardware mode count and the PHY bitmap for each
mode in the service-ready-ext event. ath12k_wmi_save_all_mac_phy_info()
uses those bitmaps to populate svc_ext_info->mac_phy_info, but the
destination is a fixed array of ATH12K_MAX_MAC_PHY_CAP elements.
If the total number of advertised PHY entries exceeds that limit, the
loop writes beyond mac_phy_info and corrupts adjacent memory.
ath12k_wmi_mac_phy_caps_parse() allocates the source array for
tot_phy_id entries and rejects excess capability TLVs. However, if the
event contains fewer capability TLVs than advertised, the remaining
allocated entries stay zeroed and are saved as invalid PHY information.
After parsing the MAC/PHY capability TLVs, validate the destination
capacity and reject an incomplete capability list before saving any
entries.
Fixes: 062ade23991e ("wifi: ath12k: parse and save hardware mode info from WMI_SERVICE_READY_EXT_EVENTID event for later use")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20261003101944.596546-1-yaojiale02@163.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/wmi.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index d5160af60e00d..3e812c79a649d 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -5050,6 +5050,7 @@ static int ath12k_wmi_svc_rdy_ext_parse(struct ath12k_base *ab,
u16 tag, u16 len,
const void *ptr, void *data)
{
+ struct ath12k_svc_ext_info *svc_ext_info = &ab->wmi_ab.svc_ext_info;
struct ath12k_wmi_pdev *wmi_handle = &ab->wmi_ab.wmi[0];
struct ath12k_wmi_svc_rdy_ext_parse *svc_rdy_ext = data;
int ret;
@@ -5094,6 +5095,22 @@ static int ath12k_wmi_svc_rdy_ext_parse(struct ath12k_base *ab,
return ret;
}
+ if (svc_rdy_ext->tot_phy_id >
+ ARRAY_SIZE(svc_ext_info->mac_phy_info)) {
+ ath12k_warn(ab, "too many PHY entries %u (max %zu)\n",
+ svc_rdy_ext->tot_phy_id,
+ ARRAY_SIZE(svc_ext_info->mac_phy_info));
+ return -EINVAL;
+ }
+
+ if (svc_rdy_ext->n_mac_phy_caps < svc_rdy_ext->tot_phy_id) {
+ ath12k_warn(ab,
+ "not enough MAC/PHY caps %u, expected %u\n",
+ svc_rdy_ext->n_mac_phy_caps,
+ svc_rdy_ext->tot_phy_id);
+ return -EINVAL;
+ }
+
ath12k_wmi_save_all_mac_phy_info(ab, svc_rdy_ext);
svc_rdy_ext->mac_phy_done = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0601/1257] USB: cdc-acm: fix urb leak on disconnect
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (599 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0600/1257] wifi: ath12k: validate MAC/PHY capability count before saving Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0602/1257] USB: serial: option: add Rolling Wireless RN947R Greg Kroah-Hartman
` (397 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Johan Hovold,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 648b08aa37c1b24a61662ad78964f2bca659ca26 ]
Make sure to drop the reference taken by usb_anchor_urb() when removing
URBs from the delayed URB anchor to prevent them from leaking when the
device is later disconnected.
Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/20260917161217.2161883-1-vulab@iscas.ac.cn/
Cc: stable@vger.kernel.org # 3.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20261009122934.464142-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/class/cdc-acm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 0d3f815b2f1e8..6a1c574634949 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -782,6 +782,7 @@ static void acm_port_shutdown(struct tty_port *port)
urb = usb_get_from_anchor(&acm->delayed);
if (!urb)
break;
+ usb_put_urb(urb);
wb = urb->context;
wb->use = false;
usb_autopm_put_interface_async(acm->control);
@@ -1710,7 +1711,7 @@ static int acm_resume(struct usb_interface *intf)
urb = usb_get_from_anchor(&acm->delayed);
if (!urb)
break;
-
+ usb_put_urb(urb);
acm_start_wb(acm, urb->context);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0602/1257] USB: serial: option: add Rolling Wireless RN947R
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (600 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0601/1257] USB: cdc-acm: fix urb leak on disconnect Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0603/1257] USB: serial: option: add support for ASR 1286:4e3c modem Greg Kroah-Hartman
` (396 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Reinhard Speyerer, Johan Hovold,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Reinhard Speyerer <rspmn@arcor.de>
[ Upstream commit 931aad81f3f2d26276fff6b7bda6793267a65725 ]
Add Rolling Wireless RN947R 0x9300 compositions:
Standard mode: DIAG + ADB + NMEA + MODEM + RMNET + QDSS + ADPL
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 6 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=33f8 ProdID=9300 Rev= 0.00
S: Manufacturer=Rolling Wireless
S: Product=RN947R
S: SerialNumber=xxxxxxxxxxx
C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#=21 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#=22 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
QDL mode:
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 12 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=33f8 ProdID=9300 Rev= 0.00
S: Manufacturer=Rolling Wireless
S: Product=RN947R
S: SerialNumber=xxxxxxxxxxx
C:* #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr= 2mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=10 Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Reinhard Speyerer <rspmn@arcor.de>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/serial/option.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 828b1be3fee2d..dc8f459ca3995 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2510,6 +2510,10 @@ static const struct usb_device_id option_ids[] = {
.driver_info = RSVD(5) },
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x1003, 0xff), /* Rolling RW135R-GL (laptop MBIM) */
.driver_info = RSVD(5) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x33f8, 0x9300, 0xff, 0xff, 0x30) }, /* Rolling RN947R */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x33f8, 0x9300, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x33f8, 0x9300, 0xff, 0xff, 0x10),
+ .driver_info = ZLP },
{ USB_DEVICE_INTERFACE_CLASS(0x3466, 0x3301, 0xff) }, /* TDTECH MT5710-CN */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) },
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0603/1257] USB: serial: option: add support for ASR 1286:4e3c modem
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (601 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0602/1257] USB: serial: option: add Rolling Wireless RN947R Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0604/1257] USB: serial: usb_wwan: fix urb leak on disconnect Greg Kroah-Hartman
` (395 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Wyraz, Johan Hovold,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Wyraz <michael@wyraz.de>
[ Upstream commit 87c56085bcdfec305f5c350fe1c58a62a7f65843 ]
The ASR modem used in the Tuoshi LT22M exposes an RNDIS function on
interfaces 0 and 1, a diagnostic port on interface 2, and AT ports on
interfaces 3 and 4. Match only the vendor-specific serial interfaces
so option does not bind to the RNDIS function.
Link: https://lore.kernel.org/all/d12635f9-9706-4dbd-8adb-d673c6a77202@wyraz.de/
Signed-off-by: Michael Wyraz <michael@wyraz.de>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/serial/option.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index dc8f459ca3995..65506f6e1502e 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2443,6 +2443,7 @@ static const struct usb_device_id option_ids[] = {
{ USB_DEVICE_AND_INTERFACE_INFO(0x04b7, 0x8217, 0xff, 0xff, 0x30) }, /* Compal EXM-G1x */
{ USB_DEVICE_AND_INTERFACE_INFO(0x04b7, 0x8217, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x04b7, 0x8217, 0xff, 0xff, 0x60) },
+ { USB_DEVICE_INTERFACE_CLASS(0x1286, 0x4e3c, 0xff) }, /* ASR modem */
{ USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */
.driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
{ USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0604/1257] USB: serial: usb_wwan: fix urb leak on disconnect
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (602 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0603/1257] USB: serial: option: add support for ASR 1286:4e3c modem Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0605/1257] misc: fastrpc: fix double-free in fastrpc_map_attach() error path Greg Kroah-Hartman
` (394 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Oliver Neukum,
Johan Hovold, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit c78dd373b5c56a5a02da591b583c6b48d0d62954 ]
Make sure to drop the reference taken by usb_anchor_urb() when removing
URBs from the delayed URB anchor to prevent them from leaking when the
device is later disconnected.
Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the option driver")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/20260916165608.2085613-1-vulab@iscas.ac.cn
Cc: stable@vger.kernel.org # 2.6.32
Cc: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/serial/usb_wwan.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index a183cc4515edb..6beb4062bda3a 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -401,6 +401,7 @@ void usb_wwan_close(struct usb_serial_port *port)
urb = usb_get_from_anchor(&portdata->delayed);
if (!urb)
break;
+ usb_put_urb(urb);
unbusy_queued_urb(urb, portdata);
usb_autopm_put_interface_async(serial->interface);
}
@@ -578,6 +579,8 @@ static int usb_wwan_submit_delayed_urbs(struct usb_serial_port *port)
if (!urb)
break;
+ usb_put_urb(urb);
+
err = usb_submit_urb(urb, GFP_ATOMIC);
if (err) {
dev_err(&port->dev, "%s: submit urb failed: %d\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0605/1257] misc: fastrpc: fix double-free in fastrpc_map_attach() error path
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (603 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0604/1257] USB: serial: usb_wwan: fix urb leak on disconnect Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0606/1257] misc: fastrpc: Allocate entire reserved memory for Audio PD in probe Greg Kroah-Hartman
` (393 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifei Gao, Ekansh Gupta,
Srinivas Kandagatla, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifei Gao <gyf161023@gmail.com>
[ Upstream commit 09fa66ec1b4896ab841da085ca58b6433f28f07f ]
map->table is assigned right after dma_buf_map_attachment_unlocked()
succeeds. The two failure checks that follow, the len > map->size test
and, where subsystem VMIDs are configured, a failed qcom_scm_assign_mem(),
jump to map_err with map->table already set.
map_err manually calls dma_buf_detach() and dma_buf_put() and then falls
through to fastrpc_map_put(). Since that change the error path tail is
fastrpc_map_put() -> fastrpc_free_map(), and fastrpc_free_map() already
unmaps, detaches and puts the dma-buf whenever map->table is set.
The two operations therefore run twice: the second dma_buf_put() drops an
extra reference on map->buf, and dma_buf_unmap_attachment_unlocked()
dereferences the map->attach already freed by the manual dma_buf_detach().
kref_init() sets the refcount to 1 with no intervening get, so the final
fastrpc_map_put() frees the map synchronously and the redundant cleanup is
deterministic.
The len > map->size branch is reachable by an unprivileged process via
FASTRPC_IOCTL_MEM_MAP with an fd whose dma-buf is smaller than the
requested length, before any DSP invocation.
Route both map->table-is-set failure branches to get_err instead of
map_err, so fastrpc_free_map() is the single owner of the
unmap/detach/put sequence. map_err is retained for the
dma_buf_map_attachment_unlocked() failure, which is reached with
map->table still NULL and an attachment that fastrpc_free_map() will not
clean up, so its dma_buf_detach()/dma_buf_put() must still run manually.
Fixes: 334f1a1cbe03 ("misc: fastrpc: Use fastrpc_map_put in fastrpc_map_create on fail")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Yifei Gao <gyf161023@gmail.com>
Reviewed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20261002101220.1084101-2-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/fastrpc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index d4fac2caca867..b35751212095d 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -927,7 +927,7 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd,
dev_dbg(sess->dev, "Bad size passed len 0x%llx map size 0x%llx\n",
len, map->size);
err = -EINVAL;
- goto map_err;
+ goto get_err;
}
map->va = sg_virt(map->table->sgl);
map->len = len;
@@ -950,7 +950,7 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd,
dev_err(sess->dev,
"Failed to assign memory with dma_addr %pad size 0x%llx err %d\n",
&map->dma_addr, map->len, err);
- goto map_err;
+ goto get_err;
}
}
spin_lock(&fl->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0606/1257] misc: fastrpc: Allocate entire reserved memory for Audio PD in probe
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (604 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0605/1257] misc: fastrpc: fix double-free in fastrpc_map_attach() error path Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0607/1257] nvmem: rockchip-otp: Serialize reads Greg Kroah-Hartman
` (392 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jianping Li, Ekansh Gupta,
Srinivas Kandagatla, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianping Li <jianping.li@oss.qualcomm.com>
[ Upstream commit 9e47ad9c562e82cabfbb9afa6c2b0dcdf2702a39 ]
Allocating and freeing Audio PD memory from userspace is unsafe because
the kernel cannot reliably determine when the DSP has finished using the
memory. Userspace may free buffers while they are still in use by the DSP,
and remote free requests cannot be safely trusted.
Additionally, the current implementation allows userspace to repeatedly
grow the Audio PD heap, but does not support shrinking it. This can lead
to unbounded memory usage over time, effectively causing a memory leak.
Fix this by allocating the entire Audio PD reserved-memory region during
rpmsg probe and tying its lifetime to the rpmsg channel. This removes
userspace-controlled alloc/free and ensures that memory is reclaimed only
when the DSP process is torn down.
The reserved-memory region is now mandatory for the Audio PD domain.
Rather than failing rpmsg probe when it is missing, validate it in
fastrpc_init_create_static_process() and reject only the static-process
creation. This keeps the fastrpc device probing for all other domains
even on a misconfigured device tree.
Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd")
Cc: stable@kernel.org
Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com>
Reviewed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Link: https://lore.kernel.org/all/20260814101955.234238-1-jianping.li@oss.qualcomm.com/
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20261002101220.1084101-3-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/fastrpc.c | 188 ++++++++++++++++++++++-------------------
1 file changed, 101 insertions(+), 87 deletions(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index b35751212095d..adc6f850e7536 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -70,8 +70,6 @@
#define ADSP_MMAP_HEAP_ADDR 4
/* MAP static DMA buffer on DSP User PD */
#define ADSP_MMAP_DMA_BUFFER 6
-/* Add memory to static PD pool protection thru hypervisor */
-#define ADSP_MMAP_REMOTE_HEAP_ADDR 8
/* Add memory to userPD pool, for user heap */
#define ADSP_MMAP_ADD_PAGES 0x1000
/* Add memory to userPD pool, for LLC heap */
@@ -314,10 +312,14 @@ struct fastrpc_channel_ctx {
struct kref refcount;
/* Flag if dsp attributes are cached */
bool valid_attributes;
+ /* Flag if audio PD init mem was allocated */
+ bool audio_init_mem;
+ /* Audio PD reserved remote heap region */
+ phys_addr_t remote_heap_addr;
+ u64 remote_heap_size;
u32 dsp_attributes[FASTRPC_MAX_DSP_ATTRIBUTES];
struct fastrpc_device *secure_fdevice;
struct fastrpc_device *fdevice;
- struct fastrpc_buf *remote_heap;
struct list_head invoke_interrupted_mmaps;
bool secure;
bool unsigned_support;
@@ -1454,15 +1456,24 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
struct fastrpc_init_create_static init;
struct fastrpc_invoke_args *args;
struct fastrpc_phy_page pages[1];
+ struct fastrpc_channel_ctx *cctx = fl->cctx;
char *name;
int err;
- bool scm_done = false;
struct {
int client_id;
u32 namelen;
u32 pageslen;
} inbuf;
u32 sc;
+ unsigned long flags;
+ bool sent_heap = false;
+
+ if (!cctx->remote_heap_addr || !cctx->remote_heap_size) {
+ err = -ENOMEM;
+ dev_err(fl->sctx->dev,
+ "remote heap memory region is not added\n");
+ return err;
+ }
args = kzalloc_objs(*args, FASTRPC_CREATE_STATIC_PROCESS_NARGS);
if (!args)
@@ -1486,31 +1497,6 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
inbuf.client_id = fl->client_id;
inbuf.namelen = init.namelen;
inbuf.pageslen = 0;
- if (!fl->cctx->remote_heap) {
- err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen,
- &fl->cctx->remote_heap);
- if (err)
- goto err_name;
-
- /* Map if we have any heap VMIDs associated with this ADSP Static Process. */
- if (fl->cctx->vmcount) {
- u64 src_perms = BIT(QCOM_SCM_VMID_HLOS);
-
- err = qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr,
- (u64)fl->cctx->remote_heap->size,
- &src_perms,
- fl->cctx->vmperms, fl->cctx->vmcount);
- if (err) {
- dev_err(fl->sctx->dev,
- "Failed to assign memory with dma_addr %pad size 0x%llx err %d\n",
- &fl->cctx->remote_heap->dma_addr,
- fl->cctx->remote_heap->size, err);
- goto err_map;
- }
- scm_done = true;
- inbuf.pageslen = 1;
- }
- }
fl->pd = USER_PD;
@@ -1522,8 +1508,25 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
args[1].length = inbuf.namelen;
args[1].fd = -1;
- pages[0].addr = fl->cctx->remote_heap->dma_addr;
- pages[0].size = fl->cctx->remote_heap->size;
+ /*
+ * Audio PD is a static PD and retains the remote heap
+ * information across daemon restarts. Therefore only
+ * the first attach should provide heap information to
+ * DSP. Subsequent attaches reuse the previously
+ * initialized memory pool.
+ */
+ spin_lock_irqsave(&cctx->lock, flags);
+ if (!cctx->audio_init_mem) {
+ pages[0].addr = cctx->remote_heap_addr;
+ pages[0].size = cctx->remote_heap_size;
+ cctx->audio_init_mem = true;
+ inbuf.pageslen = 1;
+ sent_heap = true;
+ } else {
+ pages[0].addr = 0;
+ pages[0].size = 0;
+ }
+ spin_unlock_irqrestore(&cctx->lock, flags);
args[2].ptr = (u64)(uintptr_t) pages;
args[2].length = sizeof(*pages);
@@ -1541,27 +1544,11 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
return 0;
err_invoke:
- if (fl->cctx->vmcount && scm_done) {
- u64 src_perms = 0;
- struct qcom_scm_vmperm dst_perms;
- u32 i;
-
- for (i = 0; i < fl->cctx->vmcount; i++)
- src_perms |= BIT(fl->cctx->vmperms[i].vmid);
-
- dst_perms.vmid = QCOM_SCM_VMID_HLOS;
- dst_perms.perm = QCOM_SCM_PERM_RWX;
- err = qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr,
- (u64)fl->cctx->remote_heap->size,
- &src_perms, &dst_perms, 1);
- if (err)
- dev_err(fl->sctx->dev, "Failed to assign memory dma_addr %pad size 0x%llx err %d\n",
- &fl->cctx->remote_heap->dma_addr, fl->cctx->remote_heap->size, err);
+ if (sent_heap) {
+ spin_lock_irqsave(&cctx->lock, flags);
+ cctx->audio_init_mem = false;
+ spin_unlock_irqrestore(&cctx->lock, flags);
}
-err_map:
- fastrpc_buf_free(fl->cctx->remote_heap);
- fl->cctx->remote_heap = NULL;
-err_name:
kfree(name);
err:
kfree(args);
@@ -2086,7 +2073,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp)
if (copy_from_user(&req, argp, sizeof(req)))
return -EFAULT;
- if (req.flags != ADSP_MMAP_ADD_PAGES && req.flags != ADSP_MMAP_REMOTE_HEAP_ADDR) {
+ if (req.flags != ADSP_MMAP_ADD_PAGES) {
dev_err(dev, "flag not supported 0x%x\n", req.flags);
return -EINVAL;
@@ -2097,10 +2084,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp)
return -EINVAL;
}
- if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR)
- err = fastrpc_remote_heap_alloc(fl, dev, req.size, &buf);
- else
- err = fastrpc_buf_alloc(fl, dev, req.size, &buf);
+ err = fastrpc_buf_alloc(fl, dev, req.size, &buf);
if (err) {
dev_err(dev, "failed to allocate buffer\n");
@@ -2139,20 +2123,6 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp)
/* let the client know the address to use */
req.vaddrout = rsp_msg.vaddr;
- /* Add memory to static PD pool, protection thru hypervisor */
- if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) {
- u64 src_perms = BIT(QCOM_SCM_VMID_HLOS);
-
- err = qcom_scm_assign_mem(buf->dma_addr, (u64)buf->size,
- &src_perms, fl->cctx->vmperms, fl->cctx->vmcount);
- if (err) {
- dev_err(fl->sctx->dev,
- "Failed to assign memory dma_addr %pad size 0x%llx err %d",
- &buf->dma_addr, buf->size, err);
- goto err_assign;
- }
- }
-
spin_lock(&fl->lock);
list_add_tail(&buf->node, &fl->mmaps);
spin_unlock(&fl->lock);
@@ -2533,6 +2503,45 @@ static const struct of_device_id fastrpc_poll_supported_machines[] __maybe_unuse
{},
};
+static int fastrpc_init_reserved_mem(struct fastrpc_channel_ctx *cctx,
+ struct device *rdev, u32 domain_id)
+{
+ struct resource res;
+ u64 src_perms;
+ int err;
+
+ /* Only SDSP and ADSP domains use a reserved remote heap region */
+ if (domain_id != SDSP_DOMAIN_ID && domain_id != ADSP_DOMAIN_ID)
+ return 0;
+
+ err = of_reserved_mem_region_to_resource(rdev->of_node, 0, &res);
+ if (err) {
+ /*
+ * The reserved-memory region is optional at probe time. For
+ * the Audio PD (ADSP) domain its absence is validated later in
+ * fastrpc_init_create_static_process(), so keep probing here.
+ */
+ return 0;
+ }
+
+ /*
+ * Audio PD (ADSP) is a static PD: cache the region so its lifetime
+ * is tied to the rpmsg channel instead of being controlled by
+ * userspace.
+ */
+ if (domain_id == ADSP_DOMAIN_ID) {
+ cctx->remote_heap_addr = res.start;
+ cctx->remote_heap_size = resource_size(&res);
+ }
+
+ if (!cctx->vmcount)
+ return 0;
+
+ src_perms = BIT(QCOM_SCM_VMID_HLOS);
+ return qcom_scm_assign_mem(res.start, resource_size(&res), &src_perms,
+ cctx->vmperms, cctx->vmcount);
+}
+
static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev)
{
struct device *rdev = &rpdev->dev;
@@ -2580,21 +2589,9 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev)
}
}
- if (domain_id == SDSP_DOMAIN_ID) {
- struct resource res;
- u64 src_perms;
-
- err = of_reserved_mem_region_to_resource(rdev->of_node, 0, &res);
- if (!err) {
- src_perms = BIT(QCOM_SCM_VMID_HLOS);
-
- err = qcom_scm_assign_mem(res.start, resource_size(&res), &src_perms,
- data->vmperms, data->vmcount);
- if (err)
- goto err_free_data;
- }
-
- }
+ err = fastrpc_init_reserved_mem(data, rdev, domain_id);
+ if (err)
+ goto err_free_data;
secure_dsp = !(of_property_read_bool(rdev->of_node, "qcom,non-secure-domain"));
data->secure = secure_dsp;
@@ -2694,8 +2691,25 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev)
list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node)
list_del(&buf->node);
- if (cctx->remote_heap)
- fastrpc_buf_free(cctx->remote_heap);
+ if (cctx->remote_heap_size && cctx->vmcount) {
+ u64 src_perms = 0;
+ int err, i;
+ struct qcom_scm_vmperm dst_perms;
+
+ for (i = 0; i < cctx->vmcount; i++)
+ src_perms |= BIT(cctx->vmperms[i].vmid);
+
+ dst_perms.vmid = QCOM_SCM_VMID_HLOS;
+ dst_perms.perm = QCOM_SCM_PERM_RWX;
+
+ err = qcom_scm_assign_mem(cctx->remote_heap_addr,
+ cctx->remote_heap_size, &src_perms,
+ &dst_perms, 1);
+ if (err)
+ dev_err(&rpdev->dev,
+ "Failed to assign memory back to HLOS: addr %pa size %#llx err %d\n",
+ &cctx->remote_heap_addr, cctx->remote_heap_size, err);
+ }
of_platform_depopulate(&rpdev->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0607/1257] nvmem: rockchip-otp: Serialize reads
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (605 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0606/1257] misc: fastrpc: Allocate entire reserved memory for Audio PD in probe Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0608/1257] slimbus: messaging: fix leaked PM vote on tid allocation failure Greg Kroah-Hartman
` (391 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Alexey Charkov,
Srinivas Kandagatla, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Charkov <alchark@flipper.net>
[ Upstream commit 9fc6a1592d844c0397f115ee8cbd935169b9a71e ]
The OTP controller is driven through a single set of registers holding a
state machine which has to be stepped through for every word read, yet
nothing keeps two readers out of each other's way. Concurrent reads
interleave, and the outcome is either a reader bailing out:
rockchip-otp 2a580000.otp: timeout during read setup
or, worse, one of them silently taking delivery of the other's data.
Reading two cells in parallel from userspace on RK3576 reproduces both
within 150 iterations - 53 read errors and 9 corrupted results, the latter
either losing their first word or, in one case, ending in the two bytes
which belong to the other reader's cell - whereas the same reads issued
sequentially never fail. Concurrency is not hypothetical here, as six
thermal sensors source their trim values from the OTP and reach the driver
straight from asynchronous driver probing.
Guard the read path with a mutex. Reads are the only way into the hardware,
as the driver registers no write callback, and they always run in process
context, so a plain mutex spanning the whole clock-enable, read,
clock-disable sequence is enough.
Fixes: 755864feb729 ("nvmem: add Rockchip OTP driver")
Cc: stable@vger.kernel.org
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Alexey Charkov <alchark@flipper.net>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20261002101329.1084348-2-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvmem/rockchip-otp.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/nvmem/rockchip-otp.c b/drivers/nvmem/rockchip-otp.c
index 2c0feb036f3fd..f8a8c7cece98d 100644
--- a/drivers/nvmem/rockchip-otp.c
+++ b/drivers/nvmem/rockchip-otp.c
@@ -12,6 +12,7 @@
#include <linux/io.h>
#include <linux/iopoll.h>
#include <linux/module.h>
+#include <linux/mutex.h>
#include <linux/nvmem-provider.h>
#include <linux/reset.h>
#include <linux/slab.h>
@@ -80,6 +81,8 @@ struct rockchip_otp {
void __iomem *base;
struct reset_control *rst;
const struct rockchip_data *data;
+ /* Serializes access to the OTP controller state machine */
+ struct mutex mutex;
struct clk_bulk_data clks[];
};
@@ -272,10 +275,12 @@ static int rockchip_otp_read(void *context, unsigned int offset,
if (!otp->data || !otp->data->reg_read)
return -EINVAL;
+ mutex_lock(&otp->mutex);
+
ret = clk_bulk_prepare_enable(otp->data->num_clks, otp->clks);
if (ret < 0) {
dev_err(otp->dev, "failed to prepare/enable clks\n");
- return ret;
+ goto unlock;
}
offset += otp->data->read_offset;
@@ -308,6 +313,9 @@ static int rockchip_otp_read(void *context, unsigned int offset,
err:
clk_bulk_disable_unprepare(otp->data->num_clks, otp->clks);
+unlock:
+ mutex_unlock(&otp->mutex);
+
return ret;
}
@@ -431,6 +439,11 @@ static int rockchip_otp_probe(struct platform_device *pdev)
otp->data = data;
otp->dev = dev;
+
+ ret = devm_mutex_init(dev, &otp->mutex);
+ if (ret)
+ return ret;
+
otp->base = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(otp->base))
return dev_err_probe(dev, PTR_ERR(otp->base),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0608/1257] slimbus: messaging: fix leaked PM vote on tid allocation failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (606 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0607/1257] nvmem: rockchip-otp: Serialize reads Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0609/1257] xen-blkfront: Fix IO race during unplug Greg Kroah-Hartman
` (390 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zongmin Zhou, Srinivas Kandagatla,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zongmin Zhou <zhouzongmin@kylinos.cn>
[ Upstream commit c26cc979e28f5193310e4379e14aa6417375c565 ]
In slim_do_transfer(), when a transaction needs a tid and
slim_alloc_txn_tid() fails, the function returns directly instead of
jumping to slim_xfer_err. The runtime PM vote taken earlier with
pm_runtime_get_sync() is then never released, leaving the controller
permanently powered up.
As txn->tid is still 0 at that point, jumping to slim_xfer_err drops
the vote exactly like it is done for other failed transactions.
Fixes: d3062a2109309 ("slimbus: messaging: add slim_alloc/free_txn_tid()")
Cc: stable@vger.kernel.org
Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20261002101448.1084691-2-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/slimbus/messaging.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
index e2dbe4a66b703..ee127ef42046b 100644
--- a/drivers/slimbus/messaging.c
+++ b/drivers/slimbus/messaging.c
@@ -139,7 +139,7 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn)
if (need_tid) {
ret = slim_alloc_txn_tid(ctrl, txn);
if (ret)
- return ret;
+ goto slim_xfer_err;
if (!txn->msg->comp)
txn->comp = &done;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0609/1257] xen-blkfront: Fix IO race during unplug
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (607 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0608/1257] slimbus: messaging: fix leaked PM vote on tid allocation failure Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0610/1257] RISC-V: KVM: Fix IPI delivery for out-of-order vcpu_id Greg Kroah-Hartman
` (389 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ross Lagerwall, Roger Pau Monné,
Juergen Gross, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ross Lagerwall <ross.lagerwall@citrix.com>
[ Upstream commit 61b6d1df1d6234c38a6ea7e4f58e7da035ef6ab4 ]
During unplug, blkfront stops the hw queues and marks the disk as dead,
then later during removal calls del_gendisk(). However, IO issued after
the hw queues are stopped but before the call to del_gendisk() will be
queued but never handled. This causes del_gendisk() to hang forever
waiting for the queue refcount to drop to zero.
This can be reproduced by issuing IO during an artificial delay after
stopping the hw queues.
Fix this by simply not stopping the hw queues directly. Marking the disk
as dead already freezes the queue which prevents new requests being
added and it synchronously runs the hw queues to clear anything pending.
If the hw queues are stopped when calling blk_mark_disk_dead(), running
the hw queues is a no-op and can leave queued requests unprocessed.
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Acked-by: Roger Pau Monné <roger@xenproject.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20261006163411.2583538-1-ross.lagerwall@citrix.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/xen-blkfront.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 86f5dd3aced13..ad0cb42c10197 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2142,10 +2142,8 @@ static void blkfront_closing(struct blkfront_info *info)
return;
/* No more blkif_request(). */
- if (info->rq && info->gd) {
- blk_mq_stop_hw_queues(info->rq);
+ if (info->gd)
blk_mark_disk_dead(info->gd);
- }
for_each_rinfo(info, rinfo, i) {
/* No more gnttab callback work. */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0610/1257] RISC-V: KVM: Fix IPI delivery for out-of-order vcpu_id
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (608 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0609/1257] xen-blkfront: Fix IO race during unplug Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0611/1257] vfio/mlx5: Fix boundary check in set_report_output() Greg Kroah-Hartman
` (388 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Jones, Xiaofeng Yuan,
Nutty Liu, Troy Mitchell, Anup Patel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
[ Upstream commit c367d3bf721f2bc391d6cfb47f6884e99d563df0 ]
The SBI IPI handler walks vCPUs with kvm_for_each_vcpu(), which
iterates by vcpu_idx (creation order) rather than vcpu_id order.
Since vcpu_id can be assigned out of order by userspace, a vCPU whose
hart_bit falls outside the XLEN-bit hart_mask range may be reached
before vCPUs the mask actually targets. In that case the handler jumps
to "done" and stops sending IPIs, leaving valid target vCPUs without
an interrupt.
Replace the early "goto done" with "continue" so vCPUs outside the
hart_mask range are skipped without aborting the loop.
Reproduced with a minimal userspace VMM driving KVM inside a QEMU
(RISC-V virt) guest: three vCPUs are created with ids 100, 0, 1 (in
creation order) and sbi_send_ipi(hart_mask=bit0, hbase=0) is called
from vcpu_id 1. Before this change the IPI is dropped and the ecall
returns SBI_ERR_INVALID_PARAM; with this change the IPI is delivered
and the ecall returns SBI_SUCCESS.
Fixes: 0611f78f83c9 ("riscv: KVM: Fix SBI IPI error generation")
Cc: stable@vger.kernel.org
Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260917122012.2577-1-yuanxiaofeng@eswincomputing.com
Signed-off-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kvm/vcpu_sbi_replace.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/arch/riscv/kvm/vcpu_sbi_replace.c b/arch/riscv/kvm/vcpu_sbi_replace.c
index 506a510b6bff3..c2f1f7f264423 100644
--- a/arch/riscv/kvm/vcpu_sbi_replace.c
+++ b/arch/riscv/kvm/vcpu_sbi_replace.c
@@ -64,8 +64,17 @@ static int kvm_sbi_ext_ipi_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,
if (tmp->vcpu_id < hbase)
continue;
hart_bit = tmp->vcpu_id - hbase;
+ /*
+ * kvm_for_each_vcpu() walks kvm->vcpus[] by
+ * vcpu_idx, i.e. the creation order, which has
+ * nothing to do with the vcpu_id (hart id) space
+ * that the SBI IPI operates on. vcpu_ids need not
+ * increase along the iteration, so harts outside
+ * the hart_mask window must be skipped instead of
+ * aborting the loop.
+ */
if (hart_bit >= __riscv_xlen)
- goto done;
+ continue;
if (!(hmask & (1UL << hart_bit)))
continue;
}
@@ -76,7 +85,6 @@ static int kvm_sbi_ext_ipi_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,
kvm_riscv_vcpu_pmu_incr_fw(tmp, SBI_PMU_FW_IPI_RCVD);
}
-done:
if (hbase != -1UL && (hmask ^ sentmask))
retdata->err_val = SBI_ERR_INVALID_PARAM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0611/1257] vfio/mlx5: Fix boundary check in set_report_output()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (609 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0610/1257] RISC-V: KVM: Fix IPI delivery for out-of-order vcpu_id Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0612/1257] cxl/port: Clear cached dport pointers when a dport is removed Greg Kroah-Hartman
` (387 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yishai Hadas, Seongjun Hong,
Alex Williamson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seongjun Hong <hsj0512@snu.ac.kr>
[ Upstream commit 37b2ee6747b7857920ebc71eabc25208a39164a4 ]
Use > instead of >= on boundary check of recv_buf to avoid the bug which
the full message in the last slot of recv_buf is ignored even though the
received data size does not overflow the recv_buf.
Fixes: 9c7c5430bca3 ("vfio/mlx5: Align the page tracking max message size with the device capability")
Cc: stable@vger.kernel.org
Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
Signed-off-by: Seongjun Hong <hsj0512@snu.ac.kr>
Link: https://lore.kernel.org/r/20261005-vfio-mlx5-fix-boundary-check-v2-1-75599d2f4497@snu.ac.kr
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/pci/mlx5/cmd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c
index 5fe0621b5fbd8..04180035a7fea 100644
--- a/drivers/vfio/pci/mlx5/cmd.c
+++ b/drivers/vfio/pci/mlx5/cmd.c
@@ -1644,7 +1644,7 @@ set_report_output(u32 size, int index, struct mlx5_vhca_qp *qp,
int i;
buf_offset = index * qp->max_msg_size;
- if (WARN_ON(buf_offset + size >= qp->recv_buf.npages * PAGE_SIZE ||
+ if (WARN_ON(buf_offset + size > qp->recv_buf.npages * PAGE_SIZE ||
(nent > qp->max_msg_size / entry_size)))
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0612/1257] cxl/port: Clear cached dport pointers when a dport is removed
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (610 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0611/1257] vfio/mlx5: Fix boundary check in set_report_output() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0613/1257] cxl/pci: Use the Device GPF DVSEC for restricted endpoints Greg Kroah-Hartman
` (386 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Cameron, Li Ming,
Gregory Price (Meta), Alison Schofield, Dave Jiang, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit 019560d23450a320f4060ff235563a5277ea8033 ]
Switch decoders cache dport pointers in cxlsd->target[], and nothing
clears them when a dport is freed. Readers then dereference freed memory.
KASAN caught it under a cxl_test load/unload loop with concurrent sysfs
reads (abbreviated).
Clear the matching slots from cxl_dport_remove(), walking the port's
decoders the way cxl_port_update_decoder_targets() does on the add side.
Scan all nr_targets slots, the target[] allocation size, and clear every
hit.
Fixes: 8330671c57c7 ("cxl: Add helper to delete dport")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Reviewed-by: Li Ming <ming.li@zohomail.com>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20261001154744.1095902-2-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/port.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c
index 625e4aa427db0..6ff3353865e39 100644
--- a/drivers/cxl/core/port.c
+++ b/drivers/cxl/core/port.c
@@ -1089,11 +1089,40 @@ static void cond_cxl_root_unlock(struct cxl_port *port)
device_unlock(&port->dev);
}
+static int clear_decoder_target(struct device *dev, void *data)
+{
+ struct cxl_dport *dport = data;
+ struct cxl_switch_decoder *cxlsd;
+
+ if (!is_switch_decoder(dev))
+ return 0;
+
+ cxlsd = to_cxl_switch_decoder(dev);
+ guard(rwsem_write)(&cxl_rwsem.region);
+
+ /*
+ * A dport can occupy more than one position of an interleave, so
+ * scan the whole target list rather than stopping at the first hit.
+ */
+ for (int i = 0; i < cxlsd->nr_targets; i++) {
+ if (cxlsd->target[i] != dport)
+ continue;
+ cxlsd->target[i] = NULL;
+ dev_dbg(dev, "dport%d removed from target list, index %d\n",
+ dport->port_id, i);
+ }
+
+ return 0;
+}
+
static void cxl_dport_remove(void *data)
{
struct cxl_dport *dport = data;
struct cxl_port *port = dport->port;
+ /* counterpart of cxl_port_update_decoder_targets() */
+ device_for_each_child(&port->dev, dport, clear_decoder_target);
+
port->nr_dports--;
xa_erase(&port->dports, (unsigned long) dport->dport_dev);
put_device(dport->dport_dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0613/1257] cxl/pci: Use the Device GPF DVSEC for restricted endpoints
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (611 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0612/1257] cxl/port: Clear cached dport pointers when a dport is removed Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0614/1257] cxl/pci: Program the Port GPF timeouts before caching the DVSEC Greg Kroah-Hartman
` (385 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guixin Liu, Jonathan Cameron,
Dave Jiang, Alison Schofield, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit d2654fa0d841fa36ffa76577f83a2810d643ae19 ]
cxl_gpf_get_dvsec() picks between the Port and the Device GPF DVSEC
from the PCIe type of the given device, and only a plain endpoint
counts as a device. A restricted CXL device is an endpoint too, but
it falls into the port case and is probed for the Port GPF DVSEC
instead of the Device GPF DVSEC.
On an RCD, dirty shutdown tracking therefore never arms: the DVSEC
lookup in cxl_nvdimm_arm_dirty_shutdown_tracking() fails, the dirty
shutdown count stays invalid, and the warning complains about a
missing Port GPF DVSEC on a device.
Treat restricted endpoints as devices.
Fixes: 36aace15d9bd ("cxl/pci: Drop the parameter is_port of cxl_gpf_get_dvsec()")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20261008034619.28059-2-kanie@linux.alibaba.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index 9d807c1a002ca..e31aad7a525a2 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -804,7 +804,8 @@ u16 cxl_gpf_get_dvsec(struct device *dev)
return 0;
pdev = to_pci_dev(dev);
- if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ENDPOINT)
+ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ENDPOINT ||
+ is_cxl_restricted(pdev))
is_port = false;
dvsec = pci_find_dvsec_capability(pdev, PCI_VENDOR_ID_CXL,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0614/1257] cxl/pci: Program the Port GPF timeouts before caching the DVSEC
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (612 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0613/1257] cxl/pci: Use the Device GPF DVSEC for restricted endpoints Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0615/1257] cxl/port: Convert PCIe link latency to nanoseconds Greg Kroah-Hartman
` (384 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guixin Liu, Jonathan Cameron,
Dave Jiang, Alison Schofield, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit ec2e30a682945616d194d7999cf96606b7ee5a88 ]
cxl_gpf_port_setup() caches the Port GPF DVSEC offset in the dport
before programming the phase timeouts, and ignores the return value
of both update_gpf_port_dvsec() calls: the function always reports
success.
A failing config write is therefore not only silent, it is also
permanent: the timeouts stay at the hardware defaults instead of the
maximum flush window the kernel is asking for, and the cached offset
keeps any later endpoint attach from retrying the update.
Propagate the errors and cache the offset only after both phases are
programmed, so the next endpoint attach retries the setup.
Fixes: 6af941db6a60 ("cxl/pci: Update Port GPF timeout only when the first EP attaching")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20261008034619.28059-3-kanie@linux.alibaba.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/pci.c | 30 +++++++++++++++++++++---------
1 file changed, 21 insertions(+), 9 deletions(-)
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index e31aad7a525a2..1f470ab0df3b7 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -840,7 +840,7 @@ static int update_gpf_port_dvsec(struct pci_dev *pdev, int dvsec, int phase)
rc = pci_read_config_word(pdev, dvsec + offset, &ctrl);
if (rc)
- return rc;
+ return pcibios_err_to_errno(rc);
if (FIELD_GET(base, ctrl) == GPF_TIMEOUT_BASE_MAX &&
FIELD_GET(scale, ctrl) == GPF_TIMEOUT_SCALE_MAX)
@@ -850,11 +850,17 @@ static int update_gpf_port_dvsec(struct pci_dev *pdev, int dvsec, int phase)
ctrl |= FIELD_PREP(scale, GPF_TIMEOUT_SCALE_MAX);
rc = pci_write_config_word(pdev, dvsec + offset, ctrl);
- if (!rc)
- pci_dbg(pdev, "Port GPF phase %d timeout: %d0 secs\n",
- phase, GPF_TIMEOUT_BASE_MAX);
+ if (rc) {
+ rc = pcibios_err_to_errno(rc);
+ pci_warn(pdev, "Port GPF phase %d timeout write failed: %d\n",
+ phase, rc);
+ return rc;
+ }
- return rc;
+ pci_dbg(pdev, "Port GPF phase %d timeout: %d0 secs\n",
+ phase, GPF_TIMEOUT_BASE_MAX);
+
+ return 0;
}
int cxl_gpf_port_setup(struct cxl_dport *dport)
@@ -864,16 +870,22 @@ int cxl_gpf_port_setup(struct cxl_dport *dport)
if (!dport->gpf_dvsec) {
struct pci_dev *pdev;
- int dvsec;
+ int dvsec, rc;
dvsec = cxl_gpf_get_dvsec(dport->dport_dev);
if (!dvsec)
return -EINVAL;
- dport->gpf_dvsec = dvsec;
pdev = to_pci_dev(dport->dport_dev);
- update_gpf_port_dvsec(pdev, dport->gpf_dvsec, 1);
- update_gpf_port_dvsec(pdev, dport->gpf_dvsec, 2);
+ rc = update_gpf_port_dvsec(pdev, dvsec, 1);
+ if (rc)
+ return rc;
+
+ rc = update_gpf_port_dvsec(pdev, dvsec, 2);
+ if (rc)
+ return rc;
+
+ dport->gpf_dvsec = dvsec;
}
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0615/1257] cxl/port: Convert PCIe link latency to nanoseconds
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (613 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0614/1257] cxl/pci: Program the Port GPF timeouts before caching the DVSEC Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0616/1257] cxl: Account for link width in latency calculation Greg Kroah-Hartman
` (383 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Alison Schofield,
Dave Jiang, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 16440d6e4bf1175cda83438d9f9a8ae84bfcf0ee ]
Commit 51293c565cf4 ("cxl: Fix incorrect region perf data calculation")
converted CDAT latencies to nanoseconds and removed the conversion in
cxl_region_perf_data_calculate(), but left PCIe link latencies in
picoseconds.
This inflates the FlitLatency contribution to region and node latencies
by a factor of 1000, exposing incorrect values in sysfs. The resulting
abstract distances can incorrectly reverse the memory tier ordering of
nodes.
Convert the FlitLatency contribution to nanoseconds before adding it to
the access coordinates, rounding up as cdat_normalize() does.
Fixes: 51293c565cf4 ("cxl: Fix incorrect region perf data calculation")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261009045452.1107921-2-den@valinux.co.jp
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/port.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c
index 6ff3353865e39..cd9e58d8144f1 100644
--- a/drivers/cxl/core/port.c
+++ b/drivers/cxl/core/port.c
@@ -2349,6 +2349,9 @@ EXPORT_SYMBOL_NS_GPL(schedule_cxl_memdev_detach, "CXL");
static void add_latency(struct access_coordinate *c, long latency)
{
+ /* Convert link latency from picoseconds to nanoseconds. */
+ latency = DIV_ROUND_UP(latency, 1000);
+
for (int i = 0; i < ACCESS_COORDINATE_MAX; i++) {
c[i].write_latency += latency;
c[i].read_latency += latency;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0616/1257] cxl: Account for link width in latency calculation
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (614 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0615/1257] cxl/port: Convert PCIe link latency to nanoseconds Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0617/1257] cxl/acpi: Convert QTG _DSM latencies to picoseconds Greg Kroah-Hartman
` (382 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Alison Schofield,
Dave Jiang, Sasha Levin, Bjorn Helgaas
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit db4503d4575cdd2fad7e8a13a8a8ffcbc86d152d ]
cxl_pci_get_latency() derives bandwidth from the per-lane speed returned
by pcie_link_speed_mbps(), ignoring the negotiated link width. This
overestimates the FlitLatency contribution for multi-lane links.
Sections 2.11.3 and 2.11.4 of the Intel CXL Memory Device Software Guide
describe the link bandwidth as the product of the negotiated speed and
width.
Replace pcie_link_speed_mbps() with pcie_link_bandwidth_mbps() and
migrate both CXL callers (the only users of the API). The new helper
obtains speed and width from a single Link Status read. The CXL
bandwidth calculation no longer needs a separate width read and
multiplication.
While at it, make error handling more robust by converting PCI config
read errors to negative errno values and checking for zero bandwidth
before calculating latency.
Fixes: 4d07a05397c8 ("cxl: Calculate and store PCI link latency for the downstream ports")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com> # pci/pci.c
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261009045452.1107921-3-den@valinux.co.jp
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/pci.c | 22 ++++++++--------------
drivers/pci/pci.c | 23 ++++++++++++++++++-----
include/linux/pci.h | 2 +-
3 files changed, 27 insertions(+), 20 deletions(-)
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index 1f470ab0df3b7..bb6ad0753a421 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -660,8 +660,8 @@ long cxl_pci_get_latency(struct pci_dev *pdev)
{
long bw;
- bw = pcie_link_speed_mbps(pdev);
- if (bw < 0)
+ bw = pcie_link_bandwidth_mbps(pdev);
+ if (bw <= 0)
return 0;
bw /= BITS_PER_BYTE;
@@ -756,18 +756,12 @@ EXPORT_SYMBOL_NS_GPL(cxl_pci_setup_regs, "CXL");
int cxl_pci_get_bandwidth(struct pci_dev *pdev, struct access_coordinate *c)
{
- int speed, bw;
- u16 lnksta;
- u32 width;
-
- speed = pcie_link_speed_mbps(pdev);
- if (speed < 0)
- return speed;
- speed /= BITS_PER_BYTE;
-
- pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnksta);
- width = FIELD_GET(PCI_EXP_LNKSTA_NLW, lnksta);
- bw = speed * width;
+ int bw;
+
+ bw = pcie_link_bandwidth_mbps(pdev);
+ if (bw < 0)
+ return bw;
+ bw /= BITS_PER_BYTE;
for (int i = 0; i < ACCESS_COORDINATE_MAX; i++) {
c[i].read_bandwidth = bw;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index d79d2ee4ac69b..38c7cb8221223 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -6000,18 +6000,31 @@ static enum pci_bus_speed to_pcie_link_speed(u16 lnksta)
return pcie_link_speed[FIELD_GET(PCI_EXP_LNKSTA_CLS, lnksta)];
}
-int pcie_link_speed_mbps(struct pci_dev *pdev)
+/**
+ * pcie_link_bandwidth_mbps - get the current bandwidth of a single PCIe link
+ * @pdev: PCI device to query
+ *
+ * The bandwidth includes all negotiated lanes and does not account for
+ * encoding overhead. A negotiated width of zero gives zero bandwidth.
+ *
+ * Return: Bandwidth in Mb/s, or a negative errno on failure.
+ */
+int pcie_link_bandwidth_mbps(struct pci_dev *pdev)
{
u16 lnksta;
- int err;
+ int speed, err;
err = pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnksta);
if (err)
- return err;
+ return pcibios_err_to_errno(err);
+
+ speed = pcie_dev_speed_mbps(to_pcie_link_speed(lnksta));
+ if (speed < 0)
+ return speed;
- return pcie_dev_speed_mbps(to_pcie_link_speed(lnksta));
+ return speed * FIELD_GET(PCI_EXP_LNKSTA_NLW, lnksta);
}
-EXPORT_SYMBOL(pcie_link_speed_mbps);
+EXPORT_SYMBOL(pcie_link_bandwidth_mbps);
/**
* pcie_bandwidth_available - determine minimum link settings of a PCIe
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 5ffcf5ce8c966..272378dd8973b 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1478,7 +1478,7 @@ int pcie_set_mps(struct pci_dev *dev, int mps);
u32 pcie_bandwidth_available(struct pci_dev *dev, struct pci_dev **limiting_dev,
enum pci_bus_speed *speed,
enum pcie_link_width *width);
-int pcie_link_speed_mbps(struct pci_dev *pdev);
+int pcie_link_bandwidth_mbps(struct pci_dev *pdev);
void pcie_print_link_status(struct pci_dev *dev);
int pcie_reset_flr(struct pci_dev *dev, bool probe);
int pcie_flr(struct pci_dev *dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0617/1257] cxl/acpi: Convert QTG _DSM latencies to picoseconds
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (615 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0616/1257] cxl: Account for link width in latency calculation Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0618/1257] ALSA: hda/realtek: Enable all four speaker amps on Lenovo ThinkBook X G2 IAH Greg Kroah-Hartman
` (381 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Alison Schofield,
Dave Jiang, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 2658c66a5efb5f30f5ced708a5de831845b43f6d ]
The QTG _DSM expects read and write latencies in picoseconds, as
specified in CXL 3.0, Table 9-30.
The code base originally kept the latencies passed to the QTG _DSM in
picoseconds in effect. Commit 51293c565cf4 ("cxl: Fix incorrect region
perf data calculation") normalized CDAT and host bridge latencies to
nanoseconds, but did not add a conversion back to picoseconds when
constructing the _DSM input. Firmware can therefore select QTG IDs using
understated latencies.
Convert the latencies to picoseconds when constructing the _DSM input
package. Multiply in 64 bits and reject latencies that cannot fit in the
DWORD inputs defined by the specification.
Fixes: 51293c565cf4 ("cxl: Fix incorrect region perf data calculation")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261009045452.1107921-4-den@valinux.co.jp
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/acpi.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
index fb09a5ff48c16..b7ce6b59c680b 100644
--- a/drivers/cxl/acpi.c
+++ b/drivers/cxl/acpi.c
@@ -231,9 +231,10 @@ cxl_acpi_evaluate_qtg_dsm(acpi_handle handle, struct access_coordinate *coord,
int entries, int *qos_class)
{
union acpi_object *out_obj, *out_buf, *obj;
+ /* QTG _DSM expects latencies in picoseconds. */
union acpi_object in_array[4] = {
- [0].integer = { ACPI_TYPE_INTEGER, coord->read_latency },
- [1].integer = { ACPI_TYPE_INTEGER, coord->write_latency },
+ [0].integer = { ACPI_TYPE_INTEGER, coord->read_latency * 1000ULL },
+ [1].integer = { ACPI_TYPE_INTEGER, coord->write_latency * 1000ULL },
[2].integer = { ACPI_TYPE_INTEGER, coord->read_bandwidth },
[3].integer = { ACPI_TYPE_INTEGER, coord->write_bandwidth },
};
@@ -251,6 +252,11 @@ cxl_acpi_evaluate_qtg_dsm(acpi_handle handle, struct access_coordinate *coord,
if (!entries)
return -EINVAL;
+ /* Latency inputs must fit in the DWORD fields defined by the spec. */
+ if (coord->read_latency > U32_MAX / 1000 ||
+ coord->write_latency > U32_MAX / 1000)
+ return -ERANGE;
+
out_obj = acpi_evaluate_dsm(handle, &acpi_cxl_qtg_id_guid, 1, 1, &in_obj);
if (!out_obj)
return -ENXIO;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0618/1257] ALSA: hda/realtek: Enable all four speaker amps on Lenovo ThinkBook X G2 IAH
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (616 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0617/1257] cxl/acpi: Convert QTG _DSM latencies to picoseconds Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0619/1257] KVM: arm64: Prevent 64-bit overflow when computing hyp clock rate Greg Kroah-Hartman
` (380 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Evgeny Akhtimirov, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Evgeny Akhtimirov <evgeny@devduty.com>
[ Upstream commit f2293e7b2ddd803b1461e0490f9b2f32089c1dd0 ]
The Lenovo ThinkBook X G2 IAH (MTM 21TU) has an ALC287 codec with four
CS35L41 amplifiers on I2C (CSC3551). It reports codec SSID 17aa:3929,
which it shares with the ThinkBook 13x Gen 5, and PCI SSID 17aa:3842.
Since PCI SSID 17aa:3842 has no quirk entry, the codec SSID matches
ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD. That fixup binds only
two amps (cs35l41-hda.0 and .1), while the CS35L41 configuration table
describes four for 17AA3929. Amps .2 and .3 probe and load firmware,
but they are never bound to the codec, so half of the speakers stay
silent.
Add a ThinkPad-style fixup chain that binds four I2C amps, and match the
laptop by its PCI SSID so the ThinkBook 13x Gen 5 is not affected.
Tested with hda_model=1028:0c4d (alias to ALC287_FIXUP_CS35L41_I2C_4):
all four amps bind, apply their calibration and are runtime-active
during playback.
Cc: stable@vger.kernel.org
Signed-off-by: Evgeny Akhtimirov <evgeny@devduty.com>
Link: https://patch.msgid.link/20261009-thinkbook-x-g2-iah-v1-1-56012188aee0@devduty.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index c66dd4a003f39..980e5029b2dbf 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -4339,6 +4339,8 @@ enum {
ALC245_FIXUP_HP_X360_MUTE_LEDS,
ALC287_FIXUP_THINKPAD_I2S_SPK,
ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD,
+ ALC287_FIXUP_CS35L41_I2C_4_THINKPAD_ACPI,
+ ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_4_THINKPAD,
ALC2XX_FIXUP_HEADSET_MIC,
ALC289_FIXUP_DELL_CS35L41_SPI_2,
ALC256_FIXUP_ACER_SFG16_MICMUTE_LED,
@@ -6906,6 +6908,18 @@ static const struct hda_fixup alc269_fixups[] = {
.chained = true,
.chain_id = ALC287_FIXUP_CS35L41_I2C_2_THINKPAD_ACPI,
},
+ [ALC287_FIXUP_CS35L41_I2C_4_THINKPAD_ACPI] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = cs35l41_fixup_i2c_four,
+ .chained = true,
+ .chain_id = ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK,
+ },
+ [ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_4_THINKPAD] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc287_fixup_tb_vmaster_led,
+ .chained = true,
+ .chain_id = ALC287_FIXUP_CS35L41_I2C_4_THINKPAD_ACPI,
+ },
[ALC2XX_FIXUP_HEADSET_MIC] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc2xx_fixup_headset_mic,
@@ -8236,6 +8250,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x17aa, 0x3827, "Ideapad S740", ALC285_FIXUP_IDEAPAD_S740_COEF),
SND_PCI_QUIRK(0x17aa, 0x3834, "Lenovo IdeaPad Slim 9i 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
SND_PCI_QUIRK(0x17aa, 0x383d, "Legion Y9000X 2019", ALC285_FIXUP_LEGION_Y9000X_SPEAKERS),
+ SND_PCI_QUIRK(0x17aa, 0x3842, "ThinkBook X G2 IAH", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_4_THINKPAD),
SND_PCI_QUIRK(0x17aa, 0x3843, "Lenovo Yoga 9i / Yoga Book 9i", ALC287_FIXUP_LENOVO_YOGA_BOOK_9I),
/* Yoga Pro 7 14IMH9 shares PCI SSID 17aa:3847 with Legion 7 16ACHG6;
* use codec SSID to distinguish them
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0619/1257] KVM: arm64: Prevent 64-bit overflow when computing hyp clock rate
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (617 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0618/1257] ALSA: hda/realtek: Enable all four speaker amps on Lenovo ThinkBook X G2 IAH Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0620/1257] lib/plist: fix plist_requeue() corrupting order in the last bucket Greg Kroah-Hartman
` (379 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Donnefort, Fuad Tabba,
Marc Zyngier, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <vdonnefort@google.com>
[ Upstream commit 6164ce3491bcc3a27a2e2e9260a286eb2df2301e ]
The hypervisor clock rate is delta_cycles * NSEC_PER_SEC / delta_boot.
It is computed whenever a deviation occurs. If the delta between two
rate updates is big enough, delta_cycles * NSEC_PER_SEC will overflow.
Prevent overflow with mul_u64_u64_div_u64(). And as a bonus, simplify
the clock estimation with mul_u64_u32_shr().
Fixes: b22888917fa4 ("KVM: arm64: Sync boot clock with the nVHE/pKVM hyp")
Cc: stable@vger.kernel.org
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261008104212.3134550-2-vdonnefort@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/hyp_trace.c | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/arch/arm64/kvm/hyp_trace.c b/arch/arm64/kvm/hyp_trace.c
index 9644c424819b7..c60d7dfbf5e26 100644
--- a/arch/arm64/kvm/hyp_trace.c
+++ b/arch/arm64/kvm/hyp_trace.c
@@ -59,14 +59,8 @@ static void __hyp_clock_work(struct work_struct *work)
if (hyp_clock->mult) {
u64 err, cur = delta_cycles;
- if (WARN_ON_ONCE(cur >= hyp_clock->cyc_overflow64)) {
- __uint128_t tmp = (__uint128_t)cur * hyp_clock->mult;
-
- cur = tmp >> hyp_clock->shift;
- } else {
- cur *= hyp_clock->mult;
- cur >>= hyp_clock->shift;
- }
+ WARN_ON_ONCE(cur >= hyp_clock->cyc_overflow64);
+ cur = mul_u64_u32_shr(cur, hyp_clock->mult, hyp_clock->shift);
cur += hyp_clock->boot;
err = abs_diff(cur, boot);
@@ -84,7 +78,7 @@ static void __hyp_clock_work(struct work_struct *work)
err / NSEC_PER_USEC);
}
- rate = div64_u64(delta_cycles * NSEC_PER_SEC, delta_boot);
+ rate = mul_u64_u64_div_u64(delta_cycles, NSEC_PER_SEC, delta_boot);
clocks_calc_mult_shift(&hyp_clock->mult, &hyp_clock->shift,
rate, NSEC_PER_SEC, CLOCK_MAX_CONVERSION_S);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0620/1257] lib/plist: fix plist_requeue() corrupting order in the last bucket
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (618 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0619/1257] KVM: arm64: Prevent 64-bit overflow when computing hyp clock rate Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0621/1257] usb: core: dont set drvdata to NULL in usb_unbind_interface() Greg Kroah-Hartman
` (378 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adam Harshbarger, Andrew Morton,
Nickolai Zeldovich, I Hsin Cheng, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Harshbarger <handyhandyman.adam@gmail.com>
[ Upstream commit 43c91b1522435429a63d175f5a953e6f727a4f88 ]
plist_requeue() is meant to move a node to the end of its own priority
run. When the node heads the *last* priority bucket it is instead placed
at the head of the whole list, leaving the plist unsorted:
built: A(prio 0) B(prio 1) C(prio 1)
requeue(B): B(prio 1) A(prio 0) C(prio 1)
expected: A(prio 0) C(prio 1) B(prio 1)
prio_list is a *headless* circular ring of the nodes that lead each
priority bucket. The shortcut added by commit 95d4b3450ebe ("lib/plist.c:
add shortcut for plist_requeue()") takes
iter = list_entry(iter->prio_list.next, struct plist_node,
prio_list);
node_next = &iter->node_list;
which from the last bucket wraps round to the *first* bucket, so node_next
ends up pointing at the head of the list rather than at its end. The
plist_for_each_continue() loop immediately below it computes the correct
answer (&head->node_list) for that case.
With any bucket after it the shortcut is correct, which is why this went
unnoticed: the benchmark in that commit measured elapsed time and never
checked the resulting order.
Keep the shortcut -- it is a real win -- but exclude the case where iter's
bucket is the last one, which is exactly when its ring successor is the
first bucket again.
Reachable from mm/swapfile.c, which rotates swap_avail_heads[] with
plist_requeue(). It takes three or more swap devices: at least two
distinct priorities, so that a later bucket exists for the ring to wrap
round from, and two or more devices sharing the lowest priority, so that
plist_requeue() does not return early. One device per priority returns
early at the node->prio != iter->prio test. A single priority is also
safe, but for a different reason worth stating: with one bucket no node is
ever linked onto prio_list at all -- plist_add() skips it for the first
node and for every node whose predecessor shares its priority -- so
list_empty(&iter->prio_list) holds and the shortcut is never entered.
Tested by driving three implementations -- the pre-95d4b3450ebe code,
current mainline, and this patch -- through 1,084,492 identical random
add/del/requeue operations over 24 nodes and 1..5 distinct priorities,
comparing the resulting node_list node for node after every operation:
variant differs from pre-95d4b3450ebe left list unsorted
pre-95d4b3450ebe -- (reference) 0
mainline 289,297 276,660
this patch 0 0
Link: https://lore.kernel.org/20260903222456.1881786-1-handyhandyman.adam@gmail.com
Fixes: 95d4b3450ebe ("lib/plist.c: add shortcut for plist_requeue()")
Signed-off-by: Adam Harshbarger <handyhandyman.adam@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Assisted-by: Claude:claude-opus-5
Cc: I Hsin Cheng <richard120310@gmail.com>
Cc: <stable@vger.kernel.org> # v6.15+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/plist.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/lib/plist.c b/lib/plist.c
index a5bef38add431..b0273533c04d2 100644
--- a/lib/plist.c
+++ b/lib/plist.c
@@ -174,8 +174,15 @@ void plist_requeue(struct plist_node *node, struct plist_head *head)
/*
* After plist_del(), iter is the replacement of the node. If the node
* was on prio_list, take shortcut to find node_next instead of looping.
+ *
+ * prio_list is a headless ring, so from the LAST bucket ->next wraps
+ * round to the first one; in that case node_next is the list head.
*/
if (!list_empty(&iter->prio_list)) {
+ struct plist_node *first = plist_first(head);
+
+ if (iter->prio_list.next == &first->prio_list)
+ goto queue;
iter = list_entry(iter->prio_list.next, struct plist_node,
prio_list);
node_next = &iter->node_list;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0621/1257] usb: core: dont set drvdata to NULL in usb_unbind_interface()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (619 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0620/1257] lib/plist: fix plist_requeue() corrupting order in the last bucket Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0622/1257] usb: octeon-hcd: release the USB block when initialization fails Greg Kroah-Hartman
` (377 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Johan Hovold, Alan Stern,
Danilo Krummrich, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
[ Upstream commit 8f0d16174102863936d583c90258ea02bf06205c ]
usb_unbind_interface() serves as the remove() callback of struct
usb_driver and calls usb_set_intfdata(intf, NULL) to clear the bus
device private data pointer.
However, the driver core code already sets the bus device private data
pointer to NULL in device_unbind_cleanup() *after* devres_release_all(),
which makes the call redundant.
In addition, it can create unexpected NULL pointer dereference scenarios
when drivers use managed APIs.
int probe(struct usb_interface *intf,
const struct usb_device_id *id)
{
struct data *data;
int ret;
data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
if (!data)
return -ENOMEM;
ret = devm_device_add_group(&intf->dev, &foo_attr_group);
if (ret)
return ret;
...
}
ssize_t foo_value_show(struct device *dev, struct device_attribute *attr,
char *buf)
{
struct usb_interface *intf = to_usb_interface(dev);
struct data *data = usb_get_intfdata(intf);
/* Potential NULL pointer dereference */
return sysfs_emit(buf, "%u\n", data->value);
}
Nothing prevents usb_unbind_interface() to race with foo_value_show()
and set usb_set_intfdata(intf, NULL).
The same applies to the unwind path of usb_probe_interface(), which also
calls usb_set_intfdata(intf, NULL).
Besides that, the Rust driver core code manages a driver's bus device
private data and destroys it in device_unbind_cleanup().
If usb_unbind_interface() sets the pointer to NULL prematurely, the Rust
driver core code sees NULL, and hence skips the destructor of the bus
device private data, which leaks all its resources.
Thus, drop usb_set_intfdata(intf, NULL) from usb_probe_interface() and
usb_unbind_interface(), and move it to usb_driver_release_interface(),
which manually calls the remove() callback of struct usb_driver and
hence can't rely on the driver core.
Cc: stable@kernel.org
Fixes: a995fe1a3aa7 ("rust: driver: drop device private data post unbind")
Reviewed-by: Johan Hovold <johan@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/20261010135131.286498-1-dakr@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/driver.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index bf660b15a0f60..9af0184276c10 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -410,7 +410,6 @@ static int usb_probe_interface(struct device *dev)
return error;
err:
- usb_set_intfdata(intf, NULL);
intf->needs_remote_wakeup = 0;
intf->condition = USB_INTERFACE_UNBOUND;
@@ -497,7 +496,6 @@ static int usb_unbind_interface(struct device *dev)
} else {
intf->needs_altsetting0 = 1;
}
- usb_set_intfdata(intf, NULL);
intf->condition = USB_INTERFACE_UNBOUND;
intf->needs_remote_wakeup = 0;
@@ -644,6 +642,7 @@ void usb_driver_release_interface(struct usb_driver *driver,
} else {
device_lock(dev);
usb_unbind_interface(dev);
+ dev_set_drvdata(dev, NULL);
dev->driver = NULL;
device_unlock(dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0622/1257] usb: octeon-hcd: release the USB block when initialization fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (620 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0621/1257] usb: core: dont set drvdata to NULL in usb_unbind_interface() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0623/1257] usb: octeon-hcd: keep SOF interrupts while a pipe needs them Greg Kroah-Hartman
` (376 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Orgad Shaneh, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Orgad Shaneh <orgads@gmail.com>
[ Upstream commit b8c063059f304abebc11039195f5b28298aeddbb ]
cvmx_usb_initialize() gets as far as selecting the reference clock,
enabling USBN_CLK_CTL and taking the PHY out of reset (steps 2b-2e)
before anything can go wrong, and its only caller frees the HCD and
returns without touching the hardware. Both of its error returns
therefore leave the USB block clocked and out of reset on a failed
probe.
Release it on the way out with cvmx_usb_shutdown(), which is the undo
the retry path a few lines above already uses. It cannot refuse with
-EBUSY here: the pipe lists it checks are initialised by
octeon_usb_probe() before cvmx_usb_initialize() is called, and no pipe
can have been opened yet.
Fixes: 22bce6d2b3fd ("usb: octeon-hcd: fail the probe when the USB core does not respond")
Cc: stable <stable@kernel.org>
Assisted-by: LLM
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Link: https://patch.msgid.link/20261011072238.2381564-1-orgads@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/octeon-hcd.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/host/octeon-hcd.c b/drivers/usb/host/octeon-hcd.c
index 256e459ff6d8d..4d6558e5492c2 100644
--- a/drivers/usb/host/octeon-hcd.c
+++ b/drivers/usb/host/octeon-hcd.c
@@ -708,6 +708,7 @@ static int cvmx_usb_initialize(struct device *dev,
int channel;
int divisor;
int retries = 0;
+ int status;
union cvmx_usbcx_hcfg usbcx_hcfg;
union cvmx_usbnx_clk_ctl usbn_clk_ctl;
union cvmx_usbcx_gintsts usbc_gintsts;
@@ -872,7 +873,8 @@ static int cvmx_usb_initialize(struct device *dev,
if (usbcx_gahbcfg.u32 == 0xffffffff || usbcx_gahbcfg.u32 == 0) {
dev_err(dev, "USB core is not responding (GHWCFG3=0x%08x)\n",
usbcx_gahbcfg.u32);
- return -ENODEV;
+ status = -ENODEV;
+ goto err_shutdown;
}
usbcx_gahbcfg.u32 = 0;
@@ -961,14 +963,27 @@ static int cvmx_usb_initialize(struct device *dev,
dev_dbg(dev, "gintsts after reset: 0x%x\n", (int)usbc_gintsts.u32);
if (!usbc_gintsts.s.disconnint && !usbc_gintsts.s.prtint)
return 0;
- if (retries++ >= 5)
- return -EAGAIN;
+ if (retries++ >= 5) {
+ status = -EAGAIN;
+ goto err_shutdown;
+ }
dev_info(dev, "controller reset failed (gintsts=0x%x) - retrying\n",
(int)usbc_gintsts.u32);
msleep(50);
cvmx_usb_shutdown(usb);
msleep(50);
goto retry;
+
+err_shutdown:
+ /*
+ * Steps 2b-2e above selected the reference clock, enabled
+ * USBN_CLK_CTL and took the PHY out of reset, and the caller only
+ * frees the HCD, so hand the block back before giving up. The pipe
+ * lists cvmx_usb_shutdown() checks are initialised by the caller
+ * before it gets here, so it cannot refuse with -EBUSY.
+ */
+ cvmx_usb_shutdown(usb);
+ return status;
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0623/1257] usb: octeon-hcd: keep SOF interrupts while a pipe needs them
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (621 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0622/1257] usb: octeon-hcd: release the USB block when initialization fails Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0624/1257] USB: cdc-acm: add VeriFone VX820 device ID Greg Kroah-Hartman
` (375 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Orgad Shaneh, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Orgad Shaneh <orgads@gmail.com>
[ Upstream commit 68ee2f70d0257aa327ebf8406cd28475574585f2 ]
cvmx_usb_schedule() now sleeps on an hrtimer until the nearest future
periodic deadline instead of counting frames down on every SOF. The scan
that finds that deadline only looks at pipes with
next_tx_frame > usb->frame_number
which is right for picking the deadline, but two kinds of pipe that
need a SOF to make progress are invisible to the decision:
- A periodic pipe that is due and was *not* started: no idle hardware
channel this round, its split window is closed
(cvmx_usb_find_ready_pipe() rejects both), or another pipe owns
usb->active_split. cvmx_usb_next_pipe() looks at the isochronous and
interrupt lists only when is_sof is true.
- Any pipe that has sent its start split and waits for the frame its
split complete may go out in (split_sc_frame, also checked by
cvmx_usb_find_ready_pipe()). A control or bulk pipe on a full or low
speed device behind a hub is in this state between its two halves, and
with SOF masked nothing guarantees an interrupt that brings
frame_number there.
When some other periodic pipe sets a far deadline - a hub's status pipe,
whenever a hub is attached - the driver masks SOF, arms the timer for
that deadline and these pipes wait for it. That is hundreds of frames;
the code allows up to 8000 (one second) before it falls back to SOF.
Before the hrtimer this could not happen: any pipe with a future
deadline set need_sof, so SOF stayed enabled every frame and the pipe
was retried on the next one.
Note such a pipe and keep SOF enabled while there is one, whether or not
another pipe has a future deadline. Nothing changes when there is none,
which is the case the timer was added for.
Other control and bulk pipes are excluded deliberately: their
next_tx_frame is not updated on completion, so they are almost always
"due" and would keep SOF enabled permanently.
Fixes: aebbc7d63407 ("usb: octeon-hcd: sleep on an hrtimer for far-off periodic transfers")
Cc: stable <stable@kernel.org>
Assisted-by: LLM
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Link: https://patch.msgid.link/20261011080506.2394708-1-orgads@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/octeon-hcd.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/host/octeon-hcd.c b/drivers/usb/host/octeon-hcd.c
index 4d6558e5492c2..4929c6a8e733b 100644
--- a/drivers/usb/host/octeon-hcd.c
+++ b/drivers/usb/host/octeon-hcd.c
@@ -1938,6 +1938,7 @@ static void cvmx_usb_schedule(struct octeon_hcd *usb, int is_sof)
struct cvmx_usb_pipe *pipe;
int need_sof;
u64 min_due;
+ bool due_now;
enum cvmx_usb_transfer ttype;
if (usb->init_flags & CVMX_USB_INITIALIZE_FLAGS_NO_DMA) {
@@ -1979,15 +1980,32 @@ static void cvmx_usb_schedule(struct octeon_hcd *usb, int is_sof)
*/
need_sof = 0;
min_due = ~0ull;
+ due_now = false;
for (ttype = CVMX_USB_TRANSFER_CONTROL;
ttype <= CVMX_USB_TRANSFER_INTERRUPT; ttype++) {
list_for_each_entry(pipe, &usb->active_pipes[ttype], node) {
+ /*
+ * Do not sleep past a pipe that is only retried from a
+ * SOF: a periodic one that is due but was not started
+ * (no idle channel, closed split window, another pipe's
+ * split active), or any pipe waiting for the frame its
+ * split complete may go out in. Other control and bulk
+ * pipes are left out: their next_tx_frame is not updated
+ * on completion, so they always look due.
+ */
+ if (pipe->split_sc_frame != -1 ||
+ (pipe->next_tx_frame <= usb->frame_number &&
+ (ttype == CVMX_USB_TRANSFER_ISOCHRONOUS ||
+ ttype == CVMX_USB_TRANSFER_INTERRUPT)))
+ due_now = true;
if (pipe->next_tx_frame > usb->frame_number &&
pipe->next_tx_frame < min_due)
min_due = pipe->next_tx_frame;
}
}
- if (min_due != ~0ull) {
+ if (due_now) {
+ need_sof = 1;
+ } else if (min_due != ~0ull) {
u64 delta = min_due - usb->frame_number;
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0624/1257] USB: cdc-acm: add VeriFone VX820 device ID
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (622 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0623/1257] usb: octeon-hcd: keep SOF interrupts while a pipe needs them Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0625/1257] USB: quirks: add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for GameSir G7 SE Greg Kroah-Hartman
` (374 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Drobyshev Vladimir, stable,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Drobyshev Vladimir <enigma_137@icloud.com>
[ Upstream commit ddbddee6592ecf6cf6c24d888780f9ad45a3e30b ]
Add USB ID 11ca:0219 for the VeriFone VX820 to the cdc-acm device
table and apply the SINGLE_RX_URB quirk.
Signed-off-by: Drobyshev Vladimir <enigma_137@icloud.com>
Link: https://patch.msgid.link/20260929173833.105208-1-enigma_137@icloud.com
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/class/cdc-acm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 6a1c574634949..489575d40bd14 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1819,6 +1819,9 @@ static const struct usb_device_id acm_ids[] = {
{ USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */
.driver_info = SINGLE_RX_URB,
},
+ { USB_DEVICE(0x11ca, 0x0219), /* VeriFone Vx820 Gadget Serial */
+ .driver_info = SINGLE_RX_URB,
+ },
{ USB_DEVICE(0x1901, 0x0006), /* GE Healthcare Patient Monitor UI Controller */
.driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */
},
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0625/1257] USB: quirks: add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for GameSir G7 SE
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (623 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0624/1257] USB: cdc-acm: add VeriFone VX820 device ID Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0626/1257] usb: typec: ucsi: Skip CAM query when partner has no alt modes Greg Kroah-Hartman
` (373 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Ali Resool Tuama,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Resool Tuama <aliresool567@gmail.com>
[ Upstream commit 40224df29729618ecd88c5c0077e71b1e82c7a3a ]
The GameSir G7 SE wired controller first enumerates as 3537:10a0 and
then re-enumerates in a mode it picks from how the host enumerated it.
When the configuration descriptor is fetched the Linux way, 9 bytes
followed by the full 80, the controller disconnects about 1 ms after
its string descriptors have been read, before SET_CONFIGURATION, and
comes back as 3537:1082, a generic HID gamepad without force feedback.
When the configuration descriptor is fetched in one 255-byte request,
as Windows does, it comes back as 3537:1010 in Xbox One (GIP) mode,
which xpad already supports, including rumble.
Skipping the device qualifier requests (USB_QUIRK_DEVICE_QUALIFIER)
makes no difference; the configuration descriptor request size alone
decides the mode. Add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for the 10a0
identity, as is already done for the ShanWan Wireless Gamepad.
Cc: stable <stable@kernel.org>
Assisted-by: claude-opus-5-5
Signed-off-by: Ali Resool Tuama <aliresool567@gmail.com>
Link: https://patch.msgid.link/20261002-master-v2-1-24b05d8792b5@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/quirks.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index b5b577f0b931c..a4bcbe9c913cf 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -612,6 +612,9 @@ static const struct usb_device_id usb_quirk_list[] = {
/* ezcap401 - BOS descriptor fetch hangs at SuperSpeed Plus */
{ USB_DEVICE(0x32ed, 0x0401), .driver_info = USB_QUIRK_NO_BOS },
+ /* GameSir G7 SE */
+ { USB_DEVICE(0x3537, 0x10a0), .driver_info = USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE },
+
/* DELL USB GEN2 */
{ USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME },
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0626/1257] usb: typec: ucsi: Skip CAM query when partner has no alt modes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (624 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0625/1257] USB: quirks: add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for GameSir G7 SE Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0627/1257] usb: typec: ucsi: ccg: Validate altmode index in GET_CURRENT_CAM response Greg Kroah-Hartman
` (372 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Gris Ge, Andrei Kuchynski,
Heikki Krogerus, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gris Ge <cnfourt@gmail.com>
[ Upstream commit 7c590f0716ed3c9ae9809dbc6d488d76c19fdf52 ]
Since Thunderbolt alternate mode support was added,
`ucsi_altmode_update_active()` is called on every Connector Partner
Changed event. This made the driver send `UCSI_GET_CURRENT_CAM` to
PPMs even when the partner had no alternate modes registered. Firmware
that does not support the optional alternate mode details answered Not
Supported, which produced a spurious error on every partner change:
```
ucsi_acpi USBC000:00: GET_CURRENT_CAM command failed
```
Fixed by skipping the command when there is nothing to update.
Fixes: da87d45b1951 ("usb: typec: ucsi: Add Thunderbolt alternate mode support")
Assisted-by: Codex:deepseek-v4.1-flash
Cc: stable <stable@kernel.org>
Signed-off-by: Gris Ge <cnfourt@gmail.com>
Reviewed-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260930234611.468765-2-cnfourt@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/ucsi/ucsi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index c1450639c7956..264338fd594a6 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -1519,7 +1519,8 @@ static void ucsi_handle_connector_change(struct work_struct *work)
if (con->partner && (change & UCSI_CONSTAT_PARTNER_CHANGE)) {
ucsi_partner_change(con);
- ucsi_altmode_update_active(con);
+ if (con->partner_altmode[0])
+ ucsi_altmode_update_active(con);
/* Complete pending data role swap */
if (!completion_done(&con->complete))
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0627/1257] usb: typec: ucsi: ccg: Validate altmode index in GET_CURRENT_CAM response
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (625 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0626/1257] usb: typec: ucsi: Skip CAM query when partner has no alt modes Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0628/1257] usb: xhci: Fix bounce buffer overflow Greg Kroah-Hartman
` (371 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Nathan Rebello, Seungjin Bae,
Heikki Krogerus, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit 02ee864e8d2142c5648998944c3306ea6a763c26 ]
When the PPM reports more than one DisplayPort alternate mode for a
connector, ucsi_ccg_update_altmodes() merges them into a single entry
in uc->updated[] and sets uc->has_multiple_dp. In that case,
ucsi_ccg_update_get_current_cam_cmd() rewrites the response of the
GET_CURRENT_CAM command. The response is a single byte holding the
index of the currently active alternate mode, and it is provided by
the PPM firmware.
The function uses this byte directly as an index into uc->orig[], and
then uses the linked_idx read from that entry as the translated index
into uc->updated[]. Both arrays have UCSI_MAX_ALTMODES entries, but
neither index is checked against that size.
If a malicious or buggy PPM reports a value of UCSI_MAX_ALTMODES or
larger, e.g. 0xFF, uc->orig[cam].linked_idx reads over the end of
uc->orig[]. The byte read from there is then used as the index for
writing cam into uc->updated[new_cam].active_idx, so the out-of-bounds
read is followed by an out-of-bounds write. This happens without any
userspace action, since the UCSI core issues GET_CURRENT_CAM on its own
when handling connector changes.
Fix this by rejecting responses whose index is out of range, printing an
error and returning -EPROTO, so that the caller cannot accept this.
Also check linked_idx before using it as an index, so that the write into
uc->updated[] is always within bounds.
The response is now only processed when the command completed without
an error. ucsi_sync_control_common() only reads the response when the
CCI reports command completion, so otherwise the buffer is not filled
and must not be mistaken for an invalid index.
This bug was found with a Python script that traces where firmware input
is used.
Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices")
Cc: stable <stable@kernel.org>
Reported-by: Nathan Rebello <nathan.c.rebello.27@dartmouth.edu>
Assisted-by: LLM
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20261003215520.611083-2-eeodqql09@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/ucsi/ucsi_ccg.c | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
index 91c2958a708c0..80e3e84b418d7 100644
--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -384,14 +384,28 @@ static int ucsi_ccg_init(struct ucsi_ccg *uc)
return -ETIMEDOUT;
}
-static void ucsi_ccg_update_get_current_cam_cmd(struct ucsi_ccg *uc, u8 *data)
+static int ucsi_ccg_update_get_current_cam_cmd(struct ucsi_ccg *uc, u8 *data)
{
u8 cam, new_cam;
cam = data[0];
+ if (cam >= UCSI_MAX_ALTMODES) {
+ dev_err(uc->dev, "PPM returned invalid alternate mode index %u\n",
+ cam);
+ return -EPROTO;
+ }
+
new_cam = uc->orig[cam].linked_idx;
+ if (new_cam >= UCSI_MAX_ALTMODES) {
+ dev_err(uc->dev, "invalid linked alternate mode index %u for %u\n",
+ new_cam, cam);
+ return -EPROTO;
+ }
+
uc->updated[new_cam].active_idx = cam;
data[0] = new_cam;
+
+ return 0;
}
static bool ucsi_ccg_update_altmodes(struct ucsi *ucsi,
@@ -636,8 +650,10 @@ static int ucsi_ccg_sync_control(struct ucsi *ucsi, u64 command, u32 *cci,
switch (UCSI_COMMAND(command)) {
case UCSI_GET_CURRENT_CAM:
- if (uc->has_multiple_dp)
- ucsi_ccg_update_get_current_cam_cmd(uc, (u8 *)data);
+ if (!ret && uc->has_multiple_dp &&
+ (*cci & UCSI_CCI_COMMAND_COMPLETE) &&
+ !(*cci & UCSI_CCI_ERROR))
+ ret = ucsi_ccg_update_get_current_cam_cmd(uc, (u8 *)data);
break;
case UCSI_GET_ALTERNATE_MODES:
if (UCSI_ALTMODE_RECIPIENT(command) == UCSI_RECIPIENT_SOP) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0628/1257] usb: xhci: Fix bounce buffer overflow
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (626 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0627/1257] usb: typec: ucsi: ccg: Validate altmode index in GET_CURRENT_CAM response Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0629/1257] xhci: Prevent invalid vdev dereference during sideband unregister Greg Kroah-Hartman
` (370 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+fd80bc5967eb22c3, Michal Pecio,
Mathias Nyman, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Pecio <michal.pecio@gmail.com>
[ Upstream commit 68c5cb7574c567e83ba95258cb146db95e069a87 ]
High-speed devices with out of spec 1024 byte bulk endpoints exist and
are allowed by USB core, but xhci-hcd always sets packet size to 512.
The exact nature of these devices isn't documented, commit fb5ee84ea72c
("USB: Accept bulk endpoints with 1024-byte maxpacket") only states
that they "don't work with xHCI host controllers", whatever it means.
But somebody (or a malicious device) can try, and then the driver will
allocate a 512 byte bounce buffer for this endpoint and may write up to
1024 bytes into it if particular scatter-gather URBs are used, because
xhci_align_td() obtains packet size from the descriptor. Fix this.
As a side effect, TRBs will be aligned to the packet size chosen by the
driver on all endpoints of all speeds. Alignment serves the xHC, not
device, so this is fine. Only out of spec devices are affected anyway.
Reported-by: co+fd80bc5967eb22c3@bugs.sh
Link: https://lore.kernel.org/linux-usb/D4tcSGerkYkIV1DmaUo1t8TaR5qQElDLkidn@bugs.sh/
Fixes: f9c589e142d0 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20261009151624.618967-11-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-ring.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index ec278a9f95404..fffd901b59e7f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3544,15 +3544,13 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred,
static int xhci_align_td(struct xhci_hcd *xhci, struct urb *urb, u32 enqd_len,
- u32 *trb_buff_len, struct xhci_segment *seg)
+ u32 *trb_buff_len, struct xhci_segment *seg, u32 max_pkt)
{
struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
unsigned int unalign;
- unsigned int max_pkt;
u32 new_buff_len;
size_t len;
- max_pkt = xhci_usb_endpoint_maxp(urb->dev, urb->ep);
unalign = (enqd_len + *trb_buff_len) % max_pkt;
/* we got lucky, last normal TRB data on segment is packet aligned */
@@ -3697,9 +3695,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
if (enqd_len + trb_buff_len < full_len) {
field |= TRB_CHAIN;
if (trb_is_link(ring->enqueue + 1)) {
- if (xhci_align_td(xhci, urb, enqd_len,
- &trb_buff_len,
- ring->enq_seg)) {
+ if (xhci_align_td(xhci, urb, enqd_len, &trb_buff_len,
+ ring->enq_seg, ring->bounce_buf_len)) {
send_addr = ring->enq_seg->bounce_dma;
/* TD bounced at least, and last on this seg */
td->bounce_seg = ring->enq_seg;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0629/1257] xhci: Prevent invalid vdev dereference during sideband unregister
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (627 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0628/1257] usb: xhci: Fix bounce buffer overflow Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0630/1257] usb: xhci-pci: Add AMD 600 series to xhci-pci-prom21 Greg Kroah-Hartman
` (369 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lianqin Hu, Mathias Nyman,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit fd616dc74e8f58f351f2b295620027116cd6e92e ]
Offloaded USB audio devices using the xhci-sideband API store a pointer to
the xhci virtual device (vdev) in the sideband structure when registering.
This pointer typically remains valid throughout the lifetime of the USB
device. If a configured offloaded device requires a reset, the USB core
usually unbinds or notifies the audio driver beforehand, ensuring that the
sideband is unregistered before the vdev is freed.
An exception occurs when the USB core resets a device to recover from a
failed resume, but a subsequent 'address device' request also fails. To
recover in this specific scenario, the xHCI driver disables and re-enables
the slot, which frees and re-allocates the vdev.
xhci_sideband_unregister() later dereferences the stale, previously freed
vdev pointer during disconnect, triggering a kernel oops:
Unable to handle kernel paging request at virtual address dead000000000122
Call trace:
xhci_get_ep_ctx+0x0/0x38
xhci_sideband_unregister+0x68/0xf0
uaudio_disconnect+0x70/0x144
usb_audio_disconnect+0x7c/0x268
usb_unbind_interface+0x13c/0x340
device_release_driver_internal+0x1c4/0x2bc
usb_disable_device+0x84/0x190
usb_disconnect+0xe8/0x338
hub_event+0xbd8/0x19ac
Fix this by preventing the reallocation of the vdev in this specific error
path if the device is registered for sideband use.
Just propagate the error directly to the USB core. It should either retry
enumeration or detect the disconnected device, and handle it accordingly.
Debugging this issue to the dangling vdev pointer, reporting it, testing,
and initial patch with different solution by Lianqin Hu
Reported-by: Lianqin Hu <hulianqin@vivo.com>
Closes: https://lore.kernel.org/linux-usb/TYUPR06MB6217000B59003EDF233D7246D2B22@TYUPR06MB6217.apcprd06.prod.outlook.com/
Tested-by: Lianqin Hu <hulianqin@vivo.com>
Fixes: de66754e9f80 ("xhci: sideband: add initial api to register a secondary interrupter entity")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20261009151624.618967-12-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index a9e47e178c280..28bfe5fd0b6f4 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4435,10 +4435,13 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
dev_warn(&udev->dev, "Device not responding to setup %s.\n", act);
mutex_unlock(&xhci->mutex);
- ret = xhci_disable_and_free_slot(xhci, udev->slot_id);
- if (!ret) {
- if (xhci_alloc_dev(hcd, udev) == 1)
- xhci_setup_addressable_virt_dev(xhci, udev);
+
+ if (!virt_dev->sideband) {
+ ret = xhci_disable_and_free_slot(xhci, udev->slot_id);
+ if (!ret) {
+ if (xhci_alloc_dev(hcd, udev) == 1)
+ xhci_setup_addressable_virt_dev(xhci, udev);
+ }
}
kfree(command->completion);
kfree(command);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0630/1257] usb: xhci-pci: Add AMD 600 series to xhci-pci-prom21
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (628 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0629/1257] xhci: Prevent invalid vdev dereference during sideband unregister Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0631/1257] usb: typec: ucsi_ccg: Add retry mechanism in ccg_read Greg Kroah-Hartman
` (368 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shyam Sundar S K, Jihong Min,
Stephen Horvath, Mirko Jechow, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Horvath <linux@stevetech.au>
[ Upstream commit 29381088ac50a4910d18a5f8079d9bd505f839be ]
It seems the xhci-pci-prom21 module only has IDs for the 800 series
chipsets. However, the 600 series chipsets also have Promontory 21
chips, so we should add their IDs to the list as well.
I have tested this on my X670 board featuring DID `0x43f7`.
`1022:43f7` also appears on the PCI ID database
(https://pci-ids.ucw.cz/read/PC/1022/43f7).
Device IDs `0x43f9` (B665) & `0x43fa` (A620) were suggested by Shyam.
Also list the new IDs in Documentation/hwmon/prom21-xhci.rst.
Cc: stable@vger.kernel.org # 7.2.x
Cc: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Cc: Jihong Min <hurryman2212@gmail.com>
Signed-off-by: Stephen Horvath <linux@stevetech.au>
Tested-by: Mirko Jechow <mirko.jechow@gmx.de>
[mirko.jechow@gmx.de: add new IDs to prom21-xhci.rst]
Signed-off-by: Mirko Jechow <mirko.jechow@gmx.de>
Link: https://patch.msgid.link/20261004002731.49927-1-mirko.jechow@gmx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/hwmon/prom21-xhci.rst | 2 +-
drivers/usb/host/xhci-pci-prom21.c | 3 +++
drivers/usb/host/xhci-pci.c | 3 +++
drivers/usb/host/xhci-pci.h | 3 +++
4 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/Documentation/hwmon/prom21-xhci.rst b/Documentation/hwmon/prom21-xhci.rst
index 7984fb187bd8a..6c0b6e7368921 100644
--- a/Documentation/hwmon/prom21-xhci.rst
+++ b/Documentation/hwmon/prom21-xhci.rst
@@ -9,7 +9,7 @@ Supported chips:
Prefix: 'prom21_xhci'
- PCI IDs: 1022:43fc, 1022:43fd
+ PCI IDs: 1022:43f7, 1022:43f9, 1022:43fa, 1022:43fc, 1022:43fd
Author:
diff --git a/drivers/usb/host/xhci-pci-prom21.c b/drivers/usb/host/xhci-pci-prom21.c
index 6486f4a093455..5f088a47d79f3 100644
--- a/drivers/usb/host/xhci-pci-prom21.c
+++ b/drivers/usb/host/xhci-pci-prom21.c
@@ -111,6 +111,9 @@ static void prom21_xhci_remove(struct pci_dev *dev)
}
static const struct pci_device_id pci_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_PROM21_XHCI_43F7) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_PROM21_XHCI_43F9) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_PROM21_XHCI_43FA) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_PROM21_XHCI_43FC) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_PROM21_XHCI_43FD) },
{ /* end: all zeroes */ }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index a8889081ae824..b407676808fca 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -701,6 +701,9 @@ static const struct pci_device_id pci_ids_renesas[] = {
/* handled by xhci-pci-prom21 if enabled */
static const struct pci_device_id pci_ids_prom21[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_PROM21_XHCI_43F7) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_PROM21_XHCI_43F9) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_PROM21_XHCI_43FA) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_PROM21_XHCI_43FC) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_PROM21_XHCI_43FD) },
{ /* end: all zeroes */ }
diff --git a/drivers/usb/host/xhci-pci.h b/drivers/usb/host/xhci-pci.h
index 11f435f94322a..533efc7db8012 100644
--- a/drivers/usb/host/xhci-pci.h
+++ b/drivers/usb/host/xhci-pci.h
@@ -4,6 +4,9 @@
#ifndef XHCI_PCI_H
#define XHCI_PCI_H
+#define PCI_DEVICE_ID_AMD_PROM21_XHCI_43F7 0x43f7
+#define PCI_DEVICE_ID_AMD_PROM21_XHCI_43F9 0x43f9
+#define PCI_DEVICE_ID_AMD_PROM21_XHCI_43FA 0x43fa
#define PCI_DEVICE_ID_AMD_PROM21_XHCI_43FC 0x43fc
#define PCI_DEVICE_ID_AMD_PROM21_XHCI_43FD 0x43fd
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0631/1257] usb: typec: ucsi_ccg: Add retry mechanism in ccg_read
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (629 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0630/1257] usb: xhci-pci: Add AMD 600 series to xhci-pci-prom21 Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0632/1257] mailbox: altera: shut down RX polling timer on channel teardown Greg Kroah-Hartman
` (367 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Wayne Chang, Jon Hunter,
Heikki Krogerus, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <waynec@nvidia.com>
[ Upstream commit bbf6b99a57b2479bf51c3c8ad0946f4b8c33ed69 ]
CCG4 firmware occasionally fails to respond to I2C read requests,
especially when reading cci and intr_reg from the ISR path. In these
cases, i2c_transfer() returns -EREMOTEIO.
The CCG4 is EOL, and Infineon no longer supports firmware updates, so
a software workaround is necessary.
Attempt the read up to CCG_READ_MAX_RETRIES (4) times in total when
-EREMOTEIO is returned, sleeping ~1 ms via fsleep() between attempts.
This allows recovery from transient I2C failures without affecting
other error paths.
The sleep is safe because ccg_read() is called both from process
context and from ccg_irq_handler(), which runs in threaded IRQ
context (registered via request_threaded_irq() with a NULL hard-IRQ
handler), so sleeping is allowed in both cases.
Fixes: 247c554a14aa ("usb: typec: ucsi: add support for Cypress CCGx")
Cc: stable <stable@kernel.org>
Signed-off-by: Wayne Chang <waynec@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260916061858.1471606-1-waynec@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/ucsi/ucsi_ccg.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
index 80e3e84b418d7..3f12db95c7f46 100644
--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -135,6 +135,8 @@ struct version_format {
#define NVIDIA_FTB_DP_OFFSET (2)
#define NVIDIA_FTB_DBG_OFFSET (3)
+#define CCG_READ_MAX_RETRIES 4
+
struct version_info {
struct version_format base;
struct version_format app;
@@ -255,6 +257,7 @@ static int ccg_read(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
};
u32 rlen, rem_len = len, max_read_len = len;
int status;
+ int retry_count;
/* check any max_read_len limitation on i2c adapter */
if (quirks && quirks->max_read_len)
@@ -266,7 +269,17 @@ static int ccg_read(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
rlen = min_t(u16, rem_len, max_read_len);
msgs[1].len = rlen;
put_unaligned_le16(rab, buf);
- status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+
+ for (retry_count = 0; retry_count < CCG_READ_MAX_RETRIES; retry_count++) {
+ status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+
+ /* Only retry on -EREMOTEIO, and not after the last attempt */
+ if (status != -EREMOTEIO || retry_count == CCG_READ_MAX_RETRIES - 1)
+ break;
+
+ fsleep(1000);
+ }
+
if (status < 0) {
dev_err(uc->dev, "i2c_transfer failed %d\n", status);
pm_runtime_put_sync(uc->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0632/1257] mailbox: altera: shut down RX polling timer on channel teardown
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (630 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0631/1257] usb: typec: ucsi_ccg: Add retry mechanism in ccg_read Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0633/1257] mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM Greg Kroah-Hartman
` (366 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Jassi Brar, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 0cf10e65639cba32d05994f85e6a8f08dd0ffe08 ]
The RX polling callback unconditionally rearms the timer after it
processes mailbox data. altera_mbox_shutdown() uses
timer_delete_sync(), which waits for a running callback but does not
prevent that callback from rearming the timer after the deletion.
Use timer_shutdown_sync() for the final polling teardown so the timer
cannot be queued again while the mailbox channel is being released.
The timer is reinitialized with timer_setup() on a later channel startup,
so polling mode remains reusable.
Fixes: f62092f6d77d ("mailbox: Add Altera mailbox driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mailbox-altera.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mailbox/mailbox-altera.c b/drivers/mailbox/mailbox-altera.c
index 17278c2571d34..7cb91413ef7fc 100644
--- a/drivers/mailbox/mailbox-altera.c
+++ b/drivers/mailbox/mailbox-altera.c
@@ -270,7 +270,7 @@ static void altera_mbox_shutdown(struct mbox_chan *chan)
writel_relaxed(~0, mbox->mbox_base + MAILBOX_INTMASK_REG);
free_irq(mbox->irq, chan);
} else if (!mbox->is_sender) {
- timer_delete_sync(&mbox->rxpoll_timer);
+ timer_shutdown_sync(&mbox->rxpoll_timer);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0633/1257] mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (631 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0632/1257] mailbox: altera: shut down RX polling timer on channel teardown Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0634/1257] mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush() Greg Kroah-Hartman
` (365 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli, Danesh Petigara,
Justin Chen, Jassi Brar, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <florian.fainelli@broadcom.com>
[ Upstream commit eb2ee504757674450a5e03e36e6b9340f064e599 ]
bcm74110_rx_push_init_msg() allocates a GFP_ATOMIC struct for every
BCM_MSG_SVC_INIT word received from the PMC co-processor and appends it
to rx_svc_init_list with no cap on list length. The only consumers of
this list (bcm74110_rx_pop_init_msg_block / bcm74110_rx_flush_msg) are
called only during probe and at shutdown respectively; after probe
completes, PMC firmware can continuously inject BCM_MSG_SVC_INIT words,
exhausting GFP_ATOMIC reserves and causing a whole-device denial of
service.
Add BCM74110_INIT_MSG_MAX (16 entries) as the maximum list depth.
bcm74110_rx_push_init_msg() now checks the count under the existing
rx_svc_list_lock before allocating; if the cap is reached the message is
dropped and a rate-limited warning is emitted. The new rx_svc_init_count
field is decremented by bcm74110_rx_pop_init_msg() on successful dequeue
and reset to zero by bcm74110_rx_flush_msg() on shutdown.
Fixes: 52436007b862 ("mailbox: Add support for bcm74110")
Cc: stable@vger.kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Assisted-by: Anthropic:claude-sonnet-4.6 cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Acked-by: Justin Chen <justin.chen@broadcom.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/bcm74110-mailbox.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/mailbox/bcm74110-mailbox.c b/drivers/mailbox/bcm74110-mailbox.c
index c8709d5099121..bec138d76914d 100644
--- a/drivers/mailbox/bcm74110-mailbox.c
+++ b/drivers/mailbox/bcm74110-mailbox.c
@@ -97,6 +97,8 @@ struct bcm74110_mbox_chan {
int type;
};
+#define BCM74110_INIT_MSG_MAX 16
+
struct bcm74110_mbox {
struct platform_device *pdev;
void __iomem *base;
@@ -105,6 +107,7 @@ struct bcm74110_mbox {
int rx_chan;
int rx_irq;
struct list_head rx_svc_init_list;
+ unsigned int rx_svc_init_count;
spinlock_t rx_svc_list_lock;
struct mbox_controller controller;
@@ -148,7 +151,15 @@ static void bcm74110_rx_push_init_msg(struct bcm74110_mbox *mbox, u32 val)
msg->msg = val;
spin_lock(&mbox->rx_svc_list_lock);
+ if (mbox->rx_svc_init_count >= BCM74110_INIT_MSG_MAX) {
+ spin_unlock(&mbox->rx_svc_list_lock);
+ kfree(msg);
+ dev_warn_ratelimited(&mbox->pdev->dev,
+ "PMC INIT msg list full, dropping message\n");
+ return;
+ }
list_add_tail(&msg->list_entry, &mbox->rx_svc_init_list);
+ mbox->rx_svc_init_count++;
spin_unlock(&mbox->rx_svc_list_lock);
}
@@ -225,6 +236,7 @@ static int bcm74110_rx_pop_init_msg(struct bcm74110_mbox *mbox, u32 func_type,
list_entry) {
if (BCM_MSG_GET_FIELD(msg->msg, FUNC) == func_type) {
list_del(&msg->list_entry);
+ mbox->rx_svc_init_count--;
found = true;
break;
}
@@ -248,6 +260,7 @@ static void bcm74110_rx_flush_msg(struct bcm74110_mbox *mbox)
spin_lock_irqsave(&mbox->rx_svc_list_lock, flags);
list_splice_init(&mbox->rx_svc_init_list, &list_temp);
+ mbox->rx_svc_init_count = 0;
spin_unlock_irqrestore(&mbox->rx_svc_list_lock, flags);
list_for_each_entry_safe(msg, msg_tmp, &list_temp, list_entry) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0634/1257] mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (632 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0633/1257] mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0635/1257] mailbox: qcom-ipcc: Guard against NULL con_priv in send_data() Greg Kroah-Hartman
` (364 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Jassi Brar,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 18e3e979826795b62e8916743bec4de660e7cb22 ]
pm_runtime_get_sync() leaves the runtime PM usage counter incremented
even when it fails, but cmdq_mbox_flush() returns the error without
dropping it. The same happens when the GCE thread does not drain in
time and the function bails out with -EFAULT.
Undo the reference on both error paths.
Fixes: b0524f7c9635 ("mailbox: mediatek: implement flush function")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mtk-cmdq-mailbox.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
index e523c84b48088..96462ca844715 100644
--- a/drivers/mailbox/mtk-cmdq-mailbox.c
+++ b/drivers/mailbox/mtk-cmdq-mailbox.c
@@ -565,8 +565,10 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
int ret;
ret = pm_runtime_get_sync(cmdq->mbox.dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put_noidle(cmdq->mbox.dev);
return ret;
+ }
spin_lock_irqsave(&thread->chan->lock, flags);
if (list_empty(&thread->task_busy_list))
@@ -603,6 +605,9 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
dev_err(cmdq->mbox.dev, "Fail to wait GCE thread 0x%x done\n",
(u32)(thread->base - cmdq->base));
+ pm_runtime_mark_last_busy(cmdq->mbox.dev);
+ pm_runtime_put_autosuspend(cmdq->mbox.dev);
+
return -EFAULT;
}
pm_runtime_mark_last_busy(cmdq->mbox.dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0635/1257] mailbox: qcom-ipcc: Guard against NULL con_priv in send_data()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (633 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0634/1257] mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0636/1257] m68k: Fix seccomp filtering on ColdFire and 68000 Greg Kroah-Hartman
` (363 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anup Vishwakarma, Konrad Dybcio,
Jassi Brar, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
[ Upstream commit 7b3cc361b5942ac600f38e5dff7aed009be34964 ]
qcom_ipcc_mbox_shutdown() clears chan->con_priv with no locking.
qcom_ipcc_mbox_send_data() dereferences the same field without
checking for NULL first, so a send racing a concurrent shutdown can
crash:
mchan = chan->con_priv;
...
hwirq = qcom_ipcc_get_hwirq(mchan->client_id, mchan->signal_id);
Add the same NULL guard mbox_send_message() already uses for
chan->cl, and bail out before dereferencing a cleared con_priv.
To close the remaining race where send_data() reads con_priv a moment
before a concurrent shutdown clears it, acquire the spinlock in
qcom_ipcc_mbox_shutdown() using the modern guard(spinlock_irqsave)
primitive before setting con_priv to NULL.
Fixes: d6fbfdbc1274 ("mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion")
Cc: stable@vger.kernel.org
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/qcom-ipcc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/mailbox/qcom-ipcc.c b/drivers/mailbox/qcom-ipcc.c
index 185b63f724d4f..387aa72aeedf1 100644
--- a/drivers/mailbox/qcom-ipcc.c
+++ b/drivers/mailbox/qcom-ipcc.c
@@ -10,6 +10,7 @@
#include <linux/mailbox_controller.h>
#include <linux/module.h>
#include <linux/platform_device.h>
+#include <linux/spinlock.h>
#include <dt-bindings/mailbox/qcom-ipcc.h>
@@ -151,6 +152,9 @@ static int qcom_ipcc_mbox_send_data(struct mbox_chan *chan, void *data)
struct qcom_ipcc_chan_info *mchan = chan->con_priv;
u32 hwirq;
+ if (!mchan)
+ return -EINVAL;
+
hwirq = qcom_ipcc_get_hwirq(mchan->client_id, mchan->signal_id);
writel(hwirq, ipcc->base + IPCC_REG_SEND_ID);
@@ -159,6 +163,8 @@ static int qcom_ipcc_mbox_send_data(struct mbox_chan *chan, void *data)
static void qcom_ipcc_mbox_shutdown(struct mbox_chan *chan)
{
+ guard(spinlock_irqsave)(&chan->lock);
+
chan->con_priv = NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0636/1257] m68k: Fix seccomp filtering on ColdFire and 68000
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (634 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0635/1257] mailbox: qcom-ipcc: Guard against NULL con_priv in send_data() Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0637/1257] USB: serial: sierra: fix urb leak on write completion Greg Kroah-Hartman
` (362 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Schwab, Christopher Lusk,
Greg Ungerer, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Lusk <clusk@northecho.dev>
[ Upstream commit 48859f8018d93bd93ef35f7430fdf5b97f2f9715 ]
m68k selects HAVE_ARCH_SECCOMP_FILTER for all configurations, but the
ColdFire and 68000 syscall entry paths only branch to
syscall_trace_enter() for TIF_SYSCALL_TRACE. TIF_SECCOMP alone falls
through to syscall dispatch, leaving installed filters ineffective.
Test the combined TIF_SYSCALL_TRACE and TIF_SECCOMP mask in both paths
and route either flag through the existing slow path. Leave the classic
MMU syscall entry implementation unchanged.
Validated the combined test under QEMU mcf5208evb (ColdFire): filters
denying getpid, openat, unlinkat, and reboot each returned -EPERM. A
classic-MMU control (q800) denied the filtered getpid syscall both before
and after this change. The 68000 path shares the same source-level
omission and receives the identical masked test but was not separately
emulated. Compile-tested W=1 with CONFIG_SECCOMP_FILTER=y on both
m5208evb_defconfig and a custom no-MMU UCSIMM configuration; the latter
built arch/m68k/68000/entry.o and vmlinux.
Fixes: 6baaade15594 ("m68k: Add kernel seccomp support")
Cc: stable@vger.kernel.org # v6.3+
Suggested-by: Andreas Schwab <schwab@linux-m68k.org>
Assisted-by: Claude:claude-opus-4-8
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Christopher Lusk <clusk@northecho.dev>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/m68k/68000/entry.S | 3 ++-
arch/m68k/coldfire/entry.S | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/m68k/68000/entry.S b/arch/m68k/68000/entry.S
index c257cc415c478..0d3cbededc43c 100644
--- a/arch/m68k/68000/entry.S
+++ b/arch/m68k/68000/entry.S
@@ -79,7 +79,8 @@ ENTRY(system_call)
/* Doing a trace ? */
getthreadinfo
- btst #(TIF_SYSCALL_TRACE%8),%a2@(TINFO_FLAGS+(31-TIF_SYSCALL_TRACE)/8)
+ moveb %a2@(TINFO_FLAGS+2),%d1
+ andl #((_TIF_SYSCALL_TRACE + _TIF_SECCOMP) >> 8),%d1
jne do_trace
cmpl #NR_syscalls,%d0
jcc badsys
diff --git a/arch/m68k/coldfire/entry.S b/arch/m68k/coldfire/entry.S
index 4ea08336e2fb0..d658abdc52075 100644
--- a/arch/m68k/coldfire/entry.S
+++ b/arch/m68k/coldfire/entry.S
@@ -72,7 +72,8 @@ ENTRY(system_call)
movel %d2,%a0
movel %a0@,%a1 /* save top of frame */
movel %sp,%a1@(TASK_THREAD+THREAD_ESP0)
- btst #(TIF_SYSCALL_TRACE%8),%a0@(TINFO_FLAGS+(31-TIF_SYSCALL_TRACE)/8)
+ moveb %a0@(TINFO_FLAGS+2),%d2
+ andl #((_TIF_SYSCALL_TRACE + _TIF_SECCOMP) >> 8),%d2
bnes 1f
movel %d3,%a0
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0637/1257] USB: serial: sierra: fix urb leak on write completion
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (635 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0636/1257] m68k: Fix seccomp filtering on ColdFire and 68000 Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0638/1257] selftests/filesystems: Fix idmapped_tmpfile layer dir ownership Greg Kroah-Hartman
` (361 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Oliver Neukum,
Johan Hovold, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit e7daa54802c566ed3f22e81513f84c8c9197c5d1 ]
Make sure to drop the reference taken by usb_anchor_urb() also on
successful submission of delayed write URBs during runtime resume to
prevent them from leaking on completion.
Fixes: e6929a9020ac ("USB: support for autosuspend in sierra while online")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/20260916165352.2085480-1-vulab@iscas.ac.cn
Cc: stable@vger.kernel.org # 2.6.32
Cc: Oliver Neukum <oliver@neukum.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/serial/sierra.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 6e443aacae07d..f2cc7f364d204 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -972,12 +972,13 @@ static int sierra_submit_delayed_urbs(struct usb_serial_port *port)
intfdata->in_flight--;
usb_unanchor_urb(urb);
kfree(urb->transfer_buffer);
- usb_free_urb(urb);
spin_lock(&portdata->lock);
portdata->outstanding_urbs--;
spin_unlock(&portdata->lock);
}
+
+ usb_put_urb(urb);
}
if (ec)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0638/1257] selftests/filesystems: Fix idmapped_tmpfile layer dir ownership
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (636 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0637/1257] USB: serial: sierra: fix urb leak on write completion Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0639/1257] dm-snapshot: fix crash if dm_io_client_create fails Greg Kroah-Hartman
` (360 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjoern Doebel,
Christian Brauner (Amutable), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjoern Doebel <doebel@amazon.de>
[ Upstream commit 9ba6627ef6b12debd1c54443939718db63234274 ]
The recent idmapped_tmpfile selftest creates a new directory in tmpfs
owned by user ID 0. It then idmaps the mount as caller [0,10000) to disk
[10000,20000). The original uid 0 owner does not exist in the mapped
range. As a result, mapped_caller_creates_and_links fails at the
O_TMPFILE open because inode_permission() rejects MAY_WRITE access:
idmapped_tmpfile.c:145:mapped_caller_creates_and_links:
Expected fd (-1) >= 0 (0)
Chown the directory into the mapped range to satisfy the UID
requirement.
Fixes: d943e68edc5cb ("selftests/filesystems: test O_TMPFILE creation on idmapped mounts")
Cc: stable@vger.kernel.org # 7.2+
Signed-off-by: Bjoern Doebel <doebel@amazon.de>
Link: https://patch.msgid.link/20261001082411.1493072-1-doebel@amazon.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/filesystems/idmapped_tmpfile.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/tools/testing/selftests/filesystems/idmapped_tmpfile.c b/tools/testing/selftests/filesystems/idmapped_tmpfile.c
index bc411ab8281ea..77b96d0943578 100644
--- a/tools/testing/selftests/filesystems/idmapped_tmpfile.c
+++ b/tools/testing/selftests/filesystems/idmapped_tmpfile.c
@@ -91,6 +91,13 @@ FIXTURE_SETUP(idmapped_tmpfile)
ASSERT_EQ(mkdir(self->dir, 0777), 0);
/* World-writable so an unmapped caller still passes permission(). */
ASSERT_EQ(chmod(self->dir, 0777), 0);
+ /*
+ * The directory itself must be inside the range the mount maps.
+ * Left owned by 0 it has no mapping in the mount, and
+ * inode_permission() then fails MAY_WRITE via HAS_UNMAPPED_ID()
+ * before any of the tmpfile logic is reached, regardless of mode.
+ */
+ ASSERT_EQ(chown(self->dir, MAP_HOST, MAP_HOST), 0);
}
FIXTURE_TEARDOWN(idmapped_tmpfile)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0639/1257] dm-snapshot: fix crash if dm_io_client_create fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (637 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0638/1257] selftests/filesystems: Fix idmapped_tmpfile layer dir ownership Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0640/1257] ALSA: hda: cs35l41: Fix ACPI device reference leak on probe failure Greg Kroah-Hartman
` (359 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 829c4d21148a205eca864429e06530319e1f92d5 ]
If dm_io_client_create() fails, it stores error into the ps->io_client
variable. The code would try to free it later with
dm_io_client_destroy(ps->io_client), causing an invalid pointer
dereference. Fix this by setting ps->io_client = NULL.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-snap-persistent.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index e86d929b0e951..b587ee7330562 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -325,8 +325,11 @@ static int read_header(struct pstore *ps, int *new_snapshot)
}
ps->io_client = dm_io_client_create();
- if (IS_ERR(ps->io_client))
- return PTR_ERR(ps->io_client);
+ if (IS_ERR(ps->io_client)) {
+ r = PTR_ERR(ps->io_client);
+ ps->io_client = NULL;
+ return r;
+ }
r = alloc_area(ps);
if (r)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0640/1257] ALSA: hda: cs35l41: Fix ACPI device reference leak on probe failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (638 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0639/1257] dm-snapshot: fix crash if dm_io_client_create fails Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0641/1257] ACPI: APEI: accumulate the queued flag across error sections Greg Kroah-Hartman
` (358 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit 8d70e364e866bdfca81eee24d0688fac9472cfb9 ]
cs35l41_hda_probe() takes an acpi_device through
cs35l41_hda_read_acpi() and stores it in cs35l41->dacpi. Only the
failures that happen later reach the err: label, which is where that
reference and cs35l41->acpi_subsystem_id are released, so the early
return taken when cs35l41_hda_read_acpi() fails leaves both behind.
Keep the ownership in the caller instead of dropping the reference
inside cs35l41_hda_read_acpi(). That removes the need to work out
whether a given failure path has already released it, and with it the
double put that cs35l41_hda_parse_acpi() would otherwise cause when it
fails after having released the device itself.
cs35l41_hda_parse_acpi() and the !physdev path no longer put the
reference, and the early failure enters the existing err: cleanup tail
through a new err_acpi label.
The label sits between the reset of the codec and the gpio cleanup, so
an early failure also releases the reset and chip-select descriptors
that cs35l41_hda_parse_acpi() may already have taken, while still
skipping cs35l41_safe_reset() on a codec that was never brought up.
cs35l41->dacpi comes from devm_kzalloc() and is only assigned once the
ACPI device has been found, so the put is a no-op when the lookup
itself failed.
Found by code review.
Fixes: 447106e92a0c ("ALSA: hda: cs35l41: Support mute notifications for CS35L41 HDA")
Cc: stable@vger.kernel.org
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Link: https://patch.msgid.link/20261012084152.3740340-1-make_ruc2021@163.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/side-codecs/cs35l41_hda.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/sound/hda/codecs/side-codecs/cs35l41_hda.c b/sound/hda/codecs/side-codecs/cs35l41_hda.c
index 62296be45c55e..d50c3d8f5303c 100644
--- a/sound/hda/codecs/side-codecs/cs35l41_hda.c
+++ b/sound/hda/codecs/side-codecs/cs35l41_hda.c
@@ -1907,7 +1907,6 @@ int cs35l41_hda_parse_acpi(struct cs35l41_hda *cs35l41, struct device *physdev,
hw_cfg->valid = false;
hw_cfg->gpio1.valid = false;
hw_cfg->gpio2.valid = false;
- acpi_dev_put(cs35l41->dacpi);
return ret;
}
@@ -1928,10 +1927,8 @@ static int cs35l41_hda_read_acpi(struct cs35l41_hda *cs35l41, const char *hid, i
cs35l41->dacpi = adev;
struct device *physdev __free(put_device) =
get_device(acpi_get_first_physical_node(adev));
- if (!physdev) {
- acpi_dev_put(adev);
+ if (!physdev)
return -ENODEV;
- }
sub = acpi_get_subsystem_id(ACPI_HANDLE(physdev));
if (IS_ERR(sub))
@@ -1986,8 +1983,10 @@ int cs35l41_hda_probe(struct device *dev, const char *device_name, int id, int i
dev_set_drvdata(dev, cs35l41);
ret = cs35l41_hda_read_acpi(cs35l41, device_name, id);
- if (ret)
- return dev_err_probe(cs35l41->dev, ret, "Platform not supported\n");
+ if (ret) {
+ dev_err_probe(cs35l41->dev, ret, "Platform not supported\n");
+ goto err_acpi;
+ }
if (IS_ERR(cs35l41->reset_gpio)) {
ret = PTR_ERR(cs35l41->reset_gpio);
@@ -2074,6 +2073,7 @@ int cs35l41_hda_probe(struct device *dev, const char *device_name, int id, int i
err:
if (cs35l41_safe_reset(cs35l41->regmap, cs35l41->hw_cfg.bst_type))
gpiod_set_value_cansleep(cs35l41->reset_gpio, 0);
+err_acpi:
gpiod_put(cs35l41->reset_gpio);
gpiod_put(cs35l41->cs_gpio);
acpi_dev_put(cs35l41->dacpi);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0641/1257] ACPI: APEI: accumulate the queued flag across error sections
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (639 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0640/1257] ALSA: hda: cs35l41: Fix ACPI device reference leak on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0642/1257] arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO Greg Kroah-Hartman
` (357 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Shuai Xue,
Rafael J. Wysocki, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit f341307a14895e5da056fb419a31ef7fb534ab18 ]
ghes_do_proc() walks every error section of a CPER record, and
ghes_handle_arm_hw_error() walks every error-info entry of an ARM
processor section. Both assign to "queued" instead of OR-ing into it,
so only the last iteration counts: a later section or entry that queues
no memory-failure work clears the flag an earlier one set.
Instead of reassigning the variable at every time, just do an `OR`, so,
if there was a single match, it will return "queued" as set.
The comment above the check says "If no memory failure
work is queued", which is the semantics this patch implements. I.e, only
SIGBUS if there are queue was not handled at all. If we want to SIGBUS
if any event was not handled/queued at all, we will need something more
sophisticated.
Fixes: 7f17b4a121d0 ("ACPI: APEI: Kick the memory_failure() queue for synchronous errors")
Fixes: ccb5ecdc2dde ("ACPI: APEI: fix synchronous external aborts in user-mode")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Link: https://patch.msgid.link/20260925-ghes-queued-accumulate-v1-1-df50553957d4@debian.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/apei/ghes.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index fe10ab0e02f68..ec2d5ca51db02 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -603,7 +603,7 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
* and don't filter out 'corrected' error here.
*/
if (is_cache && has_pa) {
- queued = ghes_do_memory_failure(err_info->physical_fault_addr, flags);
+ queued |= ghes_do_memory_failure(err_info->physical_fault_addr, flags);
p += err_info->length;
continue;
}
@@ -951,11 +951,11 @@ static void ghes_do_proc(struct ghes *ghes,
atomic_notifier_call_chain(&ghes_report_chain, sev, mem_err);
arch_apei_report_mem_error(sev, mem_err);
- queued = ghes_handle_memory_failure(gdata, sev, sync);
+ queued |= ghes_handle_memory_failure(gdata, sev, sync);
} else if (guid_equal(sec_type, &CPER_SEC_PCIE)) {
ghes_handle_aer(gdata);
} else if (guid_equal(sec_type, &CPER_SEC_PROC_ARM)) {
- queued = ghes_handle_arm_hw_error(gdata, sev, sync);
+ queued |= ghes_handle_arm_hw_error(gdata, sev, sync);
} else if (guid_equal(sec_type, &CPER_SEC_CXL_PROT_ERR)) {
struct cxl_cper_sec_prot_err *prot_err = acpi_hest_get_payload(gdata);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0642/1257] arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (640 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0641/1257] ACPI: APEI: accumulate the queued flag across error sections Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0643/1257] btrfs: zoned: fix block group reference leak in btrfs_repair_one_zone() Greg Kroah-Hartman
` (356 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Catalin Marinas,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit 215d7b6622733603751f546b9faf9b84b0c281d4 ]
set_permissions() sets PTE_RDONLY for regions that the Memory Attributes
Table describes as read-only, but leaves PTE_WRITE set. PTE_WRITE is
the DBM bit, so when hardware dirty state management is enabled
(TCR_EL1.HD), such a descriptor is writable-clean rather than read-only,
and a write by the firmware will be permitted by the hardware (which
marks the entry dirty) instead of faulting.
Clear PTE_WRITE as well, as pte_wrprotect() does.
Cc: stable@vger.kernel.org
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/efi.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 0ec90fd1754ed..6f34aef3d04ef 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -117,8 +117,14 @@ static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data)
const efi_memory_desc_t *md = spd->md;
pte_t pte = __ptep_get(ptep);
+ /*
+ * Clear PTE_WRITE as well: it doubles as the DBM bit, and leaving it
+ * set would permit the hardware to make the mapping writable again
+ * when TCR_EL1.HD is set.
+ */
if (md->attribute & EFI_MEMORY_RO)
- pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
+ pte = set_pte_bit(clear_pte_bit(pte, __pgprot(PTE_WRITE)),
+ __pgprot(PTE_RDONLY));
if (md->attribute & EFI_MEMORY_XP)
pte = set_pte_bit(pte, __pgprot(PTE_PXN));
else if (system_supports_bti_kernel() && spd->has_bti)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0643/1257] btrfs: zoned: fix block group reference leak in btrfs_repair_one_zone()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (641 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0642/1257] arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO Greg Kroah-Hartman
@ 2026-11-07 13:48 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0644/1257] btrfs: return -ENOTTY for unknown ioctls on the control device Greg Kroah-Hartman
` (355 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boris Burkov, Wentao Liang,
David Sterba, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 886f1aa6e6b30a02901aa7f140149d466e10a873 ]
btrfs_repair_one_zone() hands the block group reference taken by
btrfs_lookup_block_group() over to relocating_repair_kthread(), which
drops it. However the return value of kthread_run() is not checked, so
when the kernel thread fails to spawn, nothing executes the put and the
block group reference is leaked.
Check kthread_run() and drop the reference if the thread failed to
start.
Fixes: f7ef5287a63d ("btrfs: zoned: relocate block group to repair IO failure in zoned filesystems")
CC: stable@vger.kernel.org
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/volumes.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 85ea9c5d4536c..e7d3cd66a98d1 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -8971,6 +8971,7 @@ static int relocating_repair_kthread(void *data)
bool btrfs_repair_one_zone(struct btrfs_fs_info *fs_info, u64 logical)
{
struct btrfs_block_group *cache;
+ struct task_struct *task;
if (!btrfs_is_zoned(fs_info))
return false;
@@ -8988,8 +8989,9 @@ bool btrfs_repair_one_zone(struct btrfs_fs_info *fs_info, u64 logical)
return true;
}
- kthread_run(relocating_repair_kthread, cache,
- "btrfs-relocating-repair");
+ task = kthread_run(relocating_repair_kthread, cache, "btrfs-relocating-repair");
+ if (IS_ERR(task))
+ btrfs_put_block_group(cache);
return true;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0644/1257] btrfs: return -ENOTTY for unknown ioctls on the control device
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (642 preceding siblings ...)
2026-11-07 13:48 ` [PATCH 7.3 0643/1257] btrfs: zoned: fix block group reference leak in btrfs_repair_one_zone() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0645/1257] mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read() Greg Kroah-Hartman
` (354 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Hengyu Liang,
David Sterba, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengyu Liang <hengyul@cs.unc.edu>
[ Upstream commit 9985f1643ac3f8595862e2f82108f0ccae4cf959 ]
Commit 5ab2b180884c ("btrfs: factor out validation of
btrfs_ioctl_vol_args::name") made btrfs_control_ioctl() store the result
of btrfs_check_ioctl_vol_args_path() in ret before it looks at the
command.
However, ret is initialized to -ENOTTY and the switch has no default
case, so this initial value was what an unknown command returned. As of
now, every unknown ioctl on /dev/btrfs-control returns 0. A tool that
tries a control ioctl which the running kernel does not have is told
that the ioctl succeeded.
The issue can be reproduced with a simple C program, run as root:
#include <fcntl.h>
#include <stdio.h>
#include <sys/ioctl.h>
int main(void)
{
static char buf[4096];
int fd = open("/dev/btrfs-control", O_RDWR);
if (ioctl(fd, TCGETS, buf) < 0)
perror("ioctl");
else
printf("ioctl succeeded\n");
return 0;
}
Before commit 5ab2b180884c ("btrfs: factor out validation of
btrfs_ioctl_vol_args::name"), the result is:
ioctl: Inappropriate ioctl for device
After that commit, the result is:
ioctl succeeded
This patch will add a default case that returns -ENOTTY.
Fixes: 5ab2b180884c ("btrfs: factor out validation of btrfs_ioctl_vol_args::name")
CC: stable@vger.kernel.org
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/super.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index ddb620ac241b4..2c9b29aa59a2e 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -2305,6 +2305,9 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
case BTRFS_IOC_GET_SUPPORTED_FEATURES:
ret = btrfs_ioctl_get_supported_features((void __user*)arg);
break;
+ default:
+ ret = -ENOTTY;
+ break;
}
out:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0645/1257] mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (643 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0644/1257] btrfs: return -ENOTTY for unknown ioctls on the control device Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0646/1257] mtd: parsers: qcom: fix offset/size overflow on large partitions Greg Kroah-Hartman
` (353 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gabor Juhos, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <j4g8y7@gmail.com>
[ Upstream commit 94623942a66e031826756f9c92dbde9a12e2b4d2 ]
On QPIC v2 controllers, when the last codeword is being read, the read
location values must be programmed into the READ_LOCATION_LAST_CW_*
registers. Prior to commit 8c52932da5e6 ("mtd: rawnand: qcom: cleanup
qcom_nandc driver"), the config_nand_cw_read() function did it right,
but since then it always writes the read location values to the
READ_LOCATION_* registers even if the actual codeword is the last one.
Change the function to always configure the registers corresponding to
the actual codeword to restore the correct behaviour.
Cc: stable@vger.kernel.org
Fixes: 8c52932da5e6 ("mtd: rawnand: qcom: cleanup qcom_nandc driver")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/qcom_nandc.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
index d7642db2e2df1..170af9f26d471 100644
--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -328,14 +328,16 @@ config_nand_cw_read(struct nand_chip *chip, bool use_ecc, int cw)
{
struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
struct nand_ecc_ctrl *ecc = &chip->ecc;
-
__le32 *reg = &nandc->regs->read_location0;
+ int reg_base = NAND_READ_LOCATION_0;
- if (nandc->props->qpic_version2 && qcom_nandc_is_last_cw(ecc, cw))
+ if (nandc->props->qpic_version2 && qcom_nandc_is_last_cw(ecc, cw)) {
reg = &nandc->regs->read_location_last0;
+ reg_base = NAND_READ_LOCATION_LAST_CW_0;
+ }
if (nandc->props->supports_bam)
- qcom_write_reg_dma(nandc, reg, NAND_READ_LOCATION_0, 4, NAND_BAM_NEXT_SGL);
+ qcom_write_reg_dma(nandc, reg, reg_base, 4, NAND_BAM_NEXT_SGL);
qcom_write_reg_dma(nandc, &nandc->regs->cmd, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL);
qcom_write_reg_dma(nandc, &nandc->regs->exec, NAND_EXEC_CMD, 1, NAND_BAM_NEXT_SGL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0646/1257] mtd: parsers: qcom: fix offset/size overflow on large partitions
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (644 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0645/1257] mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0647/1257] xprtrdma: prevent disconnect feedback during endpoint teardown Greg Kroah-Hartman
` (352 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weigang He, Miquel Raynal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <geoffreyhe2@gmail.com>
[ Upstream commit 2f7fa8d90694d21dce68ceabd8383252b111cfea ]
In parse_qcomsmem_part() the partition offset and size are computed as
parts[j].offset = le32_to_cpu(pentry->offset) * mtd->erasesize;
parts[j].size = le32_to_cpu(pentry->length) * mtd->erasesize;
Both le32_to_cpu() and mtd->erasesize are 32-bit (u32). The multiply is
therefore evaluated in 32-bit arithmetic and the product is truncated to
32 bits before being widened and stored into the 64-bit (u64)
parts[j].offset / parts[j].size fields, so the 64-bit destinations are
never used at their full width.
The SMEM partition table is firmware-provided and the per-entry offset
and length are not bounds-checked against the device geometry (only
numparts is capped). On a sufficiently large flash, a partition whose
(offset|length) * erasesize is >= 2^32 gets a silently truncated
offset/size and is mapped to the wrong region of the master MTD, which
can overlap or extend into an unintended area.
Cast one operand to u64 so the multiplication is performed in 64-bit and
the result fits the 64-bit fields without truncation.
Found by static analysis tool CodeQL.
Fixes: 803eb124e1a6 ("mtd: parsers: Add Qcom SMEM parser")
Cc: stable@vger.kernel.org
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/parsers/qcomsmempart.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/parsers/qcomsmempart.c b/drivers/mtd/parsers/qcomsmempart.c
index d4fdc46a00730..1591aea48b280 100644
--- a/drivers/mtd/parsers/qcomsmempart.c
+++ b/drivers/mtd/parsers/qcomsmempart.c
@@ -143,9 +143,9 @@ static int parse_qcomsmem_part(struct mtd_info *mtd,
*c = tolower(*c);
parts[j].name = name;
- parts[j].offset = le32_to_cpu(pentry->offset) * mtd->erasesize;
+ parts[j].offset = (u64)le32_to_cpu(pentry->offset) * mtd->erasesize;
parts[j].mask_flags = pentry->attr;
- parts[j].size = le32_to_cpu(pentry->length) * mtd->erasesize;
+ parts[j].size = (u64)le32_to_cpu(pentry->length) * mtd->erasesize;
pr_debug("%d: %s offs=0x%08x size=0x%08x attr:0x%08x\n",
i, pentry->name, le32_to_cpu(pentry->offset),
le32_to_cpu(pentry->length), pentry->attr);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0647/1257] xprtrdma: prevent disconnect feedback during endpoint teardown
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (645 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0646/1257] mtd: parsers: qcom: fix offset/size overflow on large partitions Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0648/1257] xprtrdma: trim head iovec when the payload arrives via a Write chunk Greg Kroah-Hartman
` (351 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Menninger, Chuck Lever,
Anna Schumaker, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Menninger <tmenninger@everpuredata.com>
[ Upstream commit 0b5bb4e586f7b0a449f4d90a524f76a3be5db355 ]
xprt_autoclose() clears XPRT_CLOSE_WAIT before invoking the transport's
->close() operation. For RPC/RDMA, ->close() calls
rpcrdma_xprt_disconnect(), which disconnects the RDMA CM endpoint and
drains its QP.
Since commit 31e62d25b5b8 ("xprtrdma: Simplify RPC wake-ups on
connect"), RDMA_CM_EVENT_DISCONNECTED requests a SUNRPC transport
disconnect. Today that path, along with failed completion handling,
reaches xprt_force_disconnect() through rpcrdma_force_disconnect().
Commit c487eb7d8e41 ("xprtrdma: Clean up disconnect") later added
re_force_disconnect to ensure that multiple failure indications request
only one SUNRPC disconnect. However, the gate remains open when SUNRPC
itself begins endpoint teardown.
If re_force_disconnect is still clear, either a CM disconnect event or a
completion error can set XPRT_CLOSE_WAIT again while the current close
is in progress. When the transport send lock is subsequently released,
xprt_clear_locked() observes XPRT_CLOSE_WAIT and queues another
autoclose.
Requesting a disconnect this way is necessary when a connection is lost
unexpectedly, but not when the event was generated by
rpcrdma_xprt_disconnect() itself. In that case SUNRPC is already
committed to closing the transport.
Mark re_force_disconnect before initiating local endpoint teardown so
that CM events and completion errors caused by that teardown cannot
request another close. An unexpected error that wins the race before
local endpoint teardown begins can still request a disconnect normally.
Use a fully ordered exchange so that the gate is globally closed before
rdma_disconnect() can transition the QP to error and generate the
callbacks that the gate suppresses.
In 30-second traces of a sustained recovery loop, without this change
there were 7,693 xprt_force_disconnect() calls, 6,267 SUNRPC autocloses,
and 172,892 receive-side IB_WC_WR_FLUSH_ERR completions. With this
change, the same tracepoints recorded 3,512 xprt_force_disconnect()
calls, 3,212 autocloses, and 131,287 receive-side flush completions.
Thus QP teardown continues to produce flushed completions, but closing
the disconnect gate before teardown substantially reduces their
feedback into the SUNRPC close path.
Fixes: 31e62d25b5b8 ("xprtrdma: Simplify RPC wake-ups on connect")
Cc: stable@vger.kernel.org
Signed-off-by: Tim Menninger <tmenninger@everpuredata.com>
Reviewed-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/verbs.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index be335eed329d1..54957295a6310 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -114,9 +114,9 @@ static void rpcrdma_xprt_drain(struct rpcrdma_xprt *r_xprt)
rpcrdma_ep_put(ep);
}
-/* Ensure xprt_force_disconnect() is invoked exactly once when a
- * connection is closed or lost. (The important thing is it needs
- * to be invoked "at least" once).
+/* Ensure xprt_force_disconnect() is invoked at most once for an
+ * unexpected endpoint failure. Local endpoint teardown closes this
+ * gate before it can generate CM events and flushed completions.
*/
void rpcrdma_force_disconnect(struct rpcrdma_ep *ep)
{
@@ -587,6 +587,9 @@ void rpcrdma_xprt_disconnect(struct rpcrdma_xprt *r_xprt)
if (!ep)
return;
+ /* Prevent teardown-generated events from requesting another close. */
+ atomic_xchg(&ep->re_force_disconnect, 1);
+
id = ep->re_id;
rc = rdma_disconnect(id);
trace_xprtrdma_disconnect(r_xprt, rc);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0648/1257] xprtrdma: trim head iovec when the payload arrives via a Write chunk
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (646 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0647/1257] xprtrdma: prevent disconnect feedback during endpoint teardown Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0649/1257] PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream ports Greg Kroah-Hartman
` (350 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yongjian Mu, Chuck Lever,
Tim Menninger, Anna Schumaker, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongjian Mu <ymu@everpuredata.com>
[ Upstream commit 9ee534a75912361308b1f956bc3e7895a082a422 ]
The upper layer sets rq_rcv_buf.head[0].iov_len from its estimate of the
reply header size. For RPCSEC_GSS that estimate includes
auth->au_ralign, which gss_create_new() initializes to GSS_VERF_SLACK >>
2 (25 XDR words, or 100 bytes) and which is corrected to the real
verifier size only after the first reply on that rpc_auth has been
unwrapped. In this case, the krb5 MIC verifier is 36 bytes, so every
request encoded before the first reply completes has a head that is 64
bytes too long.
On TCP this is harmless: xdr_realign_pages() moves the excess head
bytes, which are genuine reply data, into the page list. With
RPC-over-RDMA and a Write chunk (sec=krb5, i.e. RPC_GSS_SVC_NONE, where
DDP is allowed), the payload has already been placed directly into the
page list, and the receive buffer holds only the inline part of the
reply. rpcrdma_inline_fixup() clamps its local copy of the head length
to the inline length but leaves head.iov_len untouched, so
xdr_realign_pages() still sees iov_len > cur and shifts whatever lies
past the inline reply in the receive buffer into the front of the
directly-placed payload:
rpc_xdr_recvfrom: head=[...,196] page=524288 tail=[...,64]
rpc_xdr_alignment: nfsv4 READ offset=132 copied=64
The first 64 bytes returned by each such READ are incorrect (zeroed, or
shifted right by 64 bytes depending on the kernel's xdr_shrink_bufhead()
implementation). This is readily hit with pNFS flexfiles over RDMA and
sec=krb5: the per-DS rpc_clnt gets a fresh rpc_auth whose first RPC is a
large READ. Reads following the first completed reply return the
expected data.
Commit cb0ae1fbb2f5 ("xprtrdma: Do not update {head, tail}.iov_len in
rpcrdma_inline_fixup()") removed the head-length correction while fixing
the handling of pure-inline krb5p replies.
When a Write chunk conveyed the payload, trim head.iov_len (in both
rq_rcv_buf and rq_private_buf, which call_decode() expects to match) to
the inline length actually received so that the XDR layer does not
realign the page list. These READ replies have no trailing inline
fields, and the payload is already in the page list, so the upper
layer's head estimate can be safely reduced. Reduce buflen by the same
amount to avoid treating unused head capacity as additional tail
capacity. Pure inline replies and Reply chunk replies are unchanged.
Tested on Linux 6.8.0 and 7.3-rc4 with NFSv4.1 pNFS flexfiles over
RPC/RDMA and sec=krb5.
Fixes: cb0ae1fbb2f5 ("xprtrdma: Do not update {head, tail}.iov_len in rpcrdma_inline_fixup()")
Cc: stable@vger.kernel.org
Signed-off-by: Yongjian Mu <ymu@everpuredata.com>
Reviewed-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Tim Menninger <tmenninger@everpuredata.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/rpc_rdma.c | 27 +++++++++++++++++++++++----
1 file changed, 23 insertions(+), 4 deletions(-)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 1285f04cdac14..7e5713367291e 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -984,12 +984,16 @@ void rpcrdma_reset_cwnd(struct rpcrdma_xprt *r_xprt)
* @rqst: controlling RPC request
* @srcp: points to RPC message payload in receive buffer
* @copy_len: remaining length of receive buffer content
- * @pad: Write chunk pad bytes needed (zero for pure inline)
+ * @writelist: bytes conveyed by the Write chunk (zero for pure inline)
*
* The upper layer has set the maximum number of bytes it can
* receive in each component of rq_rcv_buf. These values are set in
* the head.iov_len, page_len, tail.iov_len, and buflen fields.
*
+ * For READ replies with a Write chunk, the payload is already in
+ * the page list. An overestimated head length and buflen can be
+ * reduced without moving reply data.
+ *
* Unlike the TCP equivalent (xdr_partial_copy_from_skb), in
* many cases this function simply updates iov_base pointers in
* rq_rcv_buf to point directly to the received reply data, to
@@ -998,13 +1002,16 @@ void rpcrdma_reset_cwnd(struct rpcrdma_xprt *r_xprt)
* Returns the count of bytes which had to be memcopied.
*/
static unsigned long
-rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
+rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len,
+ u32 writelist)
{
unsigned long fixup_copy_count;
int i, npages, curlen;
char *destp;
struct page **ppages;
int page_base;
+ int pad = writelist & 3;
+ unsigned int delta;
/* The head iovec is redirected to the RPC reply message
* in the receive buffer, to avoid a memcopy.
@@ -1016,8 +1023,20 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
* head.iov_len bytes are copied into the page list.
*/
curlen = rqst->rq_rcv_buf.head[0].iov_len;
- if (curlen > copy_len)
+ if (curlen > copy_len) {
+ /* These READ replies have no inline fields after the payload.
+ * Trim the head without moving the directly-placed data.
+ */
+ if (writelist) {
+ delta = curlen - copy_len;
+
+ rqst->rq_rcv_buf.head[0].iov_len = copy_len;
+ rqst->rq_private_buf.head[0].iov_len = copy_len;
+ rqst->rq_rcv_buf.buflen -= delta;
+ rqst->rq_private_buf.buflen -= delta;
+ }
curlen = copy_len;
+ }
srcp += curlen;
copy_len -= curlen;
@@ -1245,7 +1264,7 @@ rpcrdma_decode_msg(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep,
base = (char *)xdr_inline_decode(xdr, 0);
rpclen = xdr_stream_remaining(xdr);
r_xprt->rx_stats.fixup_copy_count +=
- rpcrdma_inline_fixup(rqst, base, rpclen, writelist & 3);
+ rpcrdma_inline_fixup(rqst, base, rpclen, writelist);
r_xprt->rx_stats.total_rdma_reply += writelist;
return rpclen + xdr_align_size(writelist);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0649/1257] PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream ports
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (647 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0648/1257] xprtrdma: trim head iovec when the payload arrives via a Write chunk Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0650/1257] PCI: vmd: Flush DMA writes before handling MSI on Meteor Lake Greg Kroah-Hartman
` (349 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Imre Kaloz, Bjorn Helgaas,
Magnus Lindholm, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Kaloz <kaloz@kernel.org>
[ Upstream commit 8e923e51892c7da91687dd5b8081ddb1f0fb395a ]
Runtime PM suspends an idle downstream port of a PLX/Broadcom PEX
8532/8533/8548 switch to D3hot, but that takes the whole switch down
with it: any device behind another port of the same switch then
faults with a fatal bus error on its next access, e.g. mptsas probe
on a Sun Ultra 45.
This surfaced on sparc64 once commit a5fb3ff63287 ("PCI: Allow PCI
bridges to go to D3Hot on all non-x86") let bridges enter D3hot. Keep
these downstream ports out of D3 by setting PCI_DEV_FLAGS_NO_D3.
Fixes: a5fb3ff63287 ("PCI: Allow PCI bridges to go to D3Hot on all non-x86")
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260927105609.8813-1-kaloz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index edf035d251cc2..d4fcc336bc2a9 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2387,6 +2387,24 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9050,
DECLARE_PCI_FIXUP_HEADER(0x1402, 0x2000, quirk_plx_pci9050);
DECLARE_PCI_FIXUP_HEADER(0x1402, 0x2600, quirk_plx_pci9050);
+/*
+ * An idle downstream port of a PLX/Broadcom PEX 8532/8533/8548 switch
+ * autosuspends into D3hot, and that takes the whole switch down with
+ * it -- any device behind another port of the same switch then sees a
+ * fatal, non-recoverable bus fault on its next access. Keep these
+ * ports out of D3 entirely.
+ */
+static void quirk_plx_pex_no_d3(struct pci_dev *dev)
+{
+ if (pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM) {
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_D3;
+ pci_info(dev, "avoiding D3 on this downstream port\n");
+ }
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PLX, 0x8532, quirk_plx_pex_no_d3);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PLX, 0x8533, quirk_plx_pex_no_d3);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PLX, 0x8548, quirk_plx_pex_no_d3);
+
static void quirk_netmos(struct pci_dev *dev)
{
unsigned int num_parallel = (dev->subsystem_device & 0xf0) >> 4;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0650/1257] PCI: vmd: Flush DMA writes before handling MSI on Meteor Lake
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (648 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0649/1257] PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream ports Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0651/1257] PCI: vmd: Flush DMA writes before handling MSI on Arrow Lake Greg Kroah-Hartman
` (348 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kai-Heng Feng, Keith Busch,
Rickey Bartlett, Manivannan Sadhasivam, Bjorn Helgaas,
Varsh Satti, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rickey Bartlett <subtexel@gmail.com>
[ Upstream commit 7307899e381cb0c16245793a4adde7491d73a2b3 ]
Per the Intel Core Ultra Processor Specification Update
(ID 792254 of 9/1/2026), the Meteor Lake VMD (8086:7d0b) is affected by an
MSI erratum:
MTL016: MSI from VMD-Owned Device May Pass Memory Write
Problem When the storage subsystem is configured to operate in RAID
0 or 1 mode, a Message Signaled Interrupt (MSI) from an
Intel® Volume Management Device (Intel® VMD) owned device
may interrupt a core before a previous write from the device
is completed.
Workaround None identified. The VMD MSI interrupt-handler should
initially perform a dummy register read to the MSI initiator
device prior to any writes to ensure proper PCIe ordering.
The VMD can signal its MSI before the posted writes carrying a child
device's DMA data have landed in memory. vmd_irq() then demuxes to the
child handler while the child's completion queue is not yet coherent, so
the handler observes no completion and returns without consuming it. The
I/O is only recovered when the block layer timeout expires and polls the
queue:
nvme nvme0: I/O tag 253 (50fd) QID 1 timeout, completion polled
The practical effect is therefore not a lost I/O but a 30 second stall
of the entire storage stack, repeated under any sustained read load.
This was originally diagnosed and fixed by Kai-Heng Feng in September
2024 [1]. That patch used udelay(4); Keith Busch objected that the delay
is merely a side effect of the read, and that flushing the pending
device-to-host writes is what the erratum actually requires. Kai-Heng
agreed to respin with a dummy register read. The thread then stalled on
an open question from Manivannan Sadhasivam [2]: whether the read must
target the child device (the "MSI initiator" named by the erratum)
rather than the VMD, and whether the workaround belongs in the NVMe
driver instead. No revision followed, and the erratum has remained
unmitigated in mainline since.
This implements the flush read Keith asked for, and answers the open
question empirically: the read MUST complete at the initiating child
device. A read of the VMD's own config BAR was tried first and does not
help - it terminates at the VMD and never traverses the downstream
link, so it does not order against the child's posted writes (measured:
timeout rate unchanged). Reading the initiator's config space does
order correctly: per PCIe ordering rules the read completion cannot
pass the device's earlier posted writes, so returning from the read
guarantees the completion queue entry is visible.
The initiator's config address is captured per-IRQ at MSI allocation
time from the requesting device, so the hot path adds one config read
only on affected parts, and only for vectors owned by a child device.
The read is serialized with cfg_lock like all other VMD config access.
No NVMe driver change is needed.
Measured on a Dell Pro Max 14 MC14250 (Meteor Lake, VMD 8086:7d0b,
KIOXIA BG6 512GB, 7.0.0-30-generic). The drive is healthy (46C, 0 media
errors, 2% used) and ASPM is disabled on the link with all L1 substates
off, so neither ASPM nor APST is involved.
Dropping caches and reading 3000 shared libraries, measuring
/proc/pressure/io "full" (every task on the system blocked on I/O),
with nvme_core.io_timeout=5:
unpatched: round 1 wall 37.4s full I/O stall 32.6s timeouts 0
round 2 wall 30.6s full I/O stall 28.7s timeouts 1
round 3 wall 30.3s full I/O stall 27.4s timeouts 1
VMD-BAR read: round 1 wall 44.8s full I/O stall 38.6s timeouts 8
(insufficient) round 2 wall 234.8s full I/O stall 207.9s timeouts 37
round 3 wall 3.6s full I/O stall 0.8s timeouts 0
this patch: round 1 wall 3.6s full I/O stall 1.3s timeouts 0
round 2 wall 3.6s full I/O stall 1.3s timeouts 0
round 3 wall 3.6s full I/O stall 1.4s timeouts 0
Before any workaround, 208 seconds of total-system I/O stall
accumulated in the first 13 minutes of uptime, roughly 27% of wall
clock. Userspace experiences this as GUI applications taking 30-60+
seconds to start while throughput between stalls looks entirely normal
(1.9 GB/s QD1) - which is what makes the fault easy to misattribute to
ASPM or to the drive.
[1] https://lore.kernel.org/20240903025544.286223-1-kai.heng.feng@canonical.com/
[2] https://lore.kernel.org/20240913111142.4cgrmirofhhgrbqm@thinkpad/
Reported-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Suggested-by: Keith Busch <kbusch@kernel.org>
Assisted-by: LLM
Signed-off-by: Rickey Bartlett <subtexel@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[bhelgaas: include erratum source and text, update URLs, cc: stable]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Varsh Satti <varsh@varram.me>
Acked-by: Keith Busch <kbusch@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260825043220.9047-1-subtexel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/vmd.c | 52 ++++++++++++++++++++++++++++++++++--
1 file changed, 50 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
index 241023ecf6774..e45ef8cb16e47 100644
--- a/drivers/pci/controller/vmd.c
+++ b/drivers/pci/controller/vmd.c
@@ -92,6 +92,22 @@ enum vmd_features {
* referred to as MEMBAR2 or MSI-X BAR.
*/
VMD_FEAT_USE_BIOS_INFO = (1 << 6),
+
+ /*
+ * Meteor Lake VMD (device ID 0x7d0b) is affected by erratum MTL016:
+ * the VMD may signal its MSI before the posted writes that carry the
+ * child device's DMA data have landed in memory. The demuxed handler
+ * then runs against a not-yet-coherent completion queue and misses the
+ * completion entirely, so the I/O is only recovered when the block
+ * layer timeout fires and polls the queue ("timeout, completion
+ * polled"). Intel's documented workaround is to issue a dummy read
+ * to the MSI initiator (the child device) before handling the
+ * interrupt: the read completion cannot pass the device's earlier
+ * posted writes, so it pulls them into memory per PCIe ordering
+ * rules. A read that terminates at the VMD itself does not order
+ * against the child's writes and is not sufficient (measured).
+ */
+ VMD_FEAT_INTERRUPT_QUIRK = (1 << 7),
};
#define VMD_BIOS_PM_QUIRK_LTR 0x1003 /* 3145728 ns */
@@ -114,6 +130,9 @@ static DEFINE_RAW_SPINLOCK(list_lock);
* @irq: back pointer to parent.
* @enabled: true if driver enabled IRQ
* @virq: the virtual IRQ value provided to the requesting driver.
+ * @flush_addr: config space address of the initiating device, read before
+ * demuxing to flush its posted writes (MTL016); NULL if the
+ * VMD is not affected.
*
* Every MSI/MSI-X IRQ requested for a device in a VMD domain will be mapped to
* a VMD IRQ using this structure.
@@ -123,8 +142,14 @@ struct vmd_irq {
struct vmd_irq_list *irq;
bool enabled;
unsigned int virq;
+ void __iomem *flush_addr;
};
+struct vmd_dev;
+
+static void __iomem *vmd_cfg_addr(struct vmd_dev *vmd, struct pci_bus *bus,
+ unsigned int devfn, int reg, int len);
+
/**
* struct vmd_irq_list - list of driver requested IRQs mapping to a VMD vector
* @irq_list: the list of irq's the VMD one demuxes to.
@@ -132,12 +157,15 @@ struct vmd_irq {
* @count: number of child IRQs assigned to this vector; used to track
* sharing.
* @virq: The underlying VMD Linux interrupt number
+ * @vmd: back pointer to the owning VMD device; serializes the MTL016
+ * flush read against other config space access.
*/
struct vmd_irq_list {
struct list_head irq_list;
struct srcu_struct srcu;
unsigned int count;
unsigned int virq;
+ struct vmd_dev *vmd;
};
struct vmd_dev {
@@ -295,6 +323,13 @@ static int vmd_msi_alloc(struct irq_domain *domain, unsigned int virq,
INIT_LIST_HEAD(&vmdirq->node);
vmdirq->irq = vmd_next_irq(vmd, desc);
vmdirq->virq = virq + i;
+ if (vmd->features & VMD_FEAT_INTERRUPT_QUIRK) {
+ struct pci_dev *pdev = msi_desc_to_pci_dev(desc);
+
+ vmdirq->flush_addr = vmd_cfg_addr(vmd, pdev->bus,
+ pdev->devfn,
+ PCI_VENDOR_ID, 2);
+ }
irq_domain_set_info(domain, virq + i, vmdirq->irq->virq,
&vmd_msi_controller, vmdirq,
@@ -756,8 +791,20 @@ static irqreturn_t vmd_irq(int irq, void *data)
int idx;
idx = srcu_read_lock(&irqs->srcu);
- list_for_each_entry_rcu(vmdirq, &irqs->irq_list, node)
+ list_for_each_entry_rcu(vmdirq, &irqs->irq_list, node) {
+ /*
+ * MTL016: the MSI may have outrun the initiating device's
+ * posted writes (e.g. its NVMe completion entry). A read
+ * that completes at the initiator flushes them, so the
+ * demuxed handler observes a coherent completion queue.
+ * The value is discarded; only the ordering matters.
+ */
+ if (vmdirq->flush_addr) {
+ guard(raw_spinlock)(&irqs->vmd->cfg_lock);
+ readw(vmdirq->flush_addr);
+ }
generic_handle_irq(vmdirq->virq);
+ }
srcu_read_unlock(&irqs->srcu, idx);
return IRQ_HANDLED;
@@ -788,6 +835,7 @@ static int vmd_alloc_irqs(struct vmd_dev *vmd)
return err;
INIT_LIST_HEAD(&vmd->irqs[i].irq_list);
+ vmd->irqs[i].vmd = vmd;
vmd->irqs[i].virq = pci_irq_vector(dev, i);
err = devm_request_irq(&dev->dev, vmd->irqs[i].virq,
vmd_irq, IRQF_NO_THREAD,
@@ -1250,7 +1298,7 @@ static const struct pci_device_id vmd_ids[] = {
{PCI_VDEVICE(INTEL, 0xa77f),
.driver_data = VMD_FEATS_CLIENT,},
{PCI_VDEVICE(INTEL, 0x7d0b),
- .driver_data = VMD_FEATS_CLIENT,},
+ .driver_data = VMD_FEATS_CLIENT | VMD_FEAT_INTERRUPT_QUIRK,},
{PCI_VDEVICE(INTEL, 0xad0b),
.driver_data = VMD_FEATS_CLIENT,},
{PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_VMD_9A0B),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0651/1257] PCI: vmd: Flush DMA writes before handling MSI on Arrow Lake
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (649 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0650/1257] PCI: vmd: Flush DMA writes before handling MSI on Meteor Lake Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0652/1257] mm/damon/sysfs-schemes: read sysfs_filter->addr_range only once Greg Kroah-Hartman
` (347 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Nedoshivin, Bjorn Helgaas,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Nedoshivin <gvozd188@mail.ru>
[ Upstream commit 2c88c2dc18528489b403fe95741f5731e292f7ba ]
Per the Intel Core Ultra Processors (Series 2) Specification Update
(ID 834774 of 9/1/2026), the Arrow Lake VMD device 0xad0b is affected by an
MSI erratum:
ARL004: MSI from VMD-Owned Device May Pass Memory Write
Problem When the storage subsystem is configured to operate in RAID
0 or 1 mode, a Message Signaled Interrupt (MSI) from an
Intel® Volume Management Device (Intel® VMD) owned device
may interrupt a core before a previous write from the device
is completed.
Workaround None identified. The VMD MSI interrupt-handler should
initially perform a dummy register read to the MSI initiator
device prior to any writes to ensure proper PCIe ordering.
The existing VMD_FEAT_INTERRUPT_QUIRK implements Intel's documented
workaround by issuing a configuration-space read to the MSI initiator
before dispatching the interrupt.
Enable the existing quirk for 0xad0b as well as 0x7d0b and make the
comments describe both MTL016 and ARL004.
Tested on an MSI Vector 17 HX AI with Intel VMD 8086:ad0b and an NVMe
device behind VMD. With the quirk enabled, the NVMe completion stalls
observed without the workaround are no longer reproduced.
Link: https://bugs.launchpad.net/bugs/2166325
Signed-off-by: Vladimir Nedoshivin <gvozd188@mail.ru>
[bhelgaas: include erratum source and text, cc: stable]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260910200539.10862-1-gvozd188@mail.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/vmd.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
index e45ef8cb16e47..9d97a832785ee 100644
--- a/drivers/pci/controller/vmd.c
+++ b/drivers/pci/controller/vmd.c
@@ -94,7 +94,8 @@ enum vmd_features {
VMD_FEAT_USE_BIOS_INFO = (1 << 6),
/*
- * Meteor Lake VMD (device ID 0x7d0b) is affected by erratum MTL016:
+ * Some Intel VMD devices are affected by interrupt ordering errata,
+ * including MTL016 (0x7d0b) and ARL004 (0xad0b):
* the VMD may signal its MSI before the posted writes that carry the
* child device's DMA data have landed in memory. The demuxed handler
* then runs against a not-yet-coherent completion queue and misses the
@@ -131,7 +132,7 @@ static DEFINE_RAW_SPINLOCK(list_lock);
* @enabled: true if driver enabled IRQ
* @virq: the virtual IRQ value provided to the requesting driver.
* @flush_addr: config space address of the initiating device, read before
- * demuxing to flush its posted writes (MTL016); NULL if the
+ * demuxing to flush its posted writes; NULL if the
* VMD is not affected.
*
* Every MSI/MSI-X IRQ requested for a device in a VMD domain will be mapped to
@@ -1300,7 +1301,7 @@ static const struct pci_device_id vmd_ids[] = {
{PCI_VDEVICE(INTEL, 0x7d0b),
.driver_data = VMD_FEATS_CLIENT | VMD_FEAT_INTERRUPT_QUIRK,},
{PCI_VDEVICE(INTEL, 0xad0b),
- .driver_data = VMD_FEATS_CLIENT,},
+ .driver_data = VMD_FEATS_CLIENT | VMD_FEAT_INTERRUPT_QUIRK,},
{PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_VMD_9A0B),
.driver_data = VMD_FEATS_CLIENT,},
{PCI_VDEVICE(INTEL, 0xb60b),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0652/1257] mm/damon/sysfs-schemes: read sysfs_filter->addr_range only once
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (650 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0651/1257] PCI: vmd: Flush DMA writes before handling MSI on Arrow Lake Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0653/1257] mm/damon/core: return an error from damos_commit_filter_arg() Greg Kroah-Hartman
` (346 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton,
Brendan Higgins, David Gow, Usama Arif, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 60e58be27d5e16d35e0728298f994dcae9f208a5 ]
Patch series "mm/damon: move damos filter range arguments validation to
core".
DAMOS filter range arguments are being validated in the DAMON sysfs
interface. Some of those have minor time-of-check to time-of-use (TOCTOU)
bugs. In future, other callers might have duplicated validations with
similar bugs.
Fix the bugs and further refactor the code to move the validation to the
core layer. Also add kunit test cases for the validations.
Patches 1 and 2 fix the existing TOCTOU bugs. Patches 3 and 4 adds the
validation in the core layer. Patch 5 drops the replicated validation in
DAMON sysfs interface. Patch 6 further cleanup the code. Patches 7 and 8
extends kunit tests to test the validation.
This patch (of 8):
DAMON sysfs interface reads the user-provided address range arguments for
addr type DAMOS filter twice. Once for validation, and once again for
assignments to the variable that will be passed to the core layer. If the
user updates the argument in parallel, an invalid address range could be
passed to the core layer. Avoid it by doing the assignments first, and
then validating the assigned variables before passing those to the core
layer.
User impact of the bug should be trivial. From the core layer's
perspective, the invalid address range is not really invalid. It just
works as having a weird address range. No critical issues such as a crash
or a leak could happen. And sane users ain't do such parallel arguments
update anyway. If they do, such racy behavior is arguably somewhat
expected and deserved. That said, there is no reason to keep such races.
Link: https://lore.kernel.org/20260914142327.92510-1-sj@kernel.org
Link: https://lore.kernel.org/20260914142327.92510-2-sj@kernel.org
Fixes: 2f1abcfccd86 ("mm/damon/sysfs-schemes: support address range type DAMOS filter")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/sysfs-schemes.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
index 32f495a96b17a..974c456a9e099 100644
--- a/mm/damon/sysfs-schemes.c
+++ b/mm/damon/sysfs-schemes.c
@@ -2822,12 +2822,12 @@ static int damon_sysfs_add_scheme_filters(struct damos *scheme,
return err;
}
} else if (filter->type == DAMOS_FILTER_TYPE_ADDR) {
- if (sysfs_filter->addr_range.end <
- sysfs_filter->addr_range.start) {
+ filter->addr_range = sysfs_filter->addr_range;
+ if (filter->addr_range.end <
+ filter->addr_range.start) {
damos_destroy_filter(filter);
return -EINVAL;
}
- filter->addr_range = sysfs_filter->addr_range;
} else if (filter->type == DAMOS_FILTER_TYPE_TARGET) {
filter->target_idx = sysfs_filter->target_idx;
} else if (filter->type == DAMOS_FILTER_TYPE_HUGEPAGE_SIZE) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0653/1257] mm/damon/core: return an error from damos_commit_filter_arg()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (651 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0652/1257] mm/damon/sysfs-schemes: read sysfs_filter->addr_range only once Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0654/1257] mm/damon/core-kunit: extend damos_commit_filter_for() for wrong input Greg Kroah-Hartman
` (345 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Kunwu Chan,
Brendan Higgins, David Gow, Usama Arif, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 6f276422aded370174edea69549ebe6b1683ffcc ]
damos_commit_filter_arg() is supposed to always succeed. It may not in
future, for example, if the given filter is invalid. Prepare the case by
modifying its signature to return an error when it failed. Also pipe the
return value to its callers and let them handle the error.
Link: https://lore.kernel.org/20260914142327.92510-4-sj@kernel.org
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Kunwu Chan <kunwu.chan@gmail.com>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 41 ++++++++++++++++++++++++++++-------------
1 file changed, 28 insertions(+), 13 deletions(-)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index 0a0fdff279d86..a4542a49ff80a 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -1244,7 +1244,7 @@ static struct damos_filter *damos_nth_ops_filter(int n, struct damos *s)
return NULL;
}
-static void damos_commit_filter_arg(
+static int damos_commit_filter_arg(
struct damos_filter *dst, struct damos_filter *src)
{
switch (dst->type) {
@@ -1263,28 +1263,32 @@ static void damos_commit_filter_arg(
default:
break;
}
+ return 0;
}
-static void damos_commit_filter(
+static int damos_commit_filter(
struct damos_filter *dst, struct damos_filter *src)
{
dst->type = src->type;
dst->matching = src->matching;
dst->allow = src->allow;
- damos_commit_filter_arg(dst, src);
+ return damos_commit_filter_arg(dst, src);
}
static int damos_commit_core_filters(struct damos *dst, struct damos *src)
{
struct damos_filter *dst_filter, *next, *src_filter, *new_filter;
- int i = 0, j = 0;
+ int i = 0, j = 0, err;
damos_for_each_core_filter_safe(dst_filter, next, dst) {
src_filter = damos_nth_core_filter(i++, src);
- if (src_filter)
- damos_commit_filter(dst_filter, src_filter);
- else
+ if (src_filter) {
+ err = damos_commit_filter(dst_filter, src_filter);
+ if (err)
+ return err;
+ } else {
damos_destroy_filter(dst_filter);
+ }
}
damos_for_each_core_filter_safe(src_filter, next, src) {
@@ -1296,7 +1300,11 @@ static int damos_commit_core_filters(struct damos *dst, struct damos *src)
src_filter->allow);
if (!new_filter)
return -ENOMEM;
- damos_commit_filter_arg(new_filter, src_filter);
+ err = damos_commit_filter_arg(new_filter, src_filter);
+ if (err) {
+ damos_destroy_filter(new_filter);
+ return err;
+ }
damos_add_filter(dst, new_filter);
}
return 0;
@@ -1305,14 +1313,17 @@ static int damos_commit_core_filters(struct damos *dst, struct damos *src)
static int damos_commit_ops_filters(struct damos *dst, struct damos *src)
{
struct damos_filter *dst_filter, *next, *src_filter, *new_filter;
- int i = 0, j = 0;
+ int i = 0, j = 0, err;
damos_for_each_ops_filter_safe(dst_filter, next, dst) {
src_filter = damos_nth_ops_filter(i++, src);
- if (src_filter)
- damos_commit_filter(dst_filter, src_filter);
- else
+ if (src_filter) {
+ err = damos_commit_filter(dst_filter, src_filter);
+ if (err)
+ return err;
+ } else {
damos_destroy_filter(dst_filter);
+ }
}
damos_for_each_ops_filter_safe(src_filter, next, src) {
@@ -1324,7 +1335,11 @@ static int damos_commit_ops_filters(struct damos *dst, struct damos *src)
src_filter->allow);
if (!new_filter)
return -ENOMEM;
- damos_commit_filter_arg(new_filter, src_filter);
+ err = damos_commit_filter_arg(new_filter, src_filter);
+ if (err) {
+ damos_destroy_filter(new_filter);
+ return err;
+ }
damos_add_filter(dst, new_filter);
}
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0654/1257] mm/damon/core-kunit: extend damos_commit_filter_for() for wrong input
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (652 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0653/1257] mm/damon/core: return an error from damos_commit_filter_arg() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0655/1257] mm/damon/core-kunit: test invalid damos filter commits Greg Kroah-Hartman
` (344 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton,
Brendan Higgins, David Gow, Usama Arif, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit a1c7fdaf165755fff928a6c25b69d7e0966b6910 ]
damos_commit_filter_for() supposes damos_commit_filter() to always succeed
with given inputs. damos_commit_filter() could return an error for
invalid inputs. Existing callers always pass only valid inputs, but they
may pass invalid inputs in future, for test purposes. Extend the function
to be able to be used for wrong inputs-caused error testing.
Link: https://lore.kernel.org/20260914142327.92510-8-sj@kernel.org
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/tests/core-kunit.h | 24 +++++++++++++++---------
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index 65443aba03300..0d09a081cd84a 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -1062,9 +1062,15 @@ static void damos_test_commit_dests(struct kunit *test)
}
static void damos_test_commit_filter_for(struct kunit *test,
- struct damos_filter *dst, struct damos_filter *src)
+ struct damos_filter *dst, struct damos_filter *src,
+ bool expect_fail)
{
- damos_commit_filter(dst, src);
+ int err;
+
+ err = damos_commit_filter(dst, src);
+ KUNIT_EXPECT_EQ(test, err != 0, expect_fail);
+ if (expect_fail)
+ return;
KUNIT_EXPECT_EQ(test, dst->type, src->type);
KUNIT_EXPECT_EQ(test, dst->matching, src->matching);
KUNIT_EXPECT_EQ(test, dst->allow, src->allow);
@@ -1103,47 +1109,47 @@ static void damos_test_commit_filter(struct kunit *test)
.type = DAMOS_FILTER_TYPE_ANON,
.matching = true,
.allow = true,
- });
+ }, false);
damos_test_commit_filter_for(test, &dst,
&(struct damos_filter){
.type = DAMOS_FILTER_TYPE_MEMCG,
.matching = false,
.allow = false,
.memcg_id = 123,
- });
+ }, false);
damos_test_commit_filter_for(test, &dst,
&(struct damos_filter){
.type = DAMOS_FILTER_TYPE_YOUNG,
.matching = true,
.allow = true,
- });
+ }, false);
damos_test_commit_filter_for(test, &dst,
&(struct damos_filter){
.type = DAMOS_FILTER_TYPE_HUGEPAGE_SIZE,
.matching = false,
.allow = false,
.sz_range = {.min = 234, .max = 345},
- });
+ }, false);
damos_test_commit_filter_for(test, &dst,
&(struct damos_filter){
.type = DAMOS_FILTER_TYPE_UNMAPPED,
.matching = true,
.allow = true,
- });
+ }, false);
damos_test_commit_filter_for(test, &dst,
&(struct damos_filter){
.type = DAMOS_FILTER_TYPE_ADDR,
.matching = false,
.allow = false,
.addr_range = {.start = 456, .end = 567},
- });
+ }, false);
damos_test_commit_filter_for(test, &dst,
&(struct damos_filter){
.type = DAMOS_FILTER_TYPE_TARGET,
.matching = true,
.allow = true,
.target_idx = 6,
- });
+ }, false);
}
static void damos_test_help_initailize_scheme(struct damos *scheme)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0655/1257] mm/damon/core-kunit: test invalid damos filter commits
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (653 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0654/1257] mm/damon/core-kunit: extend damos_commit_filter_for() for wrong input Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0656/1257] proc/task_mmu: handle special PMDs in clear_refs and pagemap Greg Kroah-Hartman
` (343 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton,
Brendan Higgins, David Gow, Usama Arif, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 409d2ab6d98209c30d45123920721710475a30b4 ]
Add test cases for testing the validation of damos filter arguments in
commit time.
Link: https://lore.kernel.org/20260914142327.92510-9-sj@kernel.org
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/tests/core-kunit.h | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index 0d09a081cd84a..062332fe847ce 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -1130,6 +1130,13 @@ static void damos_test_commit_filter(struct kunit *test)
.allow = false,
.sz_range = {.min = 234, .max = 345},
}, false);
+ damos_test_commit_filter_for(test, &dst,
+ &(struct damos_filter){
+ .type = DAMOS_FILTER_TYPE_HUGEPAGE_SIZE,
+ .matching = false,
+ .allow = false,
+ .sz_range = {.min = 456, .max = 123},
+ }, true);
damos_test_commit_filter_for(test, &dst,
&(struct damos_filter){
.type = DAMOS_FILTER_TYPE_UNMAPPED,
@@ -1143,6 +1150,13 @@ static void damos_test_commit_filter(struct kunit *test)
.allow = false,
.addr_range = {.start = 456, .end = 567},
}, false);
+ damos_test_commit_filter_for(test, &dst,
+ &(struct damos_filter){
+ .type = DAMOS_FILTER_TYPE_ADDR,
+ .matching = false,
+ .allow = false,
+ .addr_range = {.start = 567, .end = 456},
+ }, true);
damos_test_commit_filter_for(test, &dst,
&(struct damos_filter){
.type = DAMOS_FILTER_TYPE_TARGET,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0656/1257] proc/task_mmu: handle special PMDs in clear_refs and pagemap
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (654 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0655/1257] mm/damon/core-kunit: test invalid damos filter commits Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0657/1257] mm/madvise: reclaim isolated folios if PTE restart fails Greg Kroah-Hartman
` (342 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price, Andrew Morton,
sashiko-bot, David Hildenbrand (Arm), Jann Horn, Jason Gunthorpe,
Liam R. Howlett, Lorenzo Stoakes, Pedro Falcato, Peter Xu,
Vlastimil Babka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit d350956d829f4b620faf294c86116de640f1518c ]
mshv_vtl_low can install a special PMD from a PFN supplied in the mmap file
offset. That PFN need not have a memmap entry. Reading /proc/PID/pagemap
or writing /proc/PID/clear_refs for such a mapping oopses the kernel.
With a test driver mapping the PFN at the 1 TiB mark:
echo 1 > /proc/self/clear_refs
BUG: unable to handle page fault for address: fffffb5b80000008
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
RIP: 0010:clear_refs_pte_range+0xb1/0x1e0
Call Trace:
walk_pgd_range+0x50a/0xad0
__walk_page_range+0x6a/0x1d0
walk_page_range_mm_unsafe+0x193/0x230
clear_refs_write+0x18e/0x3f0
pread(pagemap_fd, buf, 512 * 8, addr / PAGE_SIZE * 8)
BUG: unable to handle page fault for address: fffff57840000008
RIP: 0010:pagemap_pmd_range+0x3cf/0x6b0
Call Trace:
walk_pgd_range+0x50a/0xad0
__walk_page_range+0x6a/0x1d0
walk_page_range_mm_unsafe+0x193/0x230
pagemap_read+0x1dc/0x350
clear_refs_pte_range() passes the PMD to pmd_folio(), while
pagemap_pmd_range_thp() uses pmd_page() followed by page_folio().
Both paths assume the PFN has a struct page and dereference bad address.
Use vm_normal_folio_pmd() and vm_normal_page_pmd() so clear_refs skips
folio operations and pagemap skips folio-derived flags for special PMDs.
This matches the PTE paths, which already use vm_normal_folio() and
vm_normal_page().
User-facing notes:
- Pagemap still reports PM_PRESENT and the PFN to a CAP_SYS_ADMIN reader.
- For a special PMD backed by a valid memmap entry and for the huge
zero PMD, PM_FILE changes from set to clear.
- PM_MMAP_EXCLUSIVE is already clear in both cases.
- The output for an anonymous THP is unchanged.
Tested in QEMU with the test driver on broken and fixed kernels. Both proc
operations oops before the fix and return 0 after it.
This is technically reachable via mshv_vtl_low, so I tagged it stable.
Link: https://lore.kernel.org/20260912122822.3348978-1-gourry@gourry.net
Fixes: 3c8e44c9b369 ("mm: mark special bits for huge pfn mappings when inject")
Signed-off-by: Gregory Price <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260912034833.2952750-1-gourry%40gourry.net
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Assisted-by: LLM
Cc: Jann Horn <jannh@google.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Peter Xu <peterx@redhat.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org> # v6.19+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/proc/task_mmu.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index dd025474b0fc9..a2db957aa7996 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1786,7 +1786,9 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
if (!pmd_present(*pmd))
goto out;
- folio = pmd_folio(*pmd);
+ folio = vm_normal_folio_pmd(vma, addr, *pmd);
+ if (!folio)
+ goto out;
/* Clear accessed and referenced bits. */
pmdp_test_and_clear_young(vma, addr, pmd);
@@ -2106,7 +2108,7 @@ static int pagemap_pmd_range_thp(pmd_t *pmdp, unsigned long addr,
goto populate_pagemap;
if (pmd_present(pmd)) {
- page = pmd_page(pmd);
+ page = vm_normal_page_pmd(vma, addr, pmd);
flags |= PM_PRESENT;
if (pmd_soft_dirty(pmd))
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0657/1257] mm/madvise: reclaim isolated folios if PTE restart fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (655 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0656/1257] proc/task_mmu: handle special PMDs in clear_refs and pagemap Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0658/1257] mm/madvise: use folio_trylock() in the cold/pageout PMD split Greg Kroah-Hartman
` (341 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
sashiko-bot, Lorenzo Stoakes (ARM), David Hildenbrand, Jann Horn,
Jiexun Wang, Liam R. Howlett, Vlastimil Babka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 5445a6359d717354dd76d509b8e693f13403ec61 ]
MADV_PAGEOUT collects isolated folios on a local list before reclaiming
them after the PTE walk. The reschedule path drops the PTE lock and then
restarts the mapping with pte_offset_map_lock().
A concurrent operation can remove or replace the PTE table while the lock
is dropped, causing pte_offset_map_lock() to return NULL. Returning
directly in that case bypasses reclaim_pages(), leaving the collected
folios off the LRU with elevated references.
This results in a permanent memory leak. nr_isolated_anon increases
reliably and does not decrease when the process dies.
Route the failure through the existing cleanup path so any isolated folios
are reclaimed or put back.
Simplest userland pseudo-code reproducer:
p = mmap(PMD_SIZE, ANONYMOUS);
touch_every_page(p, PMD_SIZE);
parallel {
while (1) madvise(p, PMD_SIZE, MADV_PAGEOUT);
while (1) {
madvise(p, PMD_SIZE, MADV_DONTNEED);
touch_every_page(p, PMD_SIZE);
}
}
Reproduced in qemu trivially with some explicit widening of the race window.
Link: https://lore.kernel.org/20260912110832.3203902-1-gourry@gourry.net
Fixes: b2f557a21bc8 ("mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range()")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260821150912.183976-1-gourry@gourry.net
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Assisted-by: LLM
Cc: David Hildenbrand <david@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Jiexun Wang <wangjiexun@tinylab.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/madvise.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/madvise.c b/mm/madvise.c
index 95287c495e462..47e40d240c7e6 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -461,7 +461,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
restart:
start_pte = pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
if (!start_pte)
- return 0;
+ goto out;
flush_tlb_batched_pending(mm);
lazy_mmu_mode_enable();
for (; addr < end; pte += nr, addr += nr * PAGE_SIZE) {
@@ -565,6 +565,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
folio_deactivate(folio);
}
+out:
if (start_pte) {
lazy_mmu_mode_disable();
pte_unmap_unlock(start_pte, ptl);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0658/1257] mm/madvise: use folio_trylock() in the cold/pageout PMD split
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (656 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0657/1257] mm/madvise: reclaim isolated folios if PTE restart fails Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0659/1257] mm/page_alloc: do not boost watermarks in kdump capture kernels Greg Kroah-Hartman
` (340 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta), Andrew Morton,
sashiko-bot, Lorenzo Stoakes (ARM), David Hildenbrand (Arm),
Jann Horn, Liam R. Howlett, Vlastimil Babka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 5a6c9cf117fca3c38a98fb2a2d5549795c8b0b73 ]
MADV_COLD or MADV_PAGEOUT over part of a PMD splits the THP in
madvise_cold_or_pageout_pte_range(). Two threads doing that to the same
THP create spurious failures.
CPU0 CPU1
---- ----
folio_get()
spin_unlock(ptl)
folio_lock()
folio_get()
spin_unlock(ptl)
folio_lock() <- blocks, keeps its ref
split_folio()
folio_expected_ref_count(folio) != folio_ref_count(folio) - 1
-EAGAIN
CPU1 cannot drop its reference until it gets the lock CPU0 holds, so
CPU0's split always fails. folio_trylock() makes CPU1 leave without ever
taking a reference. The PTE branch of this same function already does
this, as do madvise_free_pte_range() and madvise_free_huge_pmd().
Reproducer: 400 rounds of eight threads calling MADV_COLD on half of each
of eight THPs, re-formed with MADV_COLLAPSE between rounds. From
/proc/vmstat:
thp_split_page thp_split_page_failed
before 3186 860
after 3200 0
The short before count is rounds where every thread failed and the advice
was dropped for that THP entirely.
On failure the walker returns 0 and nothing retries. The PMD path becomes
best effort when the folio lock is held elsewhere - same as the PTE path.
Link: https://lore.kernel.org/20260912110540.3203010-1-gourry@gourry.net
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260817220810.1175596-1-gourry%40gourry.net
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Assisted-by: LLM
Cc: Jann Horn <jannh@google.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/madvise.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/madvise.c b/mm/madvise.c
index 47e40d240c7e6..39480d78b7ad6 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -416,9 +416,10 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
if (next - addr != HPAGE_PMD_SIZE) {
int err;
+ if (!folio_trylock(folio))
+ goto huge_unlock;
folio_get(folio);
spin_unlock(ptl);
- folio_lock(folio);
err = split_folio(folio);
folio_unlock(folio);
folio_put(folio);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0659/1257] mm/page_alloc: do not boost watermarks in kdump capture kernels
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (657 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0658/1257] mm/madvise: use folio_trylock() in the cold/pageout PMD split Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0660/1257] mm/hugetlb_cgroup: move per-node usage on cross node migration Greg Kroah-Hartman
` (339 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuanhe Shu, Andrew Morton,
Vlastimil Babka (SUSE), Johannes Weiner, Henry Willard,
Brendan Jackman, David Hildenbrand, Mel Gorman, Michal Hocko,
Suren Baghdasaryan, Zi Yan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanhe Shu <xiangzao@linux.alibaba.com>
[ Upstream commit 331f94007d79b3c02d3098eea469a92aea3efc2c ]
A watermark boost is not confined to one watermark: wmark_pages() adds it
to min, low and high alike, so every watermark check sees it, including
should_reclaim_retry() and the last ditch ALLOC_WMARK_HIGH attempt in
__alloc_pages_may_oom(). Once the boost exceeds the memory still free the
allocator gives up and invokes the OOM killer, and a capture kernel that
is still booting has nothing to kill: the boot panics and the vmcore is
lost.
Seen on an arm64 machine with 64K pages, CONFIG_PAGE_BLOCK_MAX_ORDER=10
(pageblock = 64M) and crashkernel=512M, running a distribution kernel
based on 7.0.14. A high order UNMOVABLE allocation fell back to a MOVABLE
pageblock while the capture kernel was still in do_initcalls():
Node 0 DMA free:68096kB boost:65536kB min:68160kB
low:68800kB high:69440kB managed:479168kB
Out of memory and no killable processes...
Kernel panic - not syncing: System is deadlocked on memory
The zone was not short of memory. Subtracting the boost gives min:2624kB
low:3264kB high:3904kB, so the 68096kB still free sat 17 times above the
high watermark and the allocator would not even have entered its slow
path. The boost supplied 65536kB of the 68160kB min and by itself put the
zone 64kB under water. It is that large because boost_watermark() clamps
it with max(pageblock_nr_pages, max_boost); watermark_boost_factor alone
would have allowed 5824kB.
Commit 14f69140ff9c ("mm: limit boost_watermark on small zones") already
tried to protect capture kernels, but it infers them from the zone size
and skips the boost only below four pageblocks. arm64 64K pageblocks were
512M then, so the guard reached zones up to 2G;
CONFIG_PAGE_BLOCK_MAX_ORDER can cap them at 64M, which shrinks the guard
to zones under 256M and lets this 468M zone through.
kdump is a property of the kernel, not of the zone, so test for it
directly. A capture kernel exits within seconds and never uses the
fragmentation avoidance the boost buys. Normal kernels are unaffected:
the size based check still covers their genuinely tiny zones.
Passing sysctl.vm.watermark_boost_factor=0 to the capture kernel does not
cover this window: sysctl.* parameters are written through procfs by
do_sysctl_args(), which runs after do_initcalls() where the panic above
happened, and watermark_boost_factor has no early_param of its own.
Link: https://lore.kernel.org/20260916112545.3707893-1-xiangzao@linux.alibaba.com
Fixes: 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs")
Signed-off-by: Yuanhe Shu <xiangzao@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Henry Willard <henry.willard@oracle.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org> # v5.0
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_alloc.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 12fac9084c483..f52ed7d2cd347 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -37,6 +37,7 @@
#include <linux/vmstat.h>
#include <linux/fault-inject.h>
#include <linux/compaction.h>
+#include <linux/crash_dump.h>
#include <trace/events/kmem.h>
#include <trace/events/oom.h>
#include <linux/prefetch.h>
@@ -2178,10 +2179,17 @@ static inline bool boost_watermark(struct zone *zone)
if (!watermark_boost_factor)
return false;
+
+ /*
+ * A kdump capture kernel exits before a boost can pay off, while
+ * the raised watermark can exceed the memory left for the dump.
+ */
+ if (is_kdump_kernel())
+ return false;
+
/*
* Don't bother in zones that are unlikely to produce results.
- * On small machines, including kdump capture kernels running
- * in a small area, boosting the watermark can cause an out of
+ * On small machines, boosting the watermark can cause an out of
* memory situation immediately.
*/
if ((pageblock_nr_pages * 4) > zone_managed_pages(zone))
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0660/1257] mm/hugetlb_cgroup: move per-node usage on cross node migration
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (658 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0659/1257] mm/page_alloc: do not boost watermarks in kdump capture kernels Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0661/1257] mm/hugetlb_cgroup: move per-node usage on cgroup reparenting Greg Kroah-Hartman
` (338 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongfu Li, Andrew Morton,
Muchun Song, Colin Ian King, David Hildenbrand, Kees Cook,
Mina Almasry, Oscar Salvador, Shakeel Butt, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongfu Li <lihongfu@kylinos.cn>
[ Upstream commit fe0ba1909c59660f078560f5130e7af7c6004f12 ]
Patch series "mm/hugetlb_cgroup: move the per-node usage along with the
folio", v2.
The per-node usage reported by hugetlb.<size>.numa_stat is accounted
against folio_nid() in __hugetlb_cgroup_commit_charge() and
__hugetlb_cgroup_uncharge_folio(), so it is only correct while a folio
stays charged on the same node and in the same hugetlb_cgroup.
Two paths move a folio which stays charged, and neither moves the usage
with it. hugetlb_cgroup_migrate() only moves the hugetlb_cgroup pointers
of a folio migrated to another node, and hugetlb_cgroup_move_parent() only
moves the page_counter charges and the hugetlb_cgroup pointer of the
folios of a dying cgroup. In both cases the node (or cgroup) which was
charged keeps a usage which never goes away, while the node (or cgroup)
which ends up uncharging the folio underflows as soon as the folio is
freed.
Patch 1/2 moves the usage along with the folio on cross node migration,
patch 2/2 does the same for the folios a dying cgroup reparents.
This patch (of 2):
hugetlb.<size>.numa_stat uses folio_nid() to account usage in
__hugetlb_cgroup_commit_charge() and __hugetlb_cgroup_uncharge_folio().
hugetlb_cgroup_migrate() only moves hugetlb_cgroup pointers, leaving
per-node usage behind on the source node during cross-node migration.
When the migrated folio gets uncharged, we subtract usage from the
destination node counter. This creates stale usage on the source node and
unsigned long counter underflow on the destination node. The
hugetlb.<size>.numa_stat interface exposes these incorrect per-node usage
values to userspace.
Add a hugetlb_cgroup_move_usage() helper which moves the usage from the
old node to the new node, and call it from hugetlb_cgroup_migrate().
Link: https://lore.kernel.org/20260918-for-hugetlb-charge-v2-0-2b6d8c2bdc36@kylinos.cn
Link: https://lore.kernel.org/20260918-for-hugetlb-charge-v2-1-2b6d8c2bdc36@kylinos.cn
Fixes: f47761999052 ("hugetlb: add hugetlb.*.numa_stat file")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb_cgroup.c | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
index ecb6e0b7819a0..7cf7c18119b43 100644
--- a/mm/hugetlb_cgroup.c
+++ b/mm/hugetlb_cgroup.c
@@ -179,6 +179,34 @@ static void hugetlb_cgroup_css_free(struct cgroup_subsys_state *css)
hugetlb_cgroup_free(hugetlb_cgroup_from_css(css));
}
+static void hugetlb_cgroup_move_usage(struct hugetlb_cgroup *from,
+ struct hugetlb_cgroup *to,
+ struct folio *from_folio,
+ struct folio *to_folio)
+{
+ int idx = hstate_index(folio_hstate(from_folio));
+ unsigned long nr_pages = folio_nr_pages(from_folio);
+ int from_nid = folio_nid(from_folio);
+ int to_nid = folio_nid(to_folio);
+ unsigned long usage;
+
+ lockdep_assert_held(&hugetlb_lock);
+
+ if (!from || !to)
+ return;
+
+ if (from == to && from_nid == to_nid)
+ return;
+
+ usage = from->nodeinfo[from_nid]->usage[idx];
+ if (WARN_ON_ONCE(usage < nr_pages))
+ return;
+ WRITE_ONCE(from->nodeinfo[from_nid]->usage[idx], usage - nr_pages);
+
+ usage = to->nodeinfo[to_nid]->usage[idx];
+ WRITE_ONCE(to->nodeinfo[to_nid]->usage[idx], usage + nr_pages);
+}
+
/*
* Should be called with hugetlb_lock held.
* Since we are holding hugetlb_lock, pages cannot get moved from
@@ -906,6 +934,9 @@ void hugetlb_cgroup_migrate(struct folio *old_folio, struct folio *new_folio)
/* move the h_cg details to new cgroup */
set_hugetlb_cgroup(new_folio, h_cg);
set_hugetlb_cgroup_rsvd(new_folio, h_cg_rsvd);
+
+ hugetlb_cgroup_move_usage(h_cg, h_cg, old_folio, new_folio);
+
list_move(&new_folio->lru, &h->hugepage_activelist);
spin_unlock_irq(&hugetlb_lock);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0661/1257] mm/hugetlb_cgroup: move per-node usage on cgroup reparenting
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (659 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0660/1257] mm/hugetlb_cgroup: move per-node usage on cross node migration Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0662/1257] mm/shmem: report RCU-tasks quiescent states while undoing a range Greg Kroah-Hartman
` (337 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongfu Li, Andrew Morton,
Muchun Song, Colin Ian King, David Hildenbrand, Kees Cook,
Mina Almasry, Oscar Salvador, Shakeel Butt, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongfu Li <lihongfu@kylinos.cn>
[ Upstream commit 23fac055c21176f66ed453394b533bdfc00f7fba ]
hugetlb_cgroup_css_offline() hands the folios of a dying cgroup over to
its parent with hugetlb_cgroup_move_parent(), which moves the page_counter
charges and the hugetlb_cgroup pointer of the folio but not its per-node
usage. The parent's hugetlb.<size>.numa_stat is short by that usage while
they are charged, and underflows once they are freed, exposing incorrect
per-node usage values to userspace.
Move the per-node usage to the parent as well. The folios keep their node
here, so only the cgroup which holds the usage changes.
Link: https://lore.kernel.org/20260918-for-hugetlb-charge-v2-2-2b6d8c2bdc36@kylinos.cn
Fixes: f47761999052 ("hugetlb: add hugetlb.*.numa_stat file")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb_cgroup.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
index 7cf7c18119b43..3fb41311e4c7d 100644
--- a/mm/hugetlb_cgroup.c
+++ b/mm/hugetlb_cgroup.c
@@ -241,6 +241,8 @@ static void hugetlb_cgroup_move_parent(int idx, struct hugetlb_cgroup *h_cg,
/* Take the pages off the local counter */
page_counter_cancel(counter, nr_pages);
+ hugetlb_cgroup_move_usage(h_cg, parent, folio, folio);
+
set_hugetlb_cgroup(folio, parent);
out:
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0662/1257] mm/shmem: report RCU-tasks quiescent states while undoing a range
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (660 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0661/1257] mm/hugetlb_cgroup: move per-node usage on cgroup reparenting Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0663/1257] mm/alloc_tag: account for reserved tag ids in the kernel tag check Greg Kroah-Hartman
` (336 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Andrew Morton, SJ Park,
Baolin Wang, Hugh Dickins, Paul E . McKenney, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit ebd1a08c192109c83a87ddf42793ed6283180faf ]
This shows up in the Meta fleet on ftruncate() of large tmpfs files:
INFO: rcu_tasks detected stalls on tasks:
00000000752fd185: .. nvcsw: 59455/59455 holdout: 1 idle_cpu: -1/0
task:rocksdb:bottom state:R running task
__folio_split
find_get_entry
find_get_entries
truncate_inode_partial_folio
shmem_undo_range
shmem_setattr
notify_change
do_ftruncate
__x64_sys_ftruncate
do_syscall_64
shmem_undo_range() walks the whole of the requested range in folio_batch
sized steps, twice, and its two cond_resched() calls are the only
reschedule points in that walk.
cond_resched() is not an RCU-tasks quiescent state. Use
cond_resched_tasks_rcu_qs() at both points so the walk reports an
RCU-tasks quiescent state as it proceeds.
Link: https://lore.kernel.org/20260918-shmem-tasks-rcu-v1-1-79acf91a2569@debian.org
Fixes: 8315f42295d2 ("rcu: Add call_rcu_tasks()")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: "Paul E . McKenney" <paulmck@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/shmem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/shmem.c b/mm/shmem.c
index 848316eaa7f4f..af531eea77b93 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1159,7 +1159,7 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, uoff_t lend,
}
folio_batch_remove_exceptionals(&fbatch);
folio_batch_release(&fbatch);
- cond_resched();
+ cond_resched_tasks_rcu_qs();
}
/*
@@ -1200,7 +1200,7 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, uoff_t lend,
index = start;
while (index < end) {
- cond_resched();
+ cond_resched_tasks_rcu_qs();
if (!find_get_entries(mapping, &index, end - 1, &fbatch,
indices)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0663/1257] mm/alloc_tag: account for reserved tag ids in the kernel tag check
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (661 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0662/1257] mm/shmem: report RCU-tasks quiescent states while undoing a range Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0664/1257] mm/shmem: dont release a swapin-error marker as a swap entry Greg Kroah-Hartman
` (335 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao Ge, Andrew Morton,
Suren Baghdasaryan, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <hao.ge@linux.dev>
[ Upstream commit c6e5c0b9a493891634d0a413c3485930a28a8903 ]
The tag ids stored in the page flags include two reserved markers.
Id 0 means the page has no tag and id 1 means the tag was cleared,
so real tags start at CODETAG_ID_FIRST. The kernel-side check in
alloc_tag_sec_init() compared kernel_tags.count alone against the
addressable limit, so with the count at or just under the limit
the last tag ids wrapped into those markers. Pages allocated
through them then look the same as untagged pages on free, nothing
is ever subtracted from the real tag and /proc/allocinfo shows
that memory as still allocated.
Add the missing CODETAG_ID_FIRST, same as tags_addressable().
Link: https://lore.kernel.org/20260916075557.121316-1-hao.ge@linux.dev
Fixes: 4835f747d3ed ("alloc_tag: support for page allocation tag compression")
Signed-off-by: Hao Ge <hao.ge@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Suren Baghdasaryan <surenb@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/alloc_tag.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/alloc_tag.c b/mm/alloc_tag.c
index b334103104779..82e2c3448dcf2 100644
--- a/mm/alloc_tag.c
+++ b/mm/alloc_tag.c
@@ -621,7 +621,7 @@ void __init alloc_tag_sec_init(void)
kernel_tags.count = last_codetag - kernel_tags.first_tag;
/* Check if kernel tags fit into page flags */
- if (kernel_tags.count > (1UL << NR_UNUSED_PAGEFLAG_BITS)) {
+ if (CODETAG_ID_FIRST + kernel_tags.count > (1UL << NR_UNUSED_PAGEFLAG_BITS)) {
shutdown_mem_profiling(false); /* allocinfo file does not exist yet */
pr_err("%lu allocation tags cannot be references using %d available page flag bits. Memory allocation profiling is disabled!\n",
kernel_tags.count, NR_UNUSED_PAGEFLAG_BITS);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0664/1257] mm/shmem: dont release a swapin-error marker as a swap entry
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (662 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0663/1257] mm/alloc_tag: account for reserved tag ids in the kernel tag check Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0665/1257] mm/damon/core: charge only the part of a region the filter left Greg Kroah-Hartman
` (334 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Carlier, Andrew Morton,
syzbot+23b25ba3c6bf971f9c57, Baolin Wang, Baoquan he, Barry Song,
Hugh Dickens, Kairui Song, Kemeng Shi, Nhat Pham, Sasha Levin,
Chis Li
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
[ Upstream commit e4b92891aaca0d37b5973362dd14747a65406650 ]
A failed shmem swapin (eg, EIO) frees the swap slot and leaves a
PTE_MARKER_POISONED entry in the page cache. On truncate or eviction
shmem_free_swap() passes that marker to swap_put_entries_direct(), which
warns because it is not a swap entry. There is nothing left to release
either way.
Skip the release for non-swap entries, as every other caller already does.
Link: https://lore.kernel.org/20260920155002.1030454-1-devnexen@gmail.com
Fixes: ac2d3268284b ("mm/swapfile.c: remove the unneeded checking")
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: syzbot+23b25ba3c6bf971f9c57@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=23b25ba3c6bf971f9c57
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Baoquan he <bhe@redhat.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Chis Li <chrisl@kernel.org> (Google)
Cc: Hugh Dickens <hughd@google.com>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/shmem.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/mm/shmem.c b/mm/shmem.c
index af531eea77b93..93714b47f414b 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -976,6 +976,7 @@ static long shmem_free_swap(struct address_space *mapping,
pgoff_t index, pgoff_t end, void *radswap)
{
XA_STATE(xas, &mapping->i_pages, index);
+ const softleaf_t swp = radix_to_swp_entry(radswap);
unsigned int nr_pages = 0;
pgoff_t base;
void *entry;
@@ -992,8 +993,9 @@ static long shmem_free_swap(struct address_space *mapping,
}
xas_unlock_irq(&xas);
- if (nr_pages)
- swap_put_entries_direct(radix_to_swp_entry(radswap), nr_pages);
+ /* A swapin-error marker holds no swap slot, so just drop it. */
+ if (nr_pages && softleaf_is_swap(swp))
+ swap_put_entries_direct(swp, nr_pages);
return nr_pages;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0665/1257] mm/damon/core: charge only the part of a region the filter left
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (663 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0664/1257] mm/shmem: dont release a swapin-error marker as a swap entry Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0666/1257] mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region Greg Kroah-Hartman
` (333 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Donggeun Yoo, SJ Park, Andrew Morton,
Brendan Higgins, David Gow, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
[ Upstream commit 4ff3b4a54a32142497fb44b79d0920aa6ba3393d ]
Patch series "mm/damon/core: fix the size charged for a filter-trimmed
region", v2.
An address range DAMOS filter that partially overlaps a monitoring region
splits it, so the scheme action reaches only one side of the boundary.
damos_apply_scheme() reads the region size before that split and never
re-reads it, so the quota charge and schemes/<S>/stats/sz_tried account
for the whole original region.
Patch 1 re-reads the size after the core filters have run. Patch 2 adds
KUnit coverage for what the function charges and reports, for the trimmed
cases and for the cases that must not change.
This patch (of 2):
An address range DAMOS filter that partially overlaps a monitoring region
splits the region at the filter boundary, so the scheme action is applied
to only one side of it. damos_apply_scheme() reads the region size once
on entry, before damos_core_filter_out() performs that split.
The quota charge and the statistics update therefore account for the
region as it was before the trim. schemes/<S>/stats/sz_tried counts
memory the filter excluded, which Documentation/mm/damon/design.rst says
is not counted as tried, and with quotas/bytes set the excluded part is
charged against the budget, throttling the scheme to a fraction of what
was configured.
User impact is that DAMOS could unexpectedly slowly run, due to
over-charged quota. DAMOS stat could also be confusing. No critical
events such as crashes or leask happen.
Re-read the region size after the core filters have run.
Link: https://lore.kernel.org/20260921152443.80132-1-sj@kernel.org
Link: https://lore.kernel.org/20260921152443.80132-2-sj@kernel.org
Fixes: ab9bda001b68 ("mm/damon/core: introduce address range type damos filter")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <david@davidgow.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index a4542a49ff80a..4290e2a1c7e8d 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2653,6 +2653,7 @@ static void damos_apply_scheme(struct damon_ctx *c, struct damon_target *t,
}
if (damos_core_filter_out(c, t, r, s))
return;
+ sz = damon_sz_region(r);
ktime_get_coarse_ts64(&begin);
trace_damos_before_apply(cidx, sidx, tidx, r, nr_accesses,
damon_nr_regions(t), do_trace);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0666/1257] mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (664 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0665/1257] mm/damon/core: charge only the part of a region the filter left Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0667/1257] platform/x86/amd/pmf: Add AMDI0112 ACPI ID Greg Kroah-Hartman
` (332 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Donggeun Yoo, SJ Park, Andrew Morton,
Brendan Higgins, David Gow, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
[ Upstream commit 1c335228206392b96d327c6b49cea68cbb806d8a ]
damos_test_filter_out() checks that an address range filter splits a
region at the filter boundary, and stops there. Nothing checks what
damos_apply_scheme() then charges to the quota and reports as tried.
damos_test_apply_scheme_filtered_sz() covers the two ways such a filter
trims a region: one that starts before the filter's range, and one that
starts inside it.
damos_test_apply_scheme_filter_sz_unchanged() and
damos_test_apply_scheme_quota_sz() cover the cases whose accounting must
not change: a region wholly inside a reject range, one wholly inside an
allow range, two filters trimming in a single call, a filter type that
never splits, no filter at all, a region the quota trims, and a quota
remainder too small for one region.
Link: https://lore.kernel.org/20260921152443.80132-3-sj@kernel.org
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <david@davidgow.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/tests/core-kunit.h | 316 ++++++++++++++++++++++++++++++++++++
1 file changed, 316 insertions(+)
diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index 062332fe847ce..0f29da862951e 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -1433,6 +1433,319 @@ static void damos_test_filter_out(struct kunit *test)
damos_free_filter(f);
}
+static unsigned long damos_test_apply_scheme_stub(struct damon_ctx *c,
+ struct damon_target *t, struct damon_region *r,
+ struct damos *s, unsigned long *sz_filter_passed)
+{
+ return 0;
+}
+
+static void damos_test_apply_scheme_filtered_sz(struct kunit *test)
+{
+ struct damos_access_pattern pattern = {
+ .min_sz_region = 0,
+ .max_sz_region = ULONG_MAX,
+ .min_nr_accesses = 0,
+ .max_nr_accesses = UINT_MAX,
+ .min_age_region = 0,
+ .max_age_region = UINT_MAX,
+ };
+ unsigned long min_sz = DAMON_MIN_REGION_SZ;
+ struct damos_watermarks wmarks = {};
+ struct damos_quota quota = {};
+ struct damon_ctx *c;
+ struct damon_target *t;
+ struct damon_region *r;
+ struct damos_filter *f;
+ struct damos *s;
+
+ c = damon_new_ctx();
+ if (!c)
+ kunit_skip(test, "ctx alloc fail");
+ c->ops.apply_scheme = damos_test_apply_scheme_stub;
+
+ s = damon_new_scheme(&pattern, DAMOS_STAT, 0, "a, &wmarks,
+ NUMA_NO_NODE);
+ if (!s) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "scheme alloc fail");
+ }
+ damon_add_scheme(c, s);
+
+ t = damon_new_target();
+ if (!t) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "target alloc fail");
+ }
+ damon_add_target(c, t);
+
+ f = damos_new_filter(DAMOS_FILTER_TYPE_ADDR, true, false);
+ if (!f) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "filter alloc fail");
+ }
+ f->addr_range = (struct damon_addr_range){
+ .start = 2 * min_sz,
+ .end = 8 * min_sz
+ };
+ damos_add_filter(s, f);
+ damos_set_filters_default_reject(s);
+
+ /* reject filter, region starting before the range */
+ r = damon_new_region(0, 4 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 2 * min_sz);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 2 * min_sz);
+
+ if (damon_nr_regions(t) != 2)
+ goto out;
+ damon_destroy_region(damon_next_region(r), t);
+ damon_destroy_region(r, t);
+ s->stat = (struct damos_stat){};
+
+ /* allow filter, region starting inside the range */
+ f->allow = true;
+ damos_set_filters_default_reject(s);
+ r = damon_new_region(2 * min_sz, 10 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 8 * min_sz);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 6 * min_sz);
+
+out:
+ damon_destroy_ctx(c);
+}
+
+static void damos_test_apply_scheme_filter_sz_unchanged(struct kunit *test)
+{
+ struct damos_access_pattern pattern = {
+ .min_sz_region = 0,
+ .max_sz_region = ULONG_MAX,
+ .min_nr_accesses = 0,
+ .max_nr_accesses = UINT_MAX,
+ .min_age_region = 0,
+ .max_age_region = UINT_MAX,
+ };
+ unsigned long min_sz = DAMON_MIN_REGION_SZ;
+ struct damos_watermarks wmarks = {};
+ struct damos_quota quota = {};
+ struct damos_filter *f, *f2;
+ struct damon_ctx *c;
+ struct damon_target *t;
+ struct damon_region *r;
+ struct damos *s;
+
+ c = damon_new_ctx();
+ if (!c)
+ kunit_skip(test, "ctx alloc fail");
+ c->ops.apply_scheme = damos_test_apply_scheme_stub;
+
+ s = damon_new_scheme(&pattern, DAMOS_STAT, 0, "a, &wmarks,
+ NUMA_NO_NODE);
+ if (!s) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "scheme alloc fail");
+ }
+ damon_add_scheme(c, s);
+
+ t = damon_new_target();
+ if (!t) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "target alloc fail");
+ }
+ damon_add_target(c, t);
+
+ f = damos_new_filter(DAMOS_FILTER_TYPE_ADDR, true, false);
+ if (!f) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "filter alloc fail");
+ }
+ f->addr_range = (struct damon_addr_range){
+ .start = 2 * min_sz, .end = 8 * min_sz};
+ damos_add_filter(s, f);
+ damos_set_filters_default_reject(s);
+
+ /* wholly inside a reject range: not counted at all */
+ r = damon_new_region(4 * min_sz, 6 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, s->stat.nr_tried, 0);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 0);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 1);
+
+ /* wholly inside an allow range: counted whole, not split */
+ f->allow = true;
+ damos_set_filters_default_reject(s);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 2 * min_sz);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 1);
+
+ /* two filters, each trimming: the size left after both is counted */
+ damon_destroy_region(r, t);
+ s->stat = (struct damos_stat){};
+ f->allow = false;
+ f->addr_range = (struct damon_addr_range){
+ .start = 4 * min_sz, .end = 12 * min_sz};
+ f2 = damos_new_filter(DAMOS_FILTER_TYPE_ADDR, true, false);
+ if (!f2) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "filter alloc fail");
+ }
+ f2->addr_range = (struct damon_addr_range){
+ .start = 2 * min_sz, .end = 3 * min_sz};
+ damos_add_filter(s, f2);
+ damos_set_filters_default_reject(s);
+
+ r = damon_new_region(0, 8 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 2 * min_sz);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 2 * min_sz);
+
+ /* a core filter that never splits: counted whole */
+ damos_destroy_filter(f2);
+ damos_destroy_filter(f);
+ f = damos_new_filter(DAMOS_FILTER_TYPE_TARGET, true, true);
+ if (!f) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "filter alloc fail");
+ }
+ f->target_idx = 0;
+ damos_add_filter(s, f);
+ damos_set_filters_default_reject(s);
+ s->stat = (struct damos_stat){};
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 2 * min_sz);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 2 * min_sz);
+
+ damon_destroy_ctx(c);
+}
+
+static void damos_test_apply_scheme_quota_sz(struct kunit *test)
+{
+ struct damos_access_pattern pattern = {
+ .min_sz_region = 0,
+ .max_sz_region = ULONG_MAX,
+ .min_nr_accesses = 0,
+ .max_nr_accesses = UINT_MAX,
+ .min_age_region = 0,
+ .max_age_region = UINT_MAX,
+ };
+ unsigned long min_sz = DAMON_MIN_REGION_SZ;
+ struct damos_watermarks wmarks = {};
+ struct damos_quota quota = {};
+ struct damon_region *r, *next;
+ struct damon_ctx *c;
+ struct damon_target *t;
+ struct damos *s;
+
+ c = damon_new_ctx();
+ if (!c)
+ kunit_skip(test, "ctx alloc fail");
+
+ s = damon_new_scheme(&pattern, DAMOS_STAT, 0, "a, &wmarks,
+ NUMA_NO_NODE);
+ if (!s) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "scheme alloc fail");
+ }
+ damon_add_scheme(c, s);
+ damos_set_filters_default_reject(s);
+
+ t = damon_new_target();
+ if (!t) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "target alloc fail");
+ }
+ damon_add_target(c, t);
+
+ /* no apply_scheme operation: the whole region is counted */
+ r = damon_new_region(0, 4 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 4 * min_sz);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 1);
+
+ /* no filter and no quota: the whole region is counted */
+ c->ops.apply_scheme = damos_test_apply_scheme_stub;
+ s->stat = (struct damos_stat){};
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 4 * min_sz);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 1);
+
+ /* the quota trims the region: the trimmed size is counted */
+ damon_for_each_region_safe(r, next, t)
+ damon_destroy_region(r, t);
+ s->stat = (struct damos_stat){};
+ s->quota.esz = 2 * min_sz;
+ s->quota.charged_sz = 0;
+
+ r = damon_new_region(0, 8 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 2 * min_sz);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 2 * min_sz);
+
+ /* quota remainder below one region: tried, but nothing counted */
+ damon_for_each_region_safe(r, next, t)
+ damon_destroy_region(r, t);
+ s->stat = (struct damos_stat){};
+ s->quota.esz = 1;
+ s->quota.charged_sz = 0;
+
+ r = damon_new_region(0, 4 * min_sz);
+ if (!r) {
+ damon_destroy_ctx(c);
+ kunit_skip(test, "region alloc fail");
+ }
+ damon_add_region(r, t);
+
+ damos_apply_scheme(c, t, r, s);
+ KUNIT_EXPECT_EQ(test, s->stat.nr_tried, 1);
+ KUNIT_EXPECT_EQ(test, s->stat.sz_tried, 0);
+ KUNIT_EXPECT_EQ(test, r->ar.end, 4 * min_sz);
+
+ damon_destroy_ctx(c);
+}
+
static void damon_test_feed_loop_next_input(struct kunit *test)
{
unsigned long last_input = 900000, current_score = 200;
@@ -1682,6 +1995,9 @@ static struct kunit_case damon_test_cases[] = {
KUNIT_CASE(damon_test_commit_target_regions),
KUNIT_CASE(damon_test_commit_ctx),
KUNIT_CASE(damos_test_filter_out),
+ KUNIT_CASE(damos_test_apply_scheme_filtered_sz),
+ KUNIT_CASE(damos_test_apply_scheme_filter_sz_unchanged),
+ KUNIT_CASE(damos_test_apply_scheme_quota_sz),
KUNIT_CASE(damon_test_feed_loop_next_input),
KUNIT_CASE(damon_test_set_filters_default_reject),
KUNIT_CASE(damon_test_apply_min_nr_regions),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0667/1257] platform/x86/amd/pmf: Add AMDI0112 ACPI ID
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (665 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0666/1257] mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0668/1257] platform/x86/amd/pmf: Validate the APTS state index Greg Kroah-Hartman
` (331 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello,
Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit 325bcc126cf7a512a0e2da0efddad665f69badac ]
The AMDI0112 ID is used to bind the PMF driver to some platforms.
It doesn't have any Linux side code changes relative to the most
similar AMDI0105.
Cc: stable@vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260826163611.2268377-1-mario.limonciello@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/pmf/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c
index b4eae65e675b8..5966190d1496b 100644
--- a/drivers/platform/x86/amd/pmf/core.c
+++ b/drivers/platform/x86/amd/pmf/core.c
@@ -454,6 +454,7 @@ static const struct acpi_device_id amd_pmf_acpi_ids[] = {
{"AMDI0107", 0},
{"AMDI0108", 0},
{"AMDI0109", 0},
+ {"AMDI0112", 0},
{ }
};
MODULE_DEVICE_TABLE(acpi, amd_pmf_acpi_ids);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0668/1257] platform/x86/amd/pmf: Validate the APTS state index
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (666 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0667/1257] platform/x86/amd/pmf: Add AMDI0112 ACPI ID Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0669/1257] platform/x86/amd: Stop counting intermediate cycles with metrics table Greg Kroah-Hartman
` (330 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello,
Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit 192dddd5aa45166450820cef16521bdf23976a73 ]
The static slider APTS state index is supplied by the BIOS as an 8-bit
value, but apts_config_store contains only APTS_MAX_STATES entries. An
invalid firmware value can therefore cause amd_pmf_update_slider_v2() to
read beyond the end of the array.
Validate the selected index before applying the slider values and return
an error when it is out of range.
Fixes: 8362e862fb87 ("platform/x86/amd/pmf: Update sps power thermals according to the platform-profiles")
Cc: stable@vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260903182927.3556274-1-mario.limonciello@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/pmf/sps.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/platform/x86/amd/pmf/sps.c b/drivers/platform/x86/amd/pmf/sps.c
index 0b70a5153f465..0918fb388fde6 100644
--- a/drivers/platform/x86/amd/pmf/sps.c
+++ b/drivers/platform/x86/amd/pmf/sps.c
@@ -248,20 +248,24 @@ static int amd_pmf_update_sps_power_limits_v2(struct amd_pmf_dev *pdev, int pwr_
switch (pwr_mode) {
case POWER_MODE_PERFORMANCE:
index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BEST_PERFORMANCE];
- amd_pmf_update_slider_v2(pdev, index);
break;
case POWER_MODE_BALANCED_POWER:
index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BALANCED];
- amd_pmf_update_slider_v2(pdev, index);
break;
case POWER_MODE_POWER_SAVER:
index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BEST_POWER_EFFICIENCY];
- amd_pmf_update_slider_v2(pdev, index);
break;
default:
return -EINVAL;
}
+ if (index >= APTS_MAX_STATES) {
+ dev_err(pdev->dev, "Invalid APTS index: %d\n", index);
+ return -EINVAL;
+ }
+
+ amd_pmf_update_slider_v2(pdev, index);
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0669/1257] platform/x86/amd: Stop counting intermediate cycles with metrics table
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (667 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0668/1257] platform/x86/amd/pmf: Validate the APTS state index Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0670/1257] platform/x86: asus-wmi: fix unclear usage of bd->props.power Greg Kroah-Hartman
` (329 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Gibson, Mario Limonciello,
Chia-Lin Kao (AceLan), Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit 0c2c928ea7d33c8131b0785bda4e26a32dce5caa ]
The metrics table doesn't increment for all cases that can cause an
intermediate wakeup if the cycle is very fast. This can make the intent
from commit 9f5595d5f03fd ("platform/x86/amd: pmc: Require at least 2.5
seconds between HW sleep cycles") not work properly.
That commit originally was measured to work properly, but it was
accidental due to a logic error. The logic error was fixed in
commit 4dbd11796f3a8 ("platform/x86/amd: pmc: Clear metrics table at
start of cycle") but this now masked the table doesn't always update.
Since that code was introduced, Daniel Gibson added a number of changes
to the logic which includes a state variable introduced in
commit 037f0b03c663a ("platform/x86/amd/pmc: Don't log during
intermediate wakeups").
Utilize that state variable to instead decide if a single sequence has
started.
Cc: Daniel Gibson <daniel@gibson.sh>
Cc: stable@vger.kernel.org # 7.1.y: 037f0b03c663a platform/x86/amd/pmc: Don't log during intermediate wakeups
Cc: stable@vger.kernel.org # 6.18.y: 037f0b03c663a platform/x86/amd/pmc: Don't log during intermediate wakeups
Fixes: 4dbd11796f3a8 ("platform/x86/amd: pmc: Clear metrics table at start of cycle")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
Link: https://patch.msgid.link/20260914141734.2703545-1-mario.limonciello@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/pmc/pmc.c | 15 +--------------
1 file changed, 1 insertion(+), 14 deletions(-)
diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c
index 6792aa2c61874..e384b56d67559 100644
--- a/drivers/platform/x86/amd/pmc/pmc.c
+++ b/drivers/platform/x86/amd/pmc/pmc.c
@@ -701,19 +701,6 @@ static int amd_pmc_verify_czn_rtc(struct amd_pmc_dev *pdev, u32 *arg)
return rc;
}
-static bool amd_pmc_intermediate_wakeup_need_delay(struct amd_pmc_dev *pdev)
-{
- /*
- * Starting a new HW sleep cycle right after waking from one
- * can cause electrical problems triggering the over voltage protection.
- * That is avoided by delaying the next suspend a bit, see also
- * https://lore.kernel.org/all/20250414162446.3853194-1-superm1@kernel.org/
- */
- struct smu_metrics table;
-
- return get_metrics_table(pdev, &table) == 0 && table.s0i3_last_entry_status;
-}
-
static bool amd_pmc_want_suspend_delay(struct amd_pmc_dev *pdev)
{
/*
@@ -804,7 +791,7 @@ static void amd_pmc_s2idle_check(void)
struct amd_pmc_dev *pdev = &pmc;
int rc;
- if (amd_pmc_intermediate_wakeup_need_delay(pdev) ||
+ if (!pdev->is_first_check_after_suspend ||
amd_pmc_want_suspend_delay(pdev))
msleep(2500);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0670/1257] platform/x86: asus-wmi: fix unclear usage of bd->props.power
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (668 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0669/1257] platform/x86/amd: Stop counting intermediate cycles with metrics table Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0671/1257] platform/x86: asus-wmi: fix screenpad power state detection Greg Kroah-Hartman
` (328 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hugo Baigue, Ponali, Denis Benato,
Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Benato <denis.benato@linux.dev>
[ Upstream commit fd83d81ddf058d487e6d6489b18094f068e66a59 ]
The bd->props.power is checked in parts of the driver correctly
comparing with BACKLIGHT_POWER_ON, while in others with a raw usage
of bd->props.power and !bd->props.power, moreover in certain checks
the logic has been inverted due to BACKLIGHT_POWER_ON being defined
as 0: fix both the wrong usage and the inconsistencies by using
proper comparisons.
Fixes: 130d29c5627c ("platform/x86: asus-wmi: adjust screenpad power/brightness handling")
Closes: https://lore.kernel.org/all/178362762638.911488.8564892548331679884@eldamar.lan/
Closes: https://lore.kernel.org/all/ea9c63d1-4776-49d5-9dc4-6c09498f99c9@linux.dev/
Tested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Tested-by: Ponali <ponali2k@gmail.com>
Cc: stable@vger.kernel.org
Assisted-by: zcode:glm-5.3-flash
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260916143838.170950-2-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/asus-wmi.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index daf8bd17e6380..10c8fcb075b2d 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -4532,7 +4532,8 @@ static int update_screenpad_bl_status(struct backlight_device *bd)
u32 ctrl_param = bd->props.brightness;
int err = 0;
- if (bd->props.power) {
+ switch (bd->props.power) {
+ case BACKLIGHT_POWER_ON:
err = asus_wmi_set_devstate(ASUS_WMI_DEVID_SCREENPAD_POWER, 1, NULL);
if (err < 0)
return err;
@@ -4540,12 +4541,17 @@ static int update_screenpad_bl_status(struct backlight_device *bd)
err = asus_wmi_set_devstate(ASUS_WMI_DEVID_SCREENPAD_LIGHT, ctrl_param, NULL);
if (err < 0)
return err;
- }
+ break;
- if (!bd->props.power) {
+ case BACKLIGHT_POWER_OFF:
err = asus_wmi_set_devstate(ASUS_WMI_DEVID_SCREENPAD_POWER, 0, NULL);
if (err < 0)
return err;
+ break;
+
+ default:
+ pr_warn("Invalid screenpad backlight power state: %d\n", bd->props.power);
+ return -EINVAL;
}
return err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0671/1257] platform/x86: asus-wmi: fix screenpad power state detection
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (669 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0670/1257] platform/x86: asus-wmi: fix unclear usage of bd->props.power Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0672/1257] platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token Greg Kroah-Hartman
` (327 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hugo Baigue, Denis Benato,
Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Benato <denis.benato@linux.dev>
[ Upstream commit f9a1cd14b392a82fdc73474894bf8b198757dfb2 ]
On some models, e.g. the UX5400EA, the screenpad power state cannot be
read back: DSTS(ASUS_WMI_DEVID_SCREENPAD_POWER) never sets
ASUS_WMI_DSTS_STATUS_BIT, so asus_wmi_get_devstate_simple() reports the
panel as powered off regardless of its real state.
The DSDT shows DSTS 0x00050031 (POWER) and DSTS 0x00050032 (LIGHT)
both read the same two-byte EC register, each returning a different
byte: byte 0 is a raw EC status byte, which is 0xa0 when the panel is
powered and 0x00 when it is off, and byte 1 is the brightness. Read
the power state from the low byte instead of
ASUS_WMI_DSTS_STATUS_BIT: firmware reporting the power through the
status bit is covered too, since ASUS_WMI_DSTS_STATUS_BIT lies inside
ASUS_WMI_DSTS_BRIGHTNESS_MASK.
Reuse read_screenpad_backlight_power() in asus_screenpad_init() in
place of the raw devstate read. This makes the brightness read
reachable on models like the UX5400EA, so mask the SCREENPAD_LIGHT
value with ASUS_WMI_DSTS_BRIGHTNESS_MASK before storing it: the
unmasked devstate (0x0001ffa0 when the panel is on) would otherwise be
exposed to userspace as an out-of-range brightness (max_brightness is
255) which systemd-backlight then persists.
While at it, pass asus_wmi_get_devstate() the u32 it expects.
Fixes: 130d29c5627c ("platform/x86: asus-wmi: adjust screenpad power/brightness handling")
Reported-by: Hugo Baigue <hugobaigue2004@gmail.com>
Closes: https://lore.kernel.org/all/CAO84+x+P2_xyHP89+nGVSMV6bL+dy0P9=vyEEfZGnFhv0hBNWw@mail.gmail.com/
Suggested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Tested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Cc: stable@vger.kernel.org
Assisted-by: zcode:glm-5.3-flash
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260916143838.170950-3-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/asus-wmi.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 10c8fcb075b2d..3cc0b96baeb34 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -4498,13 +4498,20 @@ static int is_display_toggle(int code)
static int read_screenpad_backlight_power(struct asus_wmi *asus)
{
- int ret;
+ int ret, retval;
- ret = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_SCREENPAD_POWER);
+ ret = asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_SCREENPAD_POWER, &retval);
if (ret < 0)
return ret;
- /* 1 == powered */
- return ret ? BACKLIGHT_POWER_ON : BACKLIGHT_POWER_OFF;
+
+ /*
+ * The firmware reports the panel power in the low byte of the
+ * devstate as a raw EC status byte that is non-zero when the
+ * panel is powered; other models report it through
+ * ASUS_WMI_DSTS_STATUS_BIT, which lies inside the same mask.
+ */
+ return (retval & ASUS_WMI_DSTS_BRIGHTNESS_MASK) ?
+ BACKLIGHT_POWER_ON : BACKLIGHT_POWER_OFF;
}
static int read_screenpad_brightness(struct backlight_device *bd)
@@ -4568,16 +4575,17 @@ static int asus_screenpad_init(struct asus_wmi *asus)
struct backlight_device *bd;
struct backlight_properties props;
int err, power;
- int brightness = 0;
+ u32 brightness = 0;
- power = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_SCREENPAD_POWER);
+ power = read_screenpad_backlight_power(asus);
if (power < 0)
return power;
- if (power) {
+ if (power == BACKLIGHT_POWER_ON) {
err = asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_SCREENPAD_LIGHT, &brightness);
if (err < 0)
return err;
+ brightness &= ASUS_WMI_DSTS_BRIGHTNESS_MASK;
}
memset(&props, 0, sizeof(struct backlight_properties));
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0672/1257] platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (670 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0671/1257] platform/x86: asus-wmi: fix screenpad power state detection Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0673/1257] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query() Greg Kroah-Hartman
` (326 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josh Snyder, Muhammad Bilal,
Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit 540b8ae192afb5566c1b13b6884aee87107a26b9 ]
hp_calculate_security_buffer() special-cases an empty authentication
string and returns a fixed 4 bytes (sizeof(u16) * 2). But
hp_populate_security_buffer() does not special-case that same input:
for any authentication string that does not start with BEAM_PREFIX,
including the empty string, it always builds "UTF_PREFIX +
authentication" and converts the result to UTF-16, writing a 2-byte
length header plus 2 bytes per character of "<utf-16/>" (9 characters),
20 bytes total, regardless of how long "authentication" itself is.
The caller, hp_set_attribute(), sizes its kmalloc() buffer using
hp_calculate_security_buffer()'s return value, so for an empty
authentication token it allocates 4 bytes for the security area but
hp_populate_security_buffer() then writes 20 bytes into it, causing a
16-byte heap buffer overflow.
The authentication token used here is the current admin/setup
password, which is an empty string by default until one is
configured. Any write to a writable BIOS attribute while no admin
password has been set reaches this path.
Fix by removing the special-case early return for an empty string in
hp_calculate_security_buffer(). The generic calculation that follows
already accounts for the UTF_PREFIX correctly, which naturally yields
the same 20 bytes that hp_populate_security_buffer() writes for an empty
string, avoiding duplicate logic for special cases.
Fixes: b2715aa2e135 ("platform/x86: hp-bioscfg: spmobj-attributes")
Reported-by: Josh Snyder <josh@code406.com>
Closes: https://lore.kernel.org/platform-driver-x86/20260402-hp-bioscfg-overflow-v1-1-6985f8c9e67c@code406.com/
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260919060037.84602-1-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
index 4d94e48c1a4c8..abf8ce20fe15c 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
@@ -47,9 +47,6 @@ size_t hp_calculate_security_buffer(const char *authentication)
return sizeof(u16) * 2;
authlen = strlen(authentication);
- if (!authlen)
- return sizeof(u16) * 2;
-
size = sizeof(u16) + authlen * sizeof(u16);
if (!strstarts(authentication, BEAM_PREFIX))
size += strlen(UTF_PREFIX) * sizeof(u16);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0673/1257] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (671 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0672/1257] platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0674/1257] platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop() Greg Kroah-Hartman
` (325 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit 6dea092b261f04d632411c2be52d13190f5f67b1 ]
hp_wmi_perform_query() evaluates an ACPI WMI method and expects a
struct bios_return header in the returned buffer. However, it only
checks that the ACPI object type is ACPI_TYPE_BUFFER without verifying
that obj->buffer.length is at least sizeof(*bios_return) (8 bytes).
If the firmware or ACPI method returns a buffer shorter than 8 bytes:
1. bios_return->return_code at offset 4 reads out of bounds from the
allocated ACPI buffer slab.
2. If return_code evaluates to 0 and outsize is non-zero,
(int)(obj->buffer.length - sizeof(*bios_return)) evaluates to a
negative integer (e.g. -8 for a 0-length buffer). actual_outsize is
set to this negative value and passed to memcpy(buffer, ...,
actual_outsize), where the signed negative value is cast to
size_t (e.g. 0xfffffffffffffff8), attempting to copy ~18 Exabytes
and triggering an immediate kernel crash. Additionally,
memset(buffer + actual_outsize, ...) performs an out-of-bounds
write before buffer.
Fix this by ensuring obj->buffer.length is at least sizeof(*bios_return)
before accessing the return code, and compute actual_outsize safely
using min_t(u32, ...), which is sound specifically because the guard
above already rules out obj->buffer.length being smaller than
sizeof(*bios_return) by the time that subtraction runs.
Fixes: c3021ea1beee ("hp-wmi: allow setting input and output buffer sizes separately")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260826103012.240453-1-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-wmi.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index 615b4cf6fc451..8a0fe50ef0c29 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -691,8 +691,9 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
goto out_free;
}
- if (obj->type != ACPI_TYPE_BUFFER) {
- pr_warn("query 0x%x returned an invalid object 0x%x\n", query, ret);
+ if (obj->type != ACPI_TYPE_BUFFER ||
+ obj->buffer.length < sizeof(*bios_return)) {
+ pr_warn("query 0x%x returned wrong type or too small buffer\n", query);
ret = -EINVAL;
goto out_free;
}
@@ -711,7 +712,7 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
if (!outsize)
goto out_free;
- actual_outsize = min(outsize, (int)(obj->buffer.length - sizeof(*bios_return)));
+ actual_outsize = min_t(u32, outsize, obj->buffer.length - sizeof(*bios_return));
memcpy(buffer, obj->buffer.pointer + sizeof(*bios_return), actual_outsize);
memset(buffer + actual_outsize, 0, outsize - actual_outsize);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0674/1257] platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (672 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0673/1257] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0675/1257] platform/x86: asus-wmi: Serialize WMI method evaluations with a mutex Greg Kroah-Hartman
` (324 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jack Boykin, Ilpo Järvinen,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Boykin <jtboykin.jb@gmail.com>
[ Upstream commit 9f3eebbbd1033de0abcc2694ba4b455d30fe33f9 ]
power_supply_get_by_name() takes a reference that is only dropped on
the error path. On success it leaks, five times per policy evaluation.
Unregistering the battery later trips the use_cnt WARN_ON in
power_supply_unregister() and never frees it.
While here, return -ENODEV instead of an uninitialised 'value' when
no battery matches, and stop at the first supply found rather than
letting the last one in the table win.
Found by reading the code. Fix and changelog drafted with Claude Code
(Fable 5.1) and reviewed by hand. Compile-tested only (allmodconfig,
W=1, sparse); not run on Smart PC hardware.
Fixes: f4627dfd0e19 ("platform/x86/amd/pmf: Add support to get inputs from other subsystems")
Cc: stable@vger.kernel.org
Assisted-by: LLM sparse
Signed-off-by: Jack Boykin <jtboykin.jb@gmail.com>
Link: https://patch.msgid.link/20260902210217.69483-1-jtboykin.jb@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/pmf/spc.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/platform/x86/amd/pmf/spc.c b/drivers/platform/x86/amd/pmf/spc.c
index 592ba4de4c7f1..efb09a7915f72 100644
--- a/drivers/platform/x86/amd/pmf/spc.c
+++ b/drivers/platform/x86/amd/pmf/spc.c
@@ -199,13 +199,11 @@ static int amd_pmf_get_battery_prop(enum power_supply_property prop)
continue;
ret = power_supply_get_property(psy, prop, &value);
- if (ret) {
- power_supply_put(psy);
- return ret;
- }
+ power_supply_put(psy);
+ return ret ? ret : value.intval;
}
- return value.intval;
+ return -ENODEV;
}
static int amd_pmf_get_battery_info(struct amd_pmf_dev *dev, struct ta_pmf_enact_table *in)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0675/1257] platform/x86: asus-wmi: Serialize WMI method evaluations with a mutex
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (673 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0674/1257] platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0676/1257] platform/x86: oxpec: Fix Apex charge limit control Greg Kroah-Hartman
` (323 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marco Scardovi, Denis Benato,
Armin Wolf, Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Scardovi <scardracs@disroot.org>
[ Upstream commit b9428edaf4109e86a97254228d831767d0acc1f8 ]
Concurrent evaluations of ASUS WMI management methods (from ACPI notify,
HID, userspace daemons, and debugfs) enter the BIOS ACPI/SMM interface
simultaneously, triggering re-entrant SMIs or EC mailbox buffer corruption.
Fix this at the root by introducing a centralized evaluation helper
(asus_wmi_evaluate_method_locked()) protected by a global mutex
(asus_wmi_eval_lock) using guard(mutex). Route all evaluations of
ASUS_WMI_MGMT_GUID (method3, method5, method_buf, and show_call) through
this helper.
A static mutex is required because asus_wmi_evaluate_method() is an
exported symbol used by external modules (such as hid-asus and
asus-armoury) that lack access to struct asus_wmi drvdata, and the
underlying ASUS ACPI/EC management method is a single physical platform
resource.
The mutex is non-recursive: nested ACPI/WMI notify handlers must not call
back into evaluate on the same task (defer via workqueue, as
asus_rfkill_notify already does).
The sysfs-versus-notify race predates the later export of
asus_wmi_evaluate_method(), so Fixes points at the original shared
evaluate helper rather than that export.
Link: https://github.com/OpenGamingCollective/asusctl/issues/328
Fixes: d33da3b68669 ("asus-wmi: factorise wmi_evaluate_method call")
Cc: stable@vger.kernel.org
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Reviewed-by: Denis Benato <denis.benato@linux.dev>
Reviewed-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/b6a1981777e63f0c28bd719d8203ebbda57d6957.1789722252.git.scardracs@disroot.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/asus-wmi.c | 30 +++++++++++++++++++++---------
1 file changed, 21 insertions(+), 9 deletions(-)
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 3cc0b96baeb34..84859646d7acd 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -16,6 +16,7 @@
#include <linux/acpi.h>
#include <linux/backlight.h>
#include <linux/bits.h>
+#include <linux/cleanup.h>
#include <linux/debugfs.h>
#include <linux/delay.h>
#include <linux/dmi.h>
@@ -28,6 +29,7 @@
#include <linux/leds.h>
#include <linux/minmax.h>
#include <linux/module.h>
+#include <linux/mutex.h>
#include <linux/pci.h>
#include <linux/pci_hotplug.h>
#include <linux/platform_data/x86/asus-wmi.h>
@@ -353,6 +355,20 @@ static void asus_wmi_show_deprecated(void)
/* WMI ************************************************************************/
+/*
+ * Concurrent evaluations of ASUS WMI methods can re-enter firmware
+ * SMI/EC mailbox handling and corrupt the mailbox.
+ */
+static DEFINE_MUTEX(asus_wmi_eval_lock);
+
+static acpi_status asus_wmi_evaluate_method_locked(u32 method_id,
+ struct acpi_buffer *input,
+ struct acpi_buffer *output)
+{
+ guard(mutex)(&asus_wmi_eval_lock);
+ return wmi_evaluate_method(ASUS_WMI_MGMT_GUID, 0, method_id, input, output);
+}
+
static int asus_wmi_evaluate_method3(u32 method_id,
u32 arg0, u32 arg1, u32 arg2, u32 *retval)
{
@@ -367,8 +383,7 @@ static int asus_wmi_evaluate_method3(u32 method_id,
union acpi_object *obj;
u32 tmp = 0;
- status = wmi_evaluate_method(ASUS_WMI_MGMT_GUID, 0, method_id,
- &input, &output);
+ status = asus_wmi_evaluate_method_locked(method_id, &input, &output);
pr_debug("%s called (0x%08x) with args: 0x%08x, 0x%08x, 0x%08x\n",
__func__, method_id, arg0, arg1, arg2);
@@ -419,8 +434,7 @@ static int asus_wmi_evaluate_method5(u32 method_id,
union acpi_object *obj;
u32 tmp = 0;
- status = wmi_evaluate_method(ASUS_WMI_MGMT_GUID, 0, method_id,
- &input, &output);
+ status = asus_wmi_evaluate_method_locked(method_id, &input, &output);
pr_debug("%s called (0x%08x) with args: 0x%08x, 0x%08x, 0x%08x, 0x%08x, 0x%08x\n",
__func__, method_id, arg0, arg1, arg2, arg3, arg4);
@@ -467,8 +481,7 @@ static int asus_wmi_evaluate_method_buf(u32 method_id,
union acpi_object *obj;
int err = 0;
- status = wmi_evaluate_method(ASUS_WMI_MGMT_GUID, 0, method_id,
- &input, &output);
+ status = asus_wmi_evaluate_method_locked(method_id, &input, &output);
pr_debug("%s called (0x%08x) with args: 0x%08x, 0x%08x\n",
__func__, method_id, arg0, arg1);
@@ -5052,9 +5065,8 @@ static int show_call(struct seq_file *m, void *data)
union acpi_object *obj;
acpi_status status;
- status = wmi_evaluate_method(ASUS_WMI_MGMT_GUID,
- 0, asus->debug.method_id,
- &input, &output);
+ status = asus_wmi_evaluate_method_locked(asus->debug.method_id,
+ &input, &output);
if (ACPI_FAILURE(status))
return -EIO;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0676/1257] platform/x86: oxpec: Fix Apex charge limit control
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (674 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0675/1257] platform/x86: asus-wmi: Serialize WMI method evaluations with a mutex Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0677/1257] platform/x86: simatic-ipc: fix platform device leak on registration failure Greg Kroah-Hartman
` (322 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antheas Kapenekakis, Derek J. Clark,
Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <lkml@antheas.dev>
[ Upstream commit 0ccdf9a1381c7fb6d9e84abeb8e5d6c85dd07059 ]
The OneXPlayer Apex uses E5/E6 for battery bypass / charge limit, making
it the first device to deviate. This was verified by a user on Windows
with BIOS version 2.17 and later by running this kernel patch.
Drop X1_ from the MASK variables as they are common in all devices,
introduce a board enum for Apex, and make it use the new E5/E6 registers
for charge limit / bypass. Apply the same quirks as oxp_fly, since APEX
uses the same registers otherwise.
Fixes: 3385ea97c14d ("platform/x86: oxpec: Add support for OneXPlayer APEX")
Cc: stable@vger.kernel.org
Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
Reviewed-by: Derek J. Clark <derekjohn.clark@gmail.com>
Link: https://patch.msgid.link/20260920190438.3444923-1-lkml@antheas.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/oxpec.c | 68 ++++++++++++++++++++++++++++--------
1 file changed, 53 insertions(+), 15 deletions(-)
diff --git a/drivers/platform/x86/oxpec.c b/drivers/platform/x86/oxpec.c
index 34bb17fca1481..38c272995437e 100644
--- a/drivers/platform/x86/oxpec.c
+++ b/drivers/platform/x86/oxpec.c
@@ -50,6 +50,7 @@ enum oxp_board {
oxp_x1,
oxp_g1_i,
oxp_g1_a,
+ oxp_apex,
};
static enum oxp_board board;
@@ -93,11 +94,14 @@ static struct device *oxp_dev;
#define OXP_X1_CHARGE_LIMIT_REG 0xA3 /* X1 charge limit (%) */
#define OXP_X1_CHARGE_INHIBIT_REG 0xA4 /* X1 bypass charging */
-#define OXP_X1_CHARGE_INHIBIT_MASK_AWAKE 0x01
+#define OXP_APEX_CHARGE_LIMIT_REG 0xE5 /* Apex charge limit (%) */
+#define OXP_APEX_CHARGE_INHIBIT_REG 0xE6 /* Apex bypass charging */
+
+#define OXP_CHARGE_INHIBIT_MASK_AWAKE 0x01
/* X1 Mask is 0x0A, F1Pro is 0x02 but the extra bit on the X1 does nothing. */
-#define OXP_X1_CHARGE_INHIBIT_MASK_OFF 0x02
-#define OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS (OXP_X1_CHARGE_INHIBIT_MASK_AWAKE | \
- OXP_X1_CHARGE_INHIBIT_MASK_OFF)
+#define OXP_CHARGE_INHIBIT_MASK_OFF 0x02
+#define OXP_CHARGE_INHIBIT_MASK_ALWAYS (OXP_CHARGE_INHIBIT_MASK_AWAKE | \
+ OXP_CHARGE_INHIBIT_MASK_OFF)
static const struct dmi_system_id dmi_table[] = {
{
@@ -154,7 +158,7 @@ static const struct dmi_system_id dmi_table[] = {
DMI_MATCH(DMI_BOARD_VENDOR, "ONE-NETBOOK"),
DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER APEX"),
},
- .driver_data = (void *)oxp_fly,
+ .driver_data = (void *)oxp_apex,
},
{
.matches = {
@@ -352,6 +356,7 @@ static umode_t tt_toggle_is_visible(struct kobject *kobj,
case oxp_x1:
case oxp_g1_i:
case oxp_g1_a:
+ case oxp_apex:
return attr->mode;
default:
break;
@@ -381,6 +386,7 @@ static ssize_t tt_toggle_store(struct device *dev,
case oxp_fly:
case oxp_mini_amd_pro:
case oxp_g1_a:
+ case oxp_apex:
reg = OXP_TURBO_SWITCH_REG;
mask = OXP_TURBO_TAKE_VAL;
break;
@@ -427,6 +433,7 @@ static ssize_t tt_toggle_show(struct device *dev,
case oxp_fly:
case oxp_mini_amd_pro:
case oxp_g1_a:
+ case oxp_apex:
reg = OXP_TURBO_SWITCH_REG;
mask = OXP_TURBO_TAKE_VAL;
break;
@@ -524,6 +531,7 @@ static bool oxp_psy_ext_supported(void)
case oxp_g1_i:
case oxp_g1_a:
case oxp_fly:
+ case oxp_apex:
return true;
default:
break;
@@ -537,12 +545,24 @@ static int oxp_psy_ext_get_prop(struct power_supply *psy,
enum power_supply_property psp,
union power_supply_propval *val)
{
+ u8 limit_reg, inhibit_reg;
long raw_val;
int ret;
+ switch (board) {
+ case oxp_apex:
+ limit_reg = OXP_APEX_CHARGE_LIMIT_REG;
+ inhibit_reg = OXP_APEX_CHARGE_INHIBIT_REG;
+ break;
+ default:
+ limit_reg = OXP_X1_CHARGE_LIMIT_REG;
+ inhibit_reg = OXP_X1_CHARGE_INHIBIT_REG;
+ break;
+ }
+
switch (psp) {
case POWER_SUPPLY_PROP_CHARGE_CONTROL_END_THRESHOLD:
- ret = read_from_ec(OXP_X1_CHARGE_LIMIT_REG, 1, &raw_val);
+ ret = read_from_ec(limit_reg, 1, &raw_val);
if (ret)
return ret;
if (raw_val < 0 || raw_val > 100)
@@ -550,14 +570,14 @@ static int oxp_psy_ext_get_prop(struct power_supply *psy,
val->intval = raw_val;
return 0;
case POWER_SUPPLY_PROP_CHARGE_BEHAVIOUR:
- ret = read_from_ec(OXP_X1_CHARGE_INHIBIT_REG, 1, &raw_val);
+ ret = read_from_ec(inhibit_reg, 1, &raw_val);
if (ret)
return ret;
- if ((raw_val & OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS) ==
- OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS)
+ if ((raw_val & OXP_CHARGE_INHIBIT_MASK_ALWAYS) ==
+ OXP_CHARGE_INHIBIT_MASK_ALWAYS)
val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE;
- else if ((raw_val & OXP_X1_CHARGE_INHIBIT_MASK_AWAKE) ==
- OXP_X1_CHARGE_INHIBIT_MASK_AWAKE)
+ else if ((raw_val & OXP_CHARGE_INHIBIT_MASK_AWAKE) ==
+ OXP_CHARGE_INHIBIT_MASK_AWAKE)
val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE_AWAKE;
else
val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_AUTO;
@@ -573,29 +593,41 @@ static int oxp_psy_ext_set_prop(struct power_supply *psy,
enum power_supply_property psp,
const union power_supply_propval *val)
{
+ u8 limit_reg, inhibit_reg;
long raw_val;
+ switch (board) {
+ case oxp_apex:
+ limit_reg = OXP_APEX_CHARGE_LIMIT_REG;
+ inhibit_reg = OXP_APEX_CHARGE_INHIBIT_REG;
+ break;
+ default:
+ limit_reg = OXP_X1_CHARGE_LIMIT_REG;
+ inhibit_reg = OXP_X1_CHARGE_INHIBIT_REG;
+ break;
+ }
+
switch (psp) {
case POWER_SUPPLY_PROP_CHARGE_CONTROL_END_THRESHOLD:
if (val->intval < 0 || val->intval > 100)
return -EINVAL;
- return write_to_ec(OXP_X1_CHARGE_LIMIT_REG, val->intval);
+ return write_to_ec(limit_reg, val->intval);
case POWER_SUPPLY_PROP_CHARGE_BEHAVIOUR:
switch (val->intval) {
case POWER_SUPPLY_CHARGE_BEHAVIOUR_AUTO:
raw_val = 0;
break;
case POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE_AWAKE:
- raw_val = OXP_X1_CHARGE_INHIBIT_MASK_AWAKE;
+ raw_val = OXP_CHARGE_INHIBIT_MASK_AWAKE;
break;
case POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE:
- raw_val = OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS;
+ raw_val = OXP_CHARGE_INHIBIT_MASK_ALWAYS;
break;
default:
return -EINVAL;
}
- return write_to_ec(OXP_X1_CHARGE_INHIBIT_REG, raw_val);
+ return write_to_ec(inhibit_reg, raw_val);
default:
return -EINVAL;
}
@@ -656,6 +688,7 @@ static int oxp_pwm_enable(void)
case oxp_x1:
case oxp_g1_i:
case oxp_g1_a:
+ case oxp_apex:
return write_to_ec(OXP_SENSOR_PWM_ENABLE_REG, PWM_MODE_MANUAL);
default:
return -EINVAL;
@@ -676,6 +709,7 @@ static int oxp_pwm_disable(void)
case oxp_x1:
case oxp_g1_i:
case oxp_g1_a:
+ case oxp_apex:
return write_to_ec(OXP_SENSOR_PWM_ENABLE_REG, PWM_MODE_AUTO);
default:
return -EINVAL;
@@ -696,6 +730,7 @@ static int oxp_pwm_read(long *val)
case oxp_x1:
case oxp_g1_i:
case oxp_g1_a:
+ case oxp_apex:
return read_from_ec(OXP_SENSOR_PWM_ENABLE_REG, 1, val);
default:
return -EOPNOTSUPP;
@@ -732,6 +767,7 @@ static int oxp_pwm_fan_speed(long *val)
case oxp_mini_amd_a07:
case oxp_mini_amd_pro:
case oxp_g1_a:
+ case oxp_apex:
return read_from_ec(OXP_SENSOR_FAN_REG, 2, val);
default:
return -EOPNOTSUPP;
@@ -764,6 +800,7 @@ static int oxp_pwm_input_write(long val)
case oxp_fly:
case oxp_mini_amd_pro:
case oxp_g1_a:
+ case oxp_apex:
return write_to_ec(OXP_SENSOR_PWM_REG, val);
default:
return -EOPNOTSUPP;
@@ -803,6 +840,7 @@ static int oxp_pwm_input_read(long *val)
case oxp_fly:
case oxp_mini_amd_pro:
case oxp_g1_a:
+ case oxp_apex:
default:
ret = read_from_ec(OXP_SENSOR_PWM_REG, 1, val);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0677/1257] platform/x86: simatic-ipc: fix platform device leak on registration failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (675 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0676/1257] platform/x86: oxpec: Fix Apex charge limit control Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0678/1257] platform/x86/amd: hfi: Fix out-of-bounds reads when parsing ranking data Greg Kroah-Hartman
` (321 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Ilpo Järvinen,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 9523698252fd583d6987582b9c34ec6500d10986 ]
register_platform_devices() registers the battery, LED, and watchdog
platform devices in sequence. If LED registration fails, the battery
device remains registered. If watchdog registration fails, the LED and
battery devices remain registered.
These failure paths leave successful platform_device_register_data()
calls without the matching platform_device_unregister() calls.
Add an unwind ladder to unregister previously registered platform
devices in reverse order before returning the registration error.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fixes: dd123e62bded ("platform/x86: simatic-ipc: add main driver for Siemens devices")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260924115617.1578309-1-lgs201920130244@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/siemens/simatic-ipc.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/drivers/platform/x86/siemens/simatic-ipc.c b/drivers/platform/x86/siemens/simatic-ipc.c
index 7039874d8f112..4a4509fc9263e 100644
--- a/drivers/platform/x86/siemens/simatic-ipc.c
+++ b/drivers/platform/x86/siemens/simatic-ipc.c
@@ -92,6 +92,7 @@ static int register_platform_devices(u32 station_id)
u8 wdtmode = SIMATIC_IPC_DEVICE_NONE;
u8 battmode = SIMATIC_IPC_DEVICE_NONE;
char *pdevname;
+ int ret;
int i;
for (i = 0; i < ARRAY_SIZE(device_modes); i++) {
@@ -139,8 +140,10 @@ static int register_platform_devices(u32 station_id)
pdevname, PLATFORM_DEVID_NONE,
&platform_data,
sizeof(struct simatic_ipc_platform));
- if (IS_ERR(ipc_led_platform_device))
- return PTR_ERR(ipc_led_platform_device);
+ if (IS_ERR(ipc_led_platform_device)) {
+ ret = PTR_ERR(ipc_led_platform_device);
+ goto err_unregister_batt;
+ }
pr_debug("device=%s created\n",
ipc_led_platform_device->name);
@@ -153,8 +156,10 @@ static int register_platform_devices(u32 station_id)
KBUILD_MODNAME "_wdt", PLATFORM_DEVID_NONE,
&platform_data,
sizeof(struct simatic_ipc_platform));
- if (IS_ERR(ipc_wdt_platform_device))
- return PTR_ERR(ipc_wdt_platform_device);
+ if (IS_ERR(ipc_wdt_platform_device)) {
+ ret = PTR_ERR(ipc_wdt_platform_device);
+ goto err_unregister_led;
+ }
pr_debug("device=%s created\n",
ipc_wdt_platform_device->name);
@@ -169,6 +174,14 @@ static int register_platform_devices(u32 station_id)
}
return 0;
+
+err_unregister_led:
+ if (ledmode != SIMATIC_IPC_DEVICE_NONE)
+ platform_device_unregister(ipc_led_platform_device);
+err_unregister_batt:
+ if (battmode != SIMATIC_IPC_DEVICE_NONE)
+ platform_device_unregister(ipc_batt_platform_device);
+ return ret;
}
static void request_additional_modules(u32 station_id)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0678/1257] platform/x86/amd: hfi: Fix out-of-bounds reads when parsing ranking data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (676 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0677/1257] platform/x86: simatic-ipc: fix platform device leak on registration failure Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0679/1257] platform/x86/intel-uncore-freq: Continue restoring limits on resume Greg Kroah-Hartman
` (320 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Mario Limonciello,
Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit b7b273844b94af9cc64907dccd9e7997c2b60f1a ]
amd_hfi_fill_metadata() parses CPU core ranking data out of the
firmware-provided PCC shared memory but trusts two values it should not:
- n_bitmaps is used to bound the outer loop that reads the APIC ID
bitmaps from table_data[], but it is never validated against the size
of the shared memory region (pcct_ext->length). A firmware-supplied
count larger than the region reads past the end of table_data.
- When resolving the base of the ranking data for a processor, the
pointer is shifted by an extra "i * nr_class" term, where i is the
current bitmap index. The per-processor offset is already applied
through apic_index, which uses the running count of active processors
(apic_start). The extra shift compounds for every logical processor
beyond the first bitmap (APIC ID >= 32), reading out of bounds.
Both result in out-of-bounds reads that can corrupt the ranking metrics,
oops, or otherwise destabilise the system.
Reject an n_bitmaps value that would not fit within the shared memory
region, and drop the bogus "i * nr_class" term so the ranking data is
addressed only through its correct per-processor offset.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: d4e95ea7a78e ("platform/x86: hfi: Parse CPU core ranking data from shared memory")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260921170411.1149960-3-mario.limonciello@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/hfi/hfi.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/platform/x86/amd/hfi/hfi.c b/drivers/platform/x86/amd/hfi/hfi.c
index e1c776b71f3e6..6d1d3b6c28a97 100644
--- a/drivers/platform/x86/amd/hfi/hfi.c
+++ b/drivers/platform/x86/amd/hfi/hfi.c
@@ -20,6 +20,7 @@
#include <linux/module.h>
#include <linux/mailbox_client.h>
#include <linux/mutex.h>
+#include <linux/overflow.h>
#include <linux/percpu-defs.h>
#include <linux/platform_device.h>
#include <linux/smp.h>
@@ -168,6 +169,21 @@ static int amd_hfi_fill_metadata(struct amd_hfi_data *amd_hfi_data)
return -EINVAL;
}
+ /*
+ * The bitmaps enumerating the APIC IDs occupy the first n_bitmaps
+ * words of table_data. Reject a firmware-provided count that would
+ * push those reads past the end of the shared memory region.
+ */
+ if (struct_size(amd_hfi_data->shmem, table_data, amd_hfi_data->shmem->n_bitmaps) >
+ pcct_ext->length) {
+ dev_err(amd_hfi_data->dev, "invalid number of bitmaps: %u\n",
+ amd_hfi_data->shmem->n_bitmaps);
+ return -EINVAL;
+ }
+
+ /* The ranking data for each processor follows the bitmaps */
+ u32 *table = amd_hfi_data->shmem->table_data + amd_hfi_data->shmem->n_bitmaps;
+
for (unsigned int i = 0; i < amd_hfi_data->shmem->n_bitmaps; i++) {
u32 bitmap = amd_hfi_data->shmem->table_data[i];
@@ -192,10 +208,6 @@ static int amd_hfi_fill_metadata(struct amd_hfi_data *amd_hfi_data)
info = per_cpu_ptr(&amd_hfi_cpuinfo, cpu_index);
apic_index = apic_start * info->nr_class * 2;
for (unsigned int k = 0; k < info->nr_class; k++) {
- u32 *table = amd_hfi_data->shmem->table_data +
- amd_hfi_data->shmem->n_bitmaps +
- i * info->nr_class;
-
info->amd_hfi_classes[k].eff = table[apic_index + 2 * k];
info->amd_hfi_classes[k].perf = table[apic_index + 2 * k + 1];
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0679/1257] platform/x86/intel-uncore-freq: Continue restoring limits on resume
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (677 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0678/1257] platform/x86/amd: hfi: Fix out-of-bounds reads when parsing ranking data Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0680/1257] platform/x86/intel/vsec: Fix inverted walk_header() test in get_features() Greg Kroah-Hartman
` (319 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yijia Wang, Guixiong Wei,
Srinivas Pandruvada, Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixiong Wei <weiguixiong@bytedance.com>
[ Upstream commit 38998529f45c02edcf96b0a3ddd3c83de6d11bbe ]
The PM notifier iterates over every uncore frequency instance to restore
user-configured MSR_UNCORE_RATIO_LIMIT values after resume. Entries that
have never been configured legitimately have stored_uncore_data set to
zero.
The refactoring that split common and enumeration code changed the
iteration from active control CPUs to all allocated instances. It also
changed the skip for an invalid or unconfigured entry from continue to
return, causing that entry to terminate the entire restore operation.
On a multi-package or multi-die system, configuring only a later instance
therefore leaves its limit unrestored after suspend, hibernation, or
restore if an earlier entry is invalid or unconfigured.
Use continue to skip only the current entry and restore all remaining
configured instances.
Fixes: dbce412a7733 ("platform/x86/intel-uncore-freq: Split common and enumeration part")
Cc: stable@vger.kernel.org
Tested-by: Yijia Wang <wangyijia.yeah@bytedance.com>
Signed-off-by: Guixiong Wei <weiguixiong@bytedance.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260929163133.14326-2-weiguixiong@bytedance.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
index 667f2c8b9594a..c44e7e38cae25 100644
--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
+++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
@@ -211,7 +211,7 @@ static int uncore_pm_notify(struct notifier_block *nb, unsigned long mode,
struct uncore_data *data = &uncore_instances[i];
if (!data || !data->valid || !data->stored_uncore_data)
- return 0;
+ continue;
wrmsrq_on_cpu(data->control_cpu, MSR_UNCORE_RATIO_LIMIT,
data->stored_uncore_data);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0680/1257] platform/x86/intel/vsec: Fix inverted walk_header() test in get_features()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (678 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0679/1257] platform/x86/intel-uncore-freq: Continue restoring limits on resume Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0681/1257] fbdev: sh_mobile_lcdcfb: Restore the per-overlay sysfs attributes Greg Kroah-Hartman
` (318 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David E. Box, Michael J. Ruhl,
Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David E. Box <david.e.box@linux.intel.com>
[ Upstream commit 3678e39c6aaeb9aa380c7357b24f7d55955543f8 ]
intel_vsec_walk_header() used to return a bool that was true when devices
were found. It was converted to return 0 on success and a negative errno
on failure, but the boolean test in intel_vsec_get_features() was left
unchanged, so its meaning is now inverted.
A successful walk returns 0 and leaves found set to false, while a failed
walk returns an error that evaluates to true. When no other capabilities
are present, intel_vsec_pci_init() then returns -ENODEV even though the
auxiliary devices were created, and the driver core tears them back down.
This affects platforms that have no DVSEC or VSEC capabilities and
describe their features through device_data instead, which today means
DG1. Test the return value for success explicitly.
Fixes: a6ce8bf3c993 ("platform/x86/intel/vsec: Return real error codes from registration path")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: David E. Box <david.e.box@linux.intel.com>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Link: https://patch.msgid.link/20261001220351.1592138-3-david.e.box@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/vsec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c
index 5ab2215fdd7fa..7d51f27f09bc9 100644
--- a/drivers/platform/x86/intel/vsec.c
+++ b/drivers/platform/x86/intel/vsec.c
@@ -641,7 +641,7 @@ static bool intel_vsec_get_features(struct pci_dev *pdev,
found = true;
if (info && (info->quirks & VSEC_QUIRK_NO_DVSEC) &&
- intel_vsec_walk_header(&pdev->dev, info))
+ !intel_vsec_walk_header(&pdev->dev, info))
found = true;
return found;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0681/1257] fbdev: sh_mobile_lcdcfb: Restore the per-overlay sysfs attributes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (679 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0680/1257] platform/x86/intel/vsec: Fix inverted walk_header() test in get_features() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0682/1257] fbdev: core: Initialize modelist in framebuffer_alloc() Greg Kroah-Hartman
` (317 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Helge Deller,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 317a8be730919177956be32422ebe00cf7e46710 ]
The ovl_* files documented in
Documentation/ABI/testing/sysfs-devices-platform-sh_mobile_lcdc_fb no
longer exist.
Commit a979182a2453 ("fbdev: lcdcfb: Register sysfs groups through driver
core") moved the attributes from each overlay's framebuffer device to
the platform driver's dev_groups and renamed them overlay_*. There is
now only one set of attributes for the whole LCDC. The callbacks still
expect dev_get_drvdata() to return a struct fb_info, but the platform
device holds struct sh_mobile_lcdc_priv, so they access the wrong
structure.
Restore the documented names and register the group on each overlay's
framebuffer device with device_add_groups(). Remove it with
device_remove_groups() before unregistering the framebuffer. Skip
creation when dev_of_fbinfo(info) is NULL, as the old device_create_file()
calls did.
Drop the CONFIG_FB_DEVICE guard, since the driver already depends on it.
Fixes: a979182a2453 ("fbdev: lcdcfb: Register sysfs groups through driver core")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/sh_mobile_lcdcfb.c | 39 +++++++++++++++++---------
1 file changed, 25 insertions(+), 14 deletions(-)
diff --git a/drivers/video/fbdev/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c
index e8324b01700f6..5743c96d54814 100644
--- a/drivers/video/fbdev/sh_mobile_lcdcfb.c
+++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c
@@ -1337,22 +1337,24 @@ overlay_rop3_store(struct device *dev, struct device_attribute *attr,
return count;
}
-static DEVICE_ATTR_RW(overlay_alpha);
-static DEVICE_ATTR_RW(overlay_mode);
-static DEVICE_ATTR_RW(overlay_position);
-static DEVICE_ATTR_RW(overlay_rop3);
-
-static struct attribute *overlay_sysfs_attrs[] __maybe_unused = {
- &dev_attr_overlay_alpha.attr,
- &dev_attr_overlay_mode.attr,
- &dev_attr_overlay_position.attr,
- &dev_attr_overlay_rop3.attr,
+static struct device_attribute dev_attr_ovl_alpha =
+ __ATTR(ovl_alpha, 0644, overlay_alpha_show, overlay_alpha_store);
+static struct device_attribute dev_attr_ovl_mode =
+ __ATTR(ovl_mode, 0644, overlay_mode_show, overlay_mode_store);
+static struct device_attribute dev_attr_ovl_position =
+ __ATTR(ovl_position, 0644, overlay_position_show, overlay_position_store);
+static struct device_attribute dev_attr_ovl_rop3 =
+ __ATTR(ovl_rop3, 0644, overlay_rop3_show, overlay_rop3_store);
+
+static struct attribute *overlay_sysfs_attrs[] = {
+ &dev_attr_ovl_alpha.attr,
+ &dev_attr_ovl_mode.attr,
+ &dev_attr_ovl_position.attr,
+ &dev_attr_ovl_rop3.attr,
NULL,
};
-#ifdef CONFIG_FB_DEVICE
ATTRIBUTE_GROUPS(overlay_sysfs);
-#endif
static const struct fb_fix_screeninfo sh_mobile_lcdc_overlay_fix = {
.id = "SH Mobile LCDC",
@@ -1510,9 +1512,10 @@ sh_mobile_lcdc_overlay_fb_unregister(struct sh_mobile_lcdc_overlay *ovl)
{
struct fb_info *info = ovl->info;
- if (info == NULL || info->dev == NULL)
+ if (!info || !dev_of_fbinfo(info))
return;
+ device_remove_groups(dev_of_fbinfo(info), overlay_sysfs_groups);
unregister_framebuffer(ovl->info);
}
@@ -1530,6 +1533,15 @@ sh_mobile_lcdc_overlay_fb_register(struct sh_mobile_lcdc_overlay *ovl)
if (ret < 0)
return ret;
+ /* The framebuffer device is optional, see fb_device_create(). */
+ if (dev_of_fbinfo(info)) {
+ ret = device_add_groups(dev_of_fbinfo(info), overlay_sysfs_groups);
+ if (ret < 0) {
+ unregister_framebuffer(info);
+ return ret;
+ }
+ }
+
dev_info(lcdc->dev, "registered %s/overlay %u as %dx%d %dbpp.\n",
dev_name(lcdc->dev), ovl->index, info->var.xres,
info->var.yres, info->var.bits_per_pixel);
@@ -2637,7 +2649,6 @@ static int sh_mobile_lcdc_probe(struct platform_device *pdev)
static struct platform_driver sh_mobile_lcdc_driver = {
.driver = {
.name = "sh_mobile_lcdc_fb",
- .dev_groups = overlay_sysfs_groups,
.pm = &sh_mobile_lcdc_dev_pm_ops,
},
.probe = sh_mobile_lcdc_probe,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0682/1257] fbdev: core: Initialize modelist in framebuffer_alloc()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (680 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0681/1257] fbdev: sh_mobile_lcdcfb: Restore the per-overlay sysfs attributes Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0683/1257] fbdev: ssd1307fb: check for fb_deferred_io_init() error Greg Kroah-Hartman
` (316 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrey Misiurov, Helge Deller,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Misiurov <andrey.misyrov@gmail.com>
[ Upstream commit 0c9cb9321cb3863b52bdea4b8ae5a27705762c9e ]
framebuffer_alloc() returns zeroed memory, so info->modelist starts out
with NULL next and prev pointers. The list head is initialized only
later, by fb_videomode_to_modelist() or by do_register_framebuffer().
The "fix potential memory leak" commits listed below added
fb_destroy_modelist(&info->modelist) to the probe error paths of s3fb,
tdfxfb, tridentfb, i740fb and carminefb. These paths can run before
the list head is initialized:
- s3fb, tdfxfb, tridentfb and i740fb call fb_videomode_to_modelist()
only after a successful EDID read, and tridentfb can also hit the
error path on an ioremap() or kmalloc() failure before that;
- carminefb jumps to the error path when fb_find_mode() fails, before
its fb_videomode_to_modelist() call.
fb_destroy_modelist() then dereferences the NULL head. Reproduced on
Debian 12 (6.1.180) by binding s3fb to a VGA device without EDID and
forcing fb_alloc_cmap() to fail:
s3fb 0000:00:03.0: cannot allocate colormap
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:fb_destroy_modelist+0x10/0x80
Call Trace:
s3_pci_probe.cold+0x12b/0x2bf [s3fb]
local_pci_probe+0x41/0x80
pci_device_probe+0xc3/0x240
really_probe+0xde/0x380
__driver_probe_device+0x84/0x150
driver_probe_device+0x1f/0x90
__driver_attach+0xce/0x1c0
bus_for_each_dev+0x87/0xd0
bus_add_driver+0x1ae/0x200
driver_register+0x89/0xe0
do_one_initcall+0x59/0x220
do_init_module+0x4a/0x1f0
Initialize the list head in framebuffer_alloc(), so info->modelist is
always a valid, possibly empty, list and fb_destroy_modelist() is safe
on every error path. Keep the lazy initialization in
do_register_framebuffer(), as drivers that embed struct fb_info rather
than calling framebuffer_alloc() still depend on it.
Fixes: 3b0ed04bc852 ("fbdev: s3fb: fix potential memory leak in s3_pci_probe()")
Fixes: bb019d755366 ("fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()")
Fixes: 7a35ec619d9a ("fbdev: tridentfb: fix potential memory leak in trident_pci_probe()")
Fixes: 5936063409af ("fbdev: i740fb: fix potential memory leak in i740fb_probe()")
Fixes: 6fcca16a2b19 ("fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Misiurov <andrey.misyrov@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/fb_info.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/core/fb_info.c b/drivers/video/fbdev/core/fb_info.c
index 52f9bd2c5417a..05988a936bebb 100644
--- a/drivers/video/fbdev/core/fb_info.c
+++ b/drivers/video/fbdev/core/fb_info.c
@@ -43,6 +43,7 @@ struct fb_info *framebuffer_alloc(size_t size, struct device *dev)
info->device = dev;
info->fbcon_rotate_hint = -1;
info->blank = FB_BLANK_UNBLANK;
+ INIT_LIST_HEAD(&info->modelist);
#if IS_ENABLED(CONFIG_FB_BACKLIGHT)
mutex_init(&info->bl_curve_mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0683/1257] fbdev: ssd1307fb: check for fb_deferred_io_init() error
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (681 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0682/1257] fbdev: core: Initialize modelist in framebuffer_alloc() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0684/1257] fbdev: xen-fbfront: " Greg Kroah-Hartman
` (315 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Helge Deller,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit 81ae1f9a6c850efab3e5dec6b7c9aa5c587f92b7 ]
fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.
Currently ssd1307fb_probe() ignores its return value.
Therefore if an error arises in fb_deferred_io_init() (for instance, due
to an allocation failure) info->fbdefio_state is left NULL.
When the file is subsequently opened, fb_open() will dereference a NULL
pointer (calling fb_deferred_io_open()).
Fix this by checking for the error.
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/ssd1307fb.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index 4d185c7542843..8fd96c37ee1ab 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -767,7 +767,11 @@ static int ssd1307fb_probe(struct i2c_client *client)
info->fix.smem_start = __pa(vmem);
info->fix.smem_len = vmem_size;
- fb_deferred_io_init(info);
+ ret = fb_deferred_io_init(info);
+ if (ret) {
+ dev_err(dev, "failed to init fb deferred io: %d\n", ret);
+ goto fb_defio_error;
+ }
i2c_set_clientdata(client, info);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0684/1257] fbdev: xen-fbfront: check for fb_deferred_io_init() error
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (682 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0683/1257] fbdev: ssd1307fb: check for fb_deferred_io_init() error Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0685/1257] fbdev: udlfb: " Greg Kroah-Hartman
` (314 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Helge Deller,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit 5b234b0dd29d79207c059c7b40851dd1e934fa3a ]
fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.
Currently xenfb_probe() ignores its return value.
Therefore if an error arises in fb_deferred_io_init() (for instance, due
to an allocation failure) info->fbdefio_state is left NULL.
When the file is subsequently opened, fb_open() will dereference a NULL
pointer (calling fb_deferred_io_open()).
Fix this by checking for the error.
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/xen-fbfront.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c
index 4385976277ac3..7ef909d4242d9 100644
--- a/drivers/video/fbdev/xen-fbfront.c
+++ b/drivers/video/fbdev/xen-fbfront.c
@@ -443,7 +443,11 @@ static int xenfb_probe(struct xenbus_device *dev,
}
fb_info->fbdefio = &xenfb_defio;
- fb_deferred_io_init(fb_info);
+ ret = fb_deferred_io_init(fb_info);
+ if (ret < 0) {
+ xenbus_dev_fatal(dev, ret, "fb_deferred_io_init");
+ goto error_cmap;
+ }
xenfb_init_shared_page(info, fb_info);
@@ -465,6 +469,7 @@ static int xenfb_probe(struct xenbus_device *dev,
error_fb:
fb_deferred_io_cleanup(fb_info);
+error_cmap:
fb_dealloc_cmap(&fb_info->cmap);
framebuffer_release(fb_info);
error_nomem:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0685/1257] fbdev: udlfb: check for fb_deferred_io_init() error
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (683 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0684/1257] fbdev: xen-fbfront: " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0686/1257] fbdev: smscufx: " Greg Kroah-Hartman
` (313 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Helge Deller,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit eae055f33e41e1d3e1a7e905bdcb1e9f196ed31d ]
fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.
Currently dlfb_ops_open() ignores its return value.
Therefore if an error arises in fb_deferred_io_init() (for instance, due to
an allocation failure) info->fbdefio_state is left NULL.
fb_open() will then dereference a NULL pointer (calling
fb_deferred_io_open()) as soon as dlfb_ops_open() returns.
Additionally, if the allocation of info->fbdefio itself fails,
dlfb_ops_open() sets info->fbdefio to NULL and invokes
fb_deferred_io_init() regardless, hitting BUG_ON(!fbdefio).
Fix this by only invoking fb_deferred_io_init() if the allocation
succeeded, and checking for the error.
The driver already supports operating without deferred I/O, so in either
case fall back to that by setting info->fbdefio to NULL.
The ignored return value was introduced in commit 56c134f7f1b5 ("fbdev:
Track deferred-I/O pages in pageref struct").
However, the BUG_ON() issue originates from the earlier
commit 5bea1fbf9423 ("staging: udlfb: fix incorrect fb_defio
implementation for multiple framebuffers"), so target that for the fix.
Fixes: 5bea1fbf9423 ("staging: udlfb: fix incorrect fb_defio implementation for multiple framebuffers")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/udlfb.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index 92b352bc7e969..8b7b4bdac4fbf 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -947,10 +947,13 @@ static int dlfb_ops_open(struct fb_info *info, int user)
fbdefio->delay = DL_DEFIO_WRITE_DELAY;
fbdefio->sort_pagereflist = true;
fbdefio->deferred_io = dlfb_dpy_deferred_io;
- }
- info->fbdefio = fbdefio;
- fb_deferred_io_init(info);
+ info->fbdefio = fbdefio;
+ if (fb_deferred_io_init(info)) {
+ kfree(fbdefio);
+ info->fbdefio = NULL;
+ }
+ }
}
dev_dbg(info->dev, "open, user=%d fb_info=%p count=%d\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0686/1257] fbdev: smscufx: check for fb_deferred_io_init() error
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (684 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0685/1257] fbdev: udlfb: " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0687/1257] fbdev: sh_mobile_lcdc: " Greg Kroah-Hartman
` (312 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Helge Deller,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit 8ea6c6e77ccf887f3e68c64f4c261071a345da1e ]
fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.
Currently ufx_ops_open() ignores its return value.
Therefore if an error arises in fb_deferred_io_init() (for instance, due to
an allocation failure) info->fbdefio_state is left NULL.
fb_open() will then dereference a NULL pointer (calling
fb_deferred_io_open()) as soon as ufx_ops_open() returns.
Additionally, if the allocation of info->fbdefio itself fails,
ufx_ops_open() sets info->fbdefio to NULL and invokes
fb_deferred_io_init() regardless, hitting BUG_ON(!fbdefio).
Fix this by only invoking fb_deferred_io_init() if the allocation
succeeded, and checking for the error.
The driver already supports operating without deferred I/O, so in either
case fall back to that by setting info->fbdefio to NULL.
The ignored return value was introduced in commit 56c134f7f1b5 ("fbdev:
Track deferred-I/O pages in pageref struct").
However, the BUG_ON() issue originates from the earlier
commit 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display
adapters"), so target that for the fix.
Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/smscufx.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
index 5704f60e1741b..34d8abd5b3544 100644
--- a/drivers/video/fbdev/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
@@ -1041,10 +1041,13 @@ static int ufx_ops_open(struct fb_info *info, int user)
if (fbdefio) {
fbdefio->delay = UFX_DEFIO_WRITE_DELAY;
fbdefio->deferred_io = ufx_dpy_deferred_io;
- }
- info->fbdefio = fbdefio;
- fb_deferred_io_init(info);
+ info->fbdefio = fbdefio;
+ if (fb_deferred_io_init(info)) {
+ kfree(fbdefio);
+ info->fbdefio = NULL;
+ }
+ }
}
pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d",
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0687/1257] fbdev: sh_mobile_lcdc: check for fb_deferred_io_init() error
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (685 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0686/1257] fbdev: smscufx: " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0688/1257] fbdev: kyro: Release WC setup on registration failure Greg Kroah-Hartman
` (311 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Helge Deller,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ Upstream commit 5192201aaac2a923ff98306e3ccda58718ee395f ]
fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.
Currently sh_mobile_lcdc_start() ignores its return value.
Therefore if an error arises in fb_deferred_io_init() (for instance, due
to an allocation failure) info->fbdefio_state is left NULL.
When the file is subsequently opened, fb_open() will dereference a NULL
pointer (calling fb_deferred_io_open()).
Fix this by checking for the error.
Also clear info->fbdefio in that case, so that sh_mobile_lcdc_stop() does
not attempt to clean up deferred I/O state that was never initialised.
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c
index 5743c96d54814..a8ef7c5993919 100644
--- a/drivers/video/fbdev/sh_mobile_lcdcfb.c
+++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c
@@ -1042,7 +1042,11 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
ch->defio.deferred_io = sh_mobile_lcdc_deferred_io;
ch->defio.delay = msecs_to_jiffies(tmp);
ch->info->fbdefio = &ch->defio;
- fb_deferred_io_init(ch->info);
+ ret = fb_deferred_io_init(ch->info);
+ if (ret) {
+ ch->info->fbdefio = NULL;
+ return ret;
+ }
}
sh_mobile_lcdc_display_on(ch);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0688/1257] fbdev: kyro: Release WC setup on registration failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (686 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0687/1257] fbdev: sh_mobile_lcdc: " Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0689/1257] fbdev: nvidia: Release write-combining handle on probe failure Greg Kroah-Hartman
` (310 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Helge Deller, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit d3bc005a62945aec57059201092b12b7c955e5a7 ]
If register_framebuffer() fails, kyrofb_probe() frees the framebuffer
without releasing its write-combining range. Release the range before
freeing the framebuffer. Earlier failures still skip this cleanup.
The missing cleanup already exists in the initial Git import, before
the conversion from mtrr_add() to arch_phys_wc_add().
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/kyro/fbdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index c237389888229..94d6af54e6c46 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -765,7 +765,7 @@ static int kyrofb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
fb_memset_io(info->screen_base, 0, size);
if (register_framebuffer(info) < 0)
- goto out_free_fb;
+ goto out_free_wc;
fb_info(info, "%s frame buffer device, at %dx%d@%d using %ldk/%ldk of VRAM\n",
info->fix.id,
@@ -776,6 +776,8 @@ static int kyrofb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
return 0;
+out_free_wc:
+ arch_phys_wc_del(currentpar->wc_cookie);
out_free_fb:
framebuffer_release(info);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0689/1257] fbdev: nvidia: Release write-combining handle on probe failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (687 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0688/1257] fbdev: kyro: Release WC setup on registration failure Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0690/1257] arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults Greg Kroah-Hartman
` (309 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Helge Deller, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 8710af6a35201a6d01b5af8f7e4bad29cc40467f ]
Failures in nvidia_set_fbinfo() or register_framebuffer() leave the handle
from arch_phys_wc_add() allocated. Release it in the shared error path,
as nvidiafb_remove() already does on normal removal.
The missing cleanup was already present in the initial Git import,
when the driver used mtrr_add() directly.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/nvidia/nvidia.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
index 4ef7a5ba43cc4..395f5d0455fa4 100644
--- a/drivers/video/fbdev/nvidia/nvidia.c
+++ b/drivers/video/fbdev/nvidia/nvidia.c
@@ -1423,6 +1423,7 @@ static int nvidiafb_probe(struct pci_dev *pd, const struct pci_device_id *ent)
return 0;
err_out_iounmap_fb:
+ arch_phys_wc_del(par->wc_cookie);
fb_destroy_modelist(&info->modelist);
err_out_free_base1:
fb_destroy_modedb(info->monspecs.modedb);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0690/1257] arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (688 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0689/1257] fbdev: nvidia: Release write-combining handle on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0691/1257] tools/dma: fix building from the top level with O= Greg Kroah-Hartman
` (308 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Catalin Marinas,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit 171be684bfa3020f81bf0b85bc7ac42024575fbf ]
When EFI runtime services are invoked from a preemptible kthread, the
kthread runs with efi_mm installed via kthread_use_mm() and preemption
enabled, so neither faulthandler_disabled() nor !mm applies in
do_page_fault(). A permission fault taken by the firmware on one of its
own (TTBR0) mappings then hits the 'access to user memory outside
uaccess routines' check and oopses, without efi_runtime_fixup_exception()
ever being consulted.
efi_mm has no VMAs, so there is nothing for the mm to resolve. Send such
faults to no_context directly, so that __do_kernel_fault() can recover
from them as it does when the call is made with preemption disabled.
Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption")
Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/mm/fault.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 75c3e463df2ef..357be4c9106df 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -620,9 +620,10 @@ static int __kprobes do_page_fault(unsigned long far, unsigned long esr,
/*
* If we're in an interrupt or have no user context, we must not take
- * the fault.
+ * the fault. EFI runtime services may execute with preemption enabled
+ * and mm == &efi_mm, but faults need to be treated as kernel faults.
*/
- if (faulthandler_disabled() || !mm)
+ if (faulthandler_disabled() || !mm || mm_is_efi(mm))
goto no_context;
if (user_mode(regs))
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0691/1257] tools/dma: fix building from the top level with O=
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (689 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0690/1257] arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0692/1257] serial: sc16is7xx: fix data corruption due to unexpected xon/xoff Greg Kroah-Hartman
` (307 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sasha Levin, Qinxin Xia,
Marek Szyprowski
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 352665c55877368854f87724698dad0b453444eb ]
"make O=<dir> tools/dma" fails:
Makefile:27: /tools/build/Makefile.include: No such file or directory
tools/Makefile clears srctree, and the dma Makefile only works it out
again when building_out_of_srctree is not set, which the top-level
Makefile sets for O= builds.
Also work out srctree when it is empty, as tools/bpf/Makefile does
since commit a89b2cbf71d64 ("tools, bpf: Fix build for 'make -s
tools/bpf O=<dir>'").
Fixes: f74ee32963f1b ("tools/dma: move dma_map_benchmark from selftests to tools/dma")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Sasha Levin <sashal@kernel.org>
Acked-by: Qinxin Xia <xiaqinxin@huawei.com>
Link: https://lore.kernel.org/r/20261011223358.2327625-4-sashal@kernel.org
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/dma/Makefile | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/tools/dma/Makefile b/tools/dma/Makefile
index 0c239a6b9eae5..20ae7f09cd206 100644
--- a/tools/dma/Makefile
+++ b/tools/dma/Makefile
@@ -7,7 +7,13 @@ bindir ?= /usr/bin
# isn't set and when invoked from selftests build, where srctree
# is set to ".". building_out_of_srctree is undefined for in srctree
# builds
+ifeq ($(srctree),)
+update_srctree := 1
+endif
ifndef building_out_of_srctree
+update_srctree := 1
+endif
+ifeq ($(update_srctree),1)
srctree := $(patsubst %/,%,$(dir $(CURDIR)))
srctree := $(patsubst %/,%,$(dir $(srctree)))
endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0692/1257] serial: sc16is7xx: fix data corruption due to unexpected xon/xoff
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (690 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0691/1257] tools/dma: fix building from the top level with O= Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0693/1257] serial: sc16is7xx: declare MCR and IER as volatile registers Greg Kroah-Hartman
` (306 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Martin Fuzzey, stable, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Fuzzey <martin.fuzzey@flowbird.group>
[ Upstream commit 8bb50e95c0abd44607bc60a43032c1dbf7470d5a ]
The hardware supports automatically sending XON/OFF based on the
FIFO status and that is already implemented by the driver.
However that capability was not announced with the UPF_SOFT_FLOW bit.
When the port is opened with the default of XON enabled the driver
configures that in the hardware.
If userspace does not want XON/OFF (which is normally the case) it will
use TCSETS to disactivate it. However the serial core optimises this
to only notify the driver if someting imporant has changed, and for
XON/XOFF thit is only if the driver declares UPF_SOFT_FLOW.
So we end up with unwanted XON/XOFF in the data stream.
The problem only occurs if nothing else needed to be set by termios,
ie if the user space requested values are the same as the default values,
except for XON/XOFF.
Since the default speed is 9600 this means that the problem only occurs
when requesting 9600, otherwise the call to the driver will be made to
change the speed, and that will also clear the XON/XOFF.
As 9600 is quite rare these days that probably explains why this hasn't
already been seen.
It also only occurs on the first port open after boot since the subsequent
opens will use the "logical state" set by TCSETS but not communicated to
the driver the first time.
Signed-off-by: Martin Fuzzey <martin.fuzzey@flowbird.group>
Fixes: dfeae619d781 ("serial: sc16is7xx")
Cc: stable@kernel.org
Link: https://patch.msgid.link/20261001100534.1225894-1-martin.fuzzey@flowbird.group
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/sc16is7xx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 296079c16fdb9..7ddc8a38adab4 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -1516,7 +1516,7 @@ static int sc16is7xx_setup_channel(struct sc16is7xx_one *one, int i,
/* Initialize port data */
port->type = PORT_SC16IS7XX;
port->fifosize = SC16IS7XX_FIFO_SIZE;
- port->flags = UPF_FIXED_TYPE | UPF_LOW_LATENCY;
+ port->flags = UPF_FIXED_TYPE | UPF_LOW_LATENCY | UPF_SOFT_FLOW;
port->iotype = UPIO_BUS;
port->rs485_config = sc16is7xx_config_rs485;
port->rs485_supported = sc16is7xx_rs485_supported;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0693/1257] serial: sc16is7xx: declare MCR and IER as volatile registers
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (691 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0692/1257] serial: sc16is7xx: fix data corruption due to unexpected xon/xoff Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0694/1257] serial: 8250_exar: store the GPIO platform device in struct exar8250 Greg Kroah-Hartman
` (305 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Hugo Villeneuve, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
[ Upstream commit 1c41d09dcd07ee9648e20aa8238e404c2e6a12fb ]
MCR register has the same address as XON1 register.
IER register has the same address as DLH register.
Which register is accessed depends on bits configuration in some
other registers.
To prevent potential access errors, declare MCR and IER as volatile
registers.
Fixes: dfeae619d781 ("serial: sc16is7xx")
Cc: stable@kernel.org
Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Link: https://patch.msgid.link/20261006192540.234402-1-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/sc16is7xx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 7ddc8a38adab4..fba5885595957 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -501,7 +501,9 @@ static bool sc16is7xx_regmap_volatile(struct device *dev, unsigned int reg)
{
switch (reg) {
case SC16IS7XX_RHR_REG: /* Shared address space with THR & DLL */
+ case SC16IS7XX_IER_REG: /* Shared address space with DLH */
case SC16IS7XX_IIR_REG: /* Shared address space with FCR & EFR */
+ case SC16IS7XX_MCR_REG: /* Shared address space with XON1 */
case SC16IS7XX_LSR_REG: /* Shared address space with XON2 */
case SC16IS7XX_MSR_REG: /* Shared address space with TCR & XOFF1 */
case SC16IS7XX_SPR_REG: /* Shared address space with TLR & XOFF2 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0694/1257] serial: 8250_exar: store the GPIO platform device in struct exar8250
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (692 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0693/1257] serial: sc16is7xx: declare MCR and IER as volatile registers Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0695/1257] dm-bufio: fix non-working memory limit Greg Kroah-Hartman
` (304 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
[ Upstream commit 33d337816e00994daaf670243186d9e537ee090d ]
The GPIO platform device is registered via platform->register_gpio()
when port 0 is being set up. It is stored to port->port.private_data of
the on-stack uart template (and from there it is copied into every
registered port). pci_xr17v35x_exit() then fetches it back by
serial8250_get_port(priv->line[0]).
But port 0 does not have to exist at that point. If
serial8250_register_8250_port() fails for port 0, priv->line[0] holds a
negative error code. The probe still succeeds (it only breaks the loop),
so on unbind, priv->line[0] (a negative value) is passed to
serial8250_get_port(). The GPIO device is never unregistered and a
bogus port is accessed.
The same problem would also occur after the planned conversion of
serial8250_register_8250_port() to return a uart port instead of a
line. As Sashiko pointed out in that case:
If board->setup() fails for the first port (i=0) in exar_pci_probe(),
priv->uport[0] remains NULL. If serial8250_register_8250_port() fails,
it returns an ERR_PTR. In either case, the loop breaks and probe
returns success. When the device is later unbound,
pci_xr17v35x_exit() unconditionally passes priv->uport[0] to
platform->unregister_gpio(), which will dereference it without
checking for validity.
The GPIO device belongs to the PCI device, not to any particular port.
So store it in a new struct exar8250::gpio member. Pass priv to both
->register_gpio() and ->unregister_gpio(), so that pci_xr17v35x_exit()
does not need to look up any port at all.
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Fixes: d0aeaa83f0b0 ("serial: exar: split out the exar code from 8250_pci")
Link: https://lore.kernel.org/all/sashiko-outbox-166269@kernel.org/
Assisted-by: LLM
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/03a8b5c71614fc672fef1e55c083bda6c73b5bf3.1791873876.git.jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_exar.c | 36 ++++++++++++++---------------
1 file changed, 18 insertions(+), 18 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
index 836792e861bfc..2e7adf6a410c6 100644
--- a/drivers/tty/serial/8250/8250_exar.c
+++ b/drivers/tty/serial/8250/8250_exar.c
@@ -231,8 +231,9 @@ struct exar8250_platform {
int (*rs485_config)(struct uart_port *port, struct ktermios *termios,
struct serial_rs485 *rs485);
const struct serial_rs485 *rs485_supported;
- int (*register_gpio)(struct pci_dev *pcidev, struct uart_8250_port *port);
- void (*unregister_gpio)(struct uart_8250_port *port);
+ int (*register_gpio)(struct exar8250 *priv, struct pci_dev *pcidev,
+ struct uart_8250_port *port);
+ void (*unregister_gpio)(struct exar8250 *priv);
};
/**
@@ -256,6 +257,7 @@ struct exar8250 {
struct exar8250_board *board;
struct eeprom_93cx6 eeprom;
void __iomem *virt;
+ struct platform_device *gpio;
int line[];
};
@@ -1167,22 +1169,21 @@ static const struct software_node exar_gpio_node = {
.properties = exar_gpio_properties,
};
-static int xr17v35x_register_gpio(struct pci_dev *pcidev, struct uart_8250_port *port)
+static int xr17v35x_register_gpio(struct exar8250 *priv, struct pci_dev *pcidev,
+ struct uart_8250_port *port)
{
if (pcidev->vendor == PCI_VENDOR_ID_EXAR)
- port->port.private_data =
- __xr17v35x_register_gpio(pcidev, &exar_gpio_node);
+ priv->gpio = __xr17v35x_register_gpio(pcidev, &exar_gpio_node);
return 0;
}
-static void xr17v35x_unregister_gpio(struct uart_8250_port *port)
+static void xr17v35x_unregister_gpio(struct exar8250 *priv)
{
- if (!port->port.private_data)
- return;
-
- __xr17v35x_unregister_gpio(port->port.private_data);
- port->port.private_data = NULL;
+ if (priv->gpio) {
+ __xr17v35x_unregister_gpio(priv->gpio);
+ priv->gpio = NULL;
+ }
}
static int sealevel_rs485_config(struct uart_port *port, struct ktermios *termios,
@@ -1279,8 +1280,9 @@ static const struct software_node iot2040_gpio_node = {
.properties = iot2040_gpio_properties,
};
-static int iot2040_register_gpio(struct pci_dev *pcidev,
- struct uart_8250_port *port)
+static int iot2040_register_gpio(struct exar8250 *priv,
+ struct pci_dev *pcidev,
+ struct uart_8250_port *port)
{
u8 __iomem *p = port->port.membase;
@@ -1289,8 +1291,7 @@ static int iot2040_register_gpio(struct pci_dev *pcidev,
writeb(IOT2040_UARTS_ENABLE, p + UART_EXAR_MPIOLVL_15_8);
writeb(IOT2040_UARTS_GPIO_HI_MODE, p + UART_EXAR_MPIOSEL_15_8);
- port->port.private_data =
- __xr17v35x_register_gpio(pcidev, &iot2040_gpio_node);
+ priv->gpio = __xr17v35x_register_gpio(pcidev, &iot2040_gpio_node);
return 0;
}
@@ -1367,7 +1368,7 @@ pci_xr17v35x_setup(struct exar8250 *priv, struct pci_dev *pcidev,
/* Setup Multipurpose Input/Output pins. */
setup_gpio(pcidev, p);
- ret = platform->register_gpio(pcidev, port);
+ ret = platform->register_gpio(priv, pcidev, port);
}
return ret;
@@ -1377,9 +1378,8 @@ static void pci_xr17v35x_exit(struct pci_dev *pcidev)
{
const struct exar8250_platform *platform = exar_get_platform();
struct exar8250 *priv = pci_get_drvdata(pcidev);
- struct uart_8250_port *port = serial8250_get_port(priv->line[0]);
- platform->unregister_gpio(port);
+ platform->unregister_gpio(priv);
}
static inline void exar_misc_clear(struct exar8250 *priv)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0695/1257] dm-bufio: fix non-working memory limit
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (693 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0694/1257] serial: 8250_exar: store the GPIO platform device in struct exar8250 Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0696/1257] dm-bufio: fix a race leading to an unsigned integer underflow Greg Kroah-Hartman
` (303 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 1190dbeaeaa026a4879e675b8556a150c36a7ced ]
The function evict_old is supposed to loop and evict buffers while the
allocated size is above the threshold. However if it hits one bufio
client that is empty, it stops and doesn't attempt to scan other
clients.
This commit fixes it, so that it skips empty clients and retries up to
dm_bufio_client_count times.
Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance")
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-bufio.c | 41 +++++++++++++++++++++++++++++++++++++----
1 file changed, 37 insertions(+), 4 deletions(-)
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index d58eed96a8ff5..edad64654ef68 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -2545,6 +2545,13 @@ struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsign
init_waitqueue_head(&c->free_buffer_wait);
c->async_write_error = 0;
+ /*
+ * A client with no buffers yet is not holding the oldest buffer in
+ * the system; leaving this zeroed would claim exactly that and keep
+ * the client pinned at the front of dm_bufio_all_clients.
+ */
+ c->oldest_buffer = jiffies;
+
c->dm_io = dm_io_client_create();
if (IS_ERR(c->dm_io)) {
r = PTR_ERR(c->dm_io);
@@ -2779,9 +2786,23 @@ static unsigned long __evict_a_few(unsigned long nr_buffers)
dm_bufio_unlock(c);
- if (count)
+ if (count) {
c->oldest_buffer = oldest_buffer;
- __insert_client(c);
+ __insert_client(c);
+ } else {
+ /*
+ * We evicted nothing, so 'oldest_buffer' tells us nothing new
+ * and the client keeps its old, possibly very stale, value.
+ * Requeue it at the back rather than by that value, otherwise
+ * __insert_client() would put it straight back at the front
+ * and every subsequent call would pop this same client again,
+ * never reaching any of the others.
+ *
+ * This leaves the list slightly out of order, which is fine -
+ * it is only ever an approximation.
+ */
+ list_add_tail(&c->client_list, &dm_bufio_all_clients);
+ }
return count;
}
@@ -2806,11 +2827,23 @@ static void evict_old(void)
{
unsigned long threshold = dm_bufio_cache_size -
dm_bufio_cache_size / DM_BUFIO_LOW_WATERMARK_RATIO;
+ int unproductive = 0;
mutex_lock(&dm_bufio_clients_lock);
while (dm_bufio_current_allocated > threshold) {
- if (!__evict_a_few(64))
- break;
+ if (__evict_a_few(64)) {
+ unproductive = 0;
+ } else {
+ /*
+ * This client had nothing to give. Try the others
+ * before giving up: one idle client, or one whose
+ * buffers are all held, must not stop us evicting
+ * from everybody else. Stop once a whole sweep of
+ * the client list has freed nothing.
+ */
+ if (++unproductive >= dm_bufio_client_count)
+ break;
+ }
cond_resched();
}
mutex_unlock(&dm_bufio_clients_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0696/1257] dm-bufio: fix a race leading to an unsigned integer underflow
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (694 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0695/1257] dm-bufio: fix non-working memory limit Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0697/1257] misc: issei: Fix issei architecture deps Greg Kroah-Hartman
` (302 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 005d2ec5723cd4ac740de678274623f1fadd6a6e ]
The function __scan tests "count - freed <= retain_target" and then sets
"atomic_long_set(&c->need_shrink, 0);" It exits with the condition "if
(!atomic_long_read(&c->need_shrink)) break;" It may be possible that
between these two statements, another thread sets &c->need_shrink to a
non-zero value. In this case, the function __scan continues and it may
possibly the "freed" variable is larger than the "count" variable. The
expression "count - freed" underflows and the function __scan will
continue to free all the buffers, even those that are below
retain_target.
Fix this bug by immediatelly exiting if we set
"atomic_long_set(&c->need_shrink, 0)"; and don't attempt to re-read
c->need_shrink afterwards.
Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance")
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-bufio.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index edad64654ef68..5f02262707610 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -2426,8 +2426,10 @@ static void __scan(struct dm_bufio_client *c)
for (l = 0; l < LIST_SIZE; l++) {
while (true) {
- if (count - freed <= retain_target)
+ if (count - freed <= retain_target) {
atomic_long_set(&c->need_shrink, 0);
+ break;
+ }
if (!atomic_long_read(&c->need_shrink))
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0697/1257] misc: issei: Fix issei architecture deps
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (695 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0696/1257] dm-bufio: fix a race leading to an unsigned integer underflow Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0698/1257] misc: tifm: dont clear dev->driver in tifm_device_remove() Greg Kroah-Hartman
` (301 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Peter Robinson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Robinson <pbrobinson@gmail.com>
[ Upstream commit a8af929e9d751a85e9f46e8515cbe266249465a2 ]
The issei driver is Intel specific and hence x86 only.
Fixes: 65f0ecb9ec85c ("issei: initial driver skeleton")
Cc: stable <stable@kernel.org>
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Link: https://patch.msgid.link/20261003150433.1369234-1-pbrobinson@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/issei/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/misc/issei/Kconfig b/drivers/misc/issei/Kconfig
index 12a3fd8099694..dfcfa2d30b9ee 100644
--- a/drivers/misc/issei/Kconfig
+++ b/drivers/misc/issei/Kconfig
@@ -2,6 +2,7 @@
# Copyright (C) 2023-2026 Intel Corporation
config INTEL_SSEI
tristate "Intel Silicon Security Engine Interface"
+ depends on X86
help
The ISSEI (Intel Silicon Security Engine Interface)
subsystem provides a communication channel between the host and the
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0698/1257] misc: tifm: dont clear dev->driver in tifm_device_remove()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (696 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0697/1257] misc: issei: Fix issei architecture deps Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0699/1257] mei: vsc: Fix packet CRC computed over pointer size Greg Kroah-Hartman
` (300 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Joshua Mulloy, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Mulloy <joshuamulloy@gmail.com>
[ Upstream commit 2b23952d70d43321a90dd8a06bcaab04a1a73118 ]
tifm_device_remove() sets sock->dev.driver to NULL after calling the
driver's remove() callback. Since commit a995fe1a3aa7 ("rust: driver:
drop device private data post unbind"), device_unbind_cleanup()
dereferences dev->driver after the bus remove() callback has returned,
so removing a card from a TI FlashMedia reader oopses:
BUG: kernel NULL pointer dereference, address: 0000000000000090
Workqueue: tifm tifm_7xx1_switch_media [tifm_7xx1]
RIP: 0010:device_unbind_cleanup+0x16/0xb0
Call Trace:
device_release_driver_internal+0x220/0x260
device_release_driver+0x12/0x20
bus_remove_device+0xf9/0x1c0
device_del+0x161/0x3b0
device_unregister+0x17/0x70
tifm_7xx1_switch_media.cold+0x6b/0xbd [tifm_7xx1]
process_one_work+0x1ac/0x3d0
worker_thread+0x1b8/0x360
kthread+0xf7/0x130
ret_from_fork+0x195/0x2a0
ret_from_fork_asm+0x1a/0x30
The driver core clears dev->driver itself in device_unbind_cleanup(), so
there is no need for the bus code to do it. Remove the assignment.
The problem was found and the fix written with the help of an AI coding
assistant. Tested on a Dell Precision M6500 (TI PCIxx12 FlashMedia,
104c:803b) running a 7.0 kernel: removing an SD card oopsed every time
without the fix; with it, insert, read and remove work.
Fixes: a995fe1a3aa7 ("rust: driver: drop device private data post unbind")
Cc: stable@kernel.org
Assisted-by: LLM
Signed-off-by: Joshua Mulloy <joshuamulloy@gmail.com>
Link: https://patch.msgid.link/20261004102525.34356-1-joshuamulloy@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/tifm_core.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/misc/tifm_core.c b/drivers/misc/tifm_core.c
index aac8f0933e435..03d1324bc2534 100644
--- a/drivers/misc/tifm_core.c
+++ b/drivers/misc/tifm_core.c
@@ -97,7 +97,6 @@ static void tifm_device_remove(struct device *dev)
sock->card_event = tifm_dummy_event;
sock->data_event = tifm_dummy_event;
drv->remove(sock);
- sock->dev.driver = NULL;
}
put_device(dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0699/1257] mei: vsc: Fix packet CRC computed over pointer size
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (697 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0698/1257] misc: tifm: dont clear dev->driver in tifm_device_remove() Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0700/1257] speakup: Fix NULL pointer dereference on VT switch + selection Greg Kroah-Hartman
` (299 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Sakari Ailus, Wentao Guan,
Alexander Usyskin, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 1d2a50533aac7046488da78b0d25f69673cbb028 ]
vsc_tp_xfer() computes the packet CRC over sizeof(pkt) + olen bytes,
but pkt is a pointer, so sizeof(pkt) evaluates to the pointer size
instead of the size of struct vsc_tp_packet_hdr. The value correctly
match the 8-byte header on 64-bit builds.
Use sizeof(pkt->hdr), consistent with the header size used everywhere
else in the driver, e.g. in VSC_TP_PACKET_SIZE().
Cc: stable@kernel.org
Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device")
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20261006-vcs_fix_crc-v1-1-b7b149f13c1d@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/mei/vsc-tp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/mei/vsc-tp.c b/drivers/misc/mei/vsc-tp.c
index 432bc59f11f97..ce877cb957574 100644
--- a/drivers/misc/mei/vsc-tp.c
+++ b/drivers/misc/mei/vsc-tp.c
@@ -293,7 +293,7 @@ int vsc_tp_xfer(struct vsc_tp *tp, u8 cmd, const void *obuf, size_t olen,
pkt->hdr.seq = cpu_to_le32(++tp->seq);
memcpy(pkt->buf, obuf, olen);
- crc = ~crc32(~0, (u8 *)pkt, sizeof(pkt) + olen);
+ crc = ~crc32(~0, (u8 *)pkt, sizeof(pkt->hdr) + olen);
memcpy(pkt->buf + olen, &crc, sizeof(crc));
ret = vsc_tp_wakeup_request(tp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0700/1257] speakup: Fix NULL pointer dereference on VT switch + selection
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (698 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0699/1257] mei: vsc: Fix packet CRC computed over pointer size Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0701/1257] clk: qcom: ipq-cmn-pll: Assign .num before accessing .hws Greg Kroah-Hartman
` (298 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, co+e5693071d903b832, Samuel Thibault,
stable, Weiming Shi, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Thibault <samuel.thibault@ens-lyon.org>
[ Upstream commit e1301ab8a8411fccc7effe0711fc09939a94953c ]
When selecting/pasting very quickly after VT switch, the tty is not set
yet, leading to a NULL dereference. We can just abort the operation.
Reported-by: co+e5693071d903b832@bugs.sh
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Cc: stable@kernel.org
Tested-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260829164945.2691317-3-samuel.thibault@ens-lyon.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accessibility/speakup/selection.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/accessibility/speakup/selection.c b/drivers/accessibility/speakup/selection.c
index 1713ce4e0ba53..a04a7e8c307b3 100644
--- a/drivers/accessibility/speakup/selection.c
+++ b/drivers/accessibility/speakup/selection.c
@@ -61,6 +61,9 @@ static struct speakup_selection_work speakup_sel_work = {
int speakup_set_selection(struct tty_struct *tty)
{
+ if (!tty)
+ return -ENODEV;
+
/* we get kref here first in order to avoid a subtle race when
* cancelling selection work. getting kref first establishes the
* invariant that if speakup_sel_work.tty is not NULL when
@@ -120,6 +123,9 @@ static struct speakup_selection_work speakup_paste_work = {
int speakup_paste_selection(struct tty_struct *tty)
{
+ if (!tty)
+ return -ENODEV;
+
tty_kref_get(tty);
if (cmpxchg(&speakup_paste_work.tty, NULL, tty)) {
tty_kref_put(tty);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0701/1257] clk: qcom: ipq-cmn-pll: Assign .num before accessing .hws
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (699 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0700/1257] speakup: Fix NULL pointer dereference on VT switch + selection Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0702/1257] clk: qcom: ipq5018: add 24MHz rate for USB UTMI clock Greg Kroah-Hartman
` (297 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aamir Ahmed, Luo Jie, Konrad Dybcio,
Gustavo A. R. Silva, Abel Vesa, Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aamir Ahmed <elb12345@hotmail.co.uk>
[ Upstream commit 231bbd135772390522be3656b34b49ea3039eccf ]
hw_data->hws[] is annotated with __counted_by(num), so hw_data->num
must hold the element count before the array is accessed.
ipq_cmn_pll_register_clks() assigns it only after storing the fixed
rate output clocks and the CMN PLL, and the unwind loop under
unregister_fixed_clk reads .hws[] with .num still zero. Both are
out-of-bounds accesses under CONFIG_UBSAN_BOUNDS.
Move the assignment to right after the allocation.
Fixes: f81715a4c87c ("clk: qcom: Add CMN PLL clock controller driver for IPQ SoC")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Reviewed-by: Luo Jie <jie.luo@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/AS8P251MB000187BDFAD98A21F4C356E9C8BD2@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/ipq-cmn-pll.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/qcom/ipq-cmn-pll.c b/drivers/clk/qcom/ipq-cmn-pll.c
index dafe8c1738df8..a9abad9ff4e57 100644
--- a/drivers/clk/qcom/ipq-cmn-pll.c
+++ b/drivers/clk/qcom/ipq-cmn-pll.c
@@ -380,6 +380,8 @@ static int ipq_cmn_pll_register_clks(struct platform_device *pdev)
if (!hw_data)
return -ENOMEM;
+ hw_data->num = num_clks + 1;
+
/*
* Register the CMN PLL clock, which is the parent clock of
* the fixed rate output clocks.
@@ -406,7 +408,6 @@ static int ipq_cmn_pll_register_clks(struct platform_device *pdev)
* is configured to 12 GHZ by DT property assigned-clock-rates-u64.
*/
hw_data->hws[CMN_PLL_CLK] = cmn_pll_hw;
- hw_data->num = num_clks + 1;
ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get, hw_data);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0702/1257] clk: qcom: ipq5018: add 24MHz rate for USB UTMI clock
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (700 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0701/1257] clk: qcom: ipq-cmn-pll: Assign .num before accessing .hws Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0703/1257] clk: qcom: ipq5332: " Greg Kroah-Hartman
` (296 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kathiravan Thirumoorthy, Abel Vesa,
Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
[ Upstream commit 75e893169fc5c9ec28d5f9dffde40ce29b59a5de ]
The USB UTMI reference clock must operate at 24 MHz, as recommended
by the hardware team, for reliable USB operation.
Validation showed that USB 3.2 hub enumeration with USB 2.0 devices
fails when the UTMI reference clock is not configured to the required
24 MHz rate. Configuring the UTMI reference clock to 24 MHz to resolve
the enumeration failure and ensure successful device detection.
Cc: stable@vger.kernel.org
Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018")
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-ipq_clk_changes-v1-1-d242e3d49648@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-ipq5018.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c
index 46da652956fb0..add6a53d4df55 100644
--- a/drivers/clk/qcom/gcc-ipq5018.c
+++ b/drivers/clk/qcom/gcc-ipq5018.c
@@ -1269,6 +1269,7 @@ static struct clk_rcg2 usb0_master_clk_src = {
};
static const struct freq_tbl ftbl_usb0_mock_utmi_clk_src[] = {
+ F(24000000, P_XO, 1, 0, 0),
F(60000000, P_GPLL4, 10, 1, 2),
{ }
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0703/1257] clk: qcom: ipq5332: add 24MHz rate for USB UTMI clock
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (701 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0702/1257] clk: qcom: ipq5018: add 24MHz rate for USB UTMI clock Greg Kroah-Hartman
@ 2026-11-07 13:49 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0704/1257] clk: qcom: ipq5210: " Greg Kroah-Hartman
` (295 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kathiravan Thirumoorthy, Abel Vesa,
Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
[ Upstream commit 19b62f31e15ef70dc927aab91b1576ea6c37f992 ]
The USB UTMI reference clock must operate at 24 MHz, as recommended
by the hardware team, for reliable USB operation.
Validation showed that USB 3.2 hub enumeration with USB 2.0 devices
fails when the UTMI reference clock is not configured to the required
24 MHz rate. Configuring the UTMI reference clock to 24 MHz to resolve
the enumeration failure and ensure successful device detection.
Cc: stable@vger.kernel.org
Fixes: 3d89d52970fd ("clk: qcom: add Global Clock controller (GCC) driver for IPQ5332 SoC")
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-ipq_clk_changes-v1-2-d242e3d49648@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-ipq5332.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/qcom/gcc-ipq5332.c b/drivers/clk/qcom/gcc-ipq5332.c
index ecd9ebeed7549..4625b447c2351 100644
--- a/drivers/clk/qcom/gcc-ipq5332.c
+++ b/drivers/clk/qcom/gcc-ipq5332.c
@@ -1038,6 +1038,7 @@ static struct clk_rcg2 gcc_usb0_master_clk_src = {
};
static const struct freq_tbl ftbl_gcc_usb0_mock_utmi_clk_src[] = {
+ F(24000000, P_XO, 1, 0, 0),
F(60000000, P_GPLL4_OUT_AUX, 10, 1, 2),
{ }
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0704/1257] clk: qcom: ipq5210: add 24MHz rate for USB UTMI clock
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (702 preceding siblings ...)
2026-11-07 13:49 ` [PATCH 7.3 0703/1257] clk: qcom: ipq5332: " Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0705/1257] iomap: dont lose a fiemap iteration error when emitting the last extent Greg Kroah-Hartman
` (294 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kathiravan Thirumoorthy, Abel Vesa,
Bjorn Andersson, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
[ Upstream commit 4d61492b5fa910ed59c4cbc699d2e5a03a5777d3 ]
The USB UTMI reference clock must operate at 24 MHz, as recommended
by the hardware team, for reliable USB operation.
Validation showed that USB 3.2 hub enumeration with USB 2.0 devices
fails when the UTMI reference clock is not configured to the required
24 MHz rate. Configuring the UTMI reference clock to 24 MHz to resolve
the enumeration failure and ensure successful device detection.
Cc: stable@vger.kernel.org
Fixes: 844be6e24afd ("clk: qcom: add Global Clock controller (GCC) driver for IPQ5210 SoC")
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-ipq_clk_changes-v1-3-d242e3d49648@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-ipq5210.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/qcom/gcc-ipq5210.c b/drivers/clk/qcom/gcc-ipq5210.c
index 3a786a21bdff5..76adfa8bf2ad9 100644
--- a/drivers/clk/qcom/gcc-ipq5210.c
+++ b/drivers/clk/qcom/gcc-ipq5210.c
@@ -716,6 +716,7 @@ static struct clk_rcg2 gcc_usb0_master_clk_src = {
};
static const struct freq_tbl ftbl_gcc_usb0_mock_utmi_clk_src[] = {
+ F(24000000, P_XO, 1, 0, 0),
F(60000000, P_GPLL4_OUT_AUX, 10, 1, 2),
{ }
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0705/1257] iomap: dont lose a fiemap iteration error when emitting the last extent
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (703 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0704/1257] clk: qcom: ipq5210: " Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0706/1257] iomap: dont lose a failed direct I/O bios error when zeroing the tail Greg Kroah-Hartman
` (293 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brian Foster, Darrick J. Wong,
Christoph Hellwig, Andrea Parri, Christian Brauner (Amutable),
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit 0d0104adc2c8316433b660cdf6d182a09881864f ]
iomap_fiemap() emits extents one behind: iomap_fiemap_iter() flushes the
previous extent and remembers the current one, and the remembered extent
is written with FIEMAP_EXTENT_LAST after the iteration loop.
That final flush overwrites ret, so when ->iomap_begin() fails partway
through the iteration the error is replaced by the result of
iomap_to_fiemap() (zero on success) and iomap_fiemap() returns success
with a truncated extent list whose last entry is wrongly marked as the
last extent in the file. The pre-iomap_iter code returned the error
from inside the loop, before flushing the pending extent.
Check for the iteration error before flushing the pending extent, so
that real errors are propagated and only a successful iteration emits
the final FIEMAP_EXTENT_LAST extent. -ENOENT (no mapping) is still not
an error, and the pending extent is still emitted in that case.
Fixes: 7892386d3571 ("iomap: switch iomap_fiemap to use iomap_iter")
Cc: stable@vger.kernel.org # v5.15
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://patch.msgid.link/250226e33b3b23c6b1714a45dc3c465c2a45cdc0.1790342457.git.parri.andrea@gmail.com
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/iomap/fiemap.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/fs/iomap/fiemap.c b/fs/iomap/fiemap.c
index d11dadff82865..54b824b7edb5c 100644
--- a/fs/iomap/fiemap.c
+++ b/fs/iomap/fiemap.c
@@ -76,15 +76,15 @@ int iomap_fiemap(struct inode *inode, struct fiemap_extent_info *fi,
while ((ret = iomap_iter(&iter, ops)) > 0)
iter.status = iomap_fiemap_iter(&iter, fi, &prev);
+ /* inode with no (attribute) mapping will give ENOENT */
+ if (ret < 0 && ret != -ENOENT)
+ return ret;
+
if (prev.type != IOMAP_HOLE) {
ret = iomap_to_fiemap(fi, &prev, FIEMAP_EXTENT_LAST);
if (ret < 0)
return ret;
}
-
- /* inode with no (attribute) mapping will give ENOENT */
- if (ret < 0 && ret != -ENOENT)
- return ret;
return 0;
}
EXPORT_SYMBOL_GPL(iomap_fiemap);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0706/1257] iomap: dont lose a failed direct I/O bios error when zeroing the tail
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (704 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0705/1257] iomap: dont lose a fiemap iteration error when emitting the last extent Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0707/1257] nvme-rdma: dont complete a request after a bogus remote invalidation Greg Kroah-Hartman
` (292 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Pankaj Raghav,
Andrea Parri, Christoph Hellwig, Christian Brauner (Amutable),
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit a9fd24bcbe690ed4a5b8ea6a7516fa297fae9360 ]
iomap_dio_bio_iter() falls through to the sub-block tail zeroing when
the data bio submission fails, so that the rest of the block is still
zeroed and stale data is not exposed. The zeroing result was assigned
to ret, which overwrote the submission error with the successful
zeroing result (zero) and the failed write was reported as success.
iomap_dio_zero() can only return an error from a can't-happen
WARN_ON_ONCE() (nr_vecs exceeding BIO_MAX_VECS, which the existing
comment there says "shall never be reached" for any in-tree
filesystem), so it isn't a real runtime failure worth reporting to
userspace, let alone one worth losing the actual submission error for.
Make iomap_dio_zero() return void and drop the error handling at both
call sites instead of threading the result through a separate
variable.
Fixes: 10553a91652d ("iomap: fix iomap_dio_zero() for fs bs > system page size")
Cc: stable@vger.kernel.org # v6.12
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Pankaj Raghav <p.raghav@samsung.com>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://patch.msgid.link/0cbce1012f5333690be36a9adafb3e190fe2ca77.1790342457.git.parri.andrea@gmail.com
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/iomap/direct-io.c | 16 +++++-----------
1 file changed, 5 insertions(+), 11 deletions(-)
diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c
index 8b4039d16ce89..7f1e85f95a469 100644
--- a/fs/iomap/direct-io.c
+++ b/fs/iomap/direct-io.c
@@ -296,7 +296,7 @@ u32 iomap_finish_ioend_direct(struct iomap_ioend *ioend)
return vec_count;
}
-static int iomap_dio_zero(const struct iomap_iter *iter, struct iomap_dio *dio,
+static void iomap_dio_zero(const struct iomap_iter *iter, struct iomap_dio *dio,
loff_t pos, unsigned len)
{
struct inode *inode = file_inode(dio->iocb->ki_filp);
@@ -305,14 +305,14 @@ static int iomap_dio_zero(const struct iomap_iter *iter, struct iomap_dio *dio,
int nr_vecs = max(1, i_blocksize(inode) / folio_size(zero_folio));
if (!len)
- return 0;
+ return;
/*
* This limit shall never be reached as most filesystems have a
* maximum blocksize of 64k.
*/
if (WARN_ON_ONCE(nr_vecs > BIO_MAX_VECS))
- return -EINVAL;
+ return;
bio = iomap_dio_alloc_bio(iter, dio, nr_vecs,
REQ_OP_WRITE | REQ_SYNC | REQ_IDLE);
@@ -328,8 +328,6 @@ static int iomap_dio_zero(const struct iomap_iter *iter, struct iomap_dio *dio,
len -= io_len;
}
iomap_dio_submit_bio(iter, dio, bio, pos);
-
- return 0;
}
static ssize_t iomap_dio_bio_iter_one(struct iomap_iter *iter,
@@ -541,10 +539,7 @@ static int iomap_dio_bio_iter(struct iomap_iter *iter, struct iomap_dio *dio)
if (need_zeroout) {
/* zero out from the start of the block to the write offset */
pad = pos & (fs_block_size - 1);
-
- ret = iomap_dio_zero(iter, dio, pos - pad, pad);
- if (ret)
- goto out;
+ iomap_dio_zero(iter, dio, pos - pad, pad);
}
do {
@@ -582,8 +577,7 @@ static int iomap_dio_bio_iter(struct iomap_iter *iter, struct iomap_dio *dio)
/* zero out from the end of the write to the end of the block */
pad = pos & (fs_block_size - 1);
if (pad)
- ret = iomap_dio_zero(iter, dio, pos,
- fs_block_size - pad);
+ iomap_dio_zero(iter, dio, pos, fs_block_size - pad);
}
out:
/* Undo iter limitation to current extent */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0707/1257] nvme-rdma: dont complete a request after a bogus remote invalidation
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (705 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0706/1257] iomap: dont lose a failed direct I/O bios error when zeroing the tail Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0708/1257] nvmet: fix preempt of another registrant by the reservation holder Greg Kroah-Hartman
` (291 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Yehyeong Lee,
Keith Busch, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit 909307cea08aff4e486cdb7491de5c76a2c31341 ]
When a remote invalidation names an rkey that is not the one we handed out
for this request, nvme_rdma_process_nvme_rsp() logs and schedules error
recovery, then falls through to nvme_rdma_end_request(). The request is
completed with req->mr never invalidated, and nvme_rdma_unmap_data() hands
it back with ib_mr_pool_put(), which only puts it on a list. The rkey
stays valid and still maps the pages the completed read filled, so a
controller that sent the bogus invalidation can write into those pages
after pread() has returned.
Return instead, the way the local invalidation path below already does,
and leave the request for error recovery to cancel.
Fixes: 3ef0279bb0031 ("nvme-rdma: Check remotely invalidated rkey matches our expected rkey")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/rdma.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 9cb811a2ce1f7..5b9b540693b51 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1748,6 +1748,7 @@ static void nvme_rdma_process_nvme_rsp(struct nvme_rdma_queue *queue,
"Bogus remote invalidation for rkey %#x\n",
req->mr ? req->mr->rkey : 0);
nvme_rdma_error_recovery(queue->ctrl);
+ return;
}
} else if (req->mr) {
int ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0708/1257] nvmet: fix preempt of another registrant by the reservation holder
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (706 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0707/1257] nvme-rdma: dont complete a request after a bogus remote invalidation Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0709/1257] nvme-auth: fail when the controller does not authenticate itself Greg Kroah-Hartman
` (290 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Daejun Park,
Keith Busch, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daejun Park <daejun7.park@samsung.com>
[ Upstream commit d9e84d4e19994818b80846bd2abb7b396e4116a9 ]
Unless the reservation is of an All Registrants type, nvmet_pr_preempt()
treats every Reservation Acquire command with the Preempt or Preempt and
Abort action that is sent by the reservation holder as the holder
preempting itself. It updates the reservation type to RTYPE and
completes the command successfully without looking at PRKEY.
NVMe Base Specification 2.1, section 8.1.22.7 makes the action depend
on PRKEY for these reservation types, no matter which registrant sends
the command:
- PRKEY matches the key of the reservation holder: the reservation is
preempted. This is how a holder preempts itself.
- PRKEY does not match the key of the holder and is not 0h: the
registrants whose key matches PRKEY are unregistered.
- PRKEY does not match the key of the holder and is 0h: the command is
aborted with Invalid Field in Command.
With the current code, a holder that preempts with the key of another
registrant leaves that registrant registered, changes the reservation
type to RTYPE and still gets a successful completion. With hosts A, B
and C registered with the keys 0xa, 0xb and 0xc, and A holding an
Exclusive Access - Registrants Only reservation, A sends:
# nvme resv-acquire /dev/nvme1 -n 1 --crkey=0xa --prkey=0xb \
--rtype=4 --racqa=1
NVME Reservation Acquire success
# nvme resv-report /dev/nvme1 -n 1 --eds | grep '^regctl '
regctl : 3
and B can still write to the namespace. Preempt and Abort (--racqa=2)
gives the same result. When C sends the preempt instead (--crkey=0xc),
B is unregistered and its writes fail with Reservation Conflict.
This defeats fencing in the pNFS SCSI layout server. nfsd holds the
reservation and fences a client that does not return its layout by
calling pr_preempt() with the key of that client and the abort flag,
which is the command RFC 9561 section 2.2.3 asks for. On an nvmet
namespace the preempt succeeds, nfsd logs the client as fenced, and the
client keeps writing to the device. In a test with an nfsd server and
two clients on an nvmet-tcp namespace, the namespace still had three
registrants after the fence and the fenced client went on writing to
it. With this patch two registrants are left and the writes of the
fenced client fail with a reservation conflict.
Take the self preempt path only when PRKEY is the key of the holder.
Any other PRKEY sent by the holder is then handled by the code that
already serves a non-holder registrant, for Preempt and for Preempt and
Abort. For a host that holds the reservation this changes the
following:
- A preempt with the key of another registrant unregisters the
registrants with that key, sends them the registration preempted
notification and leaves the reservation type alone.
- A preempt with PRKEY 0h fails with Invalid Field in Command. A
holder that changed its reservation type this way has to pass its
own key in PRKEY, which works with and without this patch.
- A preempt with a PRKEY that matches no registrant fails with
Reservation Conflict. The specification defines that status only
for the All Registrants types. It is what nvmet already returns to
a non-holder registrant in this case and what the SCSI target
returns for an unregistered key. nfsd treats it as a successful
fence.
Not changed: when the holder preempts itself, registrants that share
its key stay registered.
Fixes: 5a47c2080a73 ("nvmet: support reservation feature")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/pr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/target/pr.c b/drivers/nvme/target/pr.c
index ad13a93afb782..14eaa99f98fa3 100644
--- a/drivers/nvme/target/pr.c
+++ b/drivers/nvme/target/pr.c
@@ -589,7 +589,7 @@ static u16 nvmet_pr_preempt(struct nvmet_req *req,
&ctrl->hostid, abort);
}
- if (holder == reg) {
+ if (holder == reg && prkey == holder->rkey) {
status = nvmet_pr_update_reg_attr(pr, holder,
nvmet_pr_update_holder_rtype, &rtype);
if (!status && original_rtype != rtype)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0709/1257] nvme-auth: fail when the controller does not authenticate itself
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (707 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0708/1257] nvmet: fix preempt of another registrant by the reservation holder Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0710/1257] nvmet: free the bvec on file namespace range errors Greg Kroah-Hartman
` (289 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Christoph Hellwig,
Yehyeong Lee, Keith Busch, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit f9e43d924bc74feeb56197de82b2845de2a4b85a ]
nvme_auth_process_dhchap_success1() returns success as soon as the
controller clears the rvalid flag in its DH-HMAC-CHAP success1 message,
without looking at whether the host had asked the controller to
authenticate. A host configured with a controller secret sends a
challenge in its reply, computes the expected controller response, and
sets chap->bi_directional; if the controller then answers with
rvalid = 0 the response is never compared, the host still sends
success2, and the queue is marked as authenticated.
A malicious or man-in-the-middle controller therefore only has to clear
one flag to turn the configured bidirectional authentication into a
one-way one, without holding any secret of its own. The target side
already treats the mirror image of this as fatal: when the host supplied
a challenge but no controller key is configured, nvmet_auth_success1()
fails the authentication rather than answering with rvalid = 0.
Refuse the connection if the controller returns no response although
bidirectional authentication was requested. chap->bi_directional is the
right condition rather than ctrl->ctrl_key, because secure concatenation
sends a challenge only to derive the PSK and deliberately clears
bi_directional; a one-way setup without a controller secret keeps
returning success as before.
Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/auth.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index e55920642f2c1..cbb38935fa227 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -358,8 +358,21 @@ static int nvme_auth_process_dhchap_success1(struct nvme_ctrl *ctrl,
nvme_auth_hmac_name(chap->hash_id),
nvme_auth_dhgroup_name(chap->dhgroup_id));
- if (!data->rvalid)
+ if (!data->rvalid) {
+ /*
+ * The controller did not return a response. If we asked it to
+ * authenticate itself the session must not be used, otherwise
+ * mutual authentication would silently degrade to one-way.
+ */
+ if (chap->bi_directional) {
+ dev_warn(ctrl->device,
+ "qid %d: controller did not authenticate\n",
+ chap->qid);
+ chap->status = NVME_AUTH_DHCHAP_FAILURE_FAILED;
+ return -ECONNREFUSED;
+ }
return 0;
+ }
/* Validate controller response */
if (crypto_memneq(chap->response, data->rval, data->hl)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0710/1257] nvmet: free the bvec on file namespace range errors
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (708 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0709/1257] nvme-auth: fail when the controller does not authenticate itself Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0711/1257] nvmet: require authentication before property set Greg Kroah-Hartman
` (288 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Jérémy Jean, Keith Busch, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
[ Upstream commit 9d820d55b3cb4859c7cf42a74dc78f6154f97398 ]
nvmet_file_execute_rw() allocates the bvec before
nvmet_file_execute_io() checks whether the request fits in the backing
file. If the request extends beyond the file, nvmet_file_execute_io()
calls nvmet_req_complete() to return an error. This skips
nvmet_file_io_done(), so the allocated memory is never freed. Repeated
requests can exhaust memory.
Use nvmet_file_io_done() to free the bvec before returning the range
error to the client.
Fixes: 50a909db36f2 ("nvmet: use IOCB_NOWAIT for file-ns buffered I/O")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/io-cmd-file.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
index 0b22d183f9279..695963dd932ee 100644
--- a/drivers/nvme/target/io-cmd-file.c
+++ b/drivers/nvme/target/io-cmd-file.c
@@ -133,8 +133,8 @@ static bool nvmet_file_execute_io(struct nvmet_req *req, int ki_flags)
pos = le64_to_cpu(req->cmd->rw.slba) << req->ns->blksize_shift;
if (unlikely(pos + req->transfer_len > req->ns->size)) {
- nvmet_req_complete(req, errno_to_nvme_status(req, -ENOSPC));
- return true;
+ ret = -ENOSPC;
+ goto complete;
}
memset(&req->f.iocb, 0, sizeof(struct kiocb));
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0711/1257] nvmet: require authentication before property set
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (709 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0710/1257] nvmet: free the bvec on file namespace range errors Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0712/1257] nvme: bound FDP config log reads to the received buffer Greg Kroah-Hartman
` (287 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Sung Byeongchan,
Keith Busch, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sung Byeongchan <tjdqudcks0424@naver.com>
[ Upstream commit 44512543ff0413031516a02cde67323a55e0f769 ]
I/O queues do not perform independent DH-HMAC-CHAP authentication. They
instead rely on authentication of the controller's admin queue. Fabrics
property commands, however, are dispatched before the general admin command
authentication check.
An unauthenticated peer can consequently set CC.EN, connect an I/O queue,
and access a namespace after admin CONNECT reported that authentication was
required. Reject PROPERTY_SET until the admin queue has authenticated.
Targets without a configured authentication key are unchanged.
This was found by source review with AI assistance. A localhost NVMe/TCP
wire reproducer retrieved a known 4 KiB namespace block in two independent
boots without completing AUTH_SEND or AUTH_RECEIVE. With this change,
PROPERTY_SET returned NVME_SC_AUTH_REQUIRED and the namespace data was not
returned; the no-authentication control continued to work.
Fixes: c91a20129185 ("nvmet-auth: authenticate on admin queue only")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/fabrics-cmd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
index 42d1d18116715..b451029ab8f49 100644
--- a/drivers/nvme/target/fabrics-cmd.c
+++ b/drivers/nvme/target/fabrics-cmd.c
@@ -14,6 +14,10 @@ static void nvmet_execute_prop_set(struct nvmet_req *req)
if (!nvmet_check_transfer_len(req, 0))
return;
+ if (!nvmet_check_auth_status(req)) {
+ status = NVME_SC_AUTH_REQUIRED | NVME_STATUS_DNR;
+ goto out;
+ }
if (req->cmd->prop_set.attrib & 1) {
req->error_loc =
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0712/1257] nvme: bound FDP config log reads to the received buffer
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (710 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0711/1257] nvmet: require authentication before property set Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0713/1257] nvmet: zns: dont leak stale memory in zone management receive Greg Kroah-Hartman
` (286 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kanchan Joshi, Christoph Hellwig,
Yehyeong Lee, Keith Busch, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit 3cf6de080d97d0d9641fbdb613d546c0734905dd ]
nvme_query_fdp_granularity() parses the FDP Configurations log using
sizes the controller returns, without checking that they fit the buffer
it was given. The log size is only bounded from above before
kvmalloc(), so a size below the log header makes
le16_to_cpu(h->numfdpc) read past the allocation, and a size of zero
yields ZERO_SIZE_PTR and faults. Each configuration descriptor is then
dereferenced (dsze while walking, and nrg and runs on the selected one)
without checking that the whole descriptor lies within the buffer, so a
descriptor at or past the end is read out of bounds. The out-of-bounds
runs value is then exposed to userspace through
/sys/block/nvmeXnY/queue/write_stream_granularity.
A device-supplied dsze that is not a multiple of eight also leaves the
following descriptors unaligned, and the structure is not packed, so
reading nrg and runs from one can fault on architectures without
efficient unaligned access.
A malicious or buggy controller triggers this during namespace scan with a
short FDP Configurations log:
[ 1.104828] BUG: KASAN: slab-out-of-bounds in nvme_alloc_ns+0x39a6/0x4480
[ 1.104848] Read of size 8 at addr ffff888009fd8fe0 by task kworker/u8:3/52
[ 1.104852]
[ 1.104857] CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 7.3.0-rc6-00063-g0c2669a9f4a1 #1 PREEMPT(lazy)
[ 1.104862] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
[ 1.104866] Workqueue: async async_run_entry_fn
[ 1.104873] Call Trace:
[ 1.104876] <TASK>
[ 1.104878] dump_stack_lvl+0x66/0xa0
[ 1.104886] print_report+0xd0/0x630
[ 1.104893] ? nvme_alloc_ns+0x39a6/0x4480
[ 1.104897] ? __virt_addr_valid+0x209/0x3f0
[ 1.104903] ? nvme_alloc_ns+0x39a6/0x4480
[ 1.104907] kasan_report+0xe4/0x120
[ 1.104913] ? nvme_alloc_ns+0x39a6/0x4480
[ 1.104919] nvme_alloc_ns+0x39a6/0x4480
[ 1.104926] ? __pfx_nvme_alloc_ns+0x10/0x10
[ 1.104931] ? check_prev_add+0xfd/0xe80
[ 1.104942] ? lock_acquire+0x18d/0x300
[ 1.104948] ? nvme_find_get_ns+0xbb/0x2e0
[ 1.104952] ? find_held_lock+0x2b/0x80
[ 1.104956] ? nvme_find_get_ns+0x221/0x2e0
[ 1.104962] ? nvme_find_get_ns+0x231/0x2e0
[ 1.104967] ? nvme_scan_ns+0x2e1/0x8d0
[ 1.104971] ? kfree+0x2e5/0x510
[ 1.104976] ? __lock_acquire+0x570/0x1b00
[ 1.104982] nvme_scan_ns+0x56a/0x8d0
[ 1.104987] ? __pfx_nvme_scan_ns+0x10/0x10
[ 1.104994] ? lockdep_hardirqs_on_prepare+0xdc/0x190
[ 1.104999] ? trace_hardirqs_on+0x18/0x160
[ 1.105005] ? kvm_clock_get_cycles+0x19/0x40
[ 1.105011] ? __pfx_nvme_scan_ns_async+0x10/0x10
[ 1.105015] async_run_entry_fn+0x8d/0x290
[ 1.105020] process_one_work+0x8ac/0x1b00
[ 1.105029] ? __pfx_process_one_work+0x10/0x10
[ 1.105034] ? lock_acquire+0x18d/0x300
[ 1.105040] ? lock_is_held_type+0x8f/0x100
[ 1.105046] ? __pfx_async_run_entry_fn+0x10/0x10
[ 1.105050] worker_thread+0x4ee/0xe70
[ 1.105056] ? lockdep_hardirqs_on_prepare+0xdc/0x190
[ 1.105061] ? trace_hardirqs_on+0x18/0x160
[ 1.105066] ? __pfx_worker_thread+0x10/0x10
[ 1.105071] ? __pfx_worker_thread+0x10/0x10
[ 1.105076] kthread+0x2ce/0x3b0
[ 1.105080] ? __pfx_kthread+0x10/0x10
[ 1.105085] ret_from_fork+0x52e/0x780
[ 1.105090] ? __pfx_ret_from_fork+0x10/0x10
[ 1.105094] ? __switch_to+0x572/0xde0
[ 1.105101] ? __pfx_kthread+0x10/0x10
[ 1.105105] ret_from_fork_asm+0x1a/0x30
[ 1.105114] </TASK>
[ 1.105116]
[ 1.105117] Allocated by task 52:
[ 1.105119] kasan_save_stack+0x33/0x60
[ 1.105123] kasan_save_track+0x14/0x30
[ 1.105126] __kasan_kmalloc+0x8f/0xa0
[ 1.105129] __kvmalloc_node_noprof+0x2e1/0x820
[ 1.105134] nvme_alloc_ns+0x1097/0x4480
[ 1.105138] nvme_scan_ns+0x56a/0x8d0
[ 1.105142] async_run_entry_fn+0x8d/0x290
[ 1.105145] process_one_work+0x8ac/0x1b00
[ 1.105148] worker_thread+0x4ee/0xe70
[ 1.105152] kthread+0x2ce/0x3b0
[ 1.105155] ret_from_fork+0x52e/0x780
[ 1.105159] ret_from_fork_asm+0x1a/0x30
[ 1.105163]
[ 1.105164] The buggy address belongs to the object at ffff888009fd8fc0
[ 1.105164] which belongs to the cache kmalloc-32 of size 32
[ 1.105167] The buggy address is located 8 bytes to the right of
[ 1.105167] allocated 24-byte region [ffff888009fd8fc0, ffff888009fd8fd8)
[ 1.105171]
[ 1.105172] The buggy address belongs to the physical page:
[ 1.105175] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9fd8
[ 1.105179] flags: 0x100000000000000(node=0|zone=1)
[ 1.105183] page_type: f5(slab)
[ 1.105188] raw: 0100000000000000 ffff888008c41780 dead000000000100 dead000000000122
[ 1.105192] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000
[ 1.105194] page dumped because: kasan: bad access detected
[ 1.105195]
[ 1.105196] Memory state around the buggy address:
[ 1.105198] ffff888009fd8e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1.105201] ffff888009fd8f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1.105203] >ffff888009fd8f80: fc fc fc fc fc fc fc fc 00 00 00 fc fc fc fc fc
[ 1.105205] ^
[ 1.105207] ffff888009fd9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[ 1.105210] ffff888009fd9080: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 1.105212] ==================================================================
Reject a log smaller than its header plus one configuration descriptor,
zero the buffer so a short transfer leaves no uninitialized tail to parse,
require each descriptor's declared size to be at least a descriptor and to
leave room for the next one before walking it, and read the descriptor
fields with the unaligned accessors.
Fixes: 30b5f20bb2dda ("nvme: register fdp parameters with the block layer")
Cc: stable@vger.kernel.org
Suggested-by: Kanchan Joshi <joshi.k@samsung.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 7eb0f9fe6b18d..af71d02b84765 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -2273,13 +2273,18 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl,
}
size = le32_to_cpu(hdr.sze);
+ if (size < sizeof(*h) + sizeof(*desc)) {
+ dev_warn(ctrl->device, "FDP config size too small:%zu\n",
+ size);
+ return 0;
+ }
if (size > PAGE_SIZE * MAX_ORDER_NR_PAGES) {
dev_warn(ctrl->device, "FDP config size too large:%zu\n",
size);
return 0;
}
- h = kvmalloc(size, GFP_KERNEL);
+ h = kvzalloc(size, GFP_KERNEL);
if (!h)
return -ENOMEM;
@@ -2305,9 +2310,9 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl,
desc = log;
end = log + size - sizeof(*h);
for (i = 0; i < fdp_idx; i++) {
- u16 dsze = le16_to_cpu(desc->dsze);
+ u16 dsze = get_unaligned_le16(&desc->dsze);
- if (!dsze || log + dsze > end) {
+ if (dsze < sizeof(*desc) || log + dsze + sizeof(*desc) > end) {
dev_warn(ctrl->device,
"FDP invalid config descriptor at index %d\n", i);
ret = 0;
@@ -2317,13 +2322,13 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl,
desc = log;
}
- if (le32_to_cpu(desc->nrg) > 1) {
+ if (get_unaligned_le32(&desc->nrg) > 1) {
dev_warn(ctrl->device, "FDP NRG > 1 not supported\n");
ret = 0;
goto out;
}
- info->runs = le64_to_cpu(desc->runs);
+ info->runs = get_unaligned_le64(&desc->runs);
out:
kvfree(h);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0713/1257] nvmet: zns: dont leak stale memory in zone management receive
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (711 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0712/1257] nvme: bound FDP config log reads to the received buffer Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0714/1257] f2fs: convert inline quota files when turning quota on Greg Kroah-Hartman
` (285 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Andrea Parri,
Keith Busch, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit 31b8a6af19b73e6167c4b655cd5e86681bac1c41 ]
A Zone Management Receive report returns the full buffer the host asked
for, but nvmet_bdev_zone_zmgmt_recv_work() writes only the 8-byte
Number of Zones field and one 64-byte descriptor for each matching zone
that fits. The 56 reserved header bytes and every descriptor slot past
the last match keep whatever the buffer held before. A 4096-byte report
covering a single zone leaves 4024 bytes unwritten.
The tcp, rdma and fc transports allocate that buffer with sgl_alloc()
and pci-epf with kmalloc(), none with __GFP_ZERO, and on success each
sends the whole buffer to the host (nvmet_setup_c2h_data_pdu() for
tcp), so the host receives old kernel memory from the target.
nvmet_bdev_execute_zone_mgmt_recv() also never checks the transport
data length against NUMD, so on transports where the host sets that
length, the buffer sent back can be much larger than the report NUMD
describes. pci-epf derives its data length from NUMD, so the length
check below does not apply there, but the zeroing still covers the
report.
Reject a data length that does not match NUMD with
nvmet_check_transfer_len(), as nvmet_bdev_execute_zone_append() does,
and zero the report with nvmet_zero_sgl() before filling it. Zeroing
NUMD bytes is only enough because of the length check, so the two go
together.
Allocating with __GFP_ZERO in the transports would also close the leak,
but it adds a memset to every read command to fix one handler, so the
transports are left alone.
Tested over the loop, tcp, rdma and fc transports with a zoned
null_blk namespace: before this patch, zone reports carried stale bytes
and a data length larger than NUMD was accepted; with it, reports are
fully initialized and such a length fails with Data SGL Length Invalid.
Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/zns.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c
index 23a17c02abee2..78d82b6ff1214 100644
--- a/drivers/nvme/target/zns.c
+++ b/drivers/nvme/target/zns.c
@@ -282,6 +282,11 @@ static void nvmet_bdev_zone_zmgmt_recv_work(struct work_struct *w)
if (status)
goto out;
+ /* Only the zone count and matching descriptors are written below. */
+ status = nvmet_zero_sgl(req, 0, out_bufsize);
+ if (status)
+ goto out;
+
if (!req_slba_nr_zones) {
status = NVME_SC_SUCCESS;
goto out;
@@ -317,6 +322,11 @@ static void nvmet_bdev_zone_zmgmt_recv_work(struct work_struct *w)
void nvmet_bdev_execute_zone_mgmt_recv(struct nvmet_req *req)
{
+ u32 out_bufsize = (le32_to_cpu(req->cmd->zmr.numd) + 1) << 2;
+
+ if (!nvmet_check_transfer_len(req, out_bufsize))
+ return;
+
INIT_WORK(&req->z.zmgmt_work, nvmet_bdev_zone_zmgmt_recv_work);
queue_work(zbd_wq, &req->z.zmgmt_work);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0714/1257] f2fs: convert inline quota files when turning quota on
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (712 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0713/1257] nvmet: zns: dont leak stale memory in zone management receive Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0715/1257] PCI: rockchip-ep: Do not attempt 5.0 GT/s retraining Greg Kroah-Hartman
` (284 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Daeho Jeong, Chao Yu,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <daehojeong@google.com>
[ Upstream commit a85e09bd6cc80059b9e0ef5cd1467719aa3129a8 ]
With a block size larger than 4KB, the inline data area is large enough
to hold a freshly created quota file (quotacheck writes 6KB), so
aquota.user/aquota.group stay inline after quotaon. f2fs does not
expect quota files to be inline, and this causes two problems:
1. Quota file corruption. f2fs_write_single_data_page() sends quota
inodes straight to f2fs_do_write_data_page(), which sees NULL_ADDR
for index 0, treats the folio as truncated and drops it. Updates to
the quota file are lost once the folio is reclaimed, so the quota
tree reads stale data: chown/chgrp fail with EIO and quota entries
of users disappear. For example, the kernel log shows:
find_free_dqentry: Data block full but it shouldn't
qtree_write_dquot: Error -5 occurred while creating quota
2. Deadlock. Writing a quota file past MAX_INLINE_DATA converts it from
f2fs_write_begin() under f2fs_lock_op(). dquot_transfer() is called
from f2fs_setattr() with f2fs_lock_op() already held, so chown/chgrp
take cp_rwsem for read twice and hang, together with the checkpoint
and every other writer, once a checkpoint waits for cp_rwsem in
between (seen with generic/232).
Quota files only grow and there are at most MAXQUOTAS of them, so there
is no point in keeping them inline. Convert them in f2fs_quota_on() and
after dquot_quota_on_mount(), which keeps every block size on the same
path as 4KB blocks, where quota files never fit inline. Quota sysfiles
are created by mkfs with real blocks and are not affected.
Cc: stable@kernel.org
Fixes: d7e9a9037de2 ("f2fs: Support Block Size == Page Size")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/super.c | 33 ++++++++++++++++++++++++++++++++-
1 file changed, 32 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 1314b6ccced98..137b123777edc 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -3305,15 +3305,42 @@ static qsize_t *f2fs_get_reserved_space(struct inode *inode)
return &F2FS_I(inode)->i_reserved_quota;
}
+/*
+ * Quota files only grow and there are at most MAXQUOTAS of them, so there is
+ * no point in keeping them inline. Writeback of quota files does not handle
+ * inline data and would drop what was written to them.
+ */
+static int f2fs_quota_convert_inline(struct inode *inode)
+{
+ int err;
+
+ if (!f2fs_has_inline_data(inode))
+ return 0;
+
+ inode_lock(inode);
+ err = f2fs_convert_inline_inode(inode);
+ inode_unlock(inode);
+ return err;
+}
+
static int f2fs_quota_on_mount(struct f2fs_sb_info *sbi, int type)
{
+ int err;
+
if (is_set_ckpt_flags(sbi, CP_QUOTA_NEED_FSCK_FLAG)) {
f2fs_err(sbi, "quota sysfile may be corrupted, skip loading it");
return 0;
}
- return dquot_quota_on_mount(sbi->sb, F2FS_OPTION(sbi).s_qf_names[type],
+ err = dquot_quota_on_mount(sbi->sb, F2FS_OPTION(sbi).s_qf_names[type],
F2FS_OPTION(sbi).s_jquota_fmt, type);
+ if (err)
+ return err;
+
+ err = f2fs_quota_convert_inline(sb_dqopt(sbi->sb)->files[type]);
+ if (err)
+ dquot_quota_off(sbi->sb, type);
+ return err;
}
int f2fs_enable_quota_files(struct f2fs_sb_info *sbi, bool rdonly)
@@ -3518,6 +3545,10 @@ static int f2fs_quota_on(struct super_block *sb, int type, int format_id,
inode = d_inode(path->dentry);
+ err = f2fs_quota_convert_inline(inode);
+ if (err)
+ goto out;
+
err = filemap_fdatawrite(inode->i_mapping);
if (err)
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0715/1257] PCI: rockchip-ep: Do not attempt 5.0 GT/s retraining
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (713 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0714/1257] f2fs: convert inline quota files when turning quota on Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0716/1257] PCI: rockchip-host: " Greg Kroah-Hartman
` (283 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragan Simic, Shawn Lin,
Geraldo Nascimento, Manivannan Sadhasivam, Bjorn Helgaas,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geraldo Nascimento <geraldogabriel@gmail.com>
[ Upstream commit 7f173bfa6d42742de4ab647e001232c1165ab28e ]
Drop the 5.0 GT/s Link Speed retraining code block from Rockchip PCIe EP
driver. The reason is that Shawn Lin from Rockchip has reiterated that
there may be danger of "catastrophic failure" in using their PCIe with 5.0
GT/s speeds.
While Rockchip has done so informally without issuing a proper errata, and
the particulars are thus unknown, this may cause data loss or worse.
This change is corroborated by RK3399 official datasheet [1], which states
maximum link speed for this platform is 2.5 GT/s.
[1] https://opensource.rock-chips.com/images/d/d7/Rockchip_RK3399_Datasheet_V2.1-20200323.pdf
Fixes: bd6e61df4b2e ("PCI: rockchip-ep: Improve link training")
Reported-by: Dragan Simic <dsimic@manjaro.org>
Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://lore.kernel.org/all/ffd05070-9879-4468-94e3-b88968b4c21b@rock-chips.com/
Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/d994f8fb3481bbb8f3972f117334a6e8aea383fb.1781622998.git.geraldogabriel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rockchip-ep.c | 13 -------------
1 file changed, 13 deletions(-)
diff --git a/drivers/pci/controller/pcie-rockchip-ep.c b/drivers/pci/controller/pcie-rockchip-ep.c
index 799461335762e..9ebc227a1ef84 100644
--- a/drivers/pci/controller/pcie-rockchip-ep.c
+++ b/drivers/pci/controller/pcie-rockchip-ep.c
@@ -553,19 +553,6 @@ static void rockchip_pcie_ep_link_training(struct work_struct *work)
if (ret)
goto again;
- /*
- * Check the current speed: if gen2 speed was requested and we are not
- * at gen2 speed yet, retrain again for gen2.
- */
- val = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL);
- if (!PCIE_LINK_IS_GEN2(val) && rockchip->link_gen == 2) {
- /* Enable retrain for gen2 */
- rockchip_pcie_ep_retrain_link(rockchip);
- readl_poll_timeout(rockchip->apb_base + PCIE_CORE_CTRL,
- val, PCIE_LINK_IS_GEN2(val), 50,
- LINK_TRAIN_TIMEOUT);
- }
-
/* Check again that the link is up */
if (!rockchip_pcie_ep_link_up(rockchip))
goto again;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0716/1257] PCI: rockchip-host: Do not attempt 5.0 GT/s retraining
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (714 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0715/1257] PCI: rockchip-ep: Do not attempt 5.0 GT/s retraining Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0717/1257] PCI: rockchip: Drive at 2.5 GT/s, error other speeds Greg Kroah-Hartman
` (282 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragan Simic, Shawn Lin,
Geraldo Nascimento, Manivannan Sadhasivam, Bjorn Helgaas,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geraldo Nascimento <geraldogabriel@gmail.com>
[ Upstream commit 2a1e6c382fb7567679c07bd6a7060fefc7a5edc9 ]
Drop the 5.0 GT/s Link Speed retraining from Rockchip PCIe Root Complex
Mode Operation, so-called host driver.
The reason is that Shawn Lin from Rockchip has reiterated that there may be
danger of "catastrophic failure" in using their PCIe with 5.0GT/s speeds.
While Rockchip has done so informally without issuing a proper errata, and
the particulars are thus unknown, this may cause data loss or worse.
This change is corroborated by RK3399 official datasheet [1], which states
maximum link speed for this platform is 2.5 GT/s.
[1] https://opensource.rock-chips.com/images/d/d7/Rockchip_RK3399_Datasheet_V2.1-20200323.pdf
Fixes: e77f847df54c ("PCI: rockchip: Add Rockchip PCIe controller support")
Reported-by: Dragan Simic <dsimic@manjaro.org>
Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://lore.kernel.org/all/ffd05070-9879-4468-94e3-b88968b4c21b@rock-chips.com/
Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/68f6353e3a2ea4914de36c42b6906e41282adad3.1781622998.git.geraldogabriel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rockchip-host.c | 20 --------------------
1 file changed, 20 deletions(-)
diff --git a/drivers/pci/controller/pcie-rockchip-host.c b/drivers/pci/controller/pcie-rockchip-host.c
index d203c4876d304..0b52f2e370f41 100644
--- a/drivers/pci/controller/pcie-rockchip-host.c
+++ b/drivers/pci/controller/pcie-rockchip-host.c
@@ -328,26 +328,6 @@ static int rockchip_pcie_host_init_port(struct rockchip_pcie *rockchip)
goto err_power_off_phy;
}
- if (rockchip->link_gen == 2) {
- /*
- * Enable retrain for gen2. This should be configured only after
- * gen1 finished.
- */
- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2);
- status &= ~PCI_EXP_LNKCTL2_TLS;
- status |= PCI_EXP_LNKCTL2_TLS_5_0GT;
- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2);
- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
- status |= PCI_EXP_LNKCTL_RL;
- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
-
- err = readl_poll_timeout(rockchip->apb_base + PCIE_CORE_CTRL,
- status, PCIE_LINK_IS_GEN2(status), 20,
- 500 * USEC_PER_MSEC);
- if (err)
- dev_dbg(dev, "PCIe link training gen2 timeout, fall back to gen1!\n");
- }
-
/* Check the final link width from negotiated lane counter from MGMT */
status = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL);
status = 0x1 << ((status & PCIE_CORE_PL_CONF_LANE_MASK) >>
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0717/1257] PCI: rockchip: Drive at 2.5 GT/s, error other speeds
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (715 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0716/1257] PCI: rockchip-host: " Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0718/1257] sh: intc: Sort the prio and sense lists after filling them Greg Kroah-Hartman
` (281 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragan Simic, Shawn Lin,
Geraldo Nascimento, Manivannan Sadhasivam, Bjorn Helgaas,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geraldo Nascimento <geraldogabriel@gmail.com>
[ Upstream commit 84d08ff902f1ec01177fef1a21a38934927f5aee ]
Configure the core to be driven at 2.5 GT/s Link Speed and ignore any other
speed with a warning. Also drop the 5.0 GT/s Link Speed defines from
Rockchip PCIe header.
The reason is that Shawn Lin from Rockchip has reiterated that there may be
danger of "catastrophic failure" in using their PCIe with 5.0 GT/s speeds.
While Rockchip has done so informally without issuing a proper errata, and
the particulars are thus unknown, this may cause data loss or worse.
This change is corroborated by RK3399 official datasheet [1], which states
maximum link speed for this platform is 2.5 GT/s.
[1] https://opensource.rock-chips.com/images/d/d7/Rockchip_RK3399_Datasheet_V2.1-20200323.pdf
Fixes: 956cd99b35a8 ("PCI: rockchip: Separate common code from RC driver")
Reported-by: Dragan Simic <dsimic@manjaro.org>
Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://lore.kernel.org/all/ffd05070-9879-4468-94e3-b88968b4c21b@rock-chips.com/
Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/7421df7a7b7778ee99363cccfdfabbfa8aa6ab5e.1781622998.git.geraldogabriel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rockchip.c | 14 ++++++--------
drivers/pci/controller/pcie-rockchip.h | 3 ---
2 files changed, 6 insertions(+), 11 deletions(-)
diff --git a/drivers/pci/controller/pcie-rockchip.c b/drivers/pci/controller/pcie-rockchip.c
index 8d78ab1b31f0f..45cc888ac5537 100644
--- a/drivers/pci/controller/pcie-rockchip.c
+++ b/drivers/pci/controller/pcie-rockchip.c
@@ -66,8 +66,10 @@ int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip)
}
rockchip->link_gen = of_pci_get_max_link_speed(node);
- if (rockchip->link_gen < 0 || rockchip->link_gen > 2)
- rockchip->link_gen = 2;
+ if (rockchip->link_gen < 0 || rockchip->link_gen >= 2) {
+ rockchip->link_gen = 1;
+ dev_warn(dev, "invalid max-link-speed, limited to 2.5 GT/s\n");
+ }
for (i = 0; i < ROCKCHIP_NUM_PM_RSTS; i++)
rockchip->pm_rsts[i].id = rockchip_pci_pm_rsts[i];
@@ -147,12 +149,8 @@ int rockchip_pcie_init_port(struct rockchip_pcie *rockchip)
goto err_exit_phy;
}
- if (rockchip->link_gen == 2)
- rockchip_pcie_write(rockchip, PCIE_CLIENT_GEN_SEL_2,
- PCIE_CLIENT_CONFIG);
- else
- rockchip_pcie_write(rockchip, PCIE_CLIENT_GEN_SEL_1,
- PCIE_CLIENT_CONFIG);
+ rockchip_pcie_write(rockchip, PCIE_CLIENT_GEN_SEL_1,
+ PCIE_CLIENT_CONFIG);
regs = PCIE_CLIENT_ARI_ENABLE |
PCIE_CLIENT_CONF_LANE_NUM(rockchip->lanes);
diff --git a/drivers/pci/controller/pcie-rockchip.h b/drivers/pci/controller/pcie-rockchip.h
index 3e82a69b9c006..b5da15601b585 100644
--- a/drivers/pci/controller/pcie-rockchip.h
+++ b/drivers/pci/controller/pcie-rockchip.h
@@ -42,7 +42,6 @@
#define PCIE_CLIENT_MODE_RC HWORD_SET_BIT(0x0040)
#define PCIE_CLIENT_MODE_EP HWORD_CLR_BIT(0x0040)
#define PCIE_CLIENT_GEN_SEL_1 HWORD_CLR_BIT(0x0080)
-#define PCIE_CLIENT_GEN_SEL_2 HWORD_SET_BIT(0x0080)
#define PCIE_CLIENT_LEGACY_INT_CTRL (PCIE_CLIENT_BASE + 0x0c)
#define PCIE_CLIENT_INT_IN_ASSERT HWORD_SET_BIT(0x0002)
#define PCIE_CLIENT_INT_IN_DEASSERT HWORD_CLR_BIT(0x0002)
@@ -197,8 +196,6 @@
(((x) & PCIE_CORE_PL_CONF_LS_MASK) == PCIE_CORE_PL_CONF_LS_READY)
#define PCIE_LINK_UP(x) \
(((x) & PCIE_CLIENT_LINK_STATUS_MASK) == PCIE_CLIENT_LINK_STATUS_UP)
-#define PCIE_LINK_IS_GEN2(x) \
- (((x) & PCIE_CORE_PL_CONF_SPEED_MASK) == PCIE_CORE_PL_CONF_SPEED_5G)
#define RC_REGION_0_ADDR_TRANS_H 0x00000000
#define RC_REGION_0_ADDR_TRANS_L 0x00000000
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0718/1257] sh: intc: Sort the prio and sense lists after filling them
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (716 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0717/1257] PCI: rockchip: Drive at 2.5 GT/s, error other speeds Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0719/1257] accel/qaic: Cancel Sahara read data work on removal Greg Kroah-Hartman
` (280 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter,
John Paul Adrian Glaubitz, Geert Uytterhoeven, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 94a219eda3b5fb1d1753a5ecf28b171c8f308a27 ]
register_intc_controller() sorts d->prio and d->sense right after
allocating them, with hw->nr_prio_regs and hw->nr_sense_regs as the
element count. The lists hold hw->nr_vectors entries and are only
filled later, by intc_register_irq().
On SH7785, sh7785-irq0123 and sh7785-irq4567 have four vectors but the
SoC's eleven priority registers, so sort() swaps 88 bytes in a 32 byte
kmalloc object at boot. slub_debug=FZPU reports "Right Redzone
overwritten" in kmalloc-32, and v6.5 and v6.6 panic in
__kmem_cache_alloc_node() while registering sh7785-irq0123.
Found with a custom QEMU model of the SH7785LCR. On it, v6.4
sh7785lcr_defconfig boots with SLAB, the defconfig default before v6.5,
and hangs before the console is up when built with SLUB.
Sort the lists once all vectors are registered, with the number of
entries that were added.
Fixes: b59f9f9775e6 ("sh: intc: optimize intc IRQ lookup")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/sh/intc/core.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c
index aa68fe190865d..ffbe60234eefc 100644
--- a/drivers/sh/intc/core.c
+++ b/drivers/sh/intc/core.c
@@ -275,9 +275,6 @@ int __init register_intc_controller(struct intc_desc *desc)
k += save_reg(d, k, hw->prio_regs[i].set_reg, smp);
k += save_reg(d, k, hw->prio_regs[i].clr_reg, smp);
}
-
- sort(d->prio, hw->nr_prio_regs, sizeof(*d->prio),
- intc_handle_int_cmp, NULL);
}
if (hw->sense_regs) {
@@ -287,9 +284,6 @@ int __init register_intc_controller(struct intc_desc *desc)
for (i = 0; i < hw->nr_sense_regs; i++)
k += save_reg(d, k, hw->sense_regs[i].reg, 0);
-
- sort(d->sense, hw->nr_sense_regs, sizeof(*d->sense),
- intc_handle_int_cmp, NULL);
}
if (hw->subgroups)
@@ -357,6 +351,11 @@ int __init register_intc_controller(struct intc_desc *desc)
}
}
+ sort(d->prio, d->nr_prio, sizeof(*d->prio),
+ intc_handle_int_cmp, NULL);
+ sort(d->sense, d->nr_sense, sizeof(*d->sense),
+ intc_handle_int_cmp, NULL);
+
intc_subgroup_init(desc, d);
/* enable bits matching force_enable after registering irqs */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0719/1257] accel/qaic: Cancel Sahara read data work on removal
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (717 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0718/1257] sh: intc: Sort the prio and sense lists after filling them Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0720/1257] f2fs: remove mappedtodisk flag usage in mmap write path Greg Kroah-Hartman
` (279 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Jeff Hugo,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 018e5a021904707b91cecd77e7f759937ec04643 ]
Sahara removal cancels fw_work and dump_work, but leaves read_data_work
pending or running. The latter accesses the firmware and the device-managed
context and transfer buffer, which are released during removal.
Cancel read_data_work after fw_work, which can schedule it, and before
releasing the firmware. The MHI core suspends and resets the channels
before invoking the driver's remove callback.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code. The same omission was also reported by the
Sashiko bot while reviewing the Sahara relocation series.
Fixes: 7fb19ea1ec6a ("accel/qaic: Support the new READ_DATA implementation")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260701105055.8D4371F00A3A@smtp.kernel.org/
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
[jhugo: reorder cancel_work_sync() calls]
Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Link: https://patch.msgid.link/20260917192512.56205-1-mhun512@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/qaic/sahara.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/accel/qaic/sahara.c b/drivers/accel/qaic/sahara.c
index c7c0b3eb4b65f..6333c45ef7d2a 100644
--- a/drivers/accel/qaic/sahara.c
+++ b/drivers/accel/qaic/sahara.c
@@ -880,6 +880,7 @@ static void sahara_mhi_remove(struct mhi_device *mhi_dev)
cancel_work_sync(&context->fw_work);
cancel_work_sync(&context->dump_work);
+ cancel_work_sync(&context->read_data_work);
vfree(context->mem_dump);
sahara_release_image(context);
mhi_unprepare_from_transfer(mhi_dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0720/1257] f2fs: remove mappedtodisk flag usage in mmap write path
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (718 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0719/1257] accel/qaic: Cancel Sahara read data work on removal Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0721/1257] f2fs: allow pinning empty compressed files Greg Kroah-Hartman
` (278 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chao Yu, Barry Song, Nanzhe Zhao,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
[ Upstream commit b3c9843589257631bac18f30655e82d88970688a ]
PG_mappedtodisk was inherited from the nobh/buffer-head era. However,
f2fs has no buffer heads and the flag is no longer meaningful. The only
user of the flag is the "no holes" shortcut in f2fs_vm_page_mkwrite(),
which makes mmap write faults skip marking the folio dirty. Moreover,
it causes the following race condition with filesystem freezing:
CPU0 (write fault) CPU1 (freeze_super)
---- ----
f2fs_vm_page_mkwrite()
sb_start_pagefault()
/* shortcut: no dirty */
sb_end_pagefault()
sb_wait_write(SB_FREEZE_PAGEFAULT)
/* no waiter, passes */
sync_filesystem()
/* folio not dirty, skipped */
finish_fault()
/* PTE writable */
fault_dirty_shared_page()
folio_mark_dirty()
/* dirty folio on a frozen fs */
It will also skip APP_MAPPED_IO iostat/REQ_TIME updates and post-EOF
folio zeroing.
Remove this shortcut in f2fs_vm_page_mkwrite() and stop setting it in
f2fs_read_single_page().
Reported-by: Chao Yu <chao@kernel.org>
Link: https://lore.kernel.org/linux-f2fs-devel/496b913c-eb81-4fa8-be72-c6a06a10aba2@kernel.org/
Reviewed-by: Chao Yu <chao@kernel.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Fixes: fbfa2cc58d53 ("f2fs: add file operations")
Cc: stable@vger.kernel.org
Signed-off-by: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/data.c | 1 -
fs/f2fs/file.c | 6 ------
2 files changed, 7 deletions(-)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 5a4af37b358d3..c9a1bb07a5b32 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2260,7 +2260,6 @@ static int f2fs_read_single_page(struct inode *inode, struct fsverity_info *vi,
got_it:
if ((map->m_flags & F2FS_MAP_MAPPED)) {
block_nr = map->m_pblk + block_in_file - map->m_lblk;
- folio_set_mappedtodisk(folio);
if (!f2fs_is_valid_blkaddr(F2FS_I_SB(inode), block_nr,
DATA_GENERIC_ENHANCE_READ)) {
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 5bd908799e7d5..b391ced41edda 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -217,12 +217,6 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
/* wait for GCed page writeback via META_MAPPING */
f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
- /*
- * check to see if the page is mapped already (no holes)
- */
- if (folio_test_mappedtodisk(folio))
- goto out_sem;
-
/* page is wholly or partially inside EOF */
if (((loff_t)(folio->index + 1) << PAGE_SHIFT) >
i_size_read(inode)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0721/1257] f2fs: allow pinning empty compressed files
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (719 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0720/1257] f2fs: remove mappedtodisk flag usage in mmap write path Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0722/1257] f2fs: read i_size once in f2fs_vm_page_mkwrite Greg Kroah-Hartman
` (277 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Joanne Chang, Chao Yu,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Chang <joannechien@google.com>
[ Upstream commit 2eebc31ae5f53e1066bb6238c8087c23b688ad17 ]
Commit a64a3fec11e7 ("f2fs: force out-place update for all writes on
compressed file") updated f2fs_should_update_outplace() to always
return true for compressed files. However, this function is also
called during f2fs_ioc_set_pin_file() validation, so pinning an
empty file with compression enabled now fails with -EINVAL before the
compression flag can be stripped.
Fix this by guarding the f2fs_compressed_file(inode) check with fio in
f2fs_should_update_outplace(). This preserves forced OPU for actual
compressed writes (fio != NULL), while allowing f2fs_ioc_set_pin_file()
(fio == NULL) to proceed to f2fs_disable_compressed_file(inode).
Cc: stable@kernel.org
Fixes: a64a3fec11e7 ("f2fs: force out-place update for all writes on compressed file")
Assisted-by: LLM
Signed-off-by: Joanne Chang <joannechien@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/data.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index c9a1bb07a5b32..d8965229e3e7a 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2913,7 +2913,7 @@ bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio)
* If IO comes from compressed write path and fallback to raw write,
* force out‑place to prevent metadata‑data inconsistency.
*/
- if (f2fs_compressed_file(inode))
+ if (fio && f2fs_compressed_file(inode))
return true;
/* swap file is migrating in aligned write mode */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0722/1257] f2fs: read i_size once in f2fs_vm_page_mkwrite
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (720 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0721/1257] f2fs: allow pinning empty compressed files Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0723/1257] f2fs: check every cur_*_segno[] entry on readonly images Greg Kroah-Hartman
` (276 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nanzhe Zhao, Chao Yu,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
[ Upstream commit c04f209773ecb31e592cababce0d6658ee0b8d58 ]
f2fs_vm_page_mkwrite() reads i_size twice: once to check whether the
folio is partially beyond EOF, and once to calculate the offset for
folio_zero_segment(). But a concurrent buffered write can extend isize
and cause the following race condition to corrupt data:
buffered write writes [0,3500)
CPU0 (write fault) CPU1 (buffered write)
---- ----
f2fs_vm_page_mkwrite()
folio_lock(folio)
if (((loff_t)(folio->index + 1) << PAGE_SHIFT) >
i_size_read(inode))
/* i_size_read() = 3500 */
write(fd, buf, 200, 4096)
/* writes into page1, does not
wait for folio lock */
i_size_write(inode, 4296)
offset = i_size_read(inode) & ~PAGE_MASK
/* i_size_read() = 4296, offset = 200 */
folio_zero_segment(folio, offset, folio_size(folio))
/* valid data [200, 3500) is zeroed */
Fix this by reading i_size once and using the same value for both the
EOF check and the zeroing offset.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20261012030315.978375-1-zhaonanzhe%40xiaomi.com
Fixes: fbfa2cc58d53 ("f2fs: add file operations")
Cc: stable@vger.kernel.org
Signed-off-by: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index b391ced41edda..6843c2aa67444 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -124,6 +124,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
struct dnode_of_data dn;
bool need_alloc = !f2fs_is_pinned_file(inode);
+ loff_t isize;
int err = 0;
vm_fault_t ret;
@@ -187,8 +188,14 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
filemap_invalidate_lock_shared(inode->i_mapping);
folio_lock(folio);
+ /*
+ * A concurrent buffered write can extend isize, so we store isize in a
+ * local variable to let the zeroing offset match the EOF check below.
+ */
+ isize = i_size_read(inode);
+
if (unlikely(folio->mapping != inode->i_mapping ||
- folio_pos(folio) > i_size_read(inode) ||
+ folio_pos(folio) > isize ||
!folio_test_uptodate(folio))) {
folio_unlock(folio);
err = -EFAULT;
@@ -218,11 +225,10 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
/* page is wholly or partially inside EOF */
- if (((loff_t)(folio->index + 1) << PAGE_SHIFT) >
- i_size_read(inode)) {
+ if (((loff_t)(folio->index + 1) << PAGE_SHIFT) > isize) {
loff_t offset;
- offset = i_size_read(inode) & ~PAGE_MASK;
+ offset = isize & ~PAGE_MASK;
folio_zero_segment(folio, offset, folio_size(folio));
}
folio_mark_dirty(folio);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0723/1257] f2fs: check every cur_*_segno[] entry on readonly images
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (721 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0722/1257] f2fs: read i_size once in f2fs_vm_page_mkwrite Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0724/1257] f2fs: allow empty strings for journaled quota options Greg Kroah-Hartman
` (275 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Kaixuan Li, Chao Yu,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixuan Li <kaixuanli0131@gmail.com>
[ Upstream commit 9c4ee79190c8c23a9fb5c07d3bc87eaac514b2bb ]
sanity_check_ckpt() bounds-checks cur_node_segno[] and cur_data_segno[]
against main_segs, but on an image with the RO feature the goto that skips
the duplicate-segno cross-checks also leaves the enclosing loop, so only
index 0 of each array is ever checked.
An unchecked index reaches __set_sit_entry_type() through build_curseg() ->
reset_curseg(), which writes se->type through &sit_i->sentries[segno]. With
segment_count_main 120 and cur_data_segno[1] set to 200, KASAN reports
three out-of-bounds writes during mount and the mount then succeeds.
Use continue so every index is bounds-checked, and skip the node-vs-data
cross-check explicitly, which is the other thing the old goto skipped.
Cc: stable@kernel.org
Fixes: a7d9fe3c3388 ("f2fs: support RO feature")
Signed-off-by: Kaixuan Li <kaixuanli0131@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/super.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 137b123777edc..7a7348b59f97e 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4307,7 +4307,7 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
return 1;
if (f2fs_sb_has_readonly(sbi))
- goto check_data;
+ continue;
for (j = i + 1; j < NR_CURSEG_NODE_TYPE; j++) {
if (le32_to_cpu(ckpt->cur_node_segno[i]) ==
@@ -4319,14 +4319,14 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
}
}
}
-check_data:
+
for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {
if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs ||
le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg)
return 1;
if (f2fs_sb_has_readonly(sbi))
- goto skip_cross;
+ continue;
for (j = i + 1; j < NR_CURSEG_DATA_TYPE; j++) {
if (le32_to_cpu(ckpt->cur_data_segno[i]) ==
@@ -4338,6 +4338,9 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
}
}
}
+ if (f2fs_sb_has_readonly(sbi))
+ goto skip_cross;
+
for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {
for (j = 0; j < NR_CURSEG_DATA_TYPE; j++) {
if (le32_to_cpu(ckpt->cur_node_segno[i]) ==
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0724/1257] f2fs: allow empty strings for journaled quota options
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (722 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0723/1257] f2fs: check every cur_*_segno[] entry on readonly images Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0725/1257] f2fs: fix defragment writeback range truncation on 32-bit Greg Kroah-Hartman
` (274 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hengyu Liang, Chao Yu, Jaegeuk Kim,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengyu Liang <hengyul@cs.unc.edu>
[ Upstream commit 0354a04b8c34e26cc66d0f43785d388163b6bacc ]
Commit 2a3db1e02ce0 ("f2fs: allow empty mount string for
Opt_usr|grp|projjquota") added support for passing usrjquota,
grpjquota and prjjquota as flags to disable journaled quotas.
However, it also replaced fsparam_string_empty() with fsparam_string(),
which rejects an empty string. As of now, mount(2) and
fsconfig(FSCONFIG_SET_STRING) reject usrjquota=, grpjquota= and
prjjquota= with EINVAL, although these forms are still documented in
Documentation/filesystems/f2fs.rst.
The issue can be reproduced on an F2FS device with:
mount -t f2fs -o usrjquota= /dev/loop5 /mnt/f
Before this commit, the command succeeds. Afterwards, it fails with
EINVAL and logs "f2fs: Bad value for 'usrjquota'".
The same failure occurs when remounting to clear a quota file name.
This patch will restore fsparam_string_empty() for the three options
while retaining the flag entries, so both forms are accepted.
Fixes: 2a3db1e02ce0 ("f2fs: allow empty mount string for Opt_usr|grp|projjquota")
Cc: stable@vger.kernel.org # 7.1+
Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/super.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 7a7348b59f97e..0278f2f193fbc 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -338,11 +338,11 @@ static const struct fs_parameter_spec f2fs_param_specs[] = {
fsparam_flag("usrquota", Opt_usrquota),
fsparam_flag("grpquota", Opt_grpquota),
fsparam_flag("prjquota", Opt_prjquota),
- fsparam_string("usrjquota", Opt_usrjquota),
+ fsparam_string_empty("usrjquota", Opt_usrjquota),
fsparam_flag("usrjquota", Opt_usrjquota),
- fsparam_string("grpjquota", Opt_grpjquota),
+ fsparam_string_empty("grpjquota", Opt_grpjquota),
fsparam_flag("grpjquota", Opt_grpjquota),
- fsparam_string("prjjquota", Opt_prjjquota),
+ fsparam_string_empty("prjjquota", Opt_prjjquota),
fsparam_flag("prjjquota", Opt_prjjquota),
fsparam_flag("nat_bits", Opt_nat_bits),
fsparam_enum("jqfmt", Opt_jqfmt, f2fs_param_jqfmt),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0725/1257] f2fs: fix defragment writeback range truncation on 32-bit
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (723 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0724/1257] f2fs: allow empty strings for journaled quota options Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0726/1257] f2fs: disallow mmap write and data-modifying fallocate on atomic files Greg Kroah-Hartman
` (273 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Zhan Xusheng, Chao Yu,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <zhanxusheng1024@gmail.com>
[ Upstream commit 92154fe28c3701bebf75176dc5522bec62519a8f ]
f2fs_defragment_range() flushes the range it is about to defragment:
filemap_write_and_wait_range(inode->i_mapping,
pg_start << PAGE_SHIFT,
(pg_end << PAGE_SHIFT) - 1);
pg_start and pg_end are pgoff_t, 32 bits on 32-bit kernels, so both
shifts are evaluated in 32 bits and truncated before they are widened to
the loff_t parameters. pg_end is only capped by the file's page count,
so for a file larger than 4 GiB the shift wraps.
For a 5 GiB file pg_end is 1310720 and the range collapses from
[0, 5 GiB) to [0, 1 GiB), leaving the rest of the dirty pages unwritten
before the blocks are moved. For 8 GiB the shift yields 0, the minus one
makes it (loff_t)-1, and the range becomes [0, LLONG_MAX].
The matching call in f2fs_collapse_range() already casts:
filemap_write_and_wait_range(inode->i_mapping,
(loff_t)index << PAGE_SHIFT,
((loff_t)pg_end << PAGE_SHIFT) - 1);
Do the same here. On i386 the shift changes from "shl $0xc,%ecx" to
"shld", i.e. from a 32-bit shift to a double-precision one.
Cc: stable@kernel.org
Fixes: d323d005ac4a ("f2fs: support file defragment")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 6843c2aa67444..da7564e4904f0 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3029,8 +3029,8 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi,
/* writeback all dirty pages in the range */
err = filemap_write_and_wait_range(inode->i_mapping,
- pg_start << PAGE_SHIFT,
- (pg_end << PAGE_SHIFT) - 1);
+ (loff_t)pg_start << PAGE_SHIFT,
+ ((loff_t)pg_end << PAGE_SHIFT) - 1);
if (err)
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0726/1257] f2fs: disallow mmap write and data-modifying fallocate on atomic files
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (724 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0725/1257] f2fs: fix defragment writeback range truncation on 32-bit Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0727/1257] f2fs: fix to use bio_in_atomic() in f2fs_read_end_io() Greg Kroah-Hartman
` (272 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Daeho Jeong, Chao Yu,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <daehojeong@google.com>
[ Upstream commit 06dfe4a7eb696d868b196c2a49873142f19bd862 ]
Stores through a shared writable mapping and fallocate with
FALLOC_FL_PUNCH_HOLE, FALLOC_FL_ZERO_RANGE, FALLOC_FL_COLLAPSE_RANGE or
FALLOC_FL_INSERT_RANGE do not go through ->write_begin, so they bypass
the COW inode and modify the original inode directly. Reject them while
the file is in atomic write mode, as fallocate already does for pinned
and compressed files. A write fault gets SIGBUS and fallocate gets
-EOPNOTSUPP.
fallocate without these flags only preallocates blocks and stays
allowed.
f2fs_vm_page_mkwrite() cannot take inode_lock, so check the flag under
invalidate_lock, and hold invalidate_lock in
f2fs_ioc_start_atomic_write() from the flush until the flag is set.
Otherwise a fault could check the flag, then start_atomic_write could
flush and set the flag, and the fault would dirty the folio afterwards.
Cc: stable@kernel.org
Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index da7564e4904f0..fd72eb4563de2 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -187,6 +187,17 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
file_update_time(vmf->vma->vm_file);
filemap_invalidate_lock_shared(inode->i_mapping);
+ /*
+ * mmap stores bypass the COW inode and would break atomicity. Check
+ * under invalidate_lock: f2fs_ioc_start_atomic_write() holds it while
+ * flushing dirty folios and setting FI_ATOMIC_FILE, so either it sees
+ * our dirty folio and writes it back, or we see the flag.
+ */
+ if (unlikely(f2fs_is_atomic_file(inode))) {
+ err = -EOPNOTSUPP;
+ goto out_sem;
+ }
+
folio_lock(folio);
/*
* A concurrent buffered write can extend isize, so we store isize in a
@@ -2107,9 +2118,11 @@ static long f2fs_fallocate(struct file *file, int mode,
/*
* Pinned file should not support partial truncation since the block
- * can be used by applications.
+ * can be used by applications. Atomic files should not either, since
+ * these modify the original inode directly and break atomicity.
*/
- if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode)) &&
+ if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode) ||
+ f2fs_is_atomic_file(inode)) &&
(mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_COLLAPSE_RANGE |
FALLOC_FL_ZERO_RANGE | FALLOC_FL_INSERT_RANGE))) {
ret = -EOPNOTSUPP;
@@ -2397,6 +2410,8 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
f2fs_down_write(&fi->i_gc_rwsem[WRITE]);
f2fs_down_write(&fi->i_gc_rwsem[READ]);
+ /* serialize with f2fs_vm_page_mkwrite(), see the comment there */
+ filemap_invalidate_lock(inode->i_mapping);
/*
* Should wait end_io to count F2FS_WB_CP_DATA correctly by
@@ -2452,6 +2467,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
f2fs_i_size_write(fi->cow_inode, isize);
out_unlock:
+ filemap_invalidate_unlock(inode->i_mapping);
f2fs_up_write(&fi->i_gc_rwsem[READ]);
f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0727/1257] f2fs: fix to use bio_in_atomic() in f2fs_read_end_io()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (725 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0726/1257] f2fs: disallow mmap write and data-modifying fallocate on atomic files Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0728/1257] spi: ljca: validate the response length before copying the data Greg Kroah-Hartman
` (271 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Chao Yu, Jaegeuk Kim,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit a605d5d71a6d280c43c7ede9778dda63fb5c3f22 ]
f2fs_read_end_io() uses "in_task() && !irqs_disabled()" to decide
whether it is safe to sleep, the result is passed down as @in_task to:
- f2fs_put_dic() -> f2fs_free_dic() -> f2fs_release_decomp_mem()
-> vm_unmap_ram(), which may sleep.
- f2fs_end_read_compressed_page() -> f2fs_cache_compressed_page()
-> f2fs_grab_cache() -> f2fs_lock_cache(), which may sleep in
wait_on_bit_lock().
However, the check still treats below task contexts as sleepable:
- with spinlock held via spin_lock(), i.e. preempt count != 0 while
irqs are enabled.
- with BH disabled via local_bh_disable().
- inside an RCU read lock on kernels with CONFIG_PREEMPTION.
- with any spinlock held on kernels without CONFIG_PREEMPT_COUNT.
So the "sleeping function called from invalid context" issue fixed by
commit 08a7efc5b02a ("f2fs: vm_unmap_ram() may be called from an
invalid context") can still be triggered.
The block layer provides bio_in_atomic() for exactly this purpose, it
checks rcu_preempt_depth() and preemptible(), and conservatively returns
true if CONFIG_PREEMPT_COUNT is disabled, let's use it instead. The
difference is as below:
old: intask = in_task() && !irqs_disabled()
new: intask = !bio_in_atomic()
Context | old intask | new intask
-------------------------------------+----------------+----------------
Hard IRQ / softirq | false | false
IRQs disabled | false | false
spin_lock() held, IRQs enabled | true (wrong) | false
BH disabled by local_bh_disable() | true (wrong) | false
RCU read lock (CONFIG_PREEMPTION) | true (wrong) | false
Spinlock held, w/o PREEMPT_COUNT | true (wrong) | false
Note that on kernels without CONFIG_PREEMPT_COUNT, bio_in_atomic()
always returns true, so dic freeing will always be offloaded to sbi->wq,
and compressed pages will not be cached in f2fs_read_end_io(); this is
the price of correctness, since there is no way to tell whether the
current context can sleep.
Cc: stable@kernel.org
Fixes: 08a7efc5b02a ("f2fs: vm_unmap_ram() may be called from an invalid context")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/data.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index d8965229e3e7a..cfd81bfc28a22 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -303,7 +303,7 @@ static void f2fs_read_end_io(struct bio *bio)
{
struct f2fs_sb_info *sbi = F2FS_F_SB(bio_first_folio_all(bio));
struct bio_post_read_ctx *ctx;
- bool intask = in_task() && !irqs_disabled();
+ bool intask = !bio_in_atomic();
iostat_update_and_unbind_ctx(bio);
ctx = bio->bi_private;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0728/1257] spi: ljca: validate the response length before copying the data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (726 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0727/1257] f2fs: fix to use bio_in_atomic() in f2fs_read_end_io() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0729/1257] pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank() Greg Kroah-Hartman
` (270 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weibin Liu, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit 0fe4573c822c4c9152e2fd5269ab85410c9e458f ]
ljca_spi_read_write() only checks that the response from the adapter
carries the packet header and a non-zero payload length before copying
r_packet->len bytes from the response into the transfer buffer.
The payload length is taken from the packet the device sent back and is
neither bounded by the number of bytes actually received nor by the
size of the requested transfer: a misbehaving adapter can announce a
payload larger than what it actually sent, and the memcpy then reads
past the end of the 60-byte input buffer and writes past the end of the
caller's transfer buffer.
Check that the response carries the full header before reading
r_packet->len, then reject responses whose payload is not contained in
the data received or is longer than the requested transfer.
Fixes: caee8e38da67 ("spi: Add support for Intel LJCA USB SPI driver")
Cc: stable@vger.kernel.org # 6.8+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261013031717.3933277-1-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-ljca.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-ljca.c b/drivers/spi/spi-ljca.c
index 0c6e6248d8ba3..8fd001610f67e 100644
--- a/drivers/spi/spi-ljca.c
+++ b/drivers/spi/spi-ljca.c
@@ -105,7 +105,12 @@ static int ljca_spi_read_write(struct ljca_spi_dev *ljca_spi, const u8 *w_data,
(u8 *)r_packet, LJCA_SPI_BUF_SIZE);
if (ret < 0)
return ret;
- else if (ret < sizeof(*r_packet) || r_packet->len <= 0)
+
+ if (ret < sizeof(*r_packet))
+ return -EIO;
+
+ if (!r_packet->len || ret < sizeof(*r_packet) + r_packet->len ||
+ r_packet->len > len)
return -EIO;
if (r_data)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0729/1257] pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (727 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0728/1257] spi: ljca: validate the response length before copying the data Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0730/1257] lib/decompress_bunzip2: fix off-by-one in run-length bounds check Greg Kroah-Hartman
` (269 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ma Ke, Antonio Borneo, Linus Walleij,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit 54c66b5e47a9b10cbf4a1efe9b01301b7ffee205 ]
stm32_gpiolib_register_bank() walks the "gpio-ranges" property with
fwnode_property_get_reference_args(). As documented in
drivers/base/property.c:
* The caller is responsible for calling fwnode_handle_put() on the
* returned @args->fwnode pointer.
The returned reference is never put. The function calls the helper
twice, once directly and then repeatedly in a while loop, and each
call overwrites args, so only the last reference is even reachable
and all the earlier ones are leaked for good.
Put the reference as soon as args.args[] has been consumed, both for
the initial call and for every iteration of the loop.
Found by code review.
Cc: stable@vger.kernel.org
Fixes: bb949ed9b16b ("pinctrl: stm32: Switch to use for_each_gpiochip_node() helper")
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Reviewed-by: Antonio Borneo <antonio.borneo@foss.st.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/stm32/pinctrl-stm32.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index 6a99708a5a23c..93127da05d560 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -1666,8 +1666,12 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode
/* get the last defined gpio line (offset + nb of pins) */
npins = args.args[0] + args.args[2];
- while (!fwnode_property_get_reference_args(fwnode, "gpio-ranges", NULL, 3, ++i, &args))
+ fwnode_handle_put(args.fwnode);
+
+ while (!fwnode_property_get_reference_args(fwnode, "gpio-ranges", NULL, 3, ++i, &args)) {
npins = max(npins, (int)(args.args[0] + args.args[2]));
+ fwnode_handle_put(args.fwnode);
+ }
} else {
bank_nr = pctl->nbanks;
bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0730/1257] lib/decompress_bunzip2: fix off-by-one in run-length bounds check
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (728 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0729/1257] pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0731/1257] panic: fix redirect CPU race in panic_try_force_cpu() Greg Kroah-Hartman
` (268 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Andrew Morton,
Alain Knaff, H. Peter Anvin, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
[ Upstream commit 69919be2b93ef3922f646729ff42b4bd9a30846b ]
The run-length path rejects a block when dbufCount+t equals dbufSize, but
the loop that follows writes exactly t bytes starting at dbufCount, so a
block that fills the buffer exactly is legal. bzip2 allows it too: its
decompressor bounds a block at 100000 * blockSize100k and checks that
limit per byte appended. Use > instead of >=.
bzip2's encoder stops filling a block 19 bytes early, so nothing it
produces ever reaches the limit and the bug stays hidden. Compressors
that use the full block size do reach it: an lbzip2 -9 image whose block
ends on a run fails to decode, and a self-extracting kernel built that way
does not boot.
This code came from busybox, which fixed the same line in 2013 in commit
932e233a491b ("bunzip2: fix off-by-one check").
I ran into this because my system uses lbzip2 as /bin/bzip2 -- a common
thing on Gentoo I believe. As far as I can tell, anyone using lbzip2
as their system bzip2 would run into this and it's only because it's
very uncommon these days to compress a kernel with bzip2 that no one
has noticed. I only noticed because I was adding support for various
compression formats on alpha.
Link: https://lore.kernel.org/20260912-b4-bunzip2-blocksize-fix-v1-1-c7384bbfc954@gmail.com
Fixes: bc22c17e12c1 ("bzip2/lzma: library support for gzip, bzip2 and lzma decompression")
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alain Knaff <alain@knaff.lu>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/decompress_bunzip2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index 1288f146661f1..aaa75404250e2 100644
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -439,7 +439,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
array.) */
if (runPos) {
runPos = 0;
- if (dbufCount+t >= dbufSize)
+ if (dbufCount+t > dbufSize)
return RETVAL_DATA_ERROR;
uc = symToByte[mtfSymbol[0]];
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0731/1257] panic: fix redirect CPU race in panic_try_force_cpu()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (729 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0730/1257] lib/decompress_bunzip2: fix off-by-one in run-length bounds check Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0732/1257] panic: flatten nmi_panic control flow Greg Kroah-Hartman
` (267 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Andrew Morton,
Sashiko, Petr Mladek, Guenetr Roeck, Wang Jinchao,
Wim Van Sebroeck, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <brads@mainlining.org>
[ Upstream commit 73554d8db4951d2a486405a2759cc0ffd282c0b2 ]
Patch series "panic: fix panic_force_cpu= redirect races and NMI bypass",
v7.
The panic_force_cpu= parameter redirects a panic to a specific CPU so the
crash kernel runs there. The redirect code in panic_try_force_cpu() had
two races and an NMI bypass, all found by Sashiko. This series closes
them and kills one more hack that the rework turned up.
Panic from NMI still goes through the redirect path first, so the crash
kernel ends up on the CPU the admin asked for. The redirect buffer is a
static 1KB now, no initcall, no fallback message.
This patch (of 6):
The cmpxchg() in panic_try_force_cpu() makes sure that only one CPU tries
to redirect panic() to the requested CPU. It is similar to the cmpxchg()
in panic_try_start() which makes sure that only one CPU does the panic().
In both situations, only the winner of cmpxchg() should proceed further.
Other CPUs should go offline.
There is a bug because the cmpxchg loser returns false and falls through
into vpanic(). Two non-target CPUs A and B panic, the requested CPU is C:
cpu A cpu B
---------- ----------
panic() panic()
vpanic() vpanic()
panic_try_force_cpu() panic_try_force_cpu()
cmpxchg wins cmpxchg fails
redirect = A old_cpu = A
IPI -> C return false <- BUG
return true panic_try_start() wins
panic_smp_self_stop() __crash_kexec() on B
(A stops) (target C bypassed)
The loser must stop, not fall through. It cannot just return true,
though. A CPU that already won the redirect cmpxchg can reenter
panic_try_force_cpu() on the same CPU, for example a nested NMI during the
message formatting, before the IPI is sent:
cpu A (1st) cpu A (nested)
---------- ----------
panic()
vpanic()
panic_try_force_cpu()
cmpxchg wins (redirect = A)
vsnprintf(msg) ...
<-- NMI, nested panic -->
panic()
vpanic()
panic_try_force_cpu()
cmpxchg fails
old_cpu == A (this CPU)
return true <- would halt
panic_smp_self_stop()
(IPI never sent, panic abandoned)
Check old_cpu against this_cpu so a second call from the same CPU returns
false and falls through to panic_try_start() instead.
Also fix the panic_in_progress() check. We must not redirect when
panic_cpu is already assigned. Return true to stop when the panic is on
another CPU, false to proceed when it is this one.
Update the panic_try_force_cpu() doc comment for the new return value
semantics.
Link: https://lore.kernel.org/20260916182957.7788-1-brads@mainlining.org
Link: https://lore.kernel.org/20260916182957.7788-2-brads@mainlining.org
Fixes: 2e171ab29f91 ("panic: add panic_force_cpu= parameter to redirect panic to a specific CPU")
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260705164123.18746-1-include@grrlz.net
Closes: https://sashiko.dev/#/patchset/20260707172252.4842-1-include@grrlz.net
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Guenetr Roeck <linux@roeck-us.net>
Cc: Wang Jinchao <wangjinchao600@gmail.com>
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/panic.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/kernel/panic.c b/kernel/panic.c
index 213725b612aa1..010b331658b6b 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -371,8 +371,9 @@ int __weak panic_smp_redirect_cpu(int target_cpu, void *msg)
* for the crash kernel to function correctly. This function redirects
* panic handling to the CPU specified via the panic_force_cpu= boot parameter.
*
- * Returns false if panic should proceed on current CPU.
- * Returns true if panic was redirected.
+ * Returns true when this CPU must stop: the panic was redirected or is
+ * already running on another CPU.
+ * Returns false when panic() should proceed on this CPU.
*/
__printf(1, 0)
static bool panic_try_force_cpu(const char *fmt, va_list args)
@@ -396,16 +397,20 @@ static bool panic_try_force_cpu(const char *fmt, va_list args)
return false;
}
- /* Another panic already in progress */
+ /*
+ * Don't redirect when a panic is already in progress. Stop this
+ * CPU when it's another one, proceed when it's this one.
+ */
if (panic_in_progress())
- return false;
+ return panic_on_other_cpu();
/*
- * Only one CPU can do the redirect. Use atomic cmpxchg to ensure
- * we don't race with another CPU also trying to redirect.
+ * Only one CPU can do the redirection. Others should go offline.
+ * Continue with panic() when we already tried the redirection
+ * from this CPU before, for example via nmi_panic().
*/
if (!atomic_try_cmpxchg(&panic_redirect_cpu, &old_cpu, this_cpu))
- return false;
+ return old_cpu != this_cpu;
/*
* Use dynamically allocated buffer if available, otherwise
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0732/1257] panic: flatten nmi_panic control flow
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (730 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0731/1257] panic: fix redirect CPU race in panic_try_force_cpu() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0733/1257] panic: fix va_list reuse in panic_try_force_cpu() Greg Kroah-Hartman
` (266 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Andrew Morton,
Petr Mladek, Guenetr Roeck, Sashiko, Wang Jinchao,
Wim Van Sebroeck, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <brads@mainlining.org>
[ Upstream commit 75eb687ff2bcec9fba31bbe266e5f91e5c283efe ]
panic() is __noreturn, so the else after panic_try_start() is dead. Drop
it so the force_cpu path can be added cleanly on top.
Link: https://lore.kernel.org/20260916182957.7788-3-brads@mainlining.org
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Guenetr Roeck <linux@roeck-us.net>
Cc: Sashiko <sashiko-bot@kernel.org>
Cc: Wang Jinchao <wangjinchao600@gmail.com>
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/panic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/panic.c b/kernel/panic.c
index 010b331658b6b..e1b443150ba0b 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -517,7 +517,8 @@ void nmi_panic(struct pt_regs *regs, const char *msg)
{
if (panic_try_start())
panic("%s", msg);
- else if (panic_on_other_cpu())
+
+ if (panic_on_other_cpu())
nmi_panic_self_stop(regs);
}
EXPORT_SYMBOL(nmi_panic);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0733/1257] panic: fix va_list reuse in panic_try_force_cpu()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (731 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0732/1257] panic: flatten nmi_panic control flow Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0734/1257] panic: restore variable arguments to nmi_panic() Greg Kroah-Hartman
` (265 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Andrew Morton,
Petr Mladek, Guenetr Roeck, Sashiko, Wang Jinchao,
Wim Van Sebroeck, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <brads@mainlining.org>
[ Upstream commit 245001a347f1effc09c233d1712e1efeedab59ee ]
vsnprintf() consumes the caller's va_list. When the redirect fails,
vpanic() reuses it for the panic message, which is undefined behavior.
Use va_copy().
Link: https://lore.kernel.org/20260916182957.7788-4-brads@mainlining.org
Fixes: 2e171ab29f91 ("panic: add panic_force_cpu= parameter to redirect panic to a specific CPU")
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Guenetr Roeck <linux@roeck-us.net>
Cc: Sashiko <sashiko-bot@kernel.org>
Cc: Wang Jinchao <wangjinchao600@gmail.com>
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/panic.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/panic.c b/kernel/panic.c
index e1b443150ba0b..6b5728c3c9ce2 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -417,7 +417,12 @@ static bool panic_try_force_cpu(const char *fmt, va_list args)
* fall back to static message for early boot panics or allocation failure.
*/
if (panic_force_buf) {
- vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, args);
+ va_list ap;
+
+ /* Do not consume args, the caller reuses it if we fail */
+ va_copy(ap, args);
+ vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, ap);
+ va_end(ap);
msg = panic_force_buf;
} else {
msg = "Redirected panic (buffer unavailable)";
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0734/1257] panic: restore variable arguments to nmi_panic()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (732 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0733/1257] panic: fix va_list reuse in panic_try_force_cpu() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0735/1257] panic: allow force_cpu redirect from an NMI Greg Kroah-Hartman
` (264 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Andrew Morton,
Petr Mladek, Guenetr Roeck, Sashiko, Wang Jinchao,
Wim Van Sebroeck, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <brads@mainlining.org>
[ Upstream commit ed9e4c1ff15d5b935f467811541ca0aa6e49c5d0 ]
nmi_panic() used to accept variable arguments until commit ebc41f20d77f
("panic: change nmi_panic from macro to function") flattened it to a final
message string. vpanic() did not exist back then, so the function had to
format through panic("%s", msg).
Bring the variable arguments back and format with vpanic() directly.
The next patch makes nmi_panic() try the panic_force_cpu= redirect
before claiming panic_cpu. panic_try_force_cpu() needs to print the
message but it is used also by panic() which accepts variable argument
list. The string could be formatted only when a CPU gets assigned to
process the redirection. Otherwise, there might be a race when writing
to the `panic_force_buf`.
No current caller passes a string with format specifiers. The closest one
is hpwdt_pretimeout(), which builds panic_msg with hex_byte_pack() and has
only two variants, both plain strings. But the new __printf() annotation
on nmi_panic() would warn with -Wformat-security there because the buffer
is passed directly as the format argument, so switch it to nmi_panic(regs,
"%s", panic_msg).
[pmladek@suse.com: changelog fix]
Link: https://lore.kernel.org/arJxFybmtD7OBIcL@pathway.suse.cz
Link: https://lore.kernel.org/20260916182957.7788-5-brads@mainlining.org
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Guenetr Roeck <linux@roeck-us.net>
Cc: Sashiko <sashiko-bot@kernel.org>
Cc: Wang Jinchao <wangjinchao600@gmail.com>
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/hpwdt.c | 2 +-
include/linux/panic.h | 3 ++-
kernel/panic.c | 10 ++++++++--
3 files changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 8af1fad2de0bd..78227d200afe4 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -199,7 +199,7 @@ static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs)
}
hex_byte_pack(panic_msg, nmistat);
- nmi_panic(regs, panic_msg);
+ nmi_panic(regs, "%s", panic_msg);
return NMI_HANDLED;
}
diff --git a/include/linux/panic.h b/include/linux/panic.h
index f1dd417e54b29..a9128bf3c168a 100644
--- a/include/linux/panic.h
+++ b/include/linux/panic.h
@@ -13,7 +13,8 @@ __printf(1, 2)
void panic(const char *fmt, ...) __noreturn __cold;
__printf(1, 0)
void vpanic(const char *fmt, va_list args) __noreturn __cold;
-void nmi_panic(struct pt_regs *regs, const char *msg);
+__printf(2, 3)
+void nmi_panic(struct pt_regs *regs, const char *fmt, ...);
void check_panic_on_warn(const char *origin);
extern void oops_enter(void);
extern void oops_exit(void);
diff --git a/kernel/panic.c b/kernel/panic.c
index 6b5728c3c9ce2..43ac2b9b5e001 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -518,13 +518,19 @@ EXPORT_SYMBOL(panic_on_other_cpu);
* nmi_panic_self_stop() which can provide architecture dependent code such
* as saving register state for crash dump.
*/
-void nmi_panic(struct pt_regs *regs, const char *msg)
+void nmi_panic(struct pt_regs *regs, const char *fmt, ...)
{
+ va_list args;
+
+ va_start(args, fmt);
+
if (panic_try_start())
- panic("%s", msg);
+ vpanic(fmt, args);
if (panic_on_other_cpu())
nmi_panic_self_stop(regs);
+
+ va_end(args);
}
EXPORT_SYMBOL(nmi_panic);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0735/1257] panic: allow force_cpu redirect from an NMI
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (733 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0734/1257] panic: restore variable arguments to nmi_panic() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0736/1257] panic: kill the "buffer unavailable" redirect fallback Greg Kroah-Hartman
` (263 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Andrew Morton,
Sashiko, Petr Mladek, Guenetr Roeck, Wang Jinchao,
Wim Van Sebroeck, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <brads@mainlining.org>
[ Upstream commit 36c55a9625bb9ab7eb428ff8facc6d3d0a743180 ]
nmi_panic() claims panic_cpu via panic_try_start() before calling panic().
When the panic later reaches panic_try_force_cpu(), the
panic_in_progress() check sees panic_cpu set and refuses to redirect. The
crash kernel runs on the CPU that took the NMI instead of the CPU
requested with panic_force_cpu=:
nmi_panic()
panic_try_start() wins, panic_cpu = X
panic("%s", msg)
vpanic()
panic_try_force_cpu()
panic_in_progress() true, panic_cpu is X
return false redirect bypassed
panic_try_start() already won
__crash_kexec() on X, not the requested CPU
Try the redirect before claiming panic_cpu instead, as suggested by Petr
Mladek. nmi_panic() now calls panic_try_force_cpu() first and claims
panic_cpu only when no redirect happened. The requested CPU claims
panic_cpu itself when it runs panic(), so panic_cpu does not need to be
handed off. panic_try_force_cpu() copies the arguments before formatting
(patch 3), so nmi_panic() can pass them to vpanic() again when no redirect
happens.
The redirect IPI is sent with smp_call_function_single_async(), which is
not guaranteed to work from NMI context. Treat it as best effort. It is
worth the risk because the redirection is only used when the crash kernel
would not work on the panicking CPU anyway.
Keep returning when the panic is already running on this CPU. A nested
NMI, for example with unknown_nmi_panic while this CPU is inside panic(),
must return and let the interrupted panic() continue instead of parking
the CPU in nmi_panic_self_stop().
Mark the redirecting CPU offline before stopping it, like vpanic() does,
so that panic_other_cpus_shutdown() on the target CPU does not wait for
it.
Link: https://lore.kernel.org/20260916182957.7788-6-brads@mainlining.org
Fixes: 2e171ab29f91 ("panic: add panic_force_cpu= parameter to redirect panic to a specific CPU")
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260708164312.19044-1-include@grrlz.net
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Guenetr Roeck <linux@roeck-us.net>
Cc: Wang Jinchao <wangjinchao600@gmail.com>
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/panic.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/kernel/panic.c b/kernel/panic.c
index 43ac2b9b5e001..e5e9dd38627e0 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -513,10 +513,11 @@ bool panic_on_other_cpu(void)
EXPORT_SYMBOL(panic_on_other_cpu);
/*
- * A variant of panic() called from NMI context. We return if we've already
- * panicked on this CPU. If another CPU already panicked, loop in
- * nmi_panic_self_stop() which can provide architecture dependent code such
- * as saving register state for crash dump.
+ * A variant of panic() called from NMI context. The panic is first
+ * redirected to the CPU requested via panic_force_cpu=, when configured.
+ * We return if we've already panicked on this CPU. If another CPU already
+ * panicked, loop in nmi_panic_self_stop() which can provide architecture
+ * dependent code for saving register state for crash dump.
*/
void nmi_panic(struct pt_regs *regs, const char *fmt, ...)
{
@@ -524,6 +525,16 @@ void nmi_panic(struct pt_regs *regs, const char *fmt, ...)
va_start(args, fmt);
+ /* Try to redirect to the requested CPU before claiming panic_cpu. */
+ if (panic_try_force_cpu(fmt, args)) {
+ /*
+ * Mark ourselves offline so panic_other_cpus_shutdown() won't
+ * wait for us on architectures that check num_online_cpus().
+ */
+ set_cpu_online(raw_smp_processor_id(), false);
+ nmi_panic_self_stop(regs);
+ }
+
if (panic_try_start())
vpanic(fmt, args);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0736/1257] panic: kill the "buffer unavailable" redirect fallback
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (734 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0735/1257] panic: allow force_cpu redirect from an NMI Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0737/1257] lib: decompress_bunzip2: fix integer overflow in run-length decoding Greg Kroah-Hartman
` (262 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Andrew Morton,
Petr Mladek, Guenetr Roeck, Sashiko, Wang Jinchao,
Wim Van Sebroeck, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <brads@mainlining.org>
[ Upstream commit 68d956e9e235c2e125f77a9e98831e297b624a75 ]
The redirect buffer is a disgusting terrible hack. panic_force_buf is
kmalloc'ed in a late_initcall, and until then the redirect delivers this
as the panic message:
Redirected panic (buffer unavailable)
The whole point of the redirect is to hand the panic message to the target
CPU, so the crash kernel boots knowing it panicked and not why. And that
window is the entire boot, from the early_param to the late_initcall,
which is exactly when you most want the message.
Make it a static 1KB buffer and kill the initcall. The cost is 1KB of
.bss in SMP crash dump builds, and it is only ever touched when
panic_force_cpu= is set anyway. The local msg variable is gone too, the
buffer goes directly to panic_smp_redirect_cpu().
Link: https://lore.kernel.org/20260916182957.7788-7-brads@mainlining.org
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Guenetr Roeck <linux@roeck-us.net>
Cc: Sashiko <sashiko-bot@kernel.org>
Cc: Wang Jinchao <wangjinchao600@gmail.com>
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/panic.c | 34 +++++++---------------------------
1 file changed, 7 insertions(+), 27 deletions(-)
diff --git a/kernel/panic.c b/kernel/panic.c
index e5e9dd38627e0..cec2716019355 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -307,7 +307,7 @@ atomic_t panic_cpu = ATOMIC_INIT(PANIC_CPU_INVALID);
atomic_t panic_redirect_cpu = ATOMIC_INIT(PANIC_CPU_INVALID);
#if defined(CONFIG_SMP) && defined(CONFIG_CRASH_DUMP)
-static char *panic_force_buf;
+static char panic_force_buf[PANIC_MSG_BUFSZ];
static int __init panic_force_cpu_setup(char *str)
{
@@ -326,17 +326,6 @@ static int __init panic_force_cpu_setup(char *str)
}
early_param("panic_force_cpu", panic_force_cpu_setup);
-static int __init panic_force_cpu_late_init(void)
-{
- if (panic_force_cpu < 0)
- return 0;
-
- panic_force_buf = kmalloc(PANIC_MSG_BUFSZ, GFP_KERNEL);
-
- return 0;
-}
-late_initcall(panic_force_cpu_late_init);
-
static void do_panic_on_target_cpu(void *info)
{
panic("%s", (char *)info);
@@ -380,7 +369,7 @@ static bool panic_try_force_cpu(const char *fmt, va_list args)
{
int this_cpu = raw_smp_processor_id();
int old_cpu = PANIC_CPU_INVALID;
- const char *msg;
+ va_list ap;
/* Feature not enabled via boot parameter */
if (panic_force_cpu < 0)
@@ -413,20 +402,11 @@ static bool panic_try_force_cpu(const char *fmt, va_list args)
return old_cpu != this_cpu;
/*
- * Use dynamically allocated buffer if available, otherwise
- * fall back to static message for early boot panics or allocation failure.
+ * Do not consume args, the caller reuses them if we fail.
*/
- if (panic_force_buf) {
- va_list ap;
-
- /* Do not consume args, the caller reuses it if we fail */
- va_copy(ap, args);
- vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, ap);
- va_end(ap);
- msg = panic_force_buf;
- } else {
- msg = "Redirected panic (buffer unavailable)";
- }
+ va_copy(ap, args);
+ vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, ap);
+ va_end(ap);
console_verbose();
bust_spinlocks(1);
@@ -441,7 +421,7 @@ static bool panic_try_force_cpu(const char *fmt, va_list args)
dump_stack();
}
- if (panic_smp_redirect_cpu(panic_force_cpu, (void *)msg) != 0) {
+ if (panic_smp_redirect_cpu(panic_force_cpu, panic_force_buf) != 0) {
atomic_set(&panic_redirect_cpu, PANIC_CPU_INVALID);
pr_warn("panic: failed to redirect to CPU %d, continuing on CPU %d\n",
panic_force_cpu, this_cpu);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0737/1257] lib: decompress_bunzip2: fix integer overflow in run-length decoding
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (735 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0736/1257] panic: kill the "buffer unavailable" redirect fallback Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0738/1257] ocfs2: update xattr count before moving bucket entries Greg Kroah-Hartman
` (261 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aamir Ahmed, Andrew Morton,
Alain Knaff, H. Peter Anvin, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aamir Ahmed <elb12345@hotmail.co.uk>
[ Upstream commit b822ad8d702df0be9fe3f24f71caeb0522d72319 ]
The RUNA/RUNB decoder in get_next_block() accumulates a run length into
the signed int t with no bound. runPos doubles per symbol, so t grows as
at least 2^n-1 and reaches INT_MAX after 31 RUNA symbols. The guard that
follows, dbufCount+t >= dbufSize, is itself a signed addition, and as the
kernel builds with -fno-strict-overflow it wraps negative once dbufCount
is nonzero, so the guard is skipped. while (t--) dbuf[dbufCount++] = uc
then writes INT_MAX entries into a buffer holding at most 900000. One
literal symbol ahead of the run is enough to make dbufCount nonzero.
Bound t to the block size as it is accumulated. t only grows within a
run, so the value tested never exceeds the final run length; any stream
that decodes today satisfies dbufCount+t < dbufSize at the flush, hence t
< dbufSize throughout, and no such stream is rejected. Because t grows as
at least 2^n-1 the bound trips by the 20th symbol, leaving runPos at most
2^19, so the following runPos <<= 1 cannot overflow either.
Link: https://lore.kernel.org/AS8P251MB00010FE5E38D253CF98A652AC8B92@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
Fixes: bc22c17e12c1 ("bzip2/lzma: library support for gzip, bzip2 and lzma decompression")
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: LLM
Cc: Alain Knaff <alain@knaff.lu>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/decompress_bunzip2.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index aaa75404250e2..a9236d3e9678d 100644
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -428,6 +428,10 @@ static int INIT get_next_block(struct bunzip_data *bd)
t += (runPos << nextSym);
/* +runPos if RUNA; +2*runPos if RUNB */
+ /* Bound the run so t and runPos cannot overflow. */
+ if (t >= dbufSize)
+ return RETVAL_DATA_ERROR;
+
runPos <<= 1;
continue;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0738/1257] ocfs2: update xattr count before moving bucket entries
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (736 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0737/1257] lib: decompress_bunzip2: fix integer overflow in run-length decoding Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0739/1257] ocfs2: fix array out of bound access in __ocfs2_find_path() Greg Kroah-Hartman
` (260 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Su Yue, Andrew Morton, Heming Zhao,
Joseph Qi, Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge,
Jun Piao, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Yue <glass.su@suse.com>
[ Upstream commit cd6920b6f3e5c6402d49e1128d0e53ee1c7c9b55 ]
Since commit 2f26f58df041 ("ocfs2: annotate flexible array members with
__counted_by_le()"), the xh_entries array is annotated with
__counted_by_le(xh_count), so FORTIFY uses xh_count to determine its
bounds. When inserting an entry into a bucket,
ocfs2_xa_bucket_add_entry() shifts existing entries before incrementing
xh_count. The destination therefore extends one entry past the bounds
described by the old count.
With CONFIG_CC_HAS_COUNTED_BY and CONFIG_FORTIFY_SOURCE enabled,
ocfs2-test: single_run-WIP.sh -t reflink triggers the following failure
while adding an extended attribute:
[ 150.156484] memmove: detected buffer overflow: 352 byte write of buffer size 336
[ 150.156487] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3d/0x50, CPU#15: reflink_test/2336
[ 150.160496] RIP: 0010:__fortify_report+0x40/0x50
[ 150.164031] Call Trace:
[ 150.164141] <TASK>
[ 150.164232] __fortify_panic+0x9/0xb
[ 150.164383] ocfs2_xa_bucket_add_entry.cold+0x17/0x28 [ocfs2]
[ 150.164661] ocfs2_xa_set+0x8fb/0xf40 [ocfs2]
Increment xh_count before memmove() so the destination bounds include the
new entry. Keep the local count unchanged to calculate the insertion
position and move length from the original number of entries. The caller
has already checked that there is enough space for the new entry.
Link: https://lore.kernel.org/20260916024750.9450-1-glass.su@suse.com
Fixes: 2f26f58df041 ("ocfs2: annotate flexible array members with __counted_by_le()")
Signed-off-by: Su Yue <glass.su@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/xattr.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index bfafe059bedff..8933d0f301199 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -2073,12 +2073,17 @@ static void ocfs2_xa_bucket_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash)
}
}
+ /*
+ * Increment xh_count before memmove() so __counted_by_le(xh_count)
+ * includes the new entry in the destination bounds.
+ */
+ le16_add_cpu(&xh->xh_count, 1);
+
if (low != count)
memmove(&xh->xh_entries[low + 1],
&xh->xh_entries[low],
((count - low) * sizeof(struct ocfs2_xattr_entry)));
- le16_add_cpu(&xh->xh_count, 1);
loc->xl_entry = &xh->xh_entries[low];
memset(loc->xl_entry, 0, sizeof(struct ocfs2_xattr_entry));
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0739/1257] ocfs2: fix array out of bound access in __ocfs2_find_path()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (737 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0738/1257] ocfs2: update xattr count before moving bucket entries Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0740/1257] tmpfs: fix unicode_map leaks in casefold option handling Greg Kroah-Hartman
` (259 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Giorgi Kobakhia, Andrew Morton,
Xiang Mei, Joseph Qi, Mark Fasheh, Joel Becker, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giorgi Kobakhia <gkobakhi@asu.edu>
[ Upstream commit 6193ce7896afb52a321a0063c8b6a45e477a84e2 ]
__ocfs2_find_path() walks down the extent tree and records path by calling
find_path_ins(), which appends entry to path->p_node[]. It only has 5
spots.
A corrupted ocfs2 image whose extent block is pointing to itself causes
__ocfs2_find_path() descent endlessly, writing past the end of
path->p_node[] array.
UBSAN: array-index-out-of-bounds in fs/ocfs2/alloc.c:677:14
index 5 is out of range for type 'ocfs2_path_item [5]'
Call Trace:
<TASK>
find_path_ins (fs/ocfs2/alloc.c:677 fs/ocfs2/alloc.c:1914)
__ocfs2_find_path.constprop.0 (fs/ocfs2/alloc.c:1882)
ocfs2_commit_truncate (fs/ocfs2/alloc.c:1924 fs/ocfs2/alloc.c:7286)
ocfs2_truncate_file (fs/ocfs2/file.c:515)
ocfs2_setattr (fs/ocfs2/file.c:1224)
notify_change (fs/attr.c:556)
do_truncate (fs/open.c:68)
do_ftruncate (fs/open.c:194 (discriminator 1))
ksys_ftruncate (fs/open.c:206)
__x64_sys_ftruncate (fs/open.c:211 fs/open.c:209 fs/open.c:209)
Commit a406aff8c051 ("ocfs2: validate l_tree_depth to avoid out-of-bounds
access") already restricts el->l_tree_depth to be less than
OCFS2_MAX_PATH_DEPTH, which is equal to 5. However, does not handle the
infinite descent case.
Check if the el->l_tree_depth decreases on each descent. Maximum descents
are restricted to 4 and the path->p_node[] array does not overflow.
Link: https://lore.kernel.org/20260922202159.2421642-1-gkobakhi@asu.edu
Fixes: dcd0538ff4e8 ("ocfs2: sparse b-tree support")
Signed-off-by: Giorgi Kobakhia <gkobakhi@asu.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/alloc.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index be09e766ac1fc..c85a472965d5b 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -1817,6 +1817,7 @@ static int __ocfs2_find_path(struct ocfs2_caching_info *ci,
int i, ret = 0;
u32 range;
u64 blkno;
+ u32 prev_depth = OCFS2_MAX_PATH_DEPTH;
struct buffer_head *bh = NULL;
struct ocfs2_extent_block *eb;
struct ocfs2_extent_list *el;
@@ -1824,14 +1825,16 @@ static int __ocfs2_find_path(struct ocfs2_caching_info *ci,
el = root_el;
while (el->l_tree_depth) {
- if (unlikely(le16_to_cpu(el->l_tree_depth) >= OCFS2_MAX_PATH_DEPTH)) {
+ if (unlikely(le16_to_cpu(el->l_tree_depth) >= prev_depth)) {
ocfs2_error(ocfs2_metadata_cache_get_super(ci),
- "Owner %llu has invalid tree depth %u in extent list\n",
+ "Owner %llu has invalid tree depth %u in extent list (max %u)\n",
(unsigned long long)ocfs2_metadata_cache_owner(ci),
- le16_to_cpu(el->l_tree_depth));
+ le16_to_cpu(el->l_tree_depth), prev_depth - 1);
ret = -EROFS;
goto out;
}
+ prev_depth = le16_to_cpu(el->l_tree_depth);
+
if (!el->l_next_free_rec || !el->l_count) {
ocfs2_error(ocfs2_metadata_cache_get_super(ci),
"Owner %llu has empty extent list at depth %u\n"
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0740/1257] tmpfs: fix unicode_map leaks in casefold option handling
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (738 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0739/1257] ocfs2: fix array out of bound access in __ocfs2_find_path() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0741/1257] ALSA: hda/tas2781: Assign total_sz at the end of the function Greg Kroah-Hartman
` (258 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kazuki Hanai, Andrew Morton,
Gabriel Krisman Bertazi, Hugh Dickins, Baolin Wang,
André Almeida, Christian Brauner, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kazuki Hanai <hnkz.64@gmail.com>
[ Upstream commit f439d79e8cd19f89e04cbb3b532347edacd72c79 ]
shmem_parse_opt_casefold() stores the unicode_map returned by utf8_load()
in ctx->encoding. A filesystem context can receive the casefold parameter
more than once, and a second successful parse overwrites the stored map
without releasing it.
The map is also leaked when an unmounted filesystem context is freed.
This includes the temporary context used for remount, because
shmem_reconfigure() does not take ownership of ctx->encoding.
Reject a second casefold setting, clear ctx->encoding after transferring
ownership to the superblock, and release any remaining map from
shmem_free_fc().
An unprivileged user can repeatedly create tmpfs filesystem contexts, set
the casefold parameter, and close them from a user namespace. This causes
unbounded kernel memory consumption and can result in a local denial of
service.
Link: https://lore.kernel.org/20261002081306.637148-1-hnkz.64@gmail.com
Fixes: 58e55efd6c72 ("tmpfs: Add casefold lookup support")
Signed-off-by: Kazuki Hanai <hnkz.64@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Gabriel Krisman Bertazi <gabriel@krisman.be>
Cc: Hugh Dickins <hughd@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: André Almeida <andrealmeid@igalia.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/shmem.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/mm/shmem.c b/mm/shmem.c
index 93714b47f414b..de2362209cc38 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -4511,6 +4511,9 @@ static int shmem_parse_opt_casefold(struct fs_context *fc, struct fs_parameter *
struct unicode_map *encoding;
char *version_str = param->string + 5;
+ if (ctx->encoding)
+ return invalfc(fc, "casefold parameter cannot be specified twice\n");
+
if (!latest_version) {
if (strncmp(param->string, "utf8-", 5))
return invalfc(fc, "Only UTF-8 encodings are supported "
@@ -5000,6 +5003,7 @@ static int shmem_fill_super(struct super_block *sb, struct fs_context *fc)
if (ctx->encoding) {
sb->s_encoding = ctx->encoding;
+ ctx->encoding = NULL;
set_default_d_op(sb, &shmem_ci_dentry_ops);
if (ctx->strict_encoding)
sb->s_encoding_flags = SB_ENC_STRICT_MODE_FL;
@@ -5097,6 +5101,9 @@ static void shmem_free_fc(struct fs_context *fc)
struct shmem_options *ctx = fc->fs_private;
if (ctx) {
+#if IS_ENABLED(CONFIG_UNICODE)
+ utf8_unload(ctx->encoding);
+#endif
mpol_put(ctx->mpol);
kfree(ctx);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0741/1257] ALSA: hda/tas2781: Assign total_sz at the end of the function
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (739 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0740/1257] tmpfs: fix unicode_map leaks in casefold option handling Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0742/1257] ALSA: hda/tas2781: Skip invalid TAS2563 UEFI calibration data Greg Kroah-Hartman
` (257 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gergo Koteles, Philipp Oster,
Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <soyer@irl.hu>
[ Upstream commit 35911ab70c41957b4a8ac972af137a8e5ccbe259 ]
In the tas2563_save_calibration() function, cd->total_sz is assigned in
several error paths.
Move the assignment to the end of the function.
Fixes: b6016332b889 ("ALSA: hda/tas2781: clear cali_data.total_sz when calibration read fails")
Cc: stable@vger.kernel.org # 6.18
Signed-off-by: Gergo Koteles <soyer@irl.hu>
Tested-by: Philipp Oster <philippdev5396@outlook.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/4b357778dce1b70a647e7e47b5ab3f0a6b2fc0cc.1791895478.git.soyer@irl.hu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 14 ++++----------
1 file changed, 4 insertions(+), 10 deletions(-)
diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c b/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
index 5e5f46c9fb6b7..cff8fab8133a8 100644
--- a/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
+++ b/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
@@ -335,10 +335,11 @@ static int tas2563_save_calibration(struct tas2781_hda *h)
}
cd->cali_dat_sz_per_dev = TAS2563_CAL_DATA_SIZE * TASDEV_CALIB_N;
+ cd->total_sz = 0;
/* extra byte for each device is the device number */
- cd->total_sz = (cd->cali_dat_sz_per_dev + 1) * p->ndev;
- data = cd->data = devm_kzalloc(p->dev, cd->total_sz,
+ data = cd->data = devm_kzalloc(p->dev,
+ (cd->cali_dat_sz_per_dev + 1) * p->ndev,
GFP_KERNEL);
if (!data)
return -ENOMEM;
@@ -352,7 +353,6 @@ static int tas2563_save_calibration(struct tas2781_hda *h)
if (ret < 0 || ret >= sizeof(var8) - 1) {
dev_err(p->dev, "%s: Read %s failed\n",
__func__, var8);
- cd->total_sz = 0;
return -EINVAL;
}
/*
@@ -370,7 +370,6 @@ static int tas2563_save_calibration(struct tas2781_hda *h)
dev_warn(p->dev,
"Dev %d: Caldat[%d] read failed %ld\n",
i, j, status);
- cd->total_sz = 0;
return -EINVAL;
}
bedata = cpu_to_be32(*(uint32_t *)&data[offset]);
@@ -379,12 +378,7 @@ static int tas2563_save_calibration(struct tas2781_hda *h)
}
}
- if (cd->total_sz != offset) {
- dev_err(p->dev, "%s: tot_size(%lu) and offset(%u) mismatch\n",
- __func__, cd->total_sz, offset);
- cd->total_sz = 0;
- return -EINVAL;
- }
+ cd->total_sz = offset;
r->r0_reg = TAS2563_CAL_R0;
r->invr0_reg = TAS2563_CAL_INVR0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0742/1257] ALSA: hda/tas2781: Skip invalid TAS2563 UEFI calibration data
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (740 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0741/1257] ALSA: hda/tas2781: Assign total_sz at the end of the function Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0743/1257] ALSA: hda/realtek: keep headset mic on Acer SSID 0x1640 Greg Kroah-Hartman
` (256 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georg Wenzel, Gergo Koteles,
Philipp Oster, Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <soyer@irl.hu>
[ Upstream commit a0f0325e92e505db6a6879d79da5aa88e94a36ab ]
Some Lenovo 14ARB7 laptops do not have proper calibration data.
Skip these zero calibration values and fall back to the calibration data
provided by the DSP firmware.
Tested-by: Georg Wenzel <g.wenzel@gmail.com>
Fixes: c3ca4458cc2f ("ALSA: hda/tas2781: add TAS2563 support for 14ARB7")
Cc: stable@vger.kernel.org # 6.18
Signed-off-by: Gergo Koteles <soyer@irl.hu>
Tested-by: Philipp Oster <philippdev5396@outlook.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/12a1ab265a1dc0e3a062a54287c8ef48682c4efc.1791895478.git.soyer@irl.hu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c b/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
index cff8fab8133a8..44855f593daf8 100644
--- a/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
+++ b/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
@@ -372,6 +372,11 @@ static int tas2563_save_calibration(struct tas2781_hda *h)
i, j, status);
return -EINVAL;
}
+ if (*(uint32_t *)&data[offset] == 0) {
+ dev_warn(p->dev,
+ "Dev %d: Caldat[%d] is zero\n", i, j);
+ return -EINVAL;
+ }
bedata = cpu_to_be32(*(uint32_t *)&data[offset]);
memcpy(&data[offset], &bedata, sizeof(bedata));
offset += TAS2563_CAL_DATA_SIZE;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0743/1257] ALSA: hda/realtek: keep headset mic on Acer SSID 0x1640
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (741 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0742/1257] ALSA: hda/tas2781: Skip invalid TAS2563 UEFI calibration data Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0744/1257] PCI: imx6: Avoid dereferencing a NULL clock name Greg Kroah-Hartman
` (255 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Iván Ezequiel Rodriguez,
Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
[ Upstream commit b23012149ca8e7a9c7c72e93b7639ca2a282d6b1 ]
The micmute-LED quirk for the Aspire A315-44P matches PCI SSID
1025:1640 before the Acer ALC256 pin fallback. The Aspire Go 15
AG15-42P shares that SSID and leaves nid 0x19 as 0x411111f0, so
selecting the LED-only fixup drops the headset-mic pin remap that
the fallback would have applied.
Chain ALC2XX_FIXUP_HEADSET_MIC before the GPIO3 micmute LED on that
SSID. Leave the Swift SFG16 entry (0x169a) unchanged.
Tested on Acer Aspire AG15-42P (Callisto_BCU): PCI pick 1025:1640,
Headset Mic=0x19, GPIO3 enabled with no physical micmute LED, speaker
and capture paths functional.
Fixes: d830631a128b ("ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A315-44P")
Cc: stable@vger.kernel.org
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Link: https://patch.msgid.link/20261013204219.9649-1-ivanrwcm25@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 980e5029b2dbf..94593267a5b82 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -4344,6 +4344,7 @@ enum {
ALC2XX_FIXUP_HEADSET_MIC,
ALC289_FIXUP_DELL_CS35L41_SPI_2,
ALC256_FIXUP_ACER_SFG16_MICMUTE_LED,
+ ALC256_FIXUP_ACER_HEADSET_MICMUTE_LED,
ALC256_FIXUP_HEADPHONE_AMP_VOL,
ALC245_FIXUP_HP_SPECTRE_X360_EU0XXX,
ALC245_FIXUP_HP_SPECTRE_X360_16_AA0XXX,
@@ -6934,6 +6935,13 @@ static const struct hda_fixup alc269_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc256_fixup_acer_sfg16_micmute_led,
},
+ [ALC256_FIXUP_ACER_HEADSET_MICMUTE_LED] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc256_fixup_acer_sfg16_micmute_led,
+ .chained = true,
+ .chained_before = true,
+ .chain_id = ALC2XX_FIXUP_HEADSET_MIC,
+ },
[ALC256_FIXUP_HEADPHONE_AMP_VOL] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc256_decrease_headphone_amp_val,
@@ -7264,7 +7272,13 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1025, 0x160e, "Acer PT316-51S", ALC2XX_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x1025, 0x1616, "Acer Aspire A515-57", ALC256_FIXUP_ACER_COLDBOOT),
SND_PCI_QUIRK(0x1025, 0x161f, "Acer S40-54", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
- SND_PCI_QUIRK(0x1025, 0x1640, "Acer Aspire A315-44P", ALC256_FIXUP_ACER_SFG16_MICMUTE_LED),
+ /*
+ * Shared SSID: A315-44P needs GPIO3 micmute LED; AG15-42P needs
+ * the headset pin remap (BIOS leaves 0x19 as 0x411111f0). One
+ * entry applies both. GPIO3 is unused on AG15.
+ */
+ SND_PCI_QUIRK(0x1025, 0x1640, "Acer Aspire A315-44P / AG15-42P",
+ ALC256_FIXUP_ACER_HEADSET_MICMUTE_LED),
SND_PCI_QUIRK(0x1025, 0x166c, "Acer Predator PH16-71", ALC2XX_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x1025, 0x1679, "Acer Nitro 16 AN16-41", ALC2XX_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x1025, 0x169a, "Acer Swift SFG16", ALC256_FIXUP_ACER_SFG16_MICMUTE_LED),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0744/1257] PCI: imx6: Avoid dereferencing a NULL clock name
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (742 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0743/1257] ALSA: hda/realtek: keep headset mic on Acer SSID 0x1640 Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0745/1257] platform/x86/tuxedo: Fix keyboard LED map ordering Greg Kroah-Hartman
` (254 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rudi Heitbaum, Manivannan Sadhasivam,
Richard Zhu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rudi Heitbaum <rudi@heitbaum.com>
[ Upstream commit e60d0d4dfddfac3058753a1c2255251401c92dad ]
of_clk_bulk_get() leaves 'clk_bulk_data->id' as NULL for every clock that
has no matching entry in "clock-names", which is legal: a node may list
more "clocks" phandles than it names. Both scans of the bulk array
dereference that id unconditionally, so such a node oopses during probe.
The loop in imx_pcie_probe() has been wrong since it was written. The
loop in imx_setup_phy_mpll() was not: it read a fixed clks[] whose ids
came from the driver's own clk_names[] and were never NULL, and only
became wrong when the driver moved to the bulk array.
Check 'clk_bulk_data->id' before dereferencing it in both.
Fixes: f6a1fdfc78e2 ("PCI: imx6: Use devm_clk_bulk_get_all() to fetch clocks")
Fixes: d8574ce57d76 ("PCI: imx6: Add external reference clock input mode support")
Signed-off-by: Rudi Heitbaum <rudi@heitbaum.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Acked-by: Richard Zhu <hongxing.zhu@nxp.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/am8iBwJSEhYhWTqk@6cfee64030a6/
Link: https://patch.msgid.link/aqfqE4OLhnN4a1lW@b65e9c1eb12f
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pci-imx6.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index f7a2eb257c169..785f575e0134e 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -542,7 +542,7 @@ static int imx_setup_phy_mpll(struct imx_pcie *imx_pcie)
return 0;
for (i = 0; i < imx_pcie->num_clks; i++)
- if (strncmp(clks[i].id, "pcie_phy", 8) == 0)
+ if (clks[i].id && strncmp(clks[i].id, "pcie_phy", 8) == 0)
phy_rate = clk_get_rate(clks[i].clk);
switch (phy_rate) {
@@ -1836,7 +1836,8 @@ static int imx_pcie_probe(struct platform_device *pdev)
return dev_err_probe(dev, imx_pcie->num_clks,
"failed to get clocks\n");
for (i = 0; i < imx_pcie->num_clks; i++)
- if (strncmp(imx_pcie->clks[i].id, "extref", 6) == 0)
+ if (imx_pcie->clks[i].id &&
+ strncmp(imx_pcie->clks[i].id, "extref", 6) == 0)
imx_pcie->enable_ext_refclk = true;
if (imx_check_flag(imx_pcie, IMX_PCIE_FLAG_HAS_PHYDRV)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0745/1257] platform/x86/tuxedo: Fix keyboard LED map ordering
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (743 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0744/1257] PCI: imx6: Avoid dereferencing a NULL clock name Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0746/1257] ALSA: cs46xx: fix unit mismatch in DSP code area bounds check Greg Kroah-Hartman
` (253 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Werner Sembach, Aaron Erhardt,
Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Erhardt <aer@tuxedocomputers.com>
[ Upstream commit 5c9c54dfa28c9a47c9d81322d16585f9a64d4c69 ]
The LED mappings in sirius_16_[iso|ansii]_kbl_map did contain a
flipped line that caused LEDs to turn on in the wrong order when
counting up the Lamp ID.
Fixes: cfd84b3f419b ("platform/x86/tuxedo: Add virtual LampArray for TUXEDO NB04 devices")
Cc: stable@vger.kernel.org
Reviewed-by: Werner Sembach <wse@tuxedocomputers.com>
Signed-off-by: Aaron Erhardt <aer@tuxedocomputers.com>
Link: https://patch.msgid.link/20261007080202.81694-5-aer@tuxedocomputers.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/tuxedo/nb04/wmi_ab.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/platform/x86/tuxedo/nb04/wmi_ab.c b/drivers/platform/x86/tuxedo/nb04/wmi_ab.c
index 32d7756022c26..38a719381fdc5 100644
--- a/drivers/platform/x86/tuxedo/nb04/wmi_ab.c
+++ b/drivers/platform/x86/tuxedo/nb04/wmi_ab.c
@@ -232,8 +232,8 @@ static const struct tux_kbl_map_entry_t sirius_16_ansii_kbl_map[] = {
{ 0x2e, { 246000, 67500, 5250 } },
{ 0x2a, { 269500, 67500, 5250 } },
{ 0x53, { 294500, 67500, 5250 } },
- { 0x55, { 311200, 67500, 5250 } },
- { 0x54, { 327900, 67500, 5250 } },
+ { 0x54, { 311200, 67500, 5250 } },
+ { 0x55, { 327900, 67500, 5250 } },
{ 0x56, { 344600, 67500, 5250 } },
{ 0x2b, { 31000, 85500, 5500 } },
{ 0x14, { 51500, 85500, 5500 } },
@@ -337,8 +337,8 @@ static const struct tux_kbl_map_entry_t sirius_16_iso_kbl_map[] = {
{ 0x2e, { 246000, 67500, 5250 } },
{ 0x2a, { 269500, 67500, 5250 } },
{ 0x53, { 294500, 67500, 5250 } },
- { 0x55, { 311200, 67500, 5250 } },
- { 0x54, { 327900, 67500, 5250 } },
+ { 0x54, { 311200, 67500, 5250 } },
+ { 0x55, { 327900, 67500, 5250 } },
{ 0x56, { 344600, 67500, 5250 } },
{ 0x2b, { 31000, 85500, 5500 } },
{ 0x14, { 51500, 85500, 5500 } },
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0746/1257] ALSA: cs46xx: fix unit mismatch in DSP code area bounds check
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (744 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0745/1257] platform/x86/tuxedo: Fix keyboard LED map ordering Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0747/1257] platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer() Greg Kroah-Hartman
` (252 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Denis Arefev, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <arefev@swemel.ru>
[ Upstream commit fd65108f5001ffb416dc9bd37ec1893f55cff24a ]
ins->code.offset and code->size are measured in 32-bit words, while
DSP_CODE_BYTE_SIZE is the size of the DSP code area in bytes. The
check ins->code.offset + code->size > DSP_CODE_BYTE_SIZE in
cs46xx_dsp_load_module() therefore allowed up to four times more code
than the code area can hold.
The shadow buffer ins->code.data is allocated with
kmalloc(DSP_CODE_BYTE_SIZE), i.e. it holds DSP_CODE_BYTE_SIZE/4
words. A firmware file with a code segment larger than
DSP_CODE_BYTE_SIZE/4 words (28 KiB) passed the check and caused an
out-of-bounds write in shadow_and_reallocate_code() and an
out-of-bounds read in snd_cs46xx_download().
Compare the sum in words against DSP_CODE_BYTE_SIZE/4 and cast it to
u64 so that the sum cannot wrap for large code->size values.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Denis Arefev <arefev@swemel.ru>
Link: https://patch.msgid.link/20261014102619.16415-1-arefev@swemel.ru
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/cs46xx/dsp_spos.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c
index 6fd4f629d1d57..a77e6f5a14ada 100644
--- a/sound/pci/cs46xx/dsp_spos.c
+++ b/sound/pci/cs46xx/dsp_spos.c
@@ -393,7 +393,7 @@ int cs46xx_dsp_load_module (struct snd_cs46xx * chip, struct dsp_module_desc * m
dev_dbg(chip->card->dev,
"dsp_spos: module got no code segment\n");
} else {
- if (ins->code.offset + code->size > DSP_CODE_BYTE_SIZE) {
+ if ((u64)ins->code.offset + code->size > DSP_CODE_BYTE_SIZE / 4) {
dev_err(chip->card->dev,
"dsp_spos: no space available in DSP\n");
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0747/1257] platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (745 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0746/1257] ALSA: cs46xx: fix unit mismatch in DSP code area bounds check Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0748/1257] platform/x86: hp-bioscfg: fix non-ASCII truncation " Greg Kroah-Hartman
` (251 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit 176b38b84ae5e075850b3ebb25f906d66f95a46d ]
The escape prescan loop uses 'size' as both its bound and its
accumulator, so each escape character found extends the loop and
reads past the end of src[].
Use the original u16 count as the loop bound. Also include the 2-byte
length prefix in the bounds check, pass the u16 count instead of the
byte count to utf16s_to_utf8s(), and advance the buffer by the bytes
actually consumed instead of the escape-inflated count.
Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.7).
Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20261007134711.473857-2-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 26 +++++++++++---------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
index ff28db7ced008..6b48faec2cea3 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -54,8 +54,8 @@ int hp_get_integer_from_buffer(u8 **buffer, u32 *buffer_size, u32 *integer)
int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_size)
{
u16 *src = (u16 *)*buffer;
+ u16 orig_size;
u16 src_size;
-
u16 size;
int i;
int conv_dst_size;
@@ -63,17 +63,21 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
if (*buffer_size < sizeof(u16))
return -EINVAL;
- src_size = *(src++);
- /* size value in u16 chars */
- size = src_size / sizeof(u16);
+ src_size = *src;
- /* Ensure there is enough space remaining to read and convert
- * the string
+ /*
+ * Ensure there is enough space remaining for the length prefix
+ * just read plus the string data it describes.
*/
- if (*buffer_size < src_size)
+ if (*buffer_size < sizeof(u16) + src_size)
return -EINVAL;
- for (i = 0; i < size; i++)
+ src++;
+ /* size value in u16 chars */
+ orig_size = src_size / sizeof(u16);
+ size = orig_size;
+
+ for (i = 0; i < orig_size; i++)
if (src[i] == '\\' ||
src[i] == '\r' ||
src[i] == '\n' ||
@@ -91,7 +95,7 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
/*
* convert from UTF-16 unicode to ASCII
*/
- utf16s_to_utf8s(src, src_size, UTF16_HOST_ENDIAN, dst, conv_dst_size);
+ utf16s_to_utf8s(src, orig_size, UTF16_HOST_ENDIAN, dst, conv_dst_size);
dst[conv_dst_size] = 0;
for (i = 0; i < conv_dst_size; i++) {
@@ -117,8 +121,8 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
src++;
}
- *buffer = (u8 *)src;
- *buffer_size -= size * sizeof(u16);
+ *buffer += sizeof(u16) + src_size;
+ *buffer_size -= sizeof(u16) + src_size;
return size;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0748/1257] platform/x86: hp-bioscfg: fix non-ASCII truncation in hp_get_string_from_buffer()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (746 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0747/1257] platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0749/1257] platform/x86: hp-bioscfg: return -E2BIG from validate_password_input() Greg Kroah-Hartman
` (250 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Muhammad Bilal,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit 6b8d2374b32c35efa2a431b3cd2fe346f8917dcc ]
utf16s_to_utf8s() writes into dst, but the loop that follows
overwrites dst from the raw UTF-16 code units with truncating casts,
so any character above U+007F is mangled. For example, U+00E9 is
stored as 0xe9 instead of 0xc3 0xa9.
Convert into a scratch buffer first, then escape '\\', '\r', '\n' and
'\t' into dst with string_escape_mem(). Quotes are not escaped, so the
existing strreplace() still handles them.
Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.7).
Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/
Link: https://patch.msgid.link/20261007134711.473857-3-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 62 +++++---------------
1 file changed, 14 insertions(+), 48 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
index 6b48faec2cea3..8ffdc737af4d2 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -11,7 +11,7 @@
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/printk.h>
-#include <linux/string.h>
+#include <linux/string_helpers.h>
#include <linux/wmi.h>
#include "bioscfg.h"
#include "../../firmware_attributes_class.h"
@@ -53,12 +53,12 @@ int hp_get_integer_from_buffer(u8 **buffer, u32 *buffer_size, u32 *integer)
int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_size)
{
+ char utf8_buf[MAX_BUFF_SIZE];
u16 *src = (u16 *)*buffer;
+ int escaped_len;
u16 orig_size;
u16 src_size;
- u16 size;
- int i;
- int conv_dst_size;
+ int utf8_len;
if (*buffer_size < sizeof(u16))
return -EINVAL;
@@ -75,56 +75,22 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
src++;
/* size value in u16 chars */
orig_size = src_size / sizeof(u16);
- size = orig_size;
-
- for (i = 0; i < orig_size; i++)
- if (src[i] == '\\' ||
- src[i] == '\r' ||
- src[i] == '\n' ||
- src[i] == '\t')
- size++;
- /*
- * Conversion is limited to destination string max number of
- * bytes.
- */
- conv_dst_size = size;
- if (size >= dst_size)
- conv_dst_size = dst_size - 1;
+ utf8_len = utf16s_to_utf8s(src, orig_size, UTF16_HOST_ENDIAN,
+ utf8_buf, sizeof(utf8_buf));
- /*
- * convert from UTF-16 unicode to ASCII
- */
- utf16s_to_utf8s(src, orig_size, UTF16_HOST_ENDIAN, dst, conv_dst_size);
- dst[conv_dst_size] = 0;
-
- for (i = 0; i < conv_dst_size; i++) {
- if (*src == '\\' ||
- *src == '\r' ||
- *src == '\n' ||
- *src == '\t') {
- dst[i++] = '\\';
- if (i == conv_dst_size)
- break;
- }
-
- if (*src == '\r')
- dst[i] = 'r';
- else if (*src == '\n')
- dst[i] = 'n';
- else if (*src == '\t')
- dst[i] = 't';
- else if (*src == '"')
- dst[i] = '\'';
- else
- dst[i] = *src;
- src++;
- }
+ escaped_len = string_escape_mem(utf8_buf, utf8_len, dst, dst_size - 1,
+ ESCAPE_SPACE | ESCAPE_SPECIAL,
+ "\\\r\n\t");
+ if (escaped_len > dst_size - 1)
+ escaped_len = dst_size - 1;
+ dst[escaped_len] = '\0';
+ strreplace(dst, '"', '\'');
*buffer += sizeof(u16) + src_size;
*buffer_size -= sizeof(u16) + src_size;
- return size;
+ return escaped_len;
}
int hp_get_common_data_from_buffer(u8 **buffer_ptr, u32 *buffer_size,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0749/1257] platform/x86: hp-bioscfg: return -E2BIG from validate_password_input()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (747 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0748/1257] platform/x86: hp-bioscfg: fix non-ASCII truncation " Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0750/1257] platform/x86: hp-bioscfg: allow clearing current_password Greg Kroah-Hartman
` (249 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit a4f19c589b21e18567d3c0ac7b9294f81e29b1de ]
validate_password_input() returns the positive INVALID_BIOS_AUTH on
rejection. store_password_instance() skips the store on nonzero ret,
but its final "return ret < 0 ? ret : count" treats the positive value
as success, so userspace sees count instead of an error.
Return -E2BIG for an invalid password length.
Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.7): writing 999
bytes to current_password returned 999 before this change.
Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/
Link: https://patch.msgid.link/20261007134711.473857-4-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
index a9e1786374162..3f4c45d9b9f95 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
@@ -70,12 +70,13 @@ static int validate_password_input(int instance_id, const char *buf)
length--;
if (length > MAX_PASSWD_SIZE)
- return INVALID_BIOS_AUTH;
+ return -E2BIG;
if (password_data->min_password_length > length ||
password_data->max_password_length < length)
- return INVALID_BIOS_AUTH;
- return SUCCESS;
+ return -E2BIG;
+
+ return 0;
}
ATTRIBUTE_N_PROPERTY_SHOW(is_enabled, password);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0750/1257] platform/x86: hp-bioscfg: allow clearing current_password
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (748 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0749/1257] platform/x86: hp-bioscfg: return -E2BIG from validate_password_input() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0751/1257] platform/x86: hp-bioscfg: NUL-terminate the SPM auth token Greg Kroah-Hartman
` (248 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit acada379d5c4dd3a86d48fc69802e769eff29f7e ]
The ABI documents echo "" > current_password as the way to end a
session, but validate_password_input() rejects an empty string when
min_password_length is nonzero, so the password stays cached.
Skip the length check for an empty current_password so the write
clears it.
Compile tested only.
Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/
Link: https://patch.msgid.link/20261007134711.473857-5-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
index 3f4c45d9b9f95..f0551b4553794 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
@@ -60,7 +60,8 @@ int hp_get_password_instance_for_type(const char *name)
return -EINVAL;
}
-static int validate_password_input(int instance_id, const char *buf)
+static int validate_password_input(int instance_id, const char *buf,
+ bool is_current)
{
int length;
struct password_data *password_data = &bioscfg_drv.password_data[instance_id];
@@ -69,6 +70,10 @@ static int validate_password_input(int instance_id, const char *buf)
if (length > 0 && buf[length - 1] == '\n')
length--;
+ /* An empty current_password clears the session password */
+ if (is_current && !length)
+ return 0;
+
if (length > MAX_PASSWD_SIZE)
return -E2BIG;
@@ -97,7 +102,7 @@ static int store_password_instance(struct kobject *kobj, const char *buf,
id = get_password_instance_id(kobj);
if (id >= 0)
- ret = validate_password_input(id, buf_cp);
+ ret = validate_password_input(id, buf_cp, is_current);
}
if (!ret) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0751/1257] platform/x86: hp-bioscfg: NUL-terminate the SPM auth token
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (749 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0750/1257] platform/x86: hp-bioscfg: allow clearing current_password Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0752/1257] serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit() Greg Kroah-Hartman
` (247 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Ilpo Järvinen,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
[ Upstream commit f2769668959f6411ac69e83080a240f8a8785e05 ]
auth_token_store() copies the token with kmemdup(), which does not NUL
terminate it, but hp_calculate_security_buffer() and
hp_populate_security_buffer() use it as a C string and read past the
allocation.
A lone newline (echo > auth_token) is worse: kmemdup() of 0 bytes
returns ZERO_SIZE_PTR, which passes the NULL checks, so a later
attribute write passes it to strlen().
A userspace replica of the two helpers under ASan reports a heap
buffer overflow in hp_calculate_security_buffer() for the unterminated
token and a fault at address 0x10 for the lone newline, and is clean
with this change.
The token is a string, so copy it with kstrndup(), which always NUL
terminates and allocates at least one byte.
Fixes: b2715aa2e135 ("platform/x86: hp-bioscfg: spmobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20261007134711.473857-9-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
index abf8ce20fe15c..040964ed50ced 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
@@ -307,7 +307,7 @@ static ssize_t auth_token_store(struct kobject *kobj,
length--;
/* allocate space and copy current auth token */
- bioscfg_drv.spm_data.auth_token = kmemdup(buf, length, GFP_KERNEL);
+ bioscfg_drv.spm_data.auth_token = kstrndup(buf, length, GFP_KERNEL);
if (!bioscfg_drv.spm_data.auth_token) {
ret = -ENOMEM;
goto exit_token;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0752/1257] serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (750 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0751/1257] platform/x86: hp-bioscfg: NUL-terminate the SPM auth token Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0753/1257] serial: 8250_omap: set priv->line before enabling the IRQ Greg Kroah-Hartman
` (246 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE),
Ilpo Järvinen, stable, Andy Shevchenko, linux-serial,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
[ Upstream commit 3e3ae95a3d84a6028f37a07ab7ad78bb14689f2e ]
lpss8250_probe() calls lpss->board->exit() on its error path. For the
EHL board, that is ehl_serial_exit() and it does:
serial8250_get_port(lpss->data.line)->dma = NULL;
But when lpss8250_dma_setup() or serial8250_register_8250_port() fails,
lpss->data.line was never assigned. As lpss is kzalloc()ed, line is 0
and ehl_serial_exit() clears the dma pointer of an unrelated port --
serial8250_ports[0], i.e. ttyS0, which is often the console.
Initialize lpss->data.line to -1 in probe and skip the clearing in
ehl_serial_exit() if no port was registered.
Fixes: 5318f70da7e8 ("serial: 8250_lpss: Balance reference count for PCI DMA device")
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Assisted-by: LLM
Cc: "Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>
Cc: stable@kernel.org
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: linux-serial@vger.kernel.org
Link: https://patch.msgid.link/f389df34aaa538270313ebd4cea75c2baaf46b95.1791873876.git.jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_lpss.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_lpss.c b/drivers/tty/serial/8250/8250_lpss.c
index 776ec1ef29d62..325e587ae2c42 100644
--- a/drivers/tty/serial/8250/8250_lpss.c
+++ b/drivers/tty/serial/8250/8250_lpss.c
@@ -183,9 +183,8 @@ static int ehl_serial_setup(struct lpss8250 *lpss, struct uart_port *port)
static void ehl_serial_exit(struct lpss8250 *lpss)
{
- struct uart_8250_port *up = serial8250_get_port(lpss->data.line);
-
- up->dma = NULL;
+ if (lpss->data.line >= 0)
+ serial8250_get_port(lpss->data.line)->dma = NULL;
}
#ifdef CONFIG_SERIAL_8250_DMA
@@ -329,6 +328,8 @@ static int lpss8250_probe(struct pci_dev *pdev, const struct pci_device_id *id)
return ret;
lpss->board = (struct lpss8250_board *)id->driver_data;
+ /* for tests in lpss->board->exit() */
+ lpss->data.line = -1;
memset(&uart, 0, sizeof(struct uart_8250_port));
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0753/1257] serial: 8250_omap: set priv->line before enabling the IRQ
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (751 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0752/1257] serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit() Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0754/1257] Revert "serial: 8250_port: Drop duplicate NULL check" Greg Kroah-Hartman
` (245 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE), Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
[ Upstream commit 8276a44f0a0b68c07b2331cc0058036ac4c4190d ]
omap8250_irq() is requested in omap8250_probe() with IRQ_NOAUTOEN and
enabled only in omap_8250_startup(). The handler obtains the port by
serial8250_get_port(priv->line), but probe stores priv->line only after
serial8250_register_8250_port() returns.
The port becomes visible to userspace already inside
serial8250_register_8250_port() (uart_add_one_port()). So it can be
opened -- and the IRQ enabled -- before probe stores the line. An
interrupt in that window makes the handler call
serial8250_get_port(-ENODEV) and dereference a pointer outside of
serial8250_ports[].
Store the line in omap_8250_startup() before enable_irq(), so the
handler never runs with an unset line. Keep the assignment in probe
too, as remove and the system PM callbacks rely on it even when the
port was never opened.
Fixes: fef4f600319e ("serial: 8250: omap: Fix life cycle issues for interrupt handlers")
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/3b3a642f7df2285f49a7bbbe5d1c23fa442c7d94.1791873876.git.jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_omap.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index ceecb39fb82da..70252258344cd 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -711,6 +711,9 @@ static int omap_8250_startup(struct uart_port *port)
struct uart_8250_dma *dma = &priv->omap8250_dma;
int ret;
+ /* ISR and runtime PM need the line; probe sets it only after registration */
+ priv->line = port->line;
+
#ifdef CONFIG_PM
up->capabilities |= UART_CAP_RPM;
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0754/1257] Revert "serial: 8250_port: Drop duplicate NULL check"
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (752 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0753/1257] serial: 8250_omap: set priv->line before enabling the IRQ Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0755/1257] serial: amba-pl011: honour delay_rts_before_send for every write Greg Kroah-Hartman
` (244 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ferry Toth, Andy Shevchenko,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ferry Toth <ftoth@exalondelft.nl>
[ Upstream commit 6ae994d513a6ace5462137e1025a4e7086b87348 ]
This reverts commit 7885af04df6e4efd72910200c1bfc079d61202e4.
Commit 7885af04df6e ("serial: 8250_port: Drop duplicate NULL check")
added `up->dma = NULL;` to serial8250_release_dma(), with the stated
intent of making sure DMA would not be used again after release.
However, up->dma is assigned once at probe time. serial8250_do_startup()
only calls serial8250_request_dma() when up->dma is non-NULL, so after
the first close the pointer stays NULL and DMA is never re-acquired.
On Intel Tangier (Edison) with HSU DMA this causes a regression: the
first port open uses TX DMA, the second and later opens transmit in PIO
mode, producing 64-byte FIFO bursts with ~50us gaps between them.
Fixes: 7885af04df6e ("serial: 8250_port: Drop duplicate NULL check")
Cc: stable@kernel.org
Signed-off-by: Ferry Toth <ftoth@exalondelft.nl>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20261010193755.187706-2-ftoth@exalondelft.nl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_port.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index b01baff71f60e..c961b969021ec 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -2428,8 +2428,8 @@ void serial8250_do_shutdown(struct uart_port *port)
synchronize_irq(port->irq);
- serial8250_release_dma(up);
- up->dma = NULL;
+ if (up->dma)
+ serial8250_release_dma(up);
scoped_guard(uart_port_lock_irqsave, port) {
if (port->flags & UPF_FOURPORT) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0755/1257] serial: amba-pl011: honour delay_rts_before_send for every write
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (753 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0754/1257] Revert "serial: 8250_port: Drop duplicate NULL check" Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0756/1257] serial: amba-pl011: keep transmitter enabled when disabling RS485 Greg Kroah-Hartman
` (243 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nicolai Buchwitz, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Buchwitz <nb@tipi-net.de>
[ Upstream commit 8a9750209596be35d109de5aa89623b049855c67 ]
While the driver waits out delay_rts_before_send, another write calls
pl011_start_tx() again. pl011_rs485_tx_start() then switches straight
to SEND, and the data goes out before the delay has passed.
Leave the start to the trigger_start_tx timer while it is pending.
Fixes: 2c1fd53af21b ("serial: amba-pl011: Fix RTS handling in RS485 mode")
Cc: stable@vger.kernel.org
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20261011-fix-pl011-rs485-rts-delay-v1-1-5078e61bc408@tipi-net.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/amba-pl011.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index e67f2ac454b63..d57b39f58a9bf 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1420,10 +1420,6 @@ static void pl011_rs485_tx_start(struct uart_amba_port *uap)
struct uart_port *port = &uap->port;
u32 cr;
- if (uap->rs485_tx_state == WAIT_AFTER_RTS) {
- uap->rs485_tx_state = SEND;
- return;
- }
if (uap->rs485_tx_state == WAIT_AFTER_SEND ||
uap->rs485_tx_state == WAIT_AFTER_SEND_DELAY) {
hrtimer_try_to_cancel(&uap->trigger_stop_tx);
@@ -1462,6 +1458,10 @@ static void pl011_start_tx(struct uart_port *port)
if ((uap->port.rs485.flags & SER_RS485_ENABLED) &&
uap->rs485_tx_state != SEND) {
+ /* trigger_start_tx starts TX once delay_rts_before_send passed */
+ if (uap->rs485_tx_state == WAIT_AFTER_RTS)
+ return;
+
pl011_rs485_tx_start(uap);
if (uap->rs485_tx_state == WAIT_AFTER_RTS)
return;
@@ -1478,8 +1478,10 @@ static enum hrtimer_restart pl011_trigger_start_tx(struct hrtimer *t)
unsigned long flags;
uart_port_lock_irqsave(&uap->port, &flags);
- if (uap->rs485_tx_state == WAIT_AFTER_RTS)
+ if (uap->rs485_tx_state == WAIT_AFTER_RTS) {
+ uap->rs485_tx_state = SEND;
pl011_start_tx(&uap->port);
+ }
uart_port_unlock_irqrestore(&uap->port, flags);
return HRTIMER_NORESTART;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0756/1257] serial: amba-pl011: keep transmitter enabled when disabling RS485
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (754 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0755/1257] serial: amba-pl011: honour delay_rts_before_send for every write Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0757/1257] serial: pmac_zilog: push received data to the port that received it Greg Kroah-Hartman
` (242 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Nicolai Buchwitz,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Buchwitz <nb@tipi-net.de>
[ Upstream commit 97f85204275ae4d7fb530e451f3acc65c1ec1155 ]
Disabling RS485 on an open port calls pl011_rs485_tx_stop(), which
turns off the transmitter. Only the RS485 TX path turns it back on, so
any later output stays queued and tcdrain() hangs until the port is
closed.
pl011_rs485_tx_stop() also checks only the hardware FIFO. If a DMA
transfer has started but has not filled the FIFO yet, the transmitter
is turned off under the transfer and the DMA channel never recovers.
When leaving RS485 mode, cancel pending deferred starts and stops, leave
the transmitter enabled and start any TX that was still waiting for
delay_rts_before_send.
Fixes: 8d479237727c ("serial: amba-pl011: add RS485 support")
Cc: stable@kernel.org
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20261012-fix-pl011-rs485-txe-v2-1-e9bf7d218389@tipi-net.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/amba-pl011.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index d57b39f58a9bf..c5e3b120060f9 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2399,8 +2399,31 @@ static int pl011_rs485_config(struct uart_port *port, struct ktermios *termios,
struct uart_amba_port *uap =
container_of(port, struct uart_amba_port, port);
- if (port->rs485.flags & SER_RS485_ENABLED)
+ if ((port->rs485.flags & SER_RS485_ENABLED) &&
+ !(rs485->flags & SER_RS485_ENABLED)) {
+ bool tx_pending = uap->rs485_tx_state == WAIT_AFTER_RTS;
+ u32 cr = pl011_read(uap, REG_CR);
+
+ /*
+ * Leaving RS485 mode, which only enables the transmitter while
+ * sending. Don't stop it, as that stalls a DMA transfer still
+ * in flight. Drop pending deferred starts and stops and keep
+ * it enabled.
+ */
+ hrtimer_try_to_cancel(&uap->trigger_start_tx);
+ hrtimer_try_to_cancel(&uap->trigger_stop_tx);
+ uap->rs485_tx_state = OFF;
+
+ cr |= UART011_CR_TXE | UART011_CR_RXE;
+ pl011_write(cr, uap, REG_CR);
+
+ /* Start TX that was still waiting for delay_rts_before_send */
+ if (tx_pending && !uart_tx_stopped(port) &&
+ !pl011_dma_tx_start(uap))
+ pl011_start_tx_pio(uap);
+ } else if (port->rs485.flags & SER_RS485_ENABLED) {
pl011_rs485_tx_stop(uap);
+ }
/* Make sure auto RTS is disabled */
if (rs485->flags & SER_RS485_ENABLED) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0757/1257] serial: pmac_zilog: push received data to the port that received it
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (755 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0756/1257] serial: amba-pl011: keep transmitter enabled when disabling RS485 Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0758/1257] iommu/amd: Program device table when kdump reuse fails Greg Kroah-Hartman
` (241 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tim Douglas, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Douglas <me@timdoug.com>
[ Upstream commit f3dc727da3af64abc12b625bbf1eb68d55d882cc ]
pmz_interrupt() drains both channels but, since commit 2e124b4a390c
("TTY: switch tty_flip_buffer_push"), pushes the flip buffer of the
port whose handler is running rather than the port that was drained.
With both ports open, data received on the other port can be left in
its flip buffer until something else pushes it, so its reader may not
see it.
Fixes: 2e124b4a390c ("TTY: switch tty_flip_buffer_push")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Tim Douglas <me@timdoug.com>
Link: https://patch.msgid.link/20261013013541.4535-2-me@timdoug.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/pmac_zilog.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
index e3a9193286954..f49d6052d11be 100644
--- a/drivers/tty/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c
@@ -444,7 +444,7 @@ static irqreturn_t pmz_interrupt(int irq, void *dev_id)
skip_a:
uart_port_unlock(&uap_a->port);
if (push)
- tty_flip_buffer_push(&uap->port.state->port);
+ tty_flip_buffer_push(&uap_a->port.state->port);
if (!uap_b)
goto out;
@@ -469,7 +469,7 @@ static irqreturn_t pmz_interrupt(int irq, void *dev_id)
skip_b:
uart_port_unlock(&uap_b->port);
if (push)
- tty_flip_buffer_push(&uap->port.state->port);
+ tty_flip_buffer_push(&uap_b->port.state->port);
out:
return rc;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0758/1257] iommu/amd: Program device table when kdump reuse fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (756 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0757/1257] serial: pmac_zilog: push received data to the port that received it Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0759/1257] iommu/amd: Dont allocate kdump device table from DMA32 Greg Kroah-Hartman
` (240 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ashish Kalra, Ankit Soni,
Vasant Hegde, Matt Fleming, Joerg Roedel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <mfleming@cloudflare.com>
[ Upstream commit 05d62be400f3ae0f6856f6910a1281e67cbaabcf ]
Commit 38e5f33ee359 ("iommu/amd: Reuse device table for kdump") made
iommu_set_device_table() return early in every kdump kernel. That is
needed when the previous kernel's device table is reused: the base
register already points at it, and on SNP-enabled systems the register
is locked.
But if reuse isn't possible, early_enable_iommus() falls back to the
freshly allocated table and calls early_enable_iommu(). Because of the
early return, that table is never written to the base register. The
IOMMU keeps using whatever table the register pointed at before, while
the driver writes entries into the new one.
Only skip the write when the previous kernel's table was reused.
Fixes: 38e5f33ee359 ("iommu/amd: Reuse device table for kdump")
Cc: stable@vger.kernel.org
Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>
Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/init.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index edcc187b8f14f..102b7b5d2021e 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -390,7 +390,13 @@ static void iommu_set_device_table(struct amd_iommu *iommu)
BUG_ON(iommu->mmio_base == NULL);
- if (is_kdump_kernel())
+ /*
+ * A kdump kernel that reuses the previous kernel's device table must
+ * leave the base register alone. It already points at that table, and
+ * with SNP enabled the register is locked. If reuse failed, program
+ * the freshly allocated table like a normal boot.
+ */
+ if (iommu->pci_seg->old_dev_tbl_cpy)
return;
entry = iommu_virt_to_phys(dev_table);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0759/1257] iommu/amd: Dont allocate kdump device table from DMA32
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (757 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0758/1257] iommu/amd: Program device table when kdump reuse fails Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0760/1257] nvme: make the DH-HMAC-CHAP secret attributes readable by root only Greg Kroah-Hartman
` (239 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ashish Kalra, Ankit Soni,
Matt Fleming, Vasant Hegde, Joerg Roedel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <mfleming@cloudflare.com>
[ Upstream commit bae0d3760661ac77148944e88aafef698cf7b2bf ]
Booting a kdump kernel with crashkernel=X,high crashkernel=0,low on an
AMD system fails the per-segment device table allocation because there
is no memory below 4G:
swapper/0: page allocation failure: order:9, mode:0x40104(GFP_DMA32|__GFP_ZERO|__GFP_COMP)
iommu_alloc_pages_node_sz+0x7f/0x150
alloc_pci_segment+0x4bd/0x650
iommu_go_to_state+0x213d/0x34e0
amd_iommu_prepare+0x39/0xa0
irq_remapping_prepare+0x83/0xd0
enable_IR_x2apic+0x61/0x370
On our E810 systems, the kdump kernel booted but ice MSI-X interrupts
never fired and the TX queues timed out.
Commit b336781b82cc ("iommu/amd: Allocate memory below 4G for dev table
if translation pre-enabled") allocated device tables below 4G. At the
time, the kdump kernel programmed a copy of the old table into the base
register with the IOMMU still enabled. The 64-bit register is updated
as two 32-bit halves, so the running IOMMU could see a half-written,
invalid table pointer. Keeping both tables below 4G leaves the upper
half zero throughout the update, so the pointer stays valid.
Since commit 38e5f33ee359 ("iommu/amd: Reuse device table for kdump")
the kdump kernel reuses the previous kernel's table without writing the
base register, so its newly allocated table is discarded when reuse
succeeds. If reuse fails, the previous patch programs the new table only
after disabling the IOMMU. Either way, the kdump kernel's table doesn't
need to be below 4G.
The previous kernel still allocates its table from DMA32, so the kdump
kernel's check that the old table is below 4G still works. Drop
GFP_DMA32 for kdump kernels only.
Cc: stable@vger.kernel.org # 6.18.x
Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>
Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/init.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 102b7b5d2021e..0506617b27c29 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -629,8 +629,19 @@ static int __init find_last_devid_acpi(struct acpi_table_header *table, u16 pci_
/* Allocate per PCI segment device table */
static inline int __init alloc_dev_table(struct amd_iommu_pci_seg *pci_seg)
{
- pci_seg->dev_table = iommu_alloc_pages_sz(GFP_KERNEL | GFP_DMA32,
- pci_seg->dev_table_size);
+ gfp_t gfp = GFP_KERNEL;
+
+ /*
+ * Keep normal kernel device tables below 4G because a later kdump
+ * kernel only trusts and reuses old tables below that limit. A kdump
+ * kernel's new table is either discarded when reuse succeeds or
+ * programmed after the IOMMU is disabled, so the table does not
+ * need DMA32 memory (which the crashkernel may not have).
+ */
+ if (!is_kdump_kernel())
+ gfp |= GFP_DMA32;
+
+ pci_seg->dev_table = iommu_alloc_pages_sz(gfp, pci_seg->dev_table_size);
if (!pci_seg->dev_table)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0760/1257] nvme: make the DH-HMAC-CHAP secret attributes readable by root only
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (758 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0759/1257] iommu/amd: Dont allocate kdump device table from DMA32 Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0761/1257] mfd: ab8500: Fix child device leaks on probe failure Greg Kroah-Hartman
` (238 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Wagner, Martin Belanger,
Keith Busch, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Belanger <martin.nvme.dev@gmail.com>
[ Upstream commit bbca7c312ab25efd0024eb87545c51a76ab2ea39 ]
The dhchap_secret and dhchap_ctrl_secret sysfs attributes have mode
0644. Their show functions return the secret, so any local user can
read the DH-HMAC-CHAP secrets of a connected controller.
Define them with DEVICE_ATTR_ADMIN_RW(), which sets mode 0600. The
macro takes the show and store functions from the attribute name, so
rename them. Writing the attributes was already limited to root and is
not changed.
Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Cc: stable@vger.kernel.org
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Assisted-by: LLM
Signed-off-by: Martin Belanger <martin.nvme.dev@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/sysfs.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index e1e3dcfd084be..c0ecb5df1a30b 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -809,7 +809,7 @@ static DEVICE_ATTR(io_timeout, S_IRUGO | S_IWUSR,
nvme_io_timeout_show, nvme_io_timeout_store);
#ifdef CONFIG_NVME_HOST_AUTH
-static ssize_t nvme_ctrl_dhchap_secret_show(struct device *dev,
+static ssize_t dhchap_secret_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -820,7 +820,7 @@ static ssize_t nvme_ctrl_dhchap_secret_show(struct device *dev,
return sysfs_emit(buf, "%s\n", opts->dhchap_secret);
}
-static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
+static ssize_t dhchap_secret_store(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -864,10 +864,9 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
return count;
}
-static DEVICE_ATTR(dhchap_secret, S_IRUGO | S_IWUSR,
- nvme_ctrl_dhchap_secret_show, nvme_ctrl_dhchap_secret_store);
+static DEVICE_ATTR_ADMIN_RW(dhchap_secret);
-static ssize_t nvme_ctrl_dhchap_ctrl_secret_show(struct device *dev,
+static ssize_t dhchap_ctrl_secret_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -878,7 +877,7 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_show(struct device *dev,
return sysfs_emit(buf, "%s\n", opts->dhchap_ctrl_secret);
}
-static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
+static ssize_t dhchap_ctrl_secret_store(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -922,8 +921,7 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
return count;
}
-static DEVICE_ATTR(dhchap_ctrl_secret, S_IRUGO | S_IWUSR,
- nvme_ctrl_dhchap_ctrl_secret_show, nvme_ctrl_dhchap_ctrl_secret_store);
+static DEVICE_ATTR_ADMIN_RW(dhchap_ctrl_secret);
#endif
static struct attribute *nvme_dev_attrs[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0761/1257] mfd: ab8500: Fix child device leaks on probe failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (759 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0760/1257] nvme: make the DH-HMAC-CHAP secret attributes readable by root only Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0762/1257] spi: cadence-xspi: reject SDMA transfers larger than the requested length Greg Kroah-Hartman
` (237 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Lee Jones, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 5bf2ae8b131d4ae9c0ed5f7aa02532645f512022 ]
ab8500_probe() registers MFD child devices before completing the
remaining device initialization. If a later MFD registration or sysfs
group creation fails, previously registered child devices are not
removed.
Use devm_mfd_add_devices() so registered MFD child devices are removed
when probe fails.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fixes: cca69b67b3ba ("mfd: Export ab8500 chip id to sysfs")
Fixes: 9c717cf3fa16 ("mfd: ab8500-core: Add device for new RTC version for AB8540 cut2")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260924144355.1604369-1-lgs201920130244@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/ab8500-core.c | 44 ++++++++++++++++++++-------------------
1 file changed, 23 insertions(+), 21 deletions(-)
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 86fa99022cb35..44fc2ce83cdd7 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -1194,39 +1194,41 @@ static int ab8500_probe(struct platform_device *pdev)
return ret;
if (is_ab9540(ab8500))
- ret = mfd_add_devices(ab8500->dev, 0, ab9540_devs,
- ARRAY_SIZE(ab9540_devs), NULL,
- 0, ab8500->domain);
+ ret = devm_mfd_add_devices(ab8500->dev, 0, ab9540_devs,
+ ARRAY_SIZE(ab9540_devs), NULL,
+ 0, ab8500->domain);
else if (is_ab8540(ab8500)) {
- ret = mfd_add_devices(ab8500->dev, 0, ab8540_devs,
- ARRAY_SIZE(ab8540_devs), NULL,
- 0, ab8500->domain);
+ ret = devm_mfd_add_devices(ab8500->dev, 0, ab8540_devs,
+ ARRAY_SIZE(ab8540_devs), NULL,
+ 0, ab8500->domain);
if (ret)
return ret;
if (is_ab8540_1p2_or_earlier(ab8500))
- ret = mfd_add_devices(ab8500->dev, 0, ab8540_cut1_devs,
- ARRAY_SIZE(ab8540_cut1_devs), NULL,
- 0, ab8500->domain);
+ ret = devm_mfd_add_devices(ab8500->dev, 0,
+ ab8540_cut1_devs,
+ ARRAY_SIZE(ab8540_cut1_devs),
+ NULL, 0, ab8500->domain);
else /* ab8540 >= cut2 */
- ret = mfd_add_devices(ab8500->dev, 0, ab8540_cut2_devs,
- ARRAY_SIZE(ab8540_cut2_devs), NULL,
- 0, ab8500->domain);
+ ret = devm_mfd_add_devices(ab8500->dev, 0,
+ ab8540_cut2_devs,
+ ARRAY_SIZE(ab8540_cut2_devs),
+ NULL, 0, ab8500->domain);
} else if (is_ab8505(ab8500))
- ret = mfd_add_devices(ab8500->dev, 0, ab8505_devs,
- ARRAY_SIZE(ab8505_devs), NULL,
- 0, ab8500->domain);
+ ret = devm_mfd_add_devices(ab8500->dev, 0, ab8505_devs,
+ ARRAY_SIZE(ab8505_devs), NULL,
+ 0, ab8500->domain);
else
- ret = mfd_add_devices(ab8500->dev, 0, ab8500_devs,
- ARRAY_SIZE(ab8500_devs), NULL,
- 0, ab8500->domain);
+ ret = devm_mfd_add_devices(ab8500->dev, 0, ab8500_devs,
+ ARRAY_SIZE(ab8500_devs), NULL,
+ 0, ab8500->domain);
if (ret)
return ret;
/* Add battery management devices */
- ret = mfd_add_devices(ab8500->dev, 0, ab8500_bm_devs,
- ARRAY_SIZE(ab8500_bm_devs), NULL,
- 0, ab8500->domain);
+ ret = devm_mfd_add_devices(ab8500->dev, 0, ab8500_bm_devs,
+ ARRAY_SIZE(ab8500_bm_devs), NULL,
+ 0, ab8500->domain);
if (ret)
dev_err(ab8500->dev, "error adding bm devices\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0762/1257] spi: cadence-xspi: reject SDMA transfers larger than the requested length
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (760 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0761/1257] mfd: ab8500: Fix child device leaks on probe failure Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0763/1257] spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path Greg Kroah-Hartman
` (236 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weibin Liu, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit ea9854a169e9c1437df8829bea21c2f2e80b137c ]
The XSPI controller reports the size of the slave-DMA transaction
through SDMA_SIZE_REG. Both SDMA handlers take this register at face
value and copy the reported number of bytes between the SDMA FIFO and
the transfer buffers, without checking it against the length of the
transfer that was actually requested.
While cdns_xspi_adjust_mem_op_size() clamps the size of the operations
issued by the SPI core, the device can still report a bigger SDMA size
than what was programmed, which makes the handlers read from or write
to memory beyond the end of the transfer buffers.
Track the number of bytes requested for the current data phase in a new
sdma_xfer_len field, set by cdns_xspi_send_stig_command() and by the
Marvell b0 transfer path, and reject any SDMA size that exceeds it.
Fixes: a16cc8077627 ("spi: cadence: add support for Cadence XSPI controller")
Cc: stable@vger.kernel.org # 5.16+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20260929081146.41041-2-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-cadence-xspi.c | 36 +++++++++++++++++++++++++++++-----
1 file changed, 31 insertions(+), 5 deletions(-)
diff --git a/drivers/spi/spi-cadence-xspi.c b/drivers/spi/spi-cadence-xspi.c
index 39c868a5b171c..1f1cd45359d34 100644
--- a/drivers/spi/spi-cadence-xspi.c
+++ b/drivers/spi/spi-cadence-xspi.c
@@ -332,6 +332,7 @@ struct cdns_xspi_dev {
int irq;
int cur_cs;
unsigned int sdmasize;
+ unsigned int sdma_xfer_len;
struct completion cmd_complete;
struct completion auto_cmd_complete;
@@ -346,7 +347,7 @@ struct cdns_xspi_dev {
u8 hw_num_banks;
const struct cdns_xspi_driver_data *driver_data;
- void (*sdma_handler)(struct cdns_xspi_dev *cdns_xspi);
+ int (*sdma_handler)(struct cdns_xspi_dev *cdns_xspi);
void (*set_interrupts_handler)(struct cdns_xspi_dev *cdns_xspi, bool enabled);
bool xfer_in_progress;
@@ -496,7 +497,7 @@ static inline void cdns_xspi_sdma_write(struct cdns_xspi_dev *cdns_xspi, size_t
iowrite8_rep(dst, (const u8 *)buf + offset, len);
}
-static void cdns_xspi_sdma_handle(struct cdns_xspi_dev *cdns_xspi)
+static int cdns_xspi_sdma_handle(struct cdns_xspi_dev *cdns_xspi)
{
u32 sdma_size, sdma_trd_info;
u8 sdma_dir;
@@ -505,6 +506,13 @@ static void cdns_xspi_sdma_handle(struct cdns_xspi_dev *cdns_xspi)
sdma_trd_info = readl(cdns_xspi->iobase + CDNS_XSPI_SDMA_TRD_INFO_REG);
sdma_dir = FIELD_GET(CDNS_XSPI_SDMA_DIR, sdma_trd_info);
+ if (sdma_size > cdns_xspi->sdma_xfer_len) {
+ dev_err(cdns_xspi->dev,
+ "SDMA size %u exceeds the requested length %u\n",
+ sdma_size, cdns_xspi->sdma_xfer_len);
+ return -EINVAL;
+ }
+
switch (sdma_dir) {
case CDNS_XSPI_SDMA_DIR_READ:
cdns_xspi_sdma_read(cdns_xspi, sdma_size);
@@ -514,6 +522,8 @@ static void cdns_xspi_sdma_handle(struct cdns_xspi_dev *cdns_xspi)
cdns_xspi_sdma_write(cdns_xspi, sdma_size);
break;
}
+
+ return 0;
}
static int cdns_xspi_send_stig_command(struct cdns_xspi_dev *cdns_xspi,
@@ -559,6 +569,7 @@ static int cdns_xspi_send_stig_command(struct cdns_xspi_dev *cdns_xspi,
cdns_xspi->in_buffer = op->data.buf.in;
cdns_xspi->out_buffer = op->data.buf.out;
+ cdns_xspi->sdma_xfer_len = op->data.nbytes;
cdns_xspi_trigger_command(cdns_xspi, cmd_regs);
@@ -567,7 +578,11 @@ static int cdns_xspi_send_stig_command(struct cdns_xspi_dev *cdns_xspi,
cdns_xspi->set_interrupts_handler(cdns_xspi, false);
return -EIO;
}
- cdns_xspi->sdma_handler(cdns_xspi);
+ ret = cdns_xspi->sdma_handler(cdns_xspi);
+ if (ret) {
+ cdns_xspi->set_interrupts_handler(cdns_xspi, false);
+ return ret;
+ }
}
wait_for_completion(&cdns_xspi->cmd_complete);
@@ -950,7 +965,7 @@ static void m_iowriteq(void __iomem *addr, const void *buf, int len)
}
}
-static void marvell_xspi_sdma_handle(struct cdns_xspi_dev *cdns_xspi)
+static int marvell_xspi_sdma_handle(struct cdns_xspi_dev *cdns_xspi)
{
u32 sdma_size, sdma_trd_info;
u8 sdma_dir;
@@ -959,6 +974,13 @@ static void marvell_xspi_sdma_handle(struct cdns_xspi_dev *cdns_xspi)
sdma_trd_info = readl(cdns_xspi->iobase + CDNS_XSPI_SDMA_TRD_INFO_REG);
sdma_dir = FIELD_GET(CDNS_XSPI_SDMA_DIR, sdma_trd_info);
+ if (sdma_size > cdns_xspi->sdma_xfer_len) {
+ dev_err(cdns_xspi->dev,
+ "SDMA size %u exceeds the requested length %u\n",
+ sdma_size, cdns_xspi->sdma_xfer_len);
+ return -EINVAL;
+ }
+
switch (sdma_dir) {
case CDNS_XSPI_SDMA_DIR_READ:
m_ioreadq(cdns_xspi->sdmabase,
@@ -970,6 +992,8 @@ static void marvell_xspi_sdma_handle(struct cdns_xspi_dev *cdns_xspi)
cdns_xspi->out_buffer, sdma_size);
break;
}
+
+ return 0;
}
static const struct spi_controller_mem_ops marvell_xspi_mem_ops = {
@@ -1131,9 +1155,11 @@ static int cdns_xspi_transfer_one_message_b0(struct spi_controller *controller,
cdns_xspi_prepare_transfer(cs, 1, current_transfer_len - 1,
cmd_regs);
cdns_xspi_trigger_command(cdns_xspi, cmd_regs);
+ cdns_xspi->sdma_xfer_len = current_transfer_len - 1;
if (!cdns_xspi_is_sdma_ready(cdns_xspi, true))
return -EIO;
- cdns_xspi->sdma_handler(cdns_xspi);
+ if (cdns_xspi->sdma_handler(cdns_xspi))
+ return -EIO;
if (!cdns_xspi_is_stig_ready(cdns_xspi, true))
return -EIO;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0763/1257] spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (761 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0762/1257] spi: cadence-xspi: reject SDMA transfers larger than the requested length Greg Kroah-Hartman
@ 2026-11-07 13:50 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0764/1257] ARM: 9488/1: smp: set current pointer in assembly before jumping into C Greg Kroah-Hartman
` (235 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weibin Liu, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit ef9690269999ddf9b204731baca1bd6b7aea1aa7 ]
transfer_one_message_b0() falls back to a 10-byte stack buffer for
transfers which carry no TX data and points both in_buffer and
out_buffer into it.
With a transfer longer than 10 bytes the SDMA branch of the loop moves
up to MRVL_XFER_QWORD_COUNT * MRVL_XFER_QWORD_BYTECOUNT (256) bytes
through those pointers and then advances them by the same amount, so
both directions overflow the scratch buffer: a read transaction copies
SDMA data past the end of the buffer, a write transaction sends stack
contents from beyond it to the SPI bus.
Size the scratch buffer for the largest chunk the loop can request,
keep the buffer pointers pinned to it when the message does not carry
the corresponding TX or RX data, and only advance the pointers which
reference real transfer buffers. Also zero-initialize the scratch
buffer so that padding bytes sent for TX-less transfers no longer leak
uninitialized stack contents.
Fixes: 5cb7651f78e1 ("Marvell HW overlay support for Cadence xSPI")
Cc: stable@vger.kernel.org # 6.11+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20260929081146.41041-3-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-cadence-xspi.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/spi/spi-cadence-xspi.c b/drivers/spi/spi-cadence-xspi.c
index 1f1cd45359d34..3687853e4ce4e 100644
--- a/drivers/spi/spi-cadence-xspi.c
+++ b/drivers/spi/spi-cadence-xspi.c
@@ -268,6 +268,7 @@
#define MRVL_XFER_FUNC_START BIT(0)
#define MRVL_XFER_QWORD_COUNT 32
#define MRVL_XFER_QWORD_BYTECOUNT 8
+#define MRVL_XFER_MAX_LEN (MRVL_XFER_QWORD_COUNT * MRVL_XFER_QWORD_BYTECOUNT)
#define MRVL_XSPI_POLL_TIMEOUT_US 1000
#define MRVL_XSPI_POLL_DELAY_US 10
@@ -1107,7 +1108,7 @@ static int cdns_xspi_transfer_one_message_b0(struct spi_controller *controller,
struct spi_device *spi = m->spi;
struct spi_transfer *t = NULL;
- const unsigned int max_len = MRVL_XFER_QWORD_BYTECOUNT * MRVL_XFER_QWORD_COUNT;
+ const unsigned int max_len = MRVL_XFER_MAX_LEN;
int current_transfer_len;
int cs = spi_get_chipselect(spi, 0);
int cs_change = 0;
@@ -1130,13 +1131,16 @@ static int cdns_xspi_transfer_one_message_b0(struct spi_controller *controller,
list_for_each_entry(t, &m->transfers, transfer_list) {
u8 *txd = (u8 *) t->tx_buf;
u8 *rxd = (u8 *) t->rx_buf;
- u8 data[10];
+ u8 data[MRVL_XFER_MAX_LEN] = {0};
u32 cmd_regs[6];
if (!txd)
txd = data;
- cdns_xspi->in_buffer = txd + 1;
+ if (rxd)
+ cdns_xspi->in_buffer = rxd;
+ else
+ cdns_xspi->in_buffer = data;
cdns_xspi->out_buffer = txd + 1;
while (t->len) {
@@ -1163,8 +1167,10 @@ static int cdns_xspi_transfer_one_message_b0(struct spi_controller *controller,
if (!cdns_xspi_is_stig_ready(cdns_xspi, true))
return -EIO;
- cdns_xspi->in_buffer += current_transfer_len;
- cdns_xspi->out_buffer += current_transfer_len;
+ if (rxd)
+ cdns_xspi->in_buffer += current_transfer_len;
+ if (t->tx_buf)
+ cdns_xspi->out_buffer += current_transfer_len;
}
if (rxd) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0764/1257] ARM: 9488/1: smp: set current pointer in assembly before jumping into C
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (762 preceding siblings ...)
2026-11-07 13:50 ` [PATCH 7.3 0763/1257] spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0765/1257] ARM: 9491/1: alignment: restore uaccess state on emulation fault Greg Kroah-Hartman
` (234 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Ard Biesheuvel,
Russell King, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit f6e551e7d515579b952422c93415470fb672d848 ]
With CONFIG_KCOV_INSTRUMENT_ALL=y, secondary CPUs fail to come online
on ARMv6K/ARMv7 SMP:
CPU1: failed to boot: -38
The compiler inserts a call to __sanitizer_cov_trace_pc() at the entry
of secondary_start_kernel(), before set_current(task). The KCOV hook
dereferences current while TPIDRURO is still uninitialized, causing a
data abort before cpu_init() has installed the exception stacks. The
secondary CPU consequently never completes startup.
Initialize current in the secondary assembly handoff, as
__mmap_switched already does for the boot CPU.
With current set in assembly, the set_current() call in
secondary_start_kernel() is redundant. Drop it together with the
function and the task argument. The hotplug resuscitate path in
arch_cpu_idle_dead() needs no hand-off either, as smp_ops.cpu_die()
can only return if the CPU kept its register state, TPIDRURO included.
Assisted-by: Claude:claude-fable-5
Fixes: 50596b7559bf ("ARM: smp: Store current pointer in TPIDRURO register if available")
Cc: stable@vger.kernel.org
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/include/asm/smp.h | 2 +-
arch/arm/kernel/head-nommu.S | 1 +
arch/arm/kernel/head.S | 1 +
arch/arm/kernel/smp.c | 15 ++-------------
4 files changed, 5 insertions(+), 14 deletions(-)
diff --git a/arch/arm/include/asm/smp.h b/arch/arm/include/asm/smp.h
index 8c05a7f374d8b..84aa6a663e816 100644
--- a/arch/arm/include/asm/smp.h
+++ b/arch/arm/include/asm/smp.h
@@ -43,7 +43,7 @@ extern void set_smp_ipi_range(int ipi_base, int nr_ipi);
* Called from platform specific assembly code, this is the
* secondary CPU entry point.
*/
-asmlinkage void secondary_start_kernel(struct task_struct *task);
+asmlinkage void secondary_start_kernel(void);
/*
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index b9d6818f1ee16..f80bbfbd3a6f8 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -116,6 +116,7 @@ ENTRY(secondary_startup)
ldr r7, __secondary_data @ reload r7
ldr sp, [r7, #12] @ set up the stack pointer
ldr r0, [r7, #16] @ set up task pointer
+ set_current r0, r1
mov fp, #0
b secondary_start_kernel
ENDPROC(secondary_startup)
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index f22c50d4bd417..a22403a629efa 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -442,6 +442,7 @@ ENTRY(__secondary_switched)
adr_l r7, secondary_data + 12 @ get secondary_data.stack
ldr sp, [r7]
ldr r0, [r7, #4] @ get secondary_data.task
+ set_current r0, r1
mov fp, #0
b secondary_start_kernel
ENDPROC(__secondary_switched)
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index b5fb4697bc3f8..a9f4600fe4d08 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -371,12 +371,9 @@ void __noreturn arch_cpu_idle_dead(void)
*/
__asm__("mov sp, %0\n"
" mov fp, #0\n"
- " mov r0, %1\n"
" b secondary_start_kernel"
:
- : "r" (task_stack_page(current) + THREAD_SIZE - 8),
- "r" (current)
- : "r0");
+ : "r" (task_stack_page(current) + THREAD_SIZE - 8));
unreachable();
}
@@ -397,23 +394,15 @@ static void smp_store_cpu_info(unsigned int cpuid)
check_cpu_icache_size(cpuid);
}
-static void set_current(struct task_struct *cur)
-{
- /* Set TPIDRURO */
- asm("mcr p15, 0, %0, c13, c0, 3" :: "r"(cur) : "memory");
-}
-
/*
* This is the secondary CPU boot entry. We're using this CPUs
* idle thread stack, but a set of temporary page tables.
*/
-asmlinkage void secondary_start_kernel(struct task_struct *task)
+asmlinkage void secondary_start_kernel(void)
{
struct mm_struct *mm = &init_mm;
unsigned int cpu;
- set_current(task);
-
secondary_biglittle_init();
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0765/1257] ARM: 9491/1: alignment: restore uaccess state on emulation fault
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (763 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0764/1257] ARM: 9488/1: smp: set current pointer in assembly before jumping into C Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0766/1257] ARM: 9520/1: cacheinfo: avoid out-of-bounds write in populate_cache_leaves() Greg Kroah-Hartman
` (233 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Karl Mehltretter,
Russell King, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 80dafbcb705cead6d25cb821cf29c47da8860c8c ]
The alignment handlers enable access to user memory while emulating
unaligned instructions. If a checked access faults, its exception table
fixup jumps to the handler's fault label and bypasses uaccess_restore().
This leaves DOMAIN_USER as DOMAIN_CLIENT with SW domain PAN, or leaves
TTBR0 page table walks enabled with TTBR0 PAN, while the fault is handled.
An ARM926 QEMU test using LDMIA across an unmapped page boundary reports
DOMAIN_USER=1 at TYPE_FAULT before this change and DOMAIN_USER=0 after it.
SW domain PAN is the default on ARMv5, ARMv6, and non-LPAE ARMv7 builds.
Keep the saved uaccess state at function scope and track whether it was
saved. Restore it at the fault label only when needed. Paths that did not
enable user access continue to skip the restore.
Assisted-by: Codex:gpt-5.6-sol
Fixes: 274e91b81ed2 ("ARM: alignment: fix alignment handling for uaccess changes")
Cc: stable@vger.kernel.org
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mm/alignment.c | 51 ++++++++++++++++++++++++++++++-----------
1 file changed, 37 insertions(+), 14 deletions(-)
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index 812380f30ae36..2b470a419dda3 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -341,6 +341,8 @@ static int
do_alignment_ldrhstrh(unsigned long addr, u32 instr, struct pt_regs *regs)
{
unsigned int rd = RD_BITS(instr);
+ unsigned int ua_flags;
+ bool ua_saved = false;
ai_half += 1;
@@ -364,10 +366,11 @@ do_alignment_ldrhstrh(unsigned long addr, u32 instr, struct pt_regs *regs)
user:
if (LDST_L_BIT(instr)) {
unsigned long val;
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
get16t_unaligned_check(val, addr);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
/* signed half-word? */
if (instr & 0x40)
@@ -375,14 +378,17 @@ do_alignment_ldrhstrh(unsigned long addr, u32 instr, struct pt_regs *regs)
regs->uregs[rd] = val;
} else {
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
put16t_unaligned_check(regs->uregs[rd], addr);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
}
return TYPE_LDST;
fault:
+ if (ua_saved)
+ uaccess_restore(ua_flags);
return TYPE_FAULT;
}
@@ -391,6 +397,8 @@ do_alignment_ldrdstrd(unsigned long addr, u32 instr, struct pt_regs *regs)
{
unsigned int rd = RD_BITS(instr);
unsigned int rd2;
+ unsigned int ua_flags;
+ bool ua_saved = false;
int load;
if ((instr & 0xfe000000) == 0xe8000000) {
@@ -425,26 +433,30 @@ do_alignment_ldrdstrd(unsigned long addr, u32 instr, struct pt_regs *regs)
user:
if (load) {
unsigned long val, val2;
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
get32t_unaligned_check(val, addr);
get32t_unaligned_check(val2, addr + 4);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
regs->uregs[rd] = val;
regs->uregs[rd2] = val2;
} else {
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
put32t_unaligned_check(regs->uregs[rd], addr);
put32t_unaligned_check(regs->uregs[rd2], addr + 4);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
}
return TYPE_LDST;
bad:
return TYPE_ERROR;
fault:
+ if (ua_saved)
+ uaccess_restore(ua_flags);
return TYPE_FAULT;
}
@@ -452,6 +464,8 @@ static int
do_alignment_ldrstr(unsigned long addr, u32 instr, struct pt_regs *regs)
{
unsigned int rd = RD_BITS(instr);
+ unsigned int ua_flags;
+ bool ua_saved = false;
ai_word += 1;
@@ -469,18 +483,22 @@ do_alignment_ldrstr(unsigned long addr, u32 instr, struct pt_regs *regs)
trans:
if (LDST_L_BIT(instr)) {
unsigned int val;
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
get32t_unaligned_check(val, addr);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
regs->uregs[rd] = val;
} else {
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
put32t_unaligned_check(regs->uregs[rd], addr);
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
}
return TYPE_LDST;
fault:
+ if (ua_saved)
+ uaccess_restore(ua_flags);
return TYPE_FAULT;
}
@@ -502,6 +520,8 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
{
unsigned int rd, rn, correction, nr_regs, regbits;
unsigned long eaddr, newaddr;
+ unsigned int ua_flags;
+ bool ua_saved = false;
if (LDM_S_BIT(instr))
goto bad;
@@ -547,7 +567,8 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
#endif
if (user_mode(regs)) {
- unsigned int __ua_flags = uaccess_save_and_enable();
+ ua_flags = uaccess_save_and_enable();
+ ua_saved = true;
for (regbits = REGMASK_BITS(instr), rd = 0; regbits;
regbits >>= 1, rd += 1)
if (regbits & 1) {
@@ -559,7 +580,7 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
put32t_unaligned_check(regs->uregs[rd], eaddr);
eaddr += 4;
}
- uaccess_restore(__ua_flags);
+ uaccess_restore(ua_flags);
} else {
for (regbits = REGMASK_BITS(instr), rd = 0; regbits;
regbits >>= 1, rd += 1)
@@ -581,6 +602,8 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
return TYPE_DONE;
fault:
+ if (ua_saved)
+ uaccess_restore(ua_flags);
regs->ARM_pc -= correction;
return TYPE_FAULT;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0766/1257] ARM: 9520/1: cacheinfo: avoid out-of-bounds write in populate_cache_leaves()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (764 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0765/1257] ARM: 9491/1: alignment: restore uaccess state on emulation fault Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0767/1257] ARM: 9521/1: cacheinfo: count external caches in early_cache_level() Greg Kroah-Hartman
` (232 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Karl Mehltretter, Russell King, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 41a3f4bc3e4ae4722fd24743bf3f286cea14e3dc ]
populate_cache_leaves() advances its bounds-checking index once per
cache level, but split instruction/data caches consume two entries.
CLIDR-based allocation supplies enough entries. Early allocation from
the device tree can supply fewer and expose an out-of-bounds write.
Count each written leaf and stop before a split level that does not
fit. This prepares ARM for DT-based early allocation and matches
commit 875d742cf532 ("arm64: cacheinfo: Avoid out-of-bounds write to
cacheinfo array").
Assisted-by: LLM
Fixes: a9ff94477836 ("ARM: 9433/2: implement cacheinfo support")
Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-2-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/cacheinfo.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/arch/arm/kernel/cacheinfo.c b/arch/arm/kernel/cacheinfo.c
index e1469b6417804..860eeb03cfe5d 100644
--- a/arch/arm/kernel/cacheinfo.c
+++ b/arch/arm/kernel/cacheinfo.c
@@ -151,7 +151,7 @@ int populate_cache_leaves(unsigned int cpu)
unsigned int level, idx;
enum cache_type type;
struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
- struct cacheinfo *this_leaf = this_cpu_ci->info_list;
+ struct cacheinfo *infos = this_cpu_ci->info_list;
unsigned int arch = cpu_architecture();
/* CLIDR is not present before ARMv7/v7m */
@@ -159,13 +159,15 @@ int populate_cache_leaves(unsigned int cpu)
return -EOPNOTSUPP;
for (idx = 0, level = 1; level <= this_cpu_ci->num_levels &&
- idx < this_cpu_ci->num_leaves; idx++, level++) {
+ idx < this_cpu_ci->num_leaves; level++) {
type = get_cache_type(level);
if (type == CACHE_TYPE_SEPARATE) {
- ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level);
- ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level);
+ if (idx + 1 >= this_cpu_ci->num_leaves)
+ break;
+ ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level);
+ ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level);
} else {
- ci_leaf_init(this_leaf++, type, level);
+ ci_leaf_init(&infos[idx++], type, level);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0767/1257] ARM: 9521/1: cacheinfo: count external caches in early_cache_level()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (765 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0766/1257] ARM: 9520/1: cacheinfo: avoid out-of-bounds write in populate_cache_leaves() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0768/1257] ARM: 9522/1: cacheinfo: guard the CLIDR read in populate_cache_leaves() Greg Kroah-Hartman
` (231 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Karl Mehltretter, Russell King, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 4fd69e8a9ebc42e292637ec2ebfb6bcf2d2f6c0e ]
early_cache_level() counts only caches described by CLIDR. An external
PL310 is absent from CLIDR, and its arm,pl310-cache compatible is not
accepted by init_of_cache_level(), so early allocation falls back to
an incomplete count. init_cache_level() later adds the DT-described
L2, forcing reallocation on the secondary CPU with interrupts disabled.
This defeats early allocation on PREEMPT_RT.
Use init_cache_level() for early sizing too, so the initial allocation
includes external caches described by the device tree.
Assisted-by: LLM
Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-3-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/cacheinfo.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/arch/arm/kernel/cacheinfo.c b/arch/arm/kernel/cacheinfo.c
index 860eeb03cfe5d..31591c9472548 100644
--- a/arch/arm/kernel/cacheinfo.c
+++ b/arch/arm/kernel/cacheinfo.c
@@ -111,13 +111,6 @@ static int detect_cache_level(unsigned int *level_p, unsigned int *leaves_p)
return 0;
}
-int early_cache_level(unsigned int cpu)
-{
- struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
-
- return detect_cache_level(&this_cpu_ci->num_levels, &this_cpu_ci->num_leaves);
-}
-
int init_cache_level(unsigned int cpu)
{
unsigned int level, leaves;
@@ -146,6 +139,11 @@ int init_cache_level(unsigned int cpu)
return 0;
}
+int early_cache_level(unsigned int cpu)
+{
+ return init_cache_level(cpu);
+}
+
int populate_cache_leaves(unsigned int cpu)
{
unsigned int level, idx;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0768/1257] ARM: 9522/1: cacheinfo: guard the CLIDR read in populate_cache_leaves()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (766 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0767/1257] ARM: 9521/1: cacheinfo: count external caches in early_cache_level() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0769/1257] ARM: 9523/1: topology: allocate the cacheinfo early on the boot CPU Greg Kroah-Hartman
` (230 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Karl Mehltretter, Russell King, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 2315f2c46e0813d010e7b3ea40f2769621453e27 ]
ARM1176 and ARM11 MPCore can be reported as ARMv7 by
cpu_architecture() even though they lack CLIDR. populate_cache_leaves()
therefore needs the CTR-format check used by detect_cache_level().
DT-based early allocation bypasses init_cache_level(), so its check
no longer protects populate_cache_leaves(). A combined ARMv6/ARMv7
SMP kernel can reach this path on BCM2835, whose DT describes its
caches.
Share the CLIDR capability check between detection and population.
Return -ENOENT from population when CLIDR is unavailable, preserving
the existing absence of cacheinfo and avoiding a new topology warning.
Assisted-by: LLM
Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-4-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/cacheinfo.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/arch/arm/kernel/cacheinfo.c b/arch/arm/kernel/cacheinfo.c
index 31591c9472548..993c8a1347860 100644
--- a/arch/arm/kernel/cacheinfo.c
+++ b/arch/arm/kernel/cacheinfo.c
@@ -80,19 +80,21 @@ static void ci_leaf_init(struct cacheinfo *this_leaf,
this_leaf->type = type;
}
-static int detect_cache_level(unsigned int *level_p, unsigned int *leaves_p)
+static bool clidr_present(void)
{
- unsigned int ctype, level, leaves;
- u32 ctr, format;
-
/* CLIDR is not present before ARMv7/v7m */
if (cpu_architecture() < CPU_ARCH_ARMv7)
- return -EOPNOTSUPP;
+ return false;
/* Don't try reading CLIDR if CTR declares old format */
- ctr = read_cpuid_cachetype();
- format = FIELD_GET(CTR_FORMAT_MASK, ctr);
- if (format != CTR_FORMAT_ARMV7)
+ return FIELD_GET(CTR_FORMAT_MASK, read_cpuid_cachetype()) == CTR_FORMAT_ARMV7;
+}
+
+static int detect_cache_level(unsigned int *level_p, unsigned int *leaves_p)
+{
+ unsigned int ctype, level, leaves;
+
+ if (!clidr_present())
return -EOPNOTSUPP;
for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) {
@@ -150,11 +152,10 @@ int populate_cache_leaves(unsigned int cpu)
enum cache_type type;
struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
struct cacheinfo *infos = this_cpu_ci->info_list;
- unsigned int arch = cpu_architecture();
- /* CLIDR is not present before ARMv7/v7m */
- if (arch < CPU_ARCH_ARMv7)
- return -EOPNOTSUPP;
+ /* The device tree can describe caches CLIDR cannot fill in. */
+ if (!clidr_present())
+ return -ENOENT;
for (idx = 0, level = 1; level <= this_cpu_ci->num_levels &&
idx < this_cpu_ci->num_leaves; level++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0769/1257] ARM: 9523/1: topology: allocate the cacheinfo early on the boot CPU
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (767 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0768/1257] ARM: 9522/1: cacheinfo: guard the CLIDR read in populate_cache_leaves() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0770/1257] PCI: Set supported_speeds in set_pcie_port_type() Greg Kroah-Hartman
` (229 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Karl Mehltretter, Russell King, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 2d4234f99900403842b2c031fefb4c5816ac4df8 ]
ARM secondary CPUs allocate cacheinfo in detect_cache_attributes(),
called from secondary_start_kernel() with interrupts disabled. With
PREEMPT_RT, the allocation takes a sleeping lock and triggers
"BUG: sleeping function called from invalid context".
Call fetch_cache_info() for each possible CPU from init_cpu_topology()
on the boot CPU, following commit 5944ce092b97 ("arch_topology: Build
cacheinfo from primary CPU"). This supplies the arrays before secondary
CPUs populate them. Suppress -ENOENT and -EOPNOTSUPP, which leave cache
detection to the existing late path.
The CLIDR fallback uses the boot CPU's cache geometry. A secondary CPU
with more cache leaves can still require late reallocation and trigger
the warning.
Assisted-by: LLM
Fixes: a9ff94477836 ("ARM: 9433/2: implement cacheinfo support")
Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-5-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/topology.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/arch/arm/kernel/topology.c b/arch/arm/kernel/topology.c
index 2336ee2aa44a2..e6b50cd43ce53 100644
--- a/arch/arm/kernel/topology.c
+++ b/arch/arm/kernel/topology.c
@@ -12,6 +12,7 @@
*/
#include <linux/arch_topology.h>
+#include <linux/cacheinfo.h>
#include <linux/cpu.h>
#include <linux/cpufreq.h>
#include <linux/cpumask.h>
@@ -238,8 +239,20 @@ void store_cpu_topology(unsigned int cpuid)
*/
void __init init_cpu_topology(void)
{
+ int cpu, ret;
+
reset_cpu_topology();
smp_wmb();
parse_dt_topology();
+
+ for_each_possible_cpu(cpu) {
+ ret = fetch_cache_info(cpu);
+ if (!ret)
+ continue;
+ /* CPUs without a usable CLIDR return -EOPNOTSUPP. */
+ if (ret != -ENOENT && ret != -EOPNOTSUPP)
+ pr_err("Early cacheinfo failed, ret = %d\n", ret);
+ return;
+ }
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0770/1257] PCI: Set supported_speeds in set_pcie_port_type()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (768 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0769/1257] ARM: 9523/1: topology: allocate the cacheinfo early on the boot CPU Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0771/1257] Input: xpad - add GameSir Nova Lite support Greg Kroah-Hartman
` (228 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stian Halseth, Bjorn Helgaas,
Tony Rodriguez, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stian Halseth <stian@itx.no>
[ Upstream commit 926767a9be8866d26cc27ca46c46c03d921e2193 ]
sparc64 and powerpc create PCI devices from the device tree in
of_create_pci_dev(), which calls set_pcie_port_type() but not
pci_setup_device(). Since d2bd39c0456b, supported_speeds is only set in
pci_setup_device(), so it stays 0 for these devices.
pcie_get_speed_cap() then returns PCI_SPEED_UNKNOWN, the sysfs
'max_link_speed' attribute reads "Unknown", and the failed link retraining
quirk passes PCI_SPEED_UNKNOWN to pcie_set_target_speed(), which warns on a
SPARC T7-1:
WARNING: drivers/pci/pcie/bwctrl.c:125 at pcie_set_target_speed+0x284/0x2e0
Set supported_speeds in set_pcie_port_type(), which all three paths call.
Fixes: d2bd39c0456b ("PCI: Store all PCIe Supported Link Speeds")
Closes: https://github.com/sparclinux/issues/issues/109
Signed-off-by: Stian Halseth <stian@itx.no>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Tony Rodriguez <unixpro1970@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261007131304.309511-1-stian@itx.no
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/probe.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 27008e2ea5afc..52a79b033b069 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1651,6 +1651,8 @@ void set_pcie_port_type(struct pci_dev *pdev)
pdev->aspm_l1_support = 1;
#endif
+ pdev->supported_speeds = pcie_get_supported_speeds(pdev);
+
parent = pci_upstream_bridge(pdev);
if (!parent)
return;
@@ -2074,9 +2076,6 @@ int pci_setup_device(struct pci_dev *dev)
set_pcie_untrusted(dev);
- if (pci_is_pcie(dev))
- dev->supported_speeds = pcie_get_supported_speeds(dev);
-
/* "Unknown power state" */
dev->current_state = PCI_UNKNOWN;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0771/1257] Input: xpad - add GameSir Nova Lite support
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (769 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0770/1257] PCI: Set supported_speeds in set_pcie_port_type() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0772/1257] Bluetooth: btusb: Add device ID for Realtek RTL8761BUE (StarTech AV53C1) Greg Kroah-Hartman
` (227 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Orlando, Dmitry Torokhov,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Orlando <francesco.orlando99@libero.it>
[ Upstream commit 2e6f2e5799f328ca0879dad14d7f3709c7f7496b ]
Add vendor and product ID for GameSir Nova Lite (0x3537:0x1040) in
XInput mode to enable force feedback rumble support.
Signed-off-by: Francesco Orlando <francesco.orlando99@libero.it>
Link: https://patch.msgid.link/20261011165821.72698-1-francesco.orlando99@libero.it
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/joystick/xpad.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 810e52782ae89..d2eb48d98fead 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -408,6 +408,7 @@ static const struct xpad_device {
{ 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 },
{ 0x3537, 0x100f, "GameSir Nova 2 Lite", 0, XTYPE_XBOX360 },
{ 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE },
+ { 0x3537, 0x1040, "GameSir Nova Lite", 0, XTYPE_XBOX360 },
{ 0x3651, 0x1000, "CRKD SG", 0, XTYPE_XBOX360 },
{ 0x366c, 0x0005, "ByoWave Proteus Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE, FLAG_DELAY_INIT },
{ 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0772/1257] Bluetooth: btusb: Add device ID for Realtek RTL8761BUE (StarTech AV53C1)
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (770 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0771/1257] Input: xpad - add GameSir Nova Lite support Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0773/1257] Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file Greg Kroah-Hartman
` (226 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikolaj Klitlund Børty,
Luiz Augusto von Dentz, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolaj Klitlund Børty <nbn@sj.dk>
[ Upstream commit 1430308fc9d47a801a305700cd444b1a0051d14a ]
Add the USB ID 0x14b0:0x047a for the StarTech AV53C1-USB-BLUETOOTH
adapter, a Realtek RTL8761BUE based Bluetooth 5.3 dongle.
Without this entry btusb treats the device as a generic Bluetooth
adapter and never loads the Realtek firmware, leaving the controller on
its ROM firmware. In that state it advertises and scans actively, but
never reports advertisements during passive scanning. LE connections
initiated by the kernel wait for a passive-scan report before issuing
LE Create Connection, so connecting and pairing from BlueZ time out
without any error from the controller.
The same product is also sold with the ID 0x2c0a:0x8761, which is
already supported.
lsusb -v output for the device:
Bus 001 Device 010: ID 14b0:047a StarTech.com Ltd. Bluetooth Radio
Device Descriptor:
bcdUSB 1.10
bDeviceClass 224 Wireless
bDeviceSubClass 1 Radio Frequency
bDeviceProtocol 1 Bluetooth
idVendor 0x14b0 StarTech.com Ltd.
idProduct 0x047a
bcdDevice 2.00
iManufacturer 1 Realtek
iProduct 2 Bluetooth Radio
iSerial 3 00E04C239987
bNumInterfaces 2
Interface Descriptor:
bInterfaceClass 224 Wireless
bInterfaceSubClass 1 Radio Frequency
bInterfaceProtocol 1 Bluetooth
Cc: stable@vger.kernel.org
Signed-off-by: Nikolaj Klitlund Børty <nbn@sj.dk>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index dc7191bf42349..ece1fd426f12b 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -878,6 +878,8 @@ static const struct usb_device_id quirks_table[] = {
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x37ad, 0x0600), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x14b0, 0x047a), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
/* Additional Realtek 8761CU Bluetooth devices */
{ USB_DEVICE(0x0b05, 0x1bef), .driver_info = BTUSB_REALTEK |
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0773/1257] Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (771 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0772/1257] Bluetooth: btusb: Add device ID for Realtek RTL8761BUE (StarTech AV53C1) Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0774/1257] Bluetooth: hci_debugfs: Pin module for debugfs file operations Greg Kroah-Hartman
` (225 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bui Viet Dung,
Luiz Augusto von Dentz, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Viet Dung <dungvn2345@gmail.com>
[ Upstream commit 8368f0c2cde48c09ed70644059f24172b0c59f52 ]
An open debugfs file retains lowpan_control_fops in the debugfs proxy
state. However, lowpan_control_fops has no .owner set to THIS_MODULE.
As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the bluetooth_6lowpan module.
With CONFIG_BT_6LOWPAN=m, a userspace process can keep the debugfs file
descriptor for 6lowpan_control open across module unload
(delete_module / rmmod bluetooth_6lowpan). When the process subsequently
closes the file descriptor, full_proxy_release() accesses the already
freed and unmapped lowpan_control_fops table, causing a kernel page fault
or oops.
The issue was discovered via manual code audit of
net/bluetooth/6lowpan.c.
Set .owner = THIS_MODULE on lowpan_control_fops so that debugfs pins
the module until all open file descriptors have finished.
Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/6lowpan.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 30f4afa18bc8f..20fb20eea8e79 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -1209,6 +1209,7 @@ static int lowpan_control_open(struct inode *inode, struct file *file)
}
static const struct file_operations lowpan_control_fops = {
+ .owner = THIS_MODULE,
.open = lowpan_control_open,
.read = seq_read,
.write = lowpan_control_write,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0774/1257] Bluetooth: hci_debugfs: Pin module for debugfs file operations
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (772 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0773/1257] Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0775/1257] Bluetooth: selftest: Pin module for selftest " Greg Kroah-Hartman
` (224 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bui Viet Dung,
Luiz Augusto von Dentz, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Viet Dung <dungvn2345@gmail.com>
[ Upstream commit 2a3e2287877b1ee40ffb80b7d769b633866533f3 ]
An open debugfs file retains its file_operations pointer in the
debugfs proxy state. However, the file_operations defined in
hci_debugfs.c (use_debug_keys_fops, sc_only_mode_fops,
ssp_debug_mode_fops, force_bredr_smp_fops, force_static_address_fops,
force_no_mitm_fops, dut_mode_fops, vendor_diag_fops, and the
DEFINE_QUIRK_ATTRIBUTE macro) have no .owner set to THIS_MODULE.
As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the bluetooth module. When a userspace
process opens any of these debugfs files, a subsequent controller removal
and module unload (rmmod bluetooth) can succeed while the file descriptor
remains open.
When the userspace process subsequently closes the descriptor,
full_proxy_release() accesses the already unmapped file_operations
structure, triggering a kernel oops in full_proxy_release():
BUG: unable to handle page fault for address: fffffbfff8056f03
#PF: supervisor read access in kernel mode
Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:full_proxy_release+0x8e/0x140
Call Trace:
<TASK>
__fput+0x39f/0xa60
fput_close_sync+0xff/0x200
__x64_sys_close+0x8c/0xf0
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
The issue was discovered via manual code audit of
net/bluetooth/hci_debugfs.c and verified on a Linux 7.3-rc6 test VM
with CONFIG_BT=m.
Set .owner = THIS_MODULE on all debugfs file_operations tables in
hci_debugfs.c so that debugfs keeps the module loaded until close has
finished.
Fixes: 0886aea6acd2 ("Bluetooth: Expose debug keys usage setting via debugfs")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_debugfs.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index 2559fb6324d63..cd5ef398f2382 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -65,6 +65,7 @@ static ssize_t __name ## _write(struct file *file, \
} \
\
static const struct file_operations __name ## _fops = { \
+ .owner = THIS_MODULE, \
.open = simple_open, \
.read = __name ## _read, \
.write = __name ## _write, \
@@ -283,6 +284,7 @@ static ssize_t use_debug_keys_read(struct file *file, char __user *user_buf,
}
static const struct file_operations use_debug_keys_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = use_debug_keys_read,
.llseek = default_llseek,
@@ -301,6 +303,7 @@ static ssize_t sc_only_mode_read(struct file *file, char __user *user_buf,
}
static const struct file_operations sc_only_mode_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = sc_only_mode_read,
.llseek = default_llseek,
@@ -437,6 +440,7 @@ static ssize_t ssp_debug_mode_read(struct file *file, char __user *user_buf,
}
static const struct file_operations ssp_debug_mode_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = ssp_debug_mode_read,
.llseek = default_llseek,
@@ -529,6 +533,7 @@ static ssize_t force_bredr_smp_write(struct file *file,
}
static const struct file_operations force_bredr_smp_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = force_bredr_smp_read,
.write = force_bredr_smp_write,
@@ -778,6 +783,7 @@ static ssize_t force_static_address_write(struct file *file,
}
static const struct file_operations force_static_address_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = force_static_address_read,
.write = force_static_address_write,
@@ -1177,6 +1183,7 @@ static ssize_t force_no_mitm_write(struct file *file,
}
static const struct file_operations force_no_mitm_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = force_no_mitm_read,
.write = force_no_mitm_write,
@@ -1315,6 +1322,7 @@ static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
}
static const struct file_operations dut_mode_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = dut_mode_read,
.write = dut_mode_write,
@@ -1371,6 +1379,7 @@ static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
}
static const struct file_operations vendor_diag_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = vendor_diag_read,
.write = vendor_diag_write,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0775/1257] Bluetooth: selftest: Pin module for selftest debugfs file operations
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (773 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0774/1257] Bluetooth: hci_debugfs: Pin module for debugfs file operations Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0776/1257] Bluetooth: L2CAP: Reject mode changes on connected channels Greg Kroah-Hartman
` (223 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bui Viet Dung,
Luiz Augusto von Dentz, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Viet Dung <dungvn2345@gmail.com>
[ Upstream commit 64aabf94ecccb1120a63b4ee5a6761871a181a41 ]
An open debugfs file retains its file_operations pointer in the
debugfs proxy state. However, test_smp_fops in net/bluetooth/smp.c and
test_ecdh_fops in net/bluetooth/selftest.c have no .owner set to
THIS_MODULE.
As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the bluetooth module. When CONFIG_BT=m
and selftests are enabled, a userspace process can open either
/sys/kernel/debug/bluetooth/selftest_smp or
/sys/kernel/debug/bluetooth/selftest_ecdh and keep the file descriptor
open while the module is unloaded (rmmod bluetooth).
When the userspace process subsequently closes the descriptor,
full_proxy_release() accesses the already unmapped file_operations
structure, triggering a kernel oops in full_proxy_release():
BUG: unable to handle page fault for address: fffffbfff8056f03
#PF: supervisor read access in kernel mode
Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:full_proxy_release+0x8e/0x140
Call Trace:
<TASK>
__fput+0x39f/0xa60
fput_close_sync+0xff/0x200
__x64_sys_close+0x8c/0xf0
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
The issue was discovered via manual code audit of net/bluetooth/smp.c
and net/bluetooth/selftest.c.
Set .owner = THIS_MODULE on test_smp_fops and test_ecdh_fops so that
debugfs keeps the module pinned until the file descriptors are closed.
Fixes: 64dd374eac15 ("Bluetooth: Export SMP selftest result in debugfs")
Fixes: 6de50f9fdb60 ("Bluetooth: Export ECDH selftest result in debugfs")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/selftest.c | 1 +
net/bluetooth/smp.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/net/bluetooth/selftest.c b/net/bluetooth/selftest.c
index ae5b44bb9d3d3..cdfc40e0016b4 100644
--- a/net/bluetooth/selftest.c
+++ b/net/bluetooth/selftest.c
@@ -188,6 +188,7 @@ static ssize_t test_ecdh_read(struct file *file, char __user *user_buf,
}
static const struct file_operations test_ecdh_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = test_ecdh_read,
.llseek = default_llseek,
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 2df303f6a38fa..81d255525fe07 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -3696,6 +3696,7 @@ static ssize_t test_smp_read(struct file *file, char __user *user_buf,
}
static const struct file_operations test_smp_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = test_smp_read,
.llseek = default_llseek,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0776/1257] Bluetooth: L2CAP: Reject mode changes on connected channels
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (774 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0775/1257] Bluetooth: selftest: Pin module for selftest " Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0777/1257] Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests Greg Kroah-Hartman
` (222 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siwei Zhang, Luiz Augusto von Dentz,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siwei Zhang <oss@fourdim.xyz>
[ Upstream commit c1398cf11b31a94c27ed810ba69515e0df5ce379 ]
A peer can send a configuration response with an RFC
option for another mode to a connected channel, for
example to switch it from Streaming to ERTM mode.
l2cap_parse_conf_rsp() then changes chan->mode, but
l2cap_ertm_init() is not called again, so the ERTM
sequence lists are never allocated. The next
out-of-sequence I-frame makes l2cap_seq_list_clear()
write through the NULL srej_list.list.
Refuse the channel when a response tries to change
the mode of a connected channel.
Fixes: f2fcfcd67025 ("Bluetooth: Add configuration support for ERTM and Streaming mode")
Cc: stable@vger.kernel.org
Closes: https://sashiko.dev/#/patchset/20261007144717.3832330-1-oss%40fourdim.xyz
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index d87d2dfbce684..a8de785cc45ac 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3802,7 +3802,11 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
}
}
- if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
+ /* A connected channel cannot change its mode, as the new mode would
+ * not be initialized.
+ */
+ if (chan->mode != rfc.mode &&
+ (chan->mode == L2CAP_MODE_BASIC || chan->state == BT_CONNECTED))
return -ECONNREFUSED;
chan->mode = rfc.mode;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0777/1257] Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (775 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0776/1257] Bluetooth: L2CAP: Reject mode changes on connected channels Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0778/1257] Bluetooth: L2CAP: Use default TxWindow for zero socket option Greg Kroah-Hartman
` (221 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siwei Zhang, Luiz Augusto von Dentz,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siwei Zhang <oss@fourdim.xyz>
[ Upstream commit c5ebb0245fe927cf5fa33510a9cb2799c4a2dd01 ]
A peer can send an ERTM RFC option with a TxWindow
of zero, which is out of spec. It is stored in
remote_tx_win unchanged and later passed to
l2cap_seq_list_init(), where roundup_pow_of_two(0)
is undefined. On some architectures this results in
a ZERO_SIZE_PTR list and a remote kernel oops.
A TxWindow above 63 is out of spec as well. With
6-bit sequence numbers we would then send more
unacknowledged frames than the sequence space can
tell apart.
Reply with L2CAP_CONF_UNACCEPT and propose the
default TxWindow instead of accepting the value, so
remote_tx_win always stays within 1 to 63. Keep the
parameters of an earlier request then, and do not
treat the request as done because an earlier one was.
Also refuse a zero size in l2cap_seq_list_init(), so
any other path that reaches it with a zero TxWindow
fails the channel instead of the kernel.
Fixes: f2fcfcd67025 ("Bluetooth: Add configuration support for ERTM and Streaming mode")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 35 +++++++++++++++++++++++++++--------
1 file changed, 27 insertions(+), 8 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a8de785cc45ac..b86999899f669 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -320,6 +320,10 @@ static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
{
size_t alloc_size, i;
+ /* roundup_pow_of_two(0) is undefined */
+ if (!size)
+ return -EINVAL;
+
/* Allocated size is a power of 2 to map sequence numbers
* (which may be up to 14 bits) in to a smaller array that is
* sized for the negotiated ERTM transmit windows.
@@ -3649,18 +3653,33 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
break;
case L2CAP_MODE_ERTM:
- if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
- chan->remote_tx_win = rfc.txwin_size;
- else
- rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
-
- chan->remote_max_tx = rfc.max_transmit;
-
size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
rfc.max_pdu_size = cpu_to_le16(size);
- chan->remote_mps = size;
+
+ /* The TxWindow must be within 1 to 63, otherwise
+ * propose the default one and keep the parameters of
+ * an earlier request. This overrides a PENDING result
+ * from the EFS check above, so the request is no
+ * longer pending, nor done if an earlier one was.
+ */
+ if (!rfc.txwin_size ||
+ rfc.txwin_size > L2CAP_DEFAULT_TX_WINDOW) {
+ result = L2CAP_CONF_UNACCEPT;
+ clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
+ clear_bit(CONF_OUTPUT_DONE, &chan->conf_state);
+ rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
+ remote_efs = 0;
+ } else {
+ if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
+ chan->remote_tx_win = rfc.txwin_size;
+ else
+ rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
+
+ chan->remote_max_tx = rfc.max_transmit;
+ chan->remote_mps = size;
+ }
__l2cap_set_ertm_timeouts(chan, &rfc);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0778/1257] Bluetooth: L2CAP: Use default TxWindow for zero socket option
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (776 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0777/1257] Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0779/1257] cpufreq: schedutil: Serialize sugov_start() against rate limit updates Greg Kroah-Hartman
` (220 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siwei Zhang, Luiz Augusto von Dentz,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siwei Zhang <oss@fourdim.xyz>
[ Upstream commit 226fa3b676cbf2236f803bccd347462433ffc2c8 ]
L2CAP_OPTIONS accepts a txwin_size of zero and
stores it in tx_win. The zero is then sent to the
peer in our configuration request, and if the
channel ends up in ERTM mode it is passed to
l2cap_seq_list_init().
Use the default TxWindow instead, as the mode can
still be changed to ERTM during configuration.
Fixes: 14b5aa71ec50 ("Bluetooth: Add sockopt configuration for txWindow on L2CAP")
Cc: stable@vger.kernel.org
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_sock.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 38aedd7b00d33..1eab4478abf4a 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -815,6 +815,10 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
break;
}
+ /* A zero TxWindow is invalid, use the default instead */
+ if (!opts.txwin_size)
+ opts.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
+
if (!l2cap_valid_mtu(chan, opts.imtu)) {
err = -EINVAL;
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0779/1257] cpufreq: schedutil: Serialize sugov_start() against rate limit updates
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (777 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0778/1257] Bluetooth: L2CAP: Use default TxWindow for zero socket option Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0780/1257] PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain() Greg Kroah-Hartman
` (219 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhongqiu Han, Hui Su,
Rafael J. Wysocki, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
[ Upstream commit ce390caf5541c493c9061e7a2d98a463e66b736a ]
The current value of sg_policy->tunables->rate_limit_us is used in
sugov_start() without locking to update sg_policy->freq_update_delay_ns,
so if rate_limit_us_store() runs in parallel with it, the rate limit
update may go unnoticed and the new freq_update_delay_ns value may be
stale until the rate limit is updated again.
To avoid that, acquire the update_lock mutex of the rate limit sysfs
attribute, that is held by rate_limit_us_store() during rate limit
updates, around the freq_update_delay_ns in sugov_start().
Fixes: 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Hui Su <sh_def@163.com>
Cc: All applicable <stable@vger.kernel.org>
[ rjw: Subject adjustment, new changelog, edits of the new comment ]
[ rjw: Add empty code line after guard()() ]
Link: https://patch.msgid.link/20261013034235.2678177-1-sh_def@163.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/cpufreq_schedutil.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 49ccd6f1c1850..14405a6149911 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -73,6 +73,18 @@ static void sugov_update_rate_limit_us(struct sugov_policy *sg_policy)
(s64)sg_policy->tunables->rate_limit_us * NSEC_PER_USEC;
}
+static void sugov_update_rate_limit_us_sync(struct sugov_policy *sg_policy)
+{
+ /*
+ * Serialize with rate_limit_us_store() to prevent this path from using
+ * a stale rate limit tunable value to set the limit for the given
+ * policy.
+ */
+ guard(mutex)(&sg_policy->tunables->attr_set.update_lock);
+
+ sugov_update_rate_limit_us(sg_policy);
+}
+
static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
{
s64 delta_ns;
@@ -861,7 +873,7 @@ static int sugov_start(struct cpufreq_policy *policy)
void (*uu)(struct update_util_data *data, u64 time, unsigned int flags);
unsigned int cpu;
- sugov_update_rate_limit_us(sg_policy);
+ sugov_update_rate_limit_us_sync(sg_policy);
sg_policy->last_freq_update_time = 0;
sg_policy->next_freq = 0;
sg_policy->work_in_progress = false;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0780/1257] PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (778 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0779/1257] cpufreq: schedutil: Serialize sugov_start() against rate limit updates Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0781/1257] kbuild: AutoFDO: Update split machine function argument for upstream rename Greg Kroah-Hartman
` (218 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Manivannan Sadhasivam,
Bjorn Helgaas, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 73d3d81832708137ba6332fc011663feaf97deee ]
xilinx_pl_dma_pcie_init_irq_domain() takes a reference to the PCIe
interrupt-controller child node with of_get_child_by_name(), but the
error paths after the two irq_domain_create_linear() calls and after
xilinx_pl_dma_pcie_init_msi_irq_domain() return directly without
dropping it. irq_domain_create_linear() gets its own reference on the
fwnode, so the domains do not consume the caller's one.
Add an err_put_node label that drops the reference before returning.
Fixes: 8d786149d78c ("PCI: xilinx-xdma: Add Xilinx XDMA Root Port driver")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260917132459.2153240-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-xilinx-dma-pl.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/controller/pcie-xilinx-dma-pl.c b/drivers/pci/controller/pcie-xilinx-dma-pl.c
index b037c8f315e46..e18eeecdc8a9a 100644
--- a/drivers/pci/controller/pcie-xilinx-dma-pl.c
+++ b/drivers/pci/controller/pcie-xilinx-dma-pl.c
@@ -581,7 +581,7 @@ static int xilinx_pl_dma_pcie_init_irq_domain(struct pl_dma_pcie *port)
port->pldma_domain = irq_domain_create_linear(of_fwnode_handle(pcie_intc_node), 32,
&event_domain_ops, port);
if (!port->pldma_domain)
- return -ENOMEM;
+ goto err_put_node;
irq_domain_update_bus_token(port->pldma_domain, DOMAIN_BUS_NEXUS);
@@ -589,7 +589,7 @@ static int xilinx_pl_dma_pcie_init_irq_domain(struct pl_dma_pcie *port)
&intx_domain_ops, port);
if (!port->intx_domain) {
dev_err(dev, "Failed to get a INTx IRQ domain\n");
- return -ENOMEM;
+ goto err_put_node;
}
irq_domain_update_bus_token(port->intx_domain, DOMAIN_BUS_WIRED);
@@ -597,13 +597,17 @@ static int xilinx_pl_dma_pcie_init_irq_domain(struct pl_dma_pcie *port)
ret = xilinx_pl_dma_pcie_init_msi_irq_domain(port);
if (ret != 0) {
irq_domain_remove(port->intx_domain);
- return -ENOMEM;
+ goto err_put_node;
}
of_node_put(pcie_intc_node);
raw_spin_lock_init(&port->lock);
return 0;
+
+err_put_node:
+ of_node_put(pcie_intc_node);
+ return -ENOMEM;
}
static int xilinx_pl_dma_pcie_setup_irq(struct pl_dma_pcie *port)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0781/1257] kbuild: AutoFDO: Update split machine function argument for upstream rename
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (779 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0780/1257] PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0782/1257] iommufd: Keep dmabuf PFNs MMIO when filling another domain Greg Kroah-Hartman
` (217 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit 2b358510d5cc56164f83110ca1499c95a5a352cd ]
A recent LLVM commit [1] renamed the internal LLVM plugin option
'-split-machine-functions' to '-function-splitting=all', breaking the
AutoFDO + ThinLTO build with:
ld.lld: error: -plugin-opt=-: ld.lld: Unknown command line argument '-split-machine-functions'. Try: 'ld.lld --help'
The plugin option is needed for in-process ThinLTO, so handle the rename
accordingly using ld-option.
Cc: stable@vger.kernel.org
Closes: https://github.com/ClangBuiltLinux/linux/issues/2186
Fixes: 2fd65f7afd5a ("AutoFDO: Enable machine function split optimization for AutoFDO")
Link: https://github.com/llvm/llvm-project/commit/3e6acc87c58843e551d6e8e4bf06c26712b04622 [1]
Link: https://patch.msgid.link/20261014-update-autofdo-split-machine-function-option-v1-1-5c71b3005e89@kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/Makefile.autofdo | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/Makefile.autofdo b/scripts/Makefile.autofdo
index 1442043da1391..57a3aba6ffc23 100644
--- a/scripts/Makefile.autofdo
+++ b/scripts/Makefile.autofdo
@@ -22,7 +22,7 @@ ifdef CONFIG_LTO_CLANG_THIN
KBUILD_LDFLAGS += --lto-sample-profile=$(CLANG_AUTOFDO_PROFILE)
endif
KBUILD_LDFLAGS += --mllvm=-enable-fs-discriminator=true --mllvm=-improved-fs-discriminator=true -plugin-opt=thinlto
- KBUILD_LDFLAGS += -plugin-opt=-split-machine-functions
+ KBUILD_LDFLAGS += $(call ld-option,-plugin-opt=-function-splitting=all,-plugin-opt=-split-machine-functions)
endif
export CFLAGS_AUTOFDO_CLANG RUSTFLAGS_AUTOFDO_CLANG
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0782/1257] iommufd: Keep dmabuf PFNs MMIO when filling another domain
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (780 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0781/1257] kbuild: AutoFDO: Update split machine function argument for upstream rename Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0783/1257] iommufd: Reject a zero-length dirty bitmap request Greg Kroah-Hartman
` (216 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Andrea Parri,
Jason Gunthorpe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit 769f2cd9226c96619d77fa16af84de74cae41b6b ]
A VFIO PCI dmabuf mapped into an IOAS is mapped with IOMMU_MMIO only in
the domains present when it is mapped. A domain added later, or a copy
of the area into another IOAS, maps the same BAR as cacheable CPU
memory: IOMMU_CACHE set and IOMMU_MMIO clear.
Once the area is in pages->domains_itree, pfn_reader_fill_span() reads
its PFNs back from the storage domain through batch_from_domain(), which
adds them with batch_add_pfn() as BATCH_CPU_MEMORY. Only a hole in the
span reaches pfn_reader_fill_dmabuf() and gets BATCH_MMIO, so
batch_to_domain() programs the later domain with the wrong prot.
The effect depends on the page table format. io-pgtable-arm maps the BAR
as Normal cacheable instead of Device memory, the AMDv1 and x86_64
generic_pt formats set the SME C-bit on it when the tables are encrypted,
and the RISC-V format with Svpbmt maps it as normal memory instead of IO.
Read dmabuf PFNs from the recorded phys for every span, before the
xarray and domain paths. The phys range is always available, and the
read-back from a domain only serves to avoid re-pinning user pages.
Sashiko pointed this out while reviewing an RFC that plumbs the dma-buf
memory type through pfn_reader_fill_dmabuf().
Fixes: 74014a4b55f5 ("iommufd: Have pfn_reader process DMABUF iopt_pages")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/all/20260716154123.32DC01F000E9@smtp.kernel.org/
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://patch.msgid.link/20261008125206.11990-2-parri.andrea@gmail.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/iommufd/pages.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c
index 404f31d8f7291..2f6153108add7 100644
--- a/drivers/iommu/iommufd/pages.c
+++ b/drivers/iommu/iommufd/pages.c
@@ -1178,6 +1178,15 @@ static int pfn_reader_fill_span(struct pfn_reader *pfns)
WARN_ON(span->last_used < start_index))
return -EINVAL;
+ /*
+ * Always read a dmabuf from its phys, even where a domain already
+ * maps it: a domain can only report CPU memory PFNs, losing
+ * BATCH_MMIO. last_hole aliases last_used, so this covers any span.
+ */
+ if (iopt_is_dmabuf(pfns->pages))
+ return pfn_reader_fill_dmabuf(&pfns->dmabuf, &pfns->batch,
+ start_index, span->last_hole);
+
if (span->is_used == 1) {
batch_from_xarray(&pfns->batch, &pfns->pages->pinned_pfns,
start_index, span->last_used);
@@ -1201,10 +1210,6 @@ static int pfn_reader_fill_span(struct pfn_reader *pfns)
return 0;
}
- if (iopt_is_dmabuf(pfns->pages))
- return pfn_reader_fill_dmabuf(&pfns->dmabuf, &pfns->batch,
- start_index, span->last_hole);
-
user = &pfns->user;
if (start_index >= user->upages_end) {
rc = pfn_reader_user_pin(user, pfns->pages, start_index,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0783/1257] iommufd: Reject a zero-length dirty bitmap request
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (781 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0782/1257] iommufd: Keep dmabuf PFNs MMIO when filling another domain Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0784/1257] ALSA: hda/realtek: Fix quirk for HP Laptop 15-fc0xxx Greg Kroah-Hartman
` (215 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrea Parri, Jason Gunthorpe,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Parri <parri.andrea@gmail.com>
[ Upstream commit f6b3fd8f573e801066c21b2aec3d2e949e61e48e ]
iommufd_check_iova_range() subtracts one from bitmap->length before it
checks the length, so a zero-length request wraps to SIZE_MAX. With
iova = 0 the wrapped value passes the overflow and alignment checks, and
the request reaches iova_bitmap_alloc() with length 0.
iova_bitmap_alloc() then sizes the bitmap from a length - 1 of SIZE_MAX,
so mapped_total_index is effectively unbounded. The scan uses
last_iova = ULONG_MAX, which spans the whole IOAS when an area is mapped
at IOVA 0. Reject a zero length before the subtraction.
Fixes: b9a60d6f850e ("iommufd: Add IOMMU_HWPT_GET_DIRTY_BITMAP")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://patch.msgid.link/20260925161142.189813-4-parri.andrea@gmail.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/iommufd/io_pagetable.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c
index 4e447ce74cf6c..283ab372e8da8 100644
--- a/drivers/iommu/iommufd/io_pagetable.c
+++ b/drivers/iommu/iommufd/io_pagetable.c
@@ -605,6 +605,9 @@ int iommufd_check_iova_range(struct io_pagetable *iopt,
size_t iommu_pgsize = iopt->iova_alignment;
u64 last_iova;
+ if (!bitmap->length)
+ return -EINVAL;
+
if (check_add_overflow(bitmap->iova, bitmap->length - 1, &last_iova))
return -EOVERFLOW;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0784/1257] ALSA: hda/realtek: Fix quirk for HP Laptop 15-fc0xxx
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (782 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0783/1257] iommufd: Reject a zero-length dirty bitmap request Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0785/1257] crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev() Greg Kroah-Hartman
` (214 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhang Heng, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <zhangheng@kylinos.cn>
[ Upstream commit 044d41b43ee19aa29cb0c9b7b8e77fd113336522 ]
The HP Laptop 15-fc0xxx is based on an AMD platform where the digital
microphone is provided by the snd-soc-acp6x-mach driver, not by the
HDA codec. The ALC236_FIXUP_HP_DMIC quirk configures pin 0x12 as an
internal DMIC, which is a misconfiguration for this machine: the pin
is not wired to a codec DMIC and the setting has no effect on the
actual microphone path (which works via ACP6x).
Replace ALC236_FIXUP_HP_DMIC with
ALC236_FIXUP_HP_MUTE_LED_MICMUTE_GPIO, the standard quirk used by the
closely related HP Laptop 15-fd0xxx and other ALC236 HP machines. This
removes the misleading DMIC pin config and adds proper mute LED and
micmute LED support that was missing from the original quirk.
Fixes: 720460722310 ("ALSA: hda/realtek: add quirk for HP Laptop 15-fc0xxx")
Cc: stable@vger.kernel.org
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221233
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=222044
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20261015065640.377466-1-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 94593267a5b82..58948a3bbda04 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -4379,7 +4379,6 @@ enum {
ALC245_FIXUP_BASS_HP_DAC,
ALC245_FIXUP_ACER_MICMUTE_LED,
ALC245_FIXUP_CS35L41_I2C_2_MUTE_LED,
- ALC236_FIXUP_HP_DMIC,
ALC256_FIXUP_HONOR_MRB_XXX_M1020_AUDIO,
ALC245_FIXUP_HP_ENVY_X360_15_FH0XXX,
ALC287_FIXUP_ACER_MICMUTE_LED,
@@ -7126,13 +7125,6 @@ static const struct hda_fixup alc269_fixups[] = {
.chained = true,
.chain_id = ALC287_FIXUP_CS35L41_I2C_2,
},
- [ALC236_FIXUP_HP_DMIC] = {
- .type = HDA_FIXUP_PINS,
- .v.pins = (const struct hda_pintbl[]) {
- { 0x12, 0x90a60160 }, /* use as internal mic */
- { }
- },
- },
[ALC256_FIXUP_HONOR_MRB_XXX_M1020_AUDIO] = {
.type = HDA_FIXUP_PINS,
.v.pins = (const struct hda_pintbl[]) {
@@ -7775,7 +7767,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x103c, 0x8da1, "HP 16 Clipper OmniBook X", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x103c, 0x8da7, "HP 14 Enstrom OmniBook X", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x103c, 0x8da8, "HP 16 Piston OmniBook X", ALC245_FIXUP_HP_ENVY_X360_15_FH0XXX),
- SND_PCI_QUIRK(0x103c, 0x8dc9, "HP Laptop 15-fc0xxx", ALC236_FIXUP_HP_DMIC),
+ SND_PCI_QUIRK(0x103c, 0x8dc9, "HP Laptop 15-fc0xxx", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_GPIO),
SND_PCI_QUIRK(0x103c, 0x8dd4, "HP EliteStudio 8 AIO", ALC274_FIXUP_HP_AIO_BIND_DACS),
SND_PCI_QUIRK(0x103c, 0x8dd7, "HP Laptop 15-fd0xxx", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_GPIO),
SND_PCI_QUIRK(0x103c, 0x8de8, "HP Gemtree", ALC245_FIXUP_TAS2781_SPI_2),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0785/1257] crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (783 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0784/1257] ALSA: hda/realtek: Fix quirk for HP Laptop 15-fc0xxx Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0786/1257] crypto: qat - fix use of destroyed vf2pf_lock on VF restart Greg Kroah-Hartman
` (213 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ahsan Atta, Giovanni Cabiddu,
Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahsan Atta <ahsan.atta@intel.com>
[ Upstream commit 4ad7c1bd5f3dcd3fd6efbb068d6ee2a68dddfece ]
state_lock is initialised at the end of adf_devmgr_add_dev(), but the VF
on host path whose id mapping already exists returns earlier via
'goto unlock'. That mapping outlives the VF, so this path is taken every
time a VF is recreated on a BDF that already hosted one, e.g.:
echo 0 > sriov_numvfs
echo 32 > sriov_numvfs
accel_dev is freshly allocated on each probe, so state_lock is left zeroed
and adf_dev_up() takes an uninitialised mutex. With CONFIG_DEBUG_MUTEXES
this is reported on a dh895xcc with 32 host-bound VFs:
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: kernel/locking/mutex.c:159 at mutex_lock+0x171/0x1c0
Call Trace:
adf_dev_up+0x27/0xe0 [intel_qat]
adf_probe+0x700/0xa80 [qat_dh895xccvf]
local_pci_probe+0xd5/0x190
The same happens on teardown when adf_dev_down() locks it again.
Initialise the lock next to the other per-device state, before the tables
are updated, so it is done on every path.
Fixes: 1bdc85550a2b ("crypto: qat - fix concurrency issue when device state changes")
Cc: stable@vger.kernel.org
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
index 161863841a527..26b40dd599652 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
@@ -137,6 +137,7 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev,
mutex_lock(&table_lock);
atomic_set(&accel_dev->ref_count, 0);
+ mutex_init(&accel_dev->state_lock);
/* PF on host or VF on guest - optimized to remove redundant is_vf */
if (!accel_dev->is_vf || !pf) {
@@ -210,7 +211,6 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev,
map->attached = true;
list_add_tail(&map->list, &vfs_table);
}
- mutex_init(&accel_dev->state_lock);
unlock:
mutex_unlock(&table_lock);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0786/1257] crypto: qat - fix use of destroyed vf2pf_lock on VF restart
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (784 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0785/1257] crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0787/1257] irqchip/gic-v3-its: Dont clamp nvecs to zero when id_bits is 32 Greg Kroah-Hartman
` (212 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ahsan Atta, Giovanni Cabiddu,
Herbert Xu, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahsan Atta <ahsan.atta@intel.com>
[ Upstream commit 4921634ac0a9a65aaa5e41308aabda3d3f562ee3 ]
adf_dev_stop_async() sends the RESTARTING_COMPLETE message after
adf_dev_down() has returned, but adf_dev_down() already destroyed the
lock that message takes.
Both run in sequence in the same worker, so every PF restart locks a
destroyed mutex. With CONFIG_DEBUG_MUTEXES on a dh895xcc with 32 host-bound
VFs this trips on the first PF reset:
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: kernel/locking/mutex.c:159 at mutex_lock+0x171/0x1c0
Workqueue: adf_vf_stop_wq adf_dev_stop_async [intel_qat]
Call Trace:
adf_gen2_pfvf_send+0x210/0x530 [intel_qat]
adf_vf2pf_notify_restart_complete+0x55/0x80 [intel_qat]
adf_dev_stop_async+0xdb/0x140 [intel_qat]
The notification cannot move before adf_dev_down(): the PF waits for it
before its own reset and the VF must tear down its rings first.
vf2pf_lock protects the VF2PF CSR and is unrelated to the PF2VF bottom half
it is initialised alongside. Tie its lifetime to the accel device, next to
state_lock in adf_devmgr_add_dev()/adf_devmgr_rm_dev(), so it stays valid
for messages sent outside the device up/down cycle. It is only touched for
VFs, which set is_vf before adf_devmgr_add_dev() and keep it set until
adf_devmgr_rm_dev().
Fixes: 6f1b5236348f ("crypto: qat - fix recovery flow for VFs")
Cc: stable@vger.kernel.org
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 8 ++++++++
drivers/crypto/intel/qat/qat_common/adf_vf_isr.c | 2 --
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
index 26b40dd599652..4e6d860c9a60d 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
@@ -138,6 +138,12 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev,
mutex_lock(&table_lock);
atomic_set(&accel_dev->ref_count, 0);
mutex_init(&accel_dev->state_lock);
+ /*
+ * The VF2PF lock is used to send messages to the PF outside of the
+ * device up/down cycle, so it must live as long as the accel device.
+ */
+ if (accel_dev->is_vf)
+ mutex_init(&accel_dev->vf.vf2pf_lock);
/* PF on host or VF on guest - optimized to remove redundant is_vf */
if (!accel_dev->is_vf || !pf) {
@@ -257,6 +263,8 @@ void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev,
}
}
unlock:
+ if (accel_dev->is_vf)
+ mutex_destroy(&accel_dev->vf.vf2pf_lock);
mutex_destroy(&accel_dev->state_lock);
list_del(&accel_dev->list);
mutex_unlock(&table_lock);
diff --git a/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c b/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c
index 9ffaa56def676..1f28655ec0517 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c
@@ -118,7 +118,6 @@ static int adf_setup_pf2vf_bh(struct adf_accel_dev *accel_dev)
tasklet_init(&accel_dev->vf.pf2vf_bh_tasklet,
(void *)adf_pf2vf_bh_handler, (unsigned long)accel_dev);
- mutex_init(&accel_dev->vf.vf2pf_lock);
return 0;
}
@@ -126,7 +125,6 @@ static void adf_cleanup_pf2vf_bh(struct adf_accel_dev *accel_dev)
{
tasklet_disable(&accel_dev->vf.pf2vf_bh_tasklet);
tasklet_kill(&accel_dev->vf.pf2vf_bh_tasklet);
- mutex_destroy(&accel_dev->vf.vf2pf_lock);
}
static irqreturn_t adf_isr(int irq, void *privdata)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0787/1257] irqchip/gic-v3-its: Dont clamp nvecs to zero when id_bits is 32
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (785 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0786/1257] crypto: qat - fix use of destroyed vf2pf_lock on VF restart Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0788/1257] irqchip/imx-intmux: Fix runtime PM teardown on remove Greg Kroah-Hartman
` (211 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fuad Tabba, Thomas Gleixner,
Marc Zyngier, Zenghui Yu (Huawei), Radu Rendec, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fuad Tabba <fuad.tabba@linux.dev>
[ Upstream commit 5a9d62555e7164ec79a5fe70153d79cf1fdfd614 ]
GITS_TYPER_IDBITS is five bits, so id_bits reaches 32 and
min_t(unsigned int, ...) truncates BIT(32) to 0. nvecs becomes 0,
its_lpi_alloc() rejects that, and its_msi_prepare() returns -ENOMEM.
On 32-bit ARM the shift is undefined instead.
The clamp is correct for every value below the maximum, so only that
one value is affected.
Fixes: ce9e40a9a5e5c ("irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
Reviewed-by: Radu Rendec <radu@rendec.net>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260908142632.2795308-3-fuad.tabba@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v3-its.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index e9807af235373..81a96149f9154 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3484,7 +3484,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
* Also honor the ITS's own EID limit.
*/
id_bits = FIELD_GET(GITS_TYPER_IDBITS, its->typer) + 1;
- nvecs = min_t(unsigned int, nvecs, BIT(id_bits));
+ nvecs = min_t(u64, nvecs, BIT_ULL(id_bits));
nr_ites = max(2, nvecs);
sz = nr_ites * (FIELD_GET(GITS_TYPER_ITT_ENTRY_SIZE, its->typer) + 1);
sz = max(sz, ITS_ITT_ALIGN);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0788/1257] irqchip/imx-intmux: Fix runtime PM teardown on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (786 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0787/1257] irqchip/gic-v3-its: Dont clamp nvecs to zero when id_bits is 32 Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0789/1257] irqchip/mchp-eic: Fix clock reference leak in mchp_eic_probe() Greg Kroah-Hartman
` (210 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Thomas Gleixner,
Frank Li, Radu Rendec, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit b167c1a30e9e020e4c5e102c7a555943742c024b ]
imx_intmux_probe() enables the IPG clock and then drops its runtime PM
reference with pm_runtime_put(). With CONFIG_PM enabled, the runtime
suspend callback disables the IPG clock. With CONFIG_PM disabled, the
clock remains enabled after probe.
imx_intmux_remove() accesses the CHANIER registers without first making
sure that the device is runtime active. The device may therefore be
runtime suspended with the IPG clock disabled when these registers are
accessed. In addition, the remove path only calls pm_runtime_disable()
and does not balance the clock enable when CONFIG_PM is disabled.
Resume the device and acquire a runtime PM reference before accessing
the registers. If resume fails, skip the register accesses but still
tear down the chained handlers and IRQ domains. Disable runtime PM
afterwards, drop the acquired reference without triggering another
runtime suspend, and explicitly disable the IPG clock.
This keeps the clock enabled while the hardware registers are accessed
and balances the clk_prepare_enable() performed during probe for both
CONFIG_PM configurations.
This issue was found by manual code inspection.
Fixes: bb403111e017 ("irqchip/imx-intmux: Implement intmux runtime power management")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260914134211.1734163-1-lgs201920130244@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-imx-intmux.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/irqchip/irq-imx-intmux.c b/drivers/irqchip/irq-imx-intmux.c
index 47c2681d138a0..de2a8f98f6255 100644
--- a/drivers/irqchip/irq-imx-intmux.c
+++ b/drivers/irqchip/irq-imx-intmux.c
@@ -288,12 +288,16 @@ static int imx_intmux_probe(struct platform_device *pdev)
static void imx_intmux_remove(struct platform_device *pdev)
{
struct intmux_data *data = platform_get_drvdata(pdev);
- int i;
+ int i, ret;
+
+ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0)
+ dev_warn(&pdev->dev, "failed to resume device: %d\n", ret);
for (i = 0; i < data->channum; i++) {
/* disable all interrupt sources of this channel */
- writel_relaxed(0, data->regs + CHANIER(i));
-
+ if (ret >= 0)
+ writel_relaxed(0, data->regs + CHANIER(i));
irq_set_chained_handler_and_data(data->irqchip_data[i].irq,
NULL, NULL);
@@ -301,6 +305,11 @@ static void imx_intmux_remove(struct platform_device *pdev)
}
pm_runtime_disable(&pdev->dev);
+ if (ret >= 0) {
+ pm_runtime_put_noidle(&pdev->dev);
+ clk_disable_unprepare(data->ipg_clk);
+ pm_runtime_set_suspended(&pdev->dev);
+ }
}
#ifdef CONFIG_PM
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0789/1257] irqchip/mchp-eic: Fix clock reference leak in mchp_eic_probe()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (787 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0788/1257] irqchip/imx-intmux: Fix runtime PM teardown on remove Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0790/1257] irqchip/atmel-aic[5]: Disable interrupts in the irq_pm_shutdown() callbacks Greg Kroah-Hartman
` (209 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Thomas Gleixner,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit af9c707eb065a7d48eb92dc15acdb4346acf5db0 ]
of_clk_get_by_name() returns the clock with an elevated reference count
that mchp_eic_probe() keeps for the lifetime of the driver, but none of
the probe error paths drops it, so the reference is leaked whenever
probe fails after the clock has been obtained.
Put the reference in the error cleanup. The clk_prepare_enable()
failure path must jump there directly as it cannot call
clk_disable_unprepare() on a clock that was never enabled.
Fixes: 00fa3461c86d ("irqchip/mchp-eic: Add support for the Microchip EIC")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260916190349.2094401-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-mchp-eic.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-mchp-eic.c b/drivers/irqchip/irq-mchp-eic.c
index be007d325e672..5250e6baff63c 100644
--- a/drivers/irqchip/irq-mchp-eic.c
+++ b/drivers/irqchip/irq-mchp-eic.c
@@ -233,7 +233,7 @@ static int mchp_eic_probe(struct platform_device *pdev, struct device_node *pare
ret = clk_prepare_enable(eic->clk);
if (ret)
- goto unmap;
+ goto clk_put;
for (i = 0; i < MCHP_EIC_NIRQ; i++) {
struct of_phandle_args irq;
@@ -270,6 +270,8 @@ static int mchp_eic_probe(struct platform_device *pdev, struct device_node *pare
clk_unprepare:
clk_disable_unprepare(eic->clk);
+clk_put:
+ clk_put(eic->clk);
unmap:
iounmap(eic->base);
free:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0790/1257] irqchip/atmel-aic[5]: Disable interrupts in the irq_pm_shutdown() callbacks
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (788 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0789/1257] irqchip/mchp-eic: Fix clock reference leak in mchp_eic_probe() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0791/1257] irqchip/jcore-aic: Fix lost IPIs on SMP Greg Kroah-Hartman
` (208 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Thomas Gleixner,
Radu Rendec, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 0ca21fe111457c843624a835641bb490e704bb2f ]
irq_gc_shutdown() calls the irq_pm_shutdown() callbacks from
syscore_shutdown() with interrupts enabled. aic_pm_shutdown() and
aic5_pm_shutdown() take the generic chip lock with raw_spin_lock(), and
irq_gc_eoi() takes the same lock from the interrupt handler. An
interrupt from the chip while the lock is held spins in irq_gc_eoi()
and hangs the reboot.
Lockdep reports this on every reboot of a SAM9X75 Curiosity board:
WARNING: inconsistent lock state
inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
busybox/101 [HC0[0]:SC0[0]:HE1:SE1] takes:
c1c2b434 (&gc->lock){?.-.}-{2:2}, at: aic5_pm_shutdown+0x34/0xd8
{IN-HARDIRQ-W} state was registered at:
...
irq_gc_eoi+0x28/0x60
handle_fasteoi_irq+0x120/0x214
...
aic5_pm_shutdown from irq_gc_shutdown+0x4c/0x58
irq_gc_shutdown from syscore_shutdown+0x5c/0x9c
syscore_shutdown from kernel_restart+0x34/0x78
kernel_restart from sys_reboot+0x180/0x25c
Use the irqsave guard, as
commit 33517881ede7 ("irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code")
did for brcmstb-l2.
Fixes: b1479ebb7720 ("irqchip: atmel-aic: Add atmel AIC/AIC5 drivers")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: LLM
Reviewed-by: Radu Rendec <radu@rendec.net>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260926004124.88221-1-kmehltretter@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-atmel-aic.c | 2 +-
drivers/irqchip/irq-atmel-aic5.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 1dcc52760ecae..4a7935e75e4dd 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -123,7 +123,7 @@ static void aic_pm_shutdown(struct irq_data *d)
{
struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
- guard(raw_spinlock)(&gc->lock);
+ guard(raw_spinlock_irqsave)(&gc->lock);
irq_reg_writel(gc, 0xffffffff, AT91_AIC_IDCR);
irq_reg_writel(gc, 0xffffffff, AT91_AIC_ICCR);
}
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index 1f14b401f71d0..07a317ed06ef4 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -217,7 +217,7 @@ static void aic5_pm_shutdown(struct irq_data *d)
struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
int i;
- guard(raw_spinlock)(&bgc->lock);
+ guard(raw_spinlock_irqsave)(&bgc->lock);
for (i = 0; i < dgc->irqs_per_chip; i++) {
irq_reg_writel(bgc, i + gc->irq_base, AT91_AIC5_SSR);
irq_reg_writel(bgc, 1, AT91_AIC5_IDCR);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0791/1257] irqchip/jcore-aic: Fix lost IPIs on SMP
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (789 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0790/1257] irqchip/atmel-aic[5]: Disable interrupts in the irq_pm_shutdown() callbacks Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0792/1257] irqchip/renesas-rzv2h: Preserve TIEN state in rzv2h_tint_set_type() Greg Kroah-Hartman
` (207 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Thomas Gleixner,
John Paul Adrian Glaubitz, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit f556f008f704a8777c73fb3a4177dc57c0dbe769 ]
Since commit bdf4e2ac295fe ("genirq: Allow per-cpu interrupt sharing for
non-overlapping affinities"), handle_percpu_devid_irq() only runs an
action whose affinity mask contains the current CPU. Only actions set up
through the percpu_devid request functions have such a mask.
handle_jcore_irq() passes every per-CPU interrupt to
handle_percpu_devid_irq(). The J2 IPI is not a percpu_devid interrupt.
j2_prepare_cpus() requests it with request_irq() and IRQF_PERCPU, so its
action has no affinity mask and cpumask_test_cpu() reads through a NULL
pointer. J2 has no MMU to catch this. The read returns whatever is at
address 0, the action is not found, and IPIs are dropped as spurious
("Spurious percpu IRQ20 on CPU1", printed once).
Pass only percpu_devid interrupts (the PIT) to handle_percpu_devid_irq()
and the other per-CPU interrupts to handle_percpu_irq() again, as before
commit d7e3fd658248f ("irqchip/jcore-aic, clocksource/drivers/jcore: Fix
jcore-pit interrupt request").
Found with a two-CPU J2 model simulated from the J-Core RTL. Without
this change the boot stalls with both CPUs idle shortly after
"smp: Brought up 1 node, 2 CPUs". With it, the boot reaches userspace.
Fixes: bdf4e2ac295fe ("genirq: Allow per-cpu interrupt sharing for non-overlapping affinities")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: LLM
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260928035408.25871-1-kmehltretter@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-jcore-aic.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-jcore-aic.c b/drivers/irqchip/irq-jcore-aic.c
index 94c05cf974be8..b4fee02997eee 100644
--- a/drivers/irqchip/irq-jcore-aic.c
+++ b/drivers/irqchip/irq-jcore-aic.c
@@ -37,8 +37,10 @@ static struct irq_chip jcore_aic;
static void handle_jcore_irq(struct irq_desc *desc)
{
- if (irqd_is_per_cpu(irq_desc_get_irq_data(desc)))
+ if (irq_is_percpu_devid(irq_desc_get_irq(desc)))
handle_percpu_devid_irq(desc);
+ else if (irqd_is_per_cpu(irq_desc_get_irq_data(desc)))
+ handle_percpu_irq(desc);
else
handle_simple_irq(desc);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0792/1257] irqchip/renesas-rzv2h: Preserve TIEN state in rzv2h_tint_set_type()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (790 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0791/1257] irqchip/jcore-aic: Fix lost IPIs on SMP Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0793/1257] ALSA: ump: Correct return size of fill_rpn() Greg Kroah-Hartman
` (206 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Au Dang, Tommaso Merciai,
Thomas Gleixner, Biju Das, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Au Dang <au.dang.jx@renesas.com>
[ Upstream commit 42bedd4af8cd50c32a1560d8744bd22d25be79cc ]
rzv2h_tint_set_type() clears TIEN while switching the TINT source and
then unconditionally sets it again, enabling the interrupt even if it
was disabled before the call.
Restore the previous TIEN state instead of forcing it on.
Fixes: 0d7605e75ac2 ("irqchip: Add RZ/V2H(P) Interrupt Control Unit (ICU) driver")
Signed-off-by: Au Dang <au.dang.jx@renesas.com>
Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261014095927.635132-1-tommaso.merciai.xr@bp.renesas.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-renesas-rzv2h.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/irqchip/irq-renesas-rzv2h.c b/drivers/irqchip/irq-renesas-rzv2h.c
index 1a4703a353e95..485c3eea76328 100644
--- a/drivers/irqchip/irq-renesas-rzv2h.c
+++ b/drivers/irqchip/irq-renesas-rzv2h.c
@@ -420,9 +420,9 @@ static void rzv2h_clear_tint_int(struct rzv2h_icu_priv *priv, unsigned int hwirq
static int rzv2h_tint_set_type(struct irq_data *d, unsigned int type)
{
u32 titsr, titsr_k, titsel_n, tien;
+ u32 titsr_cur, tssr_cur, tien_cur;
struct rzv2h_icu_priv *priv;
u32 tssr, tssr_k, tssel_n;
- u32 titsr_cur, tssr_cur;
unsigned int hwirq;
u32 tint, sense;
int tint_nr;
@@ -477,6 +477,8 @@ static int rzv2h_tint_set_type(struct irq_data *d, unsigned int type)
if (tssr_cur == tint && titsr_cur == sense)
goto set_parent_type;
+ tien_cur = tssr & tien;
+
tssr &= ~(ICU_TSSR_TSSEL_MASK(tssel_n, priv->info->field_width) | tien);
tssr |= ICU_TSSR_TSSEL_PREP(tint, tssel_n, priv->info->field_width);
@@ -489,7 +491,7 @@ static int rzv2h_tint_set_type(struct irq_data *d, unsigned int type)
rzv2h_clear_tint_int(priv, hwirq);
- writel_relaxed(tssr | tien, priv->base + priv->info->t_offs + ICU_TSSR(tssr_k));
+ writel_relaxed(tssr | tien_cur, priv->base + priv->info->t_offs + ICU_TSSR(tssr_k));
}
set_parent_type:
return irq_chip_set_type_parent(d, IRQ_TYPE_LEVEL_HIGH);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0793/1257] ALSA: ump: Correct return size of fill_rpn()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (791 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0792/1257] irqchip/renesas-rzv2h: Preserve TIEN state in rzv2h_tint_set_type() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0794/1257] gfs2: fix the escaped block copy in gfs2_before_commit() Greg Kroah-Hartman
` (205 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 85e8c5f933ee3dbc9d061e121237797e9fa05315 ]
The RPN/NRPN conversion in fill_rpn() is supposed to return the number
of bytes of the resultant UMP packet, but it returns boolean values.
This would result in the incorrect ump_bytes in the converter, which
will confuse stream processing. Correct to the right value 8 as a MIDI
2.0 UMP packet.
Fixes: e6ce8a28c768 ("ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception")
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261015075439.50088-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/ump_convert.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/core/ump_convert.c b/sound/core/ump_convert.c
index 85cc67de63306..0a7972d91ec52 100644
--- a/sound/core/ump_convert.c
+++ b/sound/core/ump_convert.c
@@ -323,7 +323,7 @@ static int fill_rpn(struct ump_cvt_to_ump_bank *cc,
cc->cc_data_lsb);
reset_rpn(cc);
- return 1;
+ return 8;
}
/* convert to a MIDI 1.0 Channel Voice message */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0794/1257] gfs2: fix the escaped block copy in gfs2_before_commit()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (792 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0793/1257] ALSA: ump: Correct return size of fill_rpn() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0795/1257] spi: jcore: fix divide-by-zero when speed_hz is zero Greg Kroah-Hartman
` (204 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tal Zussman, Andreas Gruenbacher,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tal Zussman <tz2294@columbia.edu>
[ Upstream commit 1a4aeb6d6a08af1a2e2c52c84170561625819377 ]
Commit d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where
appropriate") made the escaped buffer copy read from the mempool page
it had just allocated instead of from the buffer, so the block written
to the log is whatever the pool page last held. If the journal is
replayed after a crash, the block is restored from that and the file's
data is corrupted. Only escaped buffers are affected: jdata blocks
whose first four bytes match GFS2_MAGIC. Copy from the buffer's folio
instead.
Fixes: d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where appropriate")
Cc: stable@vger.kernel.org
Signed-off-by: Tal Zussman <tz2294@columbia.edu>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/lops.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 6dabe73ad790d..b8c9024c9fede 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -689,7 +689,9 @@ static void gfs2_before_commit(struct gfs2_sbd *sdp, unsigned int limit,
page = mempool_alloc(gfs2_page_pool, GFP_NOIO);
p = page_address(page);
- memcpy_from_page(p, page, bh_offset(bd2->bd_bh), bd2->bd_bh->b_size);
+ memcpy_from_folio(p, bd2->bd_bh->b_folio,
+ bh_offset(bd2->bd_bh),
+ bd2->bd_bh->b_size);
*(__be32 *)p = 0;
clear_buffer_escaped(bd2->bd_bh);
unlock_buffer(bd2->bd_bh);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0795/1257] spi: jcore: fix divide-by-zero when speed_hz is zero
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (793 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0794/1257] gfs2: fix the escaped block copy in gfs2_before_commit() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0796/1257] efi/libstub: arm64: Dont use the platform register x18 Greg Kroah-Hartman
` (203 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanglei Zhu, Weibin Liu, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit 7db773075501248893c22b11bedc6745d6d0be45 ]
jcore_spi_baudrate() computes hw->clock_freq / 2 / speed without
validating speed. The SPI core fills transfer.speed_hz from
spi->max_speed_hz when it is zero, and jcore_spi_probe() never sets
host->max_speed_hz, so the clamp in __spi_setup() is skipped. A
spi_device created via the sysfs new_device interface (or a DT node
without spi-max-frequency) therefore has max_speed_hz == 0, and any
SPI_IOC_MESSAGE transfer reaches jcore_spi_baudrate() with speed == 0,
causing a division by zero and a kernel panic.
Clamp speed to a minimum of 1 Hz before the division so the divisor is
never zero. The computed divider then truncates to the register field
width and the transfer simply runs at the slowest supported rate.
Verified by inspection of the __spi_setup() clamp and
__spi_validate()'s speed_hz handling; the division-by-zero path
requires the J-Core controller, which was not available.
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Fixes: 2cb1b3b3ac0a ("spi: add driver for J-Core SPI controller")
Cc: stable@vger.kernel.org # 4.9+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261014-spi-jcore-divzero-v1-1-a8205d30f2d1@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-jcore.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/spi/spi-jcore.c b/drivers/spi/spi-jcore.c
index a75cd61ec7a33..fc87ad98e4e7d 100644
--- a/drivers/spi/spi-jcore.c
+++ b/drivers/spi/spi-jcore.c
@@ -84,6 +84,8 @@ static void jcore_spi_baudrate(struct jcore_spi *hw, int speed)
{
if (speed == hw->speed_hz)
return;
+ if (speed <= 0)
+ speed = 1;
hw->speed_hz = speed;
if (speed >= hw->clock_freq / 2)
hw->speed_reg = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0796/1257] efi/libstub: arm64: Dont use the platform register x18
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (794 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0795/1257] spi: jcore: fix divide-by-zero when speed_hz is zero Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0797/1257] efi/libstub: Dont replace an existing LINUX_EFI_MEMRESERVE table Greg Kroah-Hartman
` (202 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit 4c86b5f3fa78347fa9cbc9e8ec06615b2f80e397 ]
The UEFI specification designates x18, the platform register, as "do not
use" on AArch64, so that UEFI code is compatible both with an OS that
assigns a fixed role to x18, and with one that uses it as a temporary
register.
The arm64 EFI stub and the EFI zboot decompressor only avoid x18 if the
kernel is built with shadow call stacks, as that is the only case where
-ffixed-x18 is added to KBUILD_CFLAGS, which the stub inherits.
Otherwise, the compiler is free to use x18 as a temporary register, and
it does so.
So pass -ffixed-x18 unconditionally when building the stub for arm64,
so that the image can be run by loaders that rely on x18 being left
alone, such as a kernel that uses it for its shadow call stack.
Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/libstub/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 77a2b2d74f3f6..48982d05c441e 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -21,7 +21,7 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ $(CC_FLAGS_DIALECT) \
# arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly
# disable the stackleak plugin
-cflags-$(CONFIG_ARM64) += -fpie $(DISABLE_KSTACK_ERASE) \
+cflags-$(CONFIG_ARM64) += -fpie $(DISABLE_KSTACK_ERASE) -ffixed-x18 \
-fno-unwind-tables -fno-asynchronous-unwind-tables
cflags-$(CONFIG_ARM) += -DEFI_HAVE_STRLEN -DEFI_HAVE_STRNLEN \
-DEFI_HAVE_MEMCHR -DEFI_HAVE_STRRCHR \
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0797/1257] efi/libstub: Dont replace an existing LINUX_EFI_MEMRESERVE table
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (795 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0796/1257] efi/libstub: arm64: Dont use the platform register x18 Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0798/1257] KVM: arm64: nv: Move L2->L1 switch on interrupt early Greg Kroah-Hartman
` (201 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit aaf3ed0f46298e18ec8bc477cf0a37478e41f2ea ]
The LINUX_EFI_MEMRESERVE table is the root of a linked list of memory
reservations that need to persist across kexec, such as the GICv3 LPI
pending and property tables, which cannot be moved once the
redistributors have been enabled. Each kernel adds its own reservations
to the list that it finds via the EFI configuration table, and honours
the ones made by its predecessors.
The EFI stub installs a new, empty table unconditionally, replacing any
existing one. This is fine on a cold boot, but not if the stub is being
executed by a loader that passes on the configuration tables of an
earlier kernel, e.g., a kexec loader that runs the incoming kernel's EFI
stub, as the reservations made by earlier kernels would be lost.
So leave an existing table in place, and only install a new one if none
exists yet.
Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/libstub/efi-stub.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/firmware/efi/libstub/efi-stub.c b/drivers/firmware/efi/libstub/efi-stub.c
index 42d6073bcd062..a4cb39656b031 100644
--- a/drivers/firmware/efi/libstub/efi-stub.c
+++ b/drivers/firmware/efi/libstub/efi-stub.c
@@ -83,6 +83,14 @@ static void install_memreserve_table(void)
efi_guid_t memreserve_table_guid = LINUX_EFI_MEMRESERVE_TABLE_GUID;
efi_status_t status;
+ /*
+ * If an earlier boot stage installed a memreserve table already, e.g.,
+ * a kexec loader passing on the persistent reservations made by the
+ * previous kernel, use it as is: installing a new one would replace it.
+ */
+ if (get_efi_config_table(memreserve_table_guid))
+ return;
+
status = efi_bs_call(allocate_pool, EFI_LOADER_DATA, sizeof(*rsv),
(void **)&rsv);
if (status != EFI_SUCCESS) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0798/1257] KVM: arm64: nv: Move L2->L1 switch on interrupt early
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (796 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0797/1257] efi/libstub: Dont replace an existing LINUX_EFI_MEMRESERVE table Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0799/1257] KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved Greg Kroah-Hartman
` (200 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fuad Tabba, Marc Zyngier,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit 21d3b33234ebbb675c2a2a0fa7b12d2d83953d7a ]
NV request generation to switch from L2 to L1 on interrupt is buried
into the vgic flush code, while we should be able to deliver requests
as early as possible.
Similarly, MI generation happens *after* the need for a request has been
evaluated, which means we potentially delay the maintenance interrupt by
a full exit/entry cycle.
Move these two things to happen much earlier in the entry code, and make
sure the MI generation and PMU interrupt serve as input to the request
switching back from L2 to L1.
Cc: stable@vger.kernel.org
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261015100539.1011760-2-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/arm.c | 4 ++--
arch/arm64/kvm/nested.c | 8 ++++++++
arch/arm64/kvm/vgic/vgic.c | 8 +-------
3 files changed, 11 insertions(+), 9 deletions(-)
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 0576c2022ef57..73706464d2653 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1314,11 +1314,11 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
*/
preempt_disable();
- kvm_nested_flush_hwstate(vcpu);
-
if (kvm_vcpu_has_pmu(vcpu))
kvm_pmu_flush_hwstate(vcpu);
+ kvm_nested_flush_hwstate(vcpu);
+
local_irq_disable();
kvm_vgic_flush_hwstate(vcpu);
diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
index 41253fe45941c..bbd7042082b68 100644
--- a/arch/arm64/kvm/nested.c
+++ b/arch/arm64/kvm/nested.c
@@ -2045,6 +2045,9 @@ void check_nested_vcpu_requests(struct kvm_vcpu *vcpu)
*
* What follows is some slop to (1) react to exception routing / masking and (2)
* preserve the pending SError state across translation regimes.
+ *
+ * Also generate the maintenance interrupt state, and finally check that if
+ * we need to take an interrupt targetting the guest hypervisor.
*/
void kvm_nested_flush_hwstate(struct kvm_vcpu *vcpu)
{
@@ -2053,6 +2056,11 @@ void kvm_nested_flush_hwstate(struct kvm_vcpu *vcpu)
if (unlikely(vcpu_test_and_clear_flag(vcpu, NESTED_SERROR_PENDING)))
kvm_inject_serror_esr(vcpu, vcpu_get_vsesr(vcpu));
+
+ vgic_v3_nested_update_mi(vcpu);
+
+ if (vgic_state_is_nested(vcpu) && kvm_vgic_vcpu_pending_irq(vcpu))
+ kvm_make_request(KVM_REQ_GUEST_HYP_IRQ_PENDING, vcpu);
}
void kvm_nested_sync_hwstate(struct kvm_vcpu *vcpu)
diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c
index 5cf5a1ef86cdd..7061b4ab206c9 100644
--- a/arch/arm64/kvm/vgic/vgic.c
+++ b/arch/arm64/kvm/vgic/vgic.c
@@ -1152,7 +1152,7 @@ void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
*
* We do that by placing a request to ourselves which will
* abort the entry procedure and inject the exception at the
- * beginning of the run loop.
+ * beginning of the run loop (see kvm_nested_flush_hwstate()).
*
* - Otherwise, do exactly *NOTHING* apart from enabling the virtual
* CPU interface. The guest state is already loaded, and we can
@@ -1162,16 +1162,10 @@ void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
* maintenance interrupt state, as it may fire.
*/
if (vgic_state_is_nested(vcpu)) {
- if (kvm_vgic_vcpu_pending_irq(vcpu))
- kvm_make_request(KVM_REQ_GUEST_HYP_IRQ_PENDING, vcpu);
-
vgic_v3_flush_nested(vcpu);
return;
}
- if (vcpu_has_nv(vcpu))
- vgic_v3_nested_update_mi(vcpu);
-
DEBUG_SPINLOCK_BUG_ON(!irqs_disabled());
vgic_flush_state(vcpu);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0799/1257] KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (797 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0798/1257] KVM: arm64: nv: Move L2->L1 switch on interrupt early Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0800/1257] KVM: arm64: Move IN_GUEST_MODE ahead of state being loaded Greg Kroah-Hartman
` (199 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fuad Tabba, Marc Zyngier,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit 1d4ce2901f1e25b06d447c0b02d105d6dd3550d8 ]
OUTSIDE_GUEST_MODE indicates to the rest of KVM that the vcpu has
exited. So far, this is set as soon as we return from the notional
hypervisor (which with VHE is just a function call away).
However, code that uses OUTSIDE_GUEST_MODE as a synchronisation point
relies on the vcpu state to have been written back to the in-memory
structures. Clearly, this is not what is happening.
Move the publication of OUTSIDE_GUEST_MODE to the point where the state
is actually written, and give this write release semantics to ensure the
correct ordering.
Cc: stable@vger.kernel.org
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261015100539.1011760-3-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/arm.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 73706464d2653..7ce9f3bfa7fff 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1334,13 +1334,13 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
smp_store_mb(vcpu->mode, IN_GUEST_MODE);
if (ret <= 0 || kvm_vcpu_exit_request(vcpu, &ret)) {
- vcpu->mode = OUTSIDE_GUEST_MODE;
isb(); /* Ensure work in x_flush_hwstate is committed */
if (kvm_vcpu_has_pmu(vcpu))
kvm_pmu_sync_hwstate(vcpu);
if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
kvm_timer_sync_user(vcpu);
kvm_vgic_sync_hwstate(vcpu);
+ smp_store_release(&vcpu->mode, OUTSIDE_GUEST_MODE);
local_irq_enable();
preempt_enable();
continue;
@@ -1356,7 +1356,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
ret = kvm_arm_vcpu_enter_exit(vcpu);
- vcpu->mode = OUTSIDE_GUEST_MODE;
vcpu->stat.exits++;
/*
* Back from guest
@@ -1390,6 +1389,13 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
kvm_arch_vcpu_ctxsync_fp(vcpu);
+ /*
+ * The state that was pushed into the CPU on entering
+ * the guest has been synchronised back, let's
+ * advertise we're outside of the guest.
+ */
+ smp_store_release(&vcpu->mode, OUTSIDE_GUEST_MODE);
+
/*
* We must ensure that any pending interrupts are taken before
* we exit guest timing so that timer ticks are accounted as
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0800/1257] KVM: arm64: Move IN_GUEST_MODE ahead of state being loaded
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (798 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0799/1257] KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0801/1257] KVM: arm64: Turn vcpu->arch.pause into a counter Greg Kroah-Hartman
` (198 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fuad Tabba, Marc Zyngier,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit 22b6557ad05bf05c73246f62c19af3e04017270e ]
IN_GUEST_MODE is advertised too late, when state has already been moved
onto CPU registers and cannot be observed by another CPU anymore.
Move the IN_GUEST_MODE publication ahead of the state being loaded, and
immediately check for pending request. This ensures that there is no
window of opportunity for another CPU to observe OUTSIDE_GUEST_MODE and
yet for state to be loaded.
This also simplifies the "state rollback", which solely amounts to
synchronising the timer when no irqchip is present.
Cc: stable@vger.kernel.org
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261015100539.1011760-4-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/arm.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 7ce9f3bfa7fff..cadc82ba5a5a0 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1321,31 +1321,33 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
local_irq_disable();
- kvm_vgic_flush_hwstate(vcpu);
-
- kvm_pmu_update_vcpu_events(vcpu);
-
/*
* Ensure we set mode to IN_GUEST_MODE after we disable
* interrupts and before the final VCPU requests check.
* See the comment in kvm_vcpu_exiting_guest_mode() and
* Documentation/virt/kvm/vcpu-requests.rst
+ *
+ * Requests to self must be posted before this point, or
+ * won't be taken into account until the next exit. No state
+ * loading other than what happens at vcpu_load() time can
+ * be done before we have checked for pending requests.
*/
smp_store_mb(vcpu->mode, IN_GUEST_MODE);
if (ret <= 0 || kvm_vcpu_exit_request(vcpu, &ret)) {
- isb(); /* Ensure work in x_flush_hwstate is committed */
- if (kvm_vcpu_has_pmu(vcpu))
- kvm_pmu_sync_hwstate(vcpu);
if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
kvm_timer_sync_user(vcpu);
- kvm_vgic_sync_hwstate(vcpu);
smp_store_release(&vcpu->mode, OUTSIDE_GUEST_MODE);
local_irq_enable();
preempt_enable();
continue;
}
+ /* From here onwards, we are commited to entering the guest */
+ kvm_vgic_flush_hwstate(vcpu);
+
+ kvm_pmu_update_vcpu_events(vcpu);
+
kvm_arch_vcpu_ctxflush_fp(vcpu);
/**************************************************************
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0801/1257] KVM: arm64: Turn vcpu->arch.pause into a counter
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (799 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0800/1257] KVM: arm64: Move IN_GUEST_MODE ahead of state being loaded Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0802/1257] spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer Greg Kroah-Hartman
` (197 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fuad Tabba, Marc Zyngier,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit e64309198eda29415a95113def92aa40196cd422 ]
We have situations where we can call kvm_arm_halt_guest() without
holding config_lock, which means that halt and resume can overlap in
funny ways when called from separate contexts, and result in situations
where a vcpu is resumed while other parts of KVM assume it is halted.
Consequences are left to the imagination of the reader.
Fix this sorry situation by turning kvm_vcpu_arch::pause into an
atomic counter, which makes the races described above harmless.
Fixes: 3b92830ad41b2 ("KVM: arm/arm64: implement kvm_arm_[halt,resume]_guest")
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261015100539.1011760-5-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/kvm_host.h | 7 +++----
arch/arm64/kvm/arm.c | 21 ++++++++++++---------
2 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index cd9b9d2462f96..9c068f27f9b8a 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -889,11 +889,10 @@ struct kvm_vcpu_arch {
/*
* Don't run the guest (internal implementation need).
*
- * Contrary to the flags above, this is set/cleared outside of
- * a vcpu context, and thus cannot be mixed with the flags
- * themselves (or the flag accesses need to be made atomic).
+ * Contrary to the flags above, this is updated outside of
+ * a vcpu context, and thus cannot be mixed with the flags.
*/
- bool pause;
+ atomic_t pause;
/*
* We maintain more than a single set of debug registers to support
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index cadc82ba5a5a0..9b773ab0b51d5 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -565,6 +565,7 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
kvm_arm_pvtime_vcpu_init(&vcpu->arch);
vcpu->arch.hw_mmu = &vcpu->kvm->arch.mmu;
+ atomic_set(&vcpu->arch.pause, 0);
/*
* This vCPU may have been created after mpidr_data was initialized.
@@ -839,6 +840,11 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
return ret;
}
+static bool vcpu_can_run(struct kvm_vcpu *vcpu)
+{
+ return !kvm_arm_vcpu_stopped(vcpu) && !atomic_read(&vcpu->arch.pause);
+}
+
/**
* kvm_arch_vcpu_runnable - determine if the vcpu can be scheduled
* @v: The VCPU pointer
@@ -854,8 +860,7 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *v)
(kvm_timer_should_notify_user(v) ||
kvm_pmu_should_notify_user(v)));
- return ((irq_lines || kvm_vgic_vcpu_pending_irq(v))
- && !kvm_arm_vcpu_stopped(v) && !v->arch.pause);
+ return ((irq_lines || kvm_vgic_vcpu_pending_irq(v)) && vcpu_can_run(v));
}
bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
@@ -1018,7 +1023,7 @@ void kvm_arm_halt_guest(struct kvm *kvm)
struct kvm_vcpu *vcpu;
kvm_for_each_vcpu(i, vcpu, kvm)
- vcpu->arch.pause = true;
+ atomic_inc(&vcpu->arch.pause);
kvm_make_all_cpus_request(kvm, KVM_REQ_SLEEP);
}
@@ -1028,8 +1033,8 @@ void kvm_arm_resume_guest(struct kvm *kvm)
struct kvm_vcpu *vcpu;
kvm_for_each_vcpu(i, vcpu, kvm) {
- vcpu->arch.pause = false;
- __kvm_vcpu_wake_up(vcpu);
+ if (atomic_dec_and_test(&vcpu->arch.pause))
+ __kvm_vcpu_wake_up(vcpu);
}
}
@@ -1037,11 +1042,9 @@ static void kvm_vcpu_sleep(struct kvm_vcpu *vcpu)
{
struct rcuwait *wait = kvm_arch_vcpu_get_wait(vcpu);
- rcuwait_wait_event(wait,
- (!kvm_arm_vcpu_stopped(vcpu)) && (!vcpu->arch.pause),
- TASK_INTERRUPTIBLE);
+ rcuwait_wait_event(wait, vcpu_can_run(vcpu), TASK_INTERRUPTIBLE);
- if (kvm_arm_vcpu_stopped(vcpu) || vcpu->arch.pause) {
+ if (!vcpu_can_run(vcpu)) {
/* Awaken to handle a signal, request we sleep again later. */
kvm_make_request(KVM_REQ_SLEEP, vcpu);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0802/1257] spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (800 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0801/1257] KVM: arm64: Turn vcpu->arch.pause into a counter Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0803/1257] mfd: bq257xx: Mark self-modifying BQ25792 registers volatile Greg Kroah-Hartman
` (196 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanglei Zhu, Weibin Liu, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit f0be928a41384ea93c876364f360779f70359249 ]
npcm_fiu_uma_read() and npcm_fiu_uma_write() use a 16-byte on-stack
staging buffer (u32 data_reg[4]) and move data_size bytes to or from
it. data_size comes straight from op->data.nbytes, which is supplied
by the SPI MEM operation and is not bounded by the driver:
npcm_fiu_exec_op() only validates op->addr.nbytes, and no
adjust_op_size callback truncates the transfer to the controller FIFO
size.
A SPI MEM operation with addr.nbytes == 0 and data.nbytes > 16
therefore overflows data_reg[] on the kernel stack (write path) or
reads past it (read path), corrupting the stack.
Reject data_size larger than the staging buffer in both UMA helpers
by returning -EOPNOTSUPP, so spi_mem falls back to the generic SPI
message path. The chunked path in npcm_fiu_manualwrite() always passes
at most CHUNK_SIZE bytes, so it is unaffected.
Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver")
Cc: stable@vger.kernel.org # 5.4+
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261015-npcm-fiu-uma-datasize-v1-1-7dee91cadee6@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-npcm-fiu.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c
index 96dfef4d90674..9c0a655a54b37 100644
--- a/drivers/spi/spi-npcm-fiu.c
+++ b/drivers/spi/spi-npcm-fiu.c
@@ -343,6 +343,10 @@ static int npcm_fiu_uma_read(struct spi_mem *mem,
u32 val;
u32 i;
+ /* data_reg holds at most 16 bytes */
+ if (data_size > sizeof(data_reg))
+ return -EOPNOTSUPP;
+
regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CTS,
NPCM_FIU_UMA_CTS_DEV_NUM,
(spi_get_chipselect(mem->spi, 0) <<
@@ -398,6 +402,10 @@ static int npcm_fiu_uma_write(struct spi_mem *mem,
u32 val;
u32 i;
+ /* data_reg holds at most 16 bytes */
+ if (data_size > sizeof(data_reg))
+ return -EOPNOTSUPP;
+
regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CTS,
NPCM_FIU_UMA_CTS_DEV_NUM,
(spi_get_chipselect(mem->spi, 0) <<
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0803/1257] mfd: bq257xx: Mark self-modifying BQ25792 registers volatile
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (801 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0802/1257] spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0804/1257] cxl/events: Test CME counter expiry with equality, not bitwise AND Greg Kroah-Hartman
` (195 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexey Charkov, Lee Jones,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Charkov <alchark@flipper.net>
[ Upstream commit 56d974f3ad074a60bf877d131eab8b1df5b4f069 ]
Some BQ25792 configuration registers change without being written: input
source detection sets VINDPM and IINDPM at plug-in, plug-in also clears
EN_HIZ, the FORCE_* bits clear once their operation starts or completes,
EN_ACDRV1/2 follow input path changes, and ADC_EN clears after a one-shot
conversion. Reading them from the cache returns stale values.
Mark these registers volatile, keeping the cache for the rest.
Cc: stable@vger.kernel.org
Fixes: 9adbe53e32cd ("mfd: bq257xx: Add BQ25792 support")
Signed-off-by: Alexey Charkov <alchark@flipper.net>
Link: https://patch.msgid.link/20261001-bq25792-volatile-v1-1-cb3d4ec8a414@flipper.net
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/bq257xx.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/mfd/bq257xx.c b/drivers/mfd/bq257xx.c
index 054342c60b731..01f5fc97f5385 100644
--- a/drivers/mfd/bq257xx.c
+++ b/drivers/mfd/bq257xx.c
@@ -52,8 +52,18 @@ static const struct regmap_access_table bq25792_writeable_regs = {
};
static const struct regmap_range bq25792_volatile_reg_ranges[] = {
+ regmap_reg_range(BQ25792_REG05_INPUT_VOLTAGE_LIMIT,
+ BQ25792_REG06_INPUT_CURRENT_LIMIT + 1),
+ regmap_reg_range(BQ25792_REG0F_CHARGER_CONTROL_0,
+ BQ25792_REG0F_CHARGER_CONTROL_0),
+ regmap_reg_range(BQ25792_REG11_CHARGER_CONTROL_2,
+ BQ25792_REG11_CHARGER_CONTROL_2),
+ regmap_reg_range(BQ25792_REG13_CHARGER_CONTROL_4,
+ BQ25792_REG13_CHARGER_CONTROL_4),
regmap_reg_range(BQ25792_REG19_ICO_CURRENT_LIMIT,
BQ25792_REG27_FAULT_FLAG_1),
+ regmap_reg_range(BQ25792_REG2E_ADC_CONTROL,
+ BQ25792_REG2E_ADC_CONTROL),
regmap_reg_range(BQ25792_REG31_IBUS_ADC,
BQ25792_REG47_DPDM_DRIVER),
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0804/1257] cxl/events: Test CME counter expiry with equality, not bitwise AND
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (802 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0803/1257] mfd: bq257xx: Mark self-modifying BQ25792 registers volatile Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0805/1257] mfd: tps65217: Fix NULL pointer dereference on IRQ init failure Greg Kroah-Hartman
` (194 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guixin Liu, Dave Jiang,
Jonathan Cameron, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit b94ba9a1f2d5c57f2eec67d502bb8fdd1e53c87a ]
The Memory Event Type field in the General Media and DRAM event records
is an enumeration, not a bitmask. The validity checks for the advanced
programmable CME counter expiration event (05h) test the field with a
bitwise AND, so types 01h, 03h, 04h and 06h match it as well.
A device reporting one of those types trips WARN_ON_ONCE once the
general media or DRAM tracepoint is enabled, which is the case anywhere
rasdaemon collects CXL events. Under panic_on_warn=1 that kills the
machine.
Compare the type field for equality instead. Type 05h records that do
violate the spec conditions still warn.
Fixes: cd3b36cfc659 ("cxl/events: Add extra validity checks for corrected memory error count in General Media Event Record")
Fixes: d8145bb8af5c ("cxl/events: Add extra validity checks for CVME count in DRAM Event Record")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Link: https://patch.msgid.link/20260922082214.3526355-1-kanie@linux.alibaba.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/mbox.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
index 55828a836c01a..01341f524a937 100644
--- a/drivers/cxl/core/mbox.c
+++ b/drivers/cxl/core/mbox.c
@@ -942,11 +942,11 @@ void cxl_event_trace_record(struct cxl_memdev *cxlmd,
if (evt->gen_media.media_hdr.descriptor &
CXL_GMER_EVT_DESC_THRESHOLD_EVENT)
- WARN_ON_ONCE((evt->gen_media.media_hdr.type &
+ WARN_ON_ONCE((evt->gen_media.media_hdr.type ==
CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE) &&
!get_unaligned_le24(evt->gen_media.cme_count));
else
- WARN_ON_ONCE(evt->gen_media.media_hdr.type &
+ WARN_ON_ONCE(evt->gen_media.media_hdr.type ==
CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE);
trace_cxl_general_media(cxlmd, type, cxlr, hpa,
@@ -957,11 +957,11 @@ void cxl_event_trace_record(struct cxl_memdev *cxlmd,
if (evt->dram.media_hdr.descriptor &
CXL_GMER_EVT_DESC_THRESHOLD_EVENT)
- WARN_ON_ONCE((evt->dram.media_hdr.type &
+ WARN_ON_ONCE((evt->dram.media_hdr.type ==
CXL_DER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE) &&
!get_unaligned_le24(evt->dram.cvme_count));
else
- WARN_ON_ONCE(evt->dram.media_hdr.type &
+ WARN_ON_ONCE(evt->dram.media_hdr.type ==
CXL_DER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE);
trace_cxl_dram(cxlmd, type, cxlr, hpa, hpa_alias,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0805/1257] mfd: tps65217: Fix NULL pointer dereference on IRQ init failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (803 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0804/1257] cxl/events: Test CME counter expiry with equality, not bitwise AND Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0806/1257] mfd: tps65217: Check return value when masking interrupt sources Greg Kroah-Hartman
` (193 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Radiy Zhambakiev, Andreas Kemnade,
Lee Jones, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
[ Upstream commit 0473a5b0663663b75573bf284beb77459e07c461 ]
tps65217_probe() ignores the return value of tps65217_irq_init(), so
when the irq domain creation fails the probe still completes and the
driver ends up bound with a NULL tps->irq_domain. Unloading the
module then makes tps65217_remove() call irq_domain_remove() on the
NULL pointer and oops the kernel. On top of that, irq_find_mapping()
may fall back to the default irq domain and dispose of mappings that
belong to other interrupt controllers.
Check the return value and abort the probe on failure so the error
is reported and no inconsistent state is left for removal.
Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20261002113624.178588-2-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/tps65217.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index c240fac0ede76..2d04d9e0ae29c 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -333,7 +333,9 @@ static int tps65217_probe(struct i2c_client *client)
}
if (client->irq) {
- tps65217_irq_init(tps, client->irq);
+ ret = tps65217_irq_init(tps, client->irq);
+ if (ret)
+ return ret;
} else {
int i;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0806/1257] mfd: tps65217: Check return value when masking interrupt sources
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (804 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0805/1257] mfd: tps65217: Fix NULL pointer dereference on IRQ init failure Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0807/1257] mfd: tps65217: Use devres for IRQ domain and wake teardown Greg Kroah-Hartman
` (192 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Radiy Zhambakiev, Lee Jones,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
[ Upstream commit 66ed12c1e5a986bee1dc63f9bd9c7f068138a69a ]
tps65217_irq_init() ignores the error returned by
tps65217_set_bits() when masking all interrupt sources. A failed
register write leaves the driver's software mask out of sync with the
hardware and may result in spurious interrupts.
Check the return value and propagate the error to the caller.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Link: https://patch.msgid.link/20261002113624.178588-3-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/tps65217.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index 2d04d9e0ae29c..ee640e3fcf7b4 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -155,8 +155,12 @@ static int tps65217_irq_init(struct tps65217 *tps, int irq)
/* Mask all interrupt sources */
tps->irq_mask = TPS65217_INT_MASK;
- tps65217_set_bits(tps, TPS65217_REG_INT, TPS65217_INT_MASK,
- TPS65217_INT_MASK, TPS65217_PROTECT_NONE);
+ ret = tps65217_set_bits(tps, TPS65217_REG_INT, TPS65217_INT_MASK,
+ TPS65217_INT_MASK, TPS65217_PROTECT_NONE);
+ if (ret) {
+ dev_err(tps->dev, "Failed to mask interrupt sources: %d\n", ret);
+ return ret;
+ }
tps->irq_domain = irq_domain_create_linear(dev_fwnode(tps->dev), TPS65217_NUM_IRQ,
&tps65217_irq_domain_ops, tps);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0807/1257] mfd: tps65217: Use devres for IRQ domain and wake teardown
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (805 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0806/1257] mfd: tps65217: Check return value when masking interrupt sources Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0808/1257] ASoC: qcom: q6apm-dai: wrap the position of a full ring to 0 Greg Kroah-Hartman
` (191 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Radiy Zhambakiev, Lee Jones,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
[ Upstream commit cffd44d2d89524e2dda6adc7b0dd59363be1c8e6 ]
Removing the parent device used to tear the IRQ domain down in
tps65217_remove() before the MFD children are unbound: the i2c core
only releases the parent's devres after the remove callback returns,
whereas devm_mfd_add_devices() registered its own devres action which
unbinds the children. Children that requested interrupts from the
domain (e.g. tps65217-charger) therefore call free_irq() on virtual
IRQs whose descriptors have already been disposed. With
CONFIG_SPARSE_IRQ free_irq() then returns early without stopping the
threaded handler, leaking the irqaction, the IRQ kthread and a module
reference.
Register the domain teardown as a devres action right after the domain
is created instead. Devres actions are released in reverse order of
registration, so the MFD children release their IRQs first, then the
parent interrupt is freed and its thread stopped, and only then is the
domain torn down. The same ordering covers probe failure, which no
longer needs manual cleanup, and the remove callback can be dropped
entirely.
Balance the enable_irq_wake() in tps65217_irq_init() by registering
disable_irq_wake() as a devres action as well. Only do so when
enabling actually succeeded, since the parent chip may not support
setting wake-up.
Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Link: https://patch.msgid.link/20261002113624.178588-4-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/tps65217.c | 57 +++++++++++++++++++++++++++++-------------
1 file changed, 39 insertions(+), 18 deletions(-)
diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index ee640e3fcf7b4..569c28c8b20f5 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -146,6 +146,31 @@ static const struct irq_domain_ops tps65217_irq_domain_ops = {
.map = tps65217_irq_map,
};
+static void tps65217_irq_cleanup(void *data)
+{
+ struct tps65217 *tps = data;
+ unsigned int virq;
+
+ if (!tps->irq_domain)
+ return;
+
+ for (int i = 0; i < TPS65217_NUM_IRQ; i++) {
+ virq = irq_find_mapping(tps->irq_domain, i);
+ if (virq)
+ irq_dispose_mapping(virq);
+ }
+
+ irq_domain_remove(tps->irq_domain);
+ tps->irq_domain = NULL;
+}
+
+static void tps65217_irq_wake_disable(void *data)
+{
+ unsigned long irq = (unsigned long)data;
+
+ disable_irq_wake(irq);
+}
+
static int tps65217_irq_init(struct tps65217 *tps, int irq)
{
int ret;
@@ -169,6 +194,10 @@ static int tps65217_irq_init(struct tps65217 *tps, int irq)
return -ENOMEM;
}
+ ret = devm_add_action_or_reset(tps->dev, tps65217_irq_cleanup, tps);
+ if (ret)
+ return ret;
+
ret = devm_request_threaded_irq(tps->dev, irq, NULL,
tps65217_irq_thread, IRQF_ONESHOT,
"tps65217-irq", tps);
@@ -178,7 +207,16 @@ static int tps65217_irq_init(struct tps65217 *tps, int irq)
return ret;
}
- enable_irq_wake(irq);
+ ret = enable_irq_wake(irq);
+ if (ret) {
+ dev_warn(tps->dev, "failed to enable IRQ wake: %d\n", ret);
+ return 0;
+ }
+
+ ret = devm_add_action_or_reset(tps->dev, tps65217_irq_wake_disable,
+ (void *)(unsigned long)irq);
+ if (ret)
+ return ret;
return 0;
}
@@ -379,22 +417,6 @@ static int tps65217_probe(struct i2c_client *client)
return 0;
}
-static void tps65217_remove(struct i2c_client *client)
-{
- struct tps65217 *tps = i2c_get_clientdata(client);
- unsigned int virq;
- int i;
-
- for (i = 0; i < TPS65217_NUM_IRQ; i++) {
- virq = irq_find_mapping(tps->irq_domain, i);
- if (virq)
- irq_dispose_mapping(virq);
- }
-
- irq_domain_remove(tps->irq_domain);
- tps->irq_domain = NULL;
-}
-
static const struct i2c_device_id tps65217_id_table[] = {
{"tps65217", TPS65217},
{ /* sentinel */ }
@@ -408,7 +430,6 @@ static struct i2c_driver tps65217_driver = {
},
.id_table = tps65217_id_table,
.probe = tps65217_probe,
- .remove = tps65217_remove,
};
static int __init tps65217_init(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0808/1257] ASoC: qcom: q6apm-dai: wrap the position of a full ring to 0
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (806 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0807/1257] mfd: tps65217: Use devres for IRQ domain and wake teardown Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0809/1257] ASoC: qcom: q6apm: reset the hw pointer with the fragment queue Greg Kroah-Hartman
` (190 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladyslav Tymoshchuk,
Srinivas Kandagatla, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladyslav Tymoshchuk <tvlad744@gmail.com>
[ Upstream commit 0ea3e0b196f9dcc17b40ac881a6efef06459975b ]
q6apm_dai_pointer() turns the number of period buffers the DSP has
returned in the current lap, 1..periods, into a position and reports
one frame less than that. Commit a93dad6f4e6a ("ASoC: q6apm-dai: make
use of q6apm_get_hw_pointer") added the "- 1" so that the end of the
ring is not reported as a position equal to the buffer size.
One frame short has a cost once the application stops feeding the
stream. The DSP returns the last queued buffer and the position stops
at appl_ptr - 1, so avail stays at buffer_size - 1, below the default
stop_threshold. The DSP sends nothing more as its queue is empty, so
no period interrupt comes either: ALSA never detects the underrun and
the stream stays RUNNING. A poll-driven application that missed its
last wakeup waits forever, and drain only ends on its timeout, with
-EIO. On capture, the last frame of each period is held back until
the next one.
Before that commit the position wrapped to 0 at the end of the ring.
Do that again. A full lap is the start of the ring, and
snd_pcm_update_hw_ptr0() accounts for the wrap: the position cannot
move by more than one lap between two updates, as each returned buffer
calls snd_pcm_period_elapsed() and the DSP holds at most periods
buffers.
Seen on a OnePlus Pad 3 (SM8750) with PipeWire in interrupt-driven
scheduling: after a stall the PCM sat at hw_ptr 78239, appl_ptr 78240
(avail 3839 of 3840) for two hours.
Fixes: a93dad6f4e6a ("ASoC: q6apm-dai: make use of q6apm_get_hw_pointer")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Vladyslav Tymoshchuk <tvlad744@gmail.com>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20261014162703.10172-2-tvlad744@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/qcom/qdsp6/q6apm-dai.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/sound/soc/qcom/qdsp6/q6apm-dai.c b/sound/soc/qcom/qdsp6/q6apm-dai.c
index 033197bdd8705..cac59c1015862 100644
--- a/sound/soc/qcom/qdsp6/q6apm-dai.c
+++ b/sound/soc/qcom/qdsp6/q6apm-dai.c
@@ -498,11 +498,15 @@ static snd_pcm_uframes_t q6apm_dai_pointer(struct snd_soc_component *component,
ptr = bytes_to_frames(runtime, index);
return ptr;
}
- ptr = q6apm_get_hw_pointer(prtd->graph, substream->stream) * runtime->period_size;
- if (ptr)
- return ptr - 1;
+ /*
+ * The hw pointer counts the period buffers the DSP has returned in
+ * this lap, 1..periods. A full lap is the start of the ring again:
+ * report 0 rather than one frame less, so that the position of a
+ * drained buffer reaches appl_ptr and ALSA sees the underrun.
+ */
+ ptr = q6apm_get_hw_pointer(prtd->graph, substream->stream) % runtime->periods;
- return 0;
+ return ptr * runtime->period_size;
}
static int q6apm_dai_hw_params(struct snd_soc_component *component,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0809/1257] ASoC: qcom: q6apm: reset the hw pointer with the fragment queue
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (807 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0808/1257] ASoC: qcom: q6apm-dai: wrap the position of a full ring to 0 Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0810/1257] ASoC: qcom: q6asm-dai: wrap the position of a full ring to 0 Greg Kroah-Hartman
` (189 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladyslav Tymoshchuk,
Srinivas Kandagatla, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladyslav Tymoshchuk <tvlad744@gmail.com>
[ Upstream commit 0337b8129cf676b8eb767b2a1f312955760a5460 ]
On every prepare in queue mode, q6apm_dai_prepare() frees and allocates
the fragments again, and q6apm_alloc_fragments() resets dsp_buf, so the
first buffer queued after it is the first one of the ring. The hw
pointer that q6apm_dai_pointer() reports is left as it was.
q6apm-dai used to keep its own position and cleared it in prepare.
Since commit a93dad6f4e6a ("ASoC: q6apm-dai: make use of
q6apm_get_hw_pointer") the position comes from the hw pointer, so a
stream that is prepared again, e.g. to recover from an xrun, reports
the position of the previous run until the DSP returns its first
buffer, while ALSA has reset its own pointer to 0.
Reset the hw pointer together with dsp_buf.
Fixes: a93dad6f4e6a ("ASoC: q6apm-dai: make use of q6apm_get_hw_pointer")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Vladyslav Tymoshchuk <tvlad744@gmail.com>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20261014162703.10172-3-tvlad744@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/qcom/qdsp6/q6apm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/qcom/qdsp6/q6apm.c b/sound/soc/qcom/qdsp6/q6apm.c
index f167b9dae3fa1..4467652aeb044 100644
--- a/sound/soc/qcom/qdsp6/q6apm.c
+++ b/sound/soc/qcom/qdsp6/q6apm.c
@@ -283,6 +283,7 @@ int q6apm_alloc_fragments(struct q6apm_graph *graph, unsigned int dir, phys_addr
mutex_lock(&graph->lock);
data->dsp_buf = 0;
+ atomic_set(&data->hw_ptr, 0);
if (data->buf) {
mutex_unlock(&graph->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0810/1257] ASoC: qcom: q6asm-dai: wrap the position of a full ring to 0
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (808 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0809/1257] ASoC: qcom: q6apm: reset the hw pointer with the fragment queue Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0811/1257] iommupt: Do not allow PTEs to be split when dirty logging Greg Kroah-Hartman
` (188 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladyslav Tymoshchuk,
Srinivas Kandagatla, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladyslav Tymoshchuk <tvlad744@gmail.com>
[ Upstream commit 222d04cf55bc5b4b63602454014619c78deda89a ]
Commit 44432315444c ("ASoC: qcom: q6asm-dai: use q6asm_get_hw_pointer")
took the position from the number of period buffers the DSP has
returned in the current lap, 1..periods, and reports one frame less
than that, as q6apm-dai does.
One frame short, a playback stream whose application stops feeding it
never reaches the stop threshold: the DSP returns the last queued
buffer, the position stops at appl_ptr - 1 and no period interrupt
comes any more, so ALSA never detects the underrun, the stream stays
RUNNING and drain only ends on its timeout. On capture, the last frame
of each period is held back until the next one.
Before that commit the position wrapped to 0 at the end of the ring.
Do that again, as for q6apm-dai.
Fixes: 44432315444c ("ASoC: qcom: q6asm-dai: use q6asm_get_hw_pointer")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Vladyslav Tymoshchuk <tvlad744@gmail.com>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20261014162703.10172-4-tvlad744@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/qcom/qdsp6/q6asm-dai.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c
index 4f09fdd409058..e3742663c13e3 100644
--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
+++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
@@ -485,11 +485,10 @@ static snd_pcm_uframes_t q6asm_dai_pointer(struct snd_soc_component *component,
struct q6asm_dai_rtd *prtd = runtime->private_data;
snd_pcm_uframes_t ptr;
- ptr = q6asm_get_hw_pointer(prtd->audio_client, substream->stream) * runtime->period_size;
- if (ptr)
- return ptr - 1;
+ /* a full lap of period buffers is the start of the ring again */
+ ptr = q6asm_get_hw_pointer(prtd->audio_client, substream->stream) % runtime->periods;
- return 0;
+ return ptr * runtime->period_size;
}
static int q6asm_dai_hw_params(struct snd_soc_component *component,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0811/1257] iommupt: Do not allow PTEs to be split when dirty logging
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (809 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0810/1257] ASoC: qcom: q6asm-dai: wrap the position of a full ring to 0 Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0812/1257] spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op Greg Kroah-Hartman
` (187 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samarth Narang, Jason Gunthorpe,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 04bcf84613346b973a8cc0c59238b6b5bc902688 ]
If a single PTE cannot be stored in the current bitmap that should be a
failure and reported back to userspace. Allowing a PTE to be split creates
a possibility that dirty memory will be reported as clean.
The gather must also cover the entire PTE that is being cleaned, not just
the part that fits within the bitmap.
Fix both issues by computing the full IOVA range of every PTE and using
that to update the bitmap and the gather. The bitmap code now rejects
ranges that don't fit in it, and the gather always combined ranges.
The selftest quietly relied on a bug where the CONT was split, that is why
the half page size for the mock domain saw alternating dirties. Increase
the dirty test page size to PAGE_SIZE so it still works as intended.
Cc: stable@vger.kernel.org
Fixes: 4a00f9434891 ("iommupt: Add read_and_clear_dirty op")
Reported-by: Samarth Narang <samarth.colleges@gmail.com>
Closes: https://lore.kernel.org/all/20261013165814.309255
Link: https://patch.msgid.link/r/0-v1-5bb926ff73ec+576-iommufd_dirty_jgg@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/generic_pt/iommu_pt.h | 30 +++++++------------------
tools/testing/selftests/iommu/iommufd.c | 10 ++++-----
2 files changed, 13 insertions(+), 27 deletions(-)
diff --git a/drivers/iommu/generic_pt/iommu_pt.h b/drivers/iommu/generic_pt/iommu_pt.h
index 07ec2b3ab986a..837d835e4fad8 100644
--- a/drivers/iommu/generic_pt/iommu_pt.h
+++ b/drivers/iommu/generic_pt/iommu_pt.h
@@ -240,27 +240,14 @@ struct pt_iommu_dirty_args {
};
static void record_dirty(struct pt_state *pts,
- struct pt_iommu_dirty_args *dirty,
- unsigned int num_contig_lg2)
+ struct pt_iommu_dirty_args *dirty)
{
- pt_vaddr_t dirty_len;
-
- if (num_contig_lg2 != ilog2(1)) {
- unsigned int index = pts->index;
- unsigned int end_index = log2_set_mod_max_t(
- unsigned int, pts->index, num_contig_lg2);
-
- /* Adjust for being contained inside a contiguous page */
- end_index = min(end_index, pts->end_index);
- dirty_len = (end_index - index) *
- log2_to_int(pt_table_item_lg2sz(pts));
- } else {
- dirty_len = log2_to_int(pt_table_item_lg2sz(pts));
- }
+ unsigned int lg2sz = pt_entry_oa_lg2sz(pts);
+ pt_vaddr_t start_va = log2_set_mod(pts->range->va, 0, lg2sz);
+ pt_vaddr_t dirty_len = log2_to_int(lg2sz);
if (dirty->dirty->bitmap)
- iova_bitmap_set(dirty->dirty->bitmap, pts->range->va,
- dirty_len);
+ iova_bitmap_set(dirty->dirty->bitmap, start_va, dirty_len);
if (!(dirty->flags & IOMMU_DIRTY_NO_CLEAR)) {
/*
@@ -268,8 +255,8 @@ static void record_dirty(struct pt_state *pts,
* dirty tracking bits can't work together
*/
pt_entry_make_write_clean(pts);
- iommu_iotlb_gather_add_range(dirty->dirty->gather,
- pts->range->va, dirty_len);
+ iommu_iotlb_gather_add_range(dirty->dirty->gather, start_va,
+ dirty_len);
}
}
@@ -289,8 +276,7 @@ static inline int __read_and_clear_dirty(struct pt_range *range, void *arg,
continue;
}
if (pts.type == PT_ENTRY_OA && pt_entry_is_write_dirty(&pts))
- record_dirty(&pts, dirty,
- pt_entry_num_contig_lg2(&pts));
+ record_dirty(&pts, dirty);
}
return 0;
}
diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c
index d44b34b05757e..22af28aef13b4 100644
--- a/tools/testing/selftests/iommu/iommufd.c
+++ b/tools/testing/selftests/iommu/iommufd.c
@@ -2175,9 +2175,9 @@ FIXTURE_SETUP(iommufd_dirty_tracking)
test_ioctl_ioas_alloc(&self->ioas_id);
/*
- * For dirty testing it is important that the page size fed into
- * the iommu page tables matches the size the dirty logic
- * expects, or set_dirty can touch too much stuff.
+ * Disabling huge pages maps in PAGE_SIZE units, which can span
+ * multiple contiguous MOCK_PAGE_SIZE entries. The dirty tests must
+ * expect the entire mapping to be reported dirty.
*/
cmd.object_id = self->ioas_id;
if (!variant->hugepages)
@@ -2335,7 +2335,7 @@ TEST_F(iommufd_dirty_tracking, device_dirty_capability)
TEST_F(iommufd_dirty_tracking, get_dirty_bitmap)
{
- uint32_t page_size = MOCK_PAGE_SIZE;
+ uint32_t page_size = PAGE_SIZE;
uint32_t ioas_id = self->ioas_id;
uint32_t hwpt_id;
@@ -2377,7 +2377,7 @@ TEST_F(iommufd_dirty_tracking, get_dirty_bitmap)
TEST_F(iommufd_dirty_tracking, get_dirty_bitmap_no_clear)
{
- uint32_t page_size = MOCK_PAGE_SIZE;
+ uint32_t page_size = PAGE_SIZE;
uint32_t ioas_id = self->ioas_id;
uint32_t hwpt_id;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0812/1257] spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (810 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0811/1257] iommupt: Do not allow PTEs to be split when dirty logging Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0813/1257] PCI/PM: Restore BARs after powering up during enumeration Greg Kroah-Hartman
` (186 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanglei Zhu, Weibin Liu, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit 9e44f0df3fff215d9033089e85980048c3ac132a ]
bcm_qspi_mspi_exec_mem_op() builds a local command buffer cmd[6]
holding one opcode byte, up to four address bytes and one spare
byte, and sets t[0].len = op->addr.nbytes + op->dummy.nbytes + 1.
bcm_qspi_exec_mem_op() only validates op->addr.nbytes <= 4 and never
bounds op->dummy.nbytes, which spi_mem_check_op() also leaves
unrestricted. With addr.nbytes = 4 and dummy.nbytes >= 2 the length
becomes 7 or more, so write_to_hw() reads past cmd[] on the kernel
stack and pushes the leaked bytes into the hardware TXRAM.
Reject operations whose dummy phase does not fit the remaining byte
of cmd[] by requiring op->dummy.nbytes <= 1, so such transfers fall
back to the generic SPI path instead of overrunning the buffer.
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Fixes: 5f195ee7d830c ("spi: bcm-qspi: Implement the spi_mem interface")
Cc: stable@vger.kernel.org # 4.18+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261015-bcm-qspi-dummy-bytes-v1-1-c319da3c2497@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-bcm-qspi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
index 0f96ac59da114..5031b21424795 100644
--- a/drivers/spi/spi-bcm-qspi.c
+++ b/drivers/spi/spi-bcm-qspi.c
@@ -1197,8 +1197,9 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem,
u32 addr = 0, len;
u_char *buf;
+ /* cmd[] holds 1 opcode + 4 address + 1 dummy byte at most */
if (!op->data.nbytes || !op->addr.nbytes || op->addr.nbytes > 4 ||
- op->data.dir != SPI_MEM_DATA_IN)
+ op->dummy.nbytes > 1 || op->data.dir != SPI_MEM_DATA_IN)
return -EOPNOTSUPP;
buf = op->data.buf.in;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0813/1257] PCI/PM: Restore BARs after powering up during enumeration
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (811 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0812/1257] spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0814/1257] spi: amd: fix len==0 underflow and FIFO overflow Greg Kroah-Hartman
` (185 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Rafael J. Wysocki,
Keng-Yu Lin, Bjorn Helgaas, Desnes Nunes, Sasha Levin,
Mario Limonciello (AMD)
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keng-Yu Lin <keng-yu.lin@hpe.com>
[ Upstream commit f043083843cac1105206437d8c58e725b6412fad ]
Commit 4d4c10f763d7 ("PCI: Explicitly put devices into D0 when
initializing") added pci_pm_power_up_and_verify_state() to pci_pm_init().
The helper ignores pci_power_up()'s return value indicating that BARs need
restoring. Its resume callers restore saved configuration afterwards;
pci_pm_init() does not.
D3hot-to-D0 may reset a device and lose its BARs (PCI PM 1.2, sec 5.4.1).
After enumeration powers it up, pci_enable_device() reads D0 and skips the
full power-up path. Previously, a device still in D3hot at enable time took
that path, including BAR restoration.
On AMD Venice SP7, two AMD xHCI controllers [1022:17d2] are in runtime
D3hot with No_Soft_Reset clear before kdump. Diagnostic reads on
v7.3-rc6-37 show the following for 0000:01:00.4 in the crash kernel:
PMCSR BAR0
before the platform power call 0003 f4100004
after the platform power call 0003 f4100004
after native D0 power-up 0000 00000004
The upper BAR DWORD stays zero. pci_power_up() returns 1, but the BAR
address remains zero while dev->resource[0] still contains 0xf4100000.
Without BAR restoration, the crash kernel hangs during boot. The last
console output includes:
pci 0000:01:00.4: enabling device (0000 -> 0002)
Restoring both controllers' BARs gives matching readbacks and allows kdump
to save a vmcore and reboot. An AMD Turin xHCI [1022:1557] shows the same
BAR loss; restoring its BAR also allows kdump to complete.
Read the initial power state first. Otherwise, pci_power_up() may request a
BAR restore based on a cached PCI_UNKNOWN state, even when the device is
already in D0.
For devices already in D0, only synchronize the platform state so
that ACPI calls such as _REG still run. For other states, use
pci_set_full_power_state() to power up the device and restore BARs
when needed.
Fixes: 4d4c10f763d7 ("PCI: Explicitly put devices into D0 when initializing")
Suggested-by: Mario Limonciello <mario.limonciello@amd.com>
Suggested-by: Rafael J. Wysocki <rafael@kernel.org>
Link: https://lore.kernel.org/r/CAJZ5v0ie2AvCbdv8-zkpYzHLcTwUPUj+=WWOQjDAPmSepSAQPg@mail.gmail.com/
Signed-off-by: Keng-Yu Lin <keng-yu.lin@hpe.com>
[bhelgaas: shorten comment]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> ---
Reviewed-by: Desnes Nunes <desnesn@redhat.com>
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261015020811.1132314-1-keng-yu.lin@hpe.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 38c7cb8221223..f85256413cf3d 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3262,7 +3262,15 @@ void pci_pm_init(struct pci_dev *dev)
}
poweron:
- pci_pm_power_up_and_verify_state(dev);
+ pci_update_current_state(dev, PCI_UNKNOWN);
+ if (dev->current_state == PCI_D0) {
+ /* No need for full power-up, just sync-up platform state */
+ platform_pci_set_power_state(dev, PCI_D0);
+ } else {
+ /* Power up the device and restore BARs if necessary */
+ pci_set_full_power_state(dev, false);
+ }
+ pci_update_current_state(dev, PCI_D0);
pm_runtime_forbid(&dev->dev);
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0814/1257] spi: amd: fix len==0 underflow and FIFO overflow
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (812 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0813/1257] PCI/PM: Restore BARs after powering up during enumeration Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0815/1257] erofs: use on-disk blkszbits for lz4 max pcluster bound Greg Kroah-Hartman
` (184 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanglei Zhu, Weibin Liu, Mark Brown,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit e2f4edfc061e493fddde16c4bbe1c4f230f41e4a ]
amd_spi_fifo_xfer() unconditionally decrements xfer->len when a tx_buf
is present. The SPI core does not reject zero-length transfers, so a
transfer submitted through the SPI_IOC_MESSAGE ioctl with len == 0 and
a tx_buf makes the u32 len wrap to 0xFFFFFFFF, and the following
per-byte loop writes far past the FIFO window.
The driver also never checks the cumulative FIFO offset against
AMD_SPI_FIFO_SIZE. The core splits each transfer down to the
controller's max transfer size but does not bound the total message
length, so a message of several transfers whose total exceeds the FIFO
overflows it with out-of-bounds MMIO writes (tx) and reads (rx).
Skip zero-length transfers and reject any transfer that would run past
the end of the FIFO window.
Tested with a user-space replica of the fifo_xfer length arithmetic
(ASAN build): a zero-length transfer with tx_buf makes len-- wrap to
0xffffffff, and skipping zero-length transfers avoids the wrap. No AMD
SPI hardware was available, so the FIFO bound check was verified by
inspection against AMD_SPI_FIFO_SIZE.
Fixes: bbb336f39efc ("spi: spi-amd: Add AMD SPI controller driver support")
Cc: stable@vger.kernel.org # 5.8+
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261014-spi-amd-fifo-fix-v1-1-9fec9ab753e8@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-amd.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/spi/spi-amd.c b/drivers/spi/spi-amd.c
index 71a6e5c475b03..ddf89e5353c55 100644
--- a/drivers/spi/spi-amd.c
+++ b/drivers/spi/spi-amd.c
@@ -322,11 +322,22 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
list_for_each_entry(xfer, &message->transfers,
transfer_list) {
+ /* Skip zero-length transfers to avoid len underflow below */
+ if (!xfer->len)
+ continue;
+
if (xfer->speed_hz)
amd_set_spi_freq(amd_spi, xfer->speed_hz);
else
amd_set_spi_freq(amd_spi, spi->max_speed_hz);
+ /* Reject transfers that would overflow the FIFO window */
+ if (fifo_pos + xfer->len >
+ AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) {
+ message->status = -EMSGSIZE;
+ goto fin_msg;
+ }
+
if (xfer->tx_buf) {
buf = (u8 *)xfer->tx_buf;
if (!tx_len) {
@@ -369,6 +380,12 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
list_for_each_entry(xfer, &message->transfers, transfer_list)
if (xfer->rx_buf) {
+ /* Reject transfers that would overflow the FIFO window */
+ if (fifo_pos + xfer->len >
+ AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) {
+ message->status = -EMSGSIZE;
+ goto fin_msg;
+ }
buf = (u8 *)xfer->rx_buf;
/* Read data from FIFO to receive buffer */
for (i = 0; i < xfer->len; i++)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0815/1257] erofs: use on-disk blkszbits for lz4 max pcluster bound
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (813 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0814/1257] spi: amd: fix len==0 underflow and FIFO overflow Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0816/1257] ring-buffer: Take cpus_read_lock() when changing the subbuf order Greg Kroah-Hartman
` (183 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gyokhan Kochmarla, Gao Xiang,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gyokhan Kochmarla <gyokhan@amazon.de>
[ Upstream commit 90b7e4a7a16443d9f6807b5c1dde52074d9f74c0 ]
z_erofs_load_lz4_config() rejects a valid LZ4 image when the kernel's
page size differs from the image's block size. It bounds the on-disk
max_pclusterblks with erofs_blknr(sb, Z_EROFS_PCLUSTER_MAX_SIZE), which
expands to Z_EROFS_PCLUSTER_MAX_SIZE >> sb->s_blocksize_bits.
At the point this runs, sb->s_blocksize_bits still holds PAGE_SHIFT:
erofs_fc_fill_super() seeds s_blocksize_bits to PAGE_SHIFT before
reading the superblock, and only corrects it down to the on-disk
blkszbits after erofs_read_superblock() returns. The LZ4 config is
parsed inside erofs_read_superblock(), before that correction, so the
bound is computed with the wrong shift.
On a 64K-page kernel mounting a 4K-block image (e.g. one built with
mkfs.erofs -C 262144 on a 4K-page host), the bound evaluates to
1 MiB >> 16 = 16 blocks instead of the correct 1 MiB >> 12 = 256
blocks. The image's legitimate max_pclusterblks of 64 then fails the
check, mount returns -EINVAL, and booting from such an image as the
root filesystem panics:
erofs (device dm-0): too large lz4 pclusterblks 64
Kernel panic - not syncing: VFS: Unable to mount root fs
sbi->blkszbits already holds the on-disk block size at this point, so
compute the bound from it directly. This makes the check independent of
the host page size and of superblock-parse ordering.
commit 3acea5fc3354 ("erofs: avoid hardcoded blocksize for subpage block
support") already handled the same ordering hazard for the superblock
checksum path by using sbi->blkszbits in erofs_superblock_csum_verify();
the lz4 config path was missed.
Fixes: 3acea5fc3354 ("erofs: avoid hardcoded blocksize for subpage block support")
Cc: stable@vger.kernel.org
Assisted-by: Kirocrew:gpt-5.6-sol
Signed-off-by: Gyokhan Kochmarla <gyokhan@amazon.de>
Reviewed-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/decompressor.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index d387b27c4ee21..771d862afc2ed 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -23,7 +23,7 @@ static int z_erofs_load_lz4_config(struct super_block *sb,
if (!sbi->lz4.max_pclusterblks) {
sbi->lz4.max_pclusterblks = 1; /* reserved case */
} else if (sbi->lz4.max_pclusterblks >
- erofs_blknr(sb, Z_EROFS_PCLUSTER_MAX_SIZE)) {
+ Z_EROFS_PCLUSTER_MAX_SIZE >> sbi->blkszbits) {
erofs_err(sb, "too large lz4 pclusterblks %u",
sbi->lz4.max_pclusterblks);
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0816/1257] ring-buffer: Take cpus_read_lock() when changing the subbuf order
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (814 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0815/1257] erofs: use on-disk blkszbits for lz4 max pcluster bound Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0817/1257] dax: Return errors from dax_core_init() Greg Kroah-Hartman
` (182 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Carlier, Vincent Donnefort,
Steven Rostedt, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
[ Upstream commit 453d0f47b174cac387af48d303c503b84f82212e ]
A CPU coming online for the first time gets its per CPU buffer allocated
by trace_rb_cpu_prepare(), which then adds it to buffer->cpumask. If that
happens while ring_buffer_subbuf_order_set() is running, the CPU shows up
after the allocation loop and the install loop walks it with an empty
new_pages list, corrupting the buffer.
Take cpus_read_lock() as ring_buffer_resize() does.
Cc: stable@vger.kernel.org
Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Link: https://patch.msgid.link/20260916192628.274136-1-devnexen@gmail.com
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 9c4e40847e430..1a1219b6d0fc0 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7466,6 +7466,8 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
if (psize > RB_WRITE_MASK + 1)
return -EINVAL;
+ guard(cpus_read_lock)();
+
/* prevent another thread from changing buffer sizes */
guard(mutex)(&buffer->mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0817/1257] dax: Return errors from dax_core_init()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (815 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0816/1257] ring-buffer: Take cpus_read_lock() when changing the subbuf order Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0818/1257] dax: fix dax_range_compare_iter() to use correct size and address offset Greg Kroah-Hartman
` (181 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jianyun Gao, Gregory Price (Meta),
Dave Jiang, Alison Schofield, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianyun Gao <jianyungao89@gmail.com>
[ Upstream commit 4da700e2cadf84a6e858391d5be51d64dcba080f ]
dax_core_init() returns success when either the character device
number allocation or DAX bus registration fails, even though the
error paths have already released the initialized resources.
For modular DAX, this allows the module to remain loaded despite
failed initialization, leaving subsequent users and module removal
to access resources that have already been released.
Return the error code from the failed operation so that module
loading fails rather than reporting successful initialization
after the resources have been released.
Fixes: 9567da0b408a ("device-dax: Introduce bus + driver model")
Cc: stable@vger.kernel.org
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261012151857.22534-1-jianyungao89@gmail.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dax/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index 45f84b0eb909a..210f4af479f0e 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -738,7 +738,7 @@ static int __init dax_core_init(void)
unregister_chrdev_region(dax_devt, MINORMASK+1);
err_chrdev:
dax_fs_exit();
- return 0;
+ return rc;
}
static void __exit dax_core_exit(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0818/1257] dax: fix dax_range_compare_iter() to use correct size and address offset
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (816 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0817/1257] dax: Return errors from dax_core_init() Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0819/1257] net: erspan: set lltx to avoid sch_direct_xmit deadlock Greg Kroah-Hartman
` (180 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jianyun Gao, Jan Kara,
Alison Schofield, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianyun Gao <jianyungao89@gmail.com>
[ Upstream commit a4bfbfb4e98a62b589ac7ca9e73e9612bfe8cab7 ]
dax_range_compare_iter() has two bugs in how it calls
dax_iomap_direct_access() and uses the returned addresses:
1. The size argument passed to dax_iomap_direct_access() is
ALIGN(pos + len, PAGE_SIZE), which is an absolute file offset
rather than a length. This causes the underlying dax_direct_access()
to request a massively inflated nr_pages via PHYS_PFN(size).
2. The addresses returned by dax_iomap_direct_access() are page-aligned
starting addresses, but memcmp() compares from saddr/daddr directly
without adding the page-in-page offset of pos1/pos2. When pos1/pos2
are not page-aligned, this compares the wrong data.
Fix the size by computing ALIGN(len + offset_in_page(pos), PAGE_SIZE),
matching the pattern used in dax_iomap_copy_around(). Fix the address
by adding offset_in_page(pos1)/offset_in_page(pos2) to saddr/daddr in
the memcmp() call.
Fixes: 6f7db3894ae2 ("fsdax: dedup file range to use a compare function")
Cc: stable@vger.kernel.org
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20261011064840.1296-1-jianyungao89@gmail.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dax.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/fs/dax.c b/fs/dax.c
index 1fbba0d21c13d..dbb58692efecf 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -2200,6 +2200,7 @@ static int dax_range_compare_iter(struct iomap_iter *it_src,
const struct iomap *dmap = &it_dest->iomap;
loff_t pos1 = it_src->pos, pos2 = it_dest->pos;
void *saddr, *daddr;
+ size_t size1, size2;
int id, ret;
len = min(len, min(smap->length, dmap->length));
@@ -2215,17 +2216,18 @@ static int dax_range_compare_iter(struct iomap_iter *it_src,
}
id = dax_read_lock();
- ret = dax_iomap_direct_access(smap, pos1, ALIGN(pos1 + len, PAGE_SIZE),
- &saddr, NULL);
+ size1 = ALIGN(len + offset_in_page(pos1), PAGE_SIZE);
+ ret = dax_iomap_direct_access(smap, pos1, size1, &saddr, NULL);
if (ret < 0)
goto out_unlock;
- ret = dax_iomap_direct_access(dmap, pos2, ALIGN(pos2 + len, PAGE_SIZE),
- &daddr, NULL);
+ size2 = ALIGN(len + offset_in_page(pos2), PAGE_SIZE);
+ ret = dax_iomap_direct_access(dmap, pos2, size2, &daddr, NULL);
if (ret < 0)
goto out_unlock;
- *same = !memcmp(saddr, daddr, len);
+ *same = !memcmp(saddr + offset_in_page(pos1),
+ daddr + offset_in_page(pos2), len);
if (!*same)
len = 0;
dax_read_unlock(id);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0819/1257] net: erspan: set lltx to avoid sch_direct_xmit deadlock
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (817 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0818/1257] dax: fix dax_range_compare_iter() to use correct size and address offset Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0820/1257] ublk: keep a canceled FETCH round canceling until the server is gone Greg Kroah-Hartman
` (179 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+9bda1b9fbb7fbdf9b62b,
Yun Zhou, Ido Schimmel, Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <yun.zhou@windriver.com>
[ Upstream commit 2d36ec73836e83175deb467fd494c61006107e5d ]
The ERSPAN xmit path re-enters the network stack, causing nested
acquisition of _xmit_lock on the underlay device while already holding
the ERSPAN device's _xmit_lock, creating an ABBA deadlock. This happens
for both IPv4 ERSPAN (erspan_xmit() -> ip_tunnel_xmit()) and IPv6 ERSPAN
(ip6erspan_tunnel_xmit() -> ip6_tnl_xmit()):
sch_direct_xmit [lock erspan] -> erspan_xmit -> ip_tunnel_xmit ->
ip_output -> __dev_queue_xmit -> sch_direct_xmit [lock underlay]
sch_direct_xmit [lock erspan] -> ip6erspan_tunnel_xmit -> ip6_tnl_xmit ->
ip6_output -> __dev_queue_xmit -> sch_direct_xmit [lock underlay]
Set dev->lltx = true so HARD_TX_LOCK() skips the spinlock for ERSPAN.
This is safe as the ERSPAN xmit path has no shared mutable state: o_seqno
is atomic, TX stats are per-CPU u64_stats, dst_cache is per-CPU, and
o_flags is no longer modified in the xmit path since commit 9958e69b9893
("gre: fix ERSPAN o_flags race/corruption in xmit and fill_info").
GRETAP, the sibling device with identical xmit structure, already sets
lltx.
Reported-by: syzbot+9bda1b9fbb7fbdf9b62b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9bda1b9fbb7fbdf9b62b
Fixes: 84e54fe0a5ea ("gre: introduce native tunnel support for ERSPAN")
Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support")
Cc: stable@vger.kernel.org # 9958e69b9893 ("gre: fix ERSPAN o_flags race/corruption in xmit and fill_info")
Cc: stable@vger.kernel.org
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261008093824.119453-1-yun.zhou@windriver.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/ip_gre.c | 1 +
net/ipv6/ip6_gre.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index e4878e9aa6367..149a4e83b6925 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1367,6 +1367,7 @@ static int erspan_tunnel_init(struct net_device *dev)
dev->features |= GRE_FEATURES;
dev->hw_features |= GRE_FEATURES;
dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+ dev->lltx = true;
netif_keep_dst(dev);
return ip_tunnel_init(dev);
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 04f7c70b7320e..3429543ec77e7 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1864,6 +1864,7 @@ static int ip6erspan_tap_init(struct net_device *dev)
dev->mtu -= 8;
dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+ dev->lltx = true;
ip6erspan_tnl_link_config(tunnel, 1);
netdev_hold(dev, &tunnel->dev_tracker, GFP_KERNEL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0820/1257] ublk: keep a canceled FETCH round canceling until the server is gone
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (818 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0819/1257] net: erspan: set lltx to avoid sch_direct_xmit deadlock Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0821/1257] ublk: mark the io command cancelable before publishing it Greg Kroah-Hartman
` (178 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Ming Lei, Jens Axboe,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <tom.leiming@gmail.com>
[ Upstream commit 4c454b5b2634d982caf797fbe477770c3edfc983 ]
A cancel completes a fetched io command and sets io->cmd to NULL, but
the io still counts as ready. Only ubq->canceling stops ublk_queue_rq()
from using the NULL io->cmd. Two paths clear that flag too early:
partial FETCH round recovery, two queues
------------------- --------------------
task A: FETCH tags 0-2 q0 ready: q0->canceling = false
task A exits: q0 task exits:
start_cancel(): mark queues start_cancel(): ub->canceling
tags 0-2: io->cmd = NULL is still set -> q0 not marked
task B: FETCH tag 3 q0: io->cmd = NULL
queue ready: canceling = false q1 ready
START_DEV END_USER_RECOVERY
read -> ublk_queue_cmd(NULL) read on q0 -> ublk_queue_cmd(NULL)
A FETCH round runs from the open of /dev/ublkcN until
ublk_reset_ch_dev() resets the queues. A canceled command can't be
fetched again in the same round. So the ready check only needs one
fact: did this round see a cancel? ub->canceling already records it:
ublk_start_cancel() sets it under cancel_mutex before any command is
taken. It is only cleared too early, when all queues are ready.
Fix:
- clear ub->canceling only in ublk_reset_ch_dev()
- when a queue gets ready, clear ubq->canceling only if ub->canceling
is not set, and check it under cancel_mutex
The check and the marking are ordered by cancel_mutex:
check first: queue cleared -> start_cancel() marks it again
-> command taken
cancel first: check sees ub->canceling -> queue stays canceling
While ub->canceling is set, no queue clears its flag. So the "all
queues marked" shortcut in ublk_start_cancel() is correct again.
UBLK_F_BATCH_IO follows the same rule. It does not dispatch through
io->cmd, so it never hit the oops, but a round which lost a fetch
command is treated the same way: it has to start over.
Fixes: 728cbac5fe21 ("ublk: move device reset into ublk_ch_release()")
Fixes: 3f3850785594 ("ublk: fix batch I/O recovery -ENODEV error")
Cc: stable@vger.kernel.org # v6.17+: needs cancel_mutex
Reported-by: Josef Bacik <josef@toxicpanda.com>
Closes: https://lore.kernel.org/linux-block/20260928-b4-ublk-cancel-stop-v1-0-4a4360232a46@toxicpanda.com/
Tested-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261011063555.1142277-2-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 54 ++++++++++++++++++++++++----------------
1 file changed, 33 insertions(+), 21 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 66eb55e7162e5..38ed7d0e39793 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -334,6 +334,11 @@ struct ublk_device {
u16 nr_queue_ready;
bool unprivileged_daemons;
struct mutex cancel_mutex;
+ /*
+ * A cancel started in this FETCH round. Set by ublk_set_canceling(),
+ * cleared only by ublk_reset_ch_dev() when a new round starts. While
+ * it is set, no queue clears its ->canceling.
+ */
bool canceling;
pid_t ublksrv_tgid;
struct delayed_work exit_work;
@@ -2415,6 +2420,11 @@ static void ublk_reset_ch_dev(struct ublk_device *ub)
spin_unlock(&ubq->cancel_lock);
}
+ /* a new FETCH round starts, the queues stay canceling until ready */
+ mutex_lock(&ub->cancel_mutex);
+ ub->canceling = false;
+ mutex_unlock(&ub->cancel_mutex);
+
/* set to NULL, otherwise new tasks cannot mmap io_cmd_buf */
ub->mm = NULL;
ub->nr_queue_ready = 0;
@@ -3024,11 +3034,19 @@ static void ublk_reset_io_flags(struct ublk_queue *ubq, struct ublk_io *io)
}
/* reset per-queue io flags */
-static void ublk_queue_reset_io_flags(struct ublk_queue *ubq)
+static void ublk_queue_reset_io_flags(struct ublk_device *ub,
+ struct ublk_queue *ubq)
{
- spin_lock(&ubq->cancel_lock);
- ubq->canceling = false;
- spin_unlock(&ubq->cancel_lock);
+ /*
+ * A cancel in this FETCH round took a command which still counts as
+ * ready, so the queue has to stay canceling. ub->canceling is set
+ * under cancel_mutex before any command is taken: either we see it
+ * here, or the cancel marks this queue again later.
+ */
+ mutex_lock(&ub->cancel_mutex);
+ if (!ub->canceling)
+ ubq->canceling = false;
+ mutex_unlock(&ub->cancel_mutex);
ubq->fail_io = false;
ubq->force_abort = false;
}
@@ -3051,24 +3069,17 @@ static void ublk_mark_io_ready(struct ublk_device *ub, u16 q_id,
ub->nr_queue_ready++;
/*
- * Reset queue flags as soon as this queue is ready.
- * This clears the canceling flag, allowing batch FETCH commands
- * to succeed during recovery without waiting for all queues.
+ * Reset queue flags as soon as this queue is ready. Unless
+ * this round saw a cancel, this clears the canceling flag,
+ * allowing batch FETCH commands to succeed during recovery
+ * without waiting for all queues.
*/
- ublk_queue_reset_io_flags(ubq);
+ ublk_queue_reset_io_flags(ub, ubq);
}
- /* Check if all queues are ready */
- if (ublk_dev_ready(ub)) {
- /*
- * All queues ready - clear device-level canceling flag
- * and wake ublk_dev_ready() waiters.
- */
- mutex_lock(&ub->cancel_mutex);
- ub->canceling = false;
- mutex_unlock(&ub->cancel_mutex);
+ /* All queues ready - wake ublk_dev_ready() waiters */
+ if (ublk_dev_ready(ub))
wake_up_var(&ub->nr_queue_ready);
- }
}
static inline int ublk_check_cmd_op(u32 cmd_op)
@@ -4433,9 +4444,10 @@ static bool ublk_validate_user_pid(struct ublk_device *ub, pid_t ublksrv_pid)
/*
* Wait until all queues have fetched their I/O commands, and return with
- * ub->mutex held and readiness guaranteed: then every queue's ->canceling
- * is cleared. Ready may regress between wakeup and mutex_lock() (F_BATCH
- * UNPREP, daemon death), so re-check it under the mutex and wait again.
+ * ub->mutex held and readiness guaranteed. The queues stay canceling if
+ * this round saw a cancel, see ublk_queue_reset_io_flags(). Ready may
+ * regress between wakeup and mutex_lock() (F_BATCH UNPREP, daemon death),
+ * so re-check it under the mutex and wait again.
*/
static int ublk_wait_dev_ready_and_lock(struct ublk_device *ub)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0821/1257] ublk: mark the io command cancelable before publishing it
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (819 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0820/1257] ublk: keep a canceled FETCH round canceling until the server is gone Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0822/1257] ublk: mark the batch fetch command cancelable before linking it Greg Kroah-Hartman
` (177 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Ming Lei, Jens Axboe,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <tom.leiming@gmail.com>
[ Upstream commit a261f0cacacc022e4fab5b8e38c59f74ce4942e8 ]
FETCH, COMMIT_AND_FETCH and NEED_GET_DATA publish the command in io->cmd
before marking it cancelable. A cancel from the control path (STOP_DEV,
QUIESCE_DEV) can complete it in between:
issue path control-path cancel
io->cmd = C
take C, io_uring_cmd_done(C):
C not marked, nothing to unlink
ublk_prep_cancel(C)
the completed C is linked on the cancelable list
ring exit: the cancel walk hits it → GPF (KASAN, with a delay added)
Mark the command before ublk_fill_io_cmd() publishes it. The handlers
run with uring_lock held, as io_uring's cancel walk does, so marking
takes no lock and the walk can't see a marked command before it is
published. smp_wmb() orders the mark before the io->cmd store; the
cancel loads cmd with READ_ONCE(io->cmd) before reading cmd->flags.
A marked command has to be completed by io_uring_cmd_done(), so a failed
FETCH and the inline UBLK_IO_RES_OK of NEED_GET_DATA now do that. The CQE
is the same.
Fixes: 216c8f5ef0f2 ("ublk: replace monitor with cancelable uring_cmd")
Cc: stable@vger.kernel.org
Tested-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261011063555.1142277-3-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 38ed7d0e39793..6015fb2fb925f 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2800,7 +2800,8 @@ static void ublk_cancel_cmd(struct ublk_queue *ubq, u16 tag,
done = !!(io->flags & UBLK_IO_FLAG_CANCELED);
if (!done) {
io->flags |= UBLK_IO_FLAG_CANCELED;
- cmd = io->cmd;
+ /* dependency ordered against smp_wmb() in ublk_prep_cancel() */
+ cmd = READ_ONCE(io->cmd);
io->cmd = NULL;
}
spin_unlock(&ubq->cancel_lock);
@@ -3163,6 +3164,12 @@ ublk_fill_io_cmd(struct ublk_io *io, struct io_uring_cmd *cmd)
return req;
}
+/*
+ * Call before ublk_fill_io_cmd() publishes @cmd in io->cmd: a control-path
+ * cancel may complete any command found there, and io_uring_cmd_done() only
+ * takes it off the cancelable list if it is marked already. The handlers
+ * hold uring_lock, so marking takes no lock.
+ */
static inline void ublk_prep_cancel(struct io_uring_cmd *cmd,
unsigned int issue_flags,
struct ublk_queue *ubq, u16 tag)
@@ -3176,6 +3183,8 @@ static inline void ublk_prep_cancel(struct io_uring_cmd *cmd,
pdu->ubq = ubq;
pdu->tag = tag;
io_uring_cmd_mark_cancelable(cmd, issue_flags);
+ /* pairs with the cancel loading cmd from io->cmd, then cmd->flags */
+ smp_wmb();
}
static void ublk_io_release(void *priv)
@@ -3423,11 +3432,11 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
ret = ublk_check_fetch_buf(ub, addr);
if (ret)
goto out;
+ /* before ublk_fetch() publishes io->cmd, see ublk_prep_cancel() */
+ ublk_prep_cancel(cmd, issue_flags, ubq, tag);
ret = ublk_fetch(cmd, ub, io, addr, q_id);
if (ret)
- goto out;
-
- ublk_prep_cancel(cmd, issue_flags, ubq, tag);
+ goto out_done;
return -EIOCBQUEUED;
}
@@ -3471,6 +3480,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
if (ret)
goto out;
io->res = result;
+ ublk_prep_cancel(cmd, issue_flags, ubq, tag);
req = ublk_fill_io_cmd(io, cmd);
ublk_apply_io_buf(ub, io, cmd, addr, &auto_buf, &buf_idx);
if (buf_idx != UBLK_INVALID_BUF_IDX)
@@ -3489,19 +3499,24 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
* uring_cmd active first and prepare for handling new requeued
* request
*/
+ ublk_prep_cancel(cmd, issue_flags, ubq, tag);
req = ublk_fill_io_cmd(io, cmd);
io->buf.addr = addr;
if (likely(ublk_get_data(ubq, io, req))) {
__ublk_prep_compl_io_cmd(io, req);
- return UBLK_IO_RES_OK;
+ ret = UBLK_IO_RES_OK;
+ goto out_done;
}
break;
default:
goto out;
}
- ublk_prep_cancel(cmd, issue_flags, ubq, tag);
return -EIOCBQUEUED;
+ out_done:
+ /* marked cancelable: complete through io_uring_cmd_done() */
+ io_uring_cmd_done(cmd, ret, issue_flags);
+ return -EIOCBQUEUED;
out:
pr_devel("%s: complete: cmd op %d, tag %d ret %x io_flags %x\n",
__func__, cmd_op, tag, ret, io ? io->flags : 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0822/1257] ublk: mark the batch fetch command cancelable before linking it
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (820 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0821/1257] ublk: mark the io command cancelable before publishing it Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0823/1257] ublk: reset the FETCH round in release also without a disk Greg Kroah-Hartman
` (176 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Ming Lei, Jens Axboe,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <tom.leiming@gmail.com>
[ Upstream commit b59e96011d22e322fbf4d5d1d1124de538c278ed ]
UBLK_U_IO_FETCH_IO_CMDS has the same order problem as the per-io
commands: ublk_batch_attach() links the fetch command into fcmd_head
and marks it cancelable only after dropping evts_lock. A cancel from
the control path (ublk_batch_cancel_queue()) can take it in between and
complete it, and the later mark puts a completed request on io_uring's
cancelable list.
Mark it before linking it. evts_lock orders the mark before the link,
which is where the cancel finds it.
Batch commands are not bounced to task work, so they can run from io-wq
without uring_lock, and io_uring's cancel walk can now find a fetch
command before it is linked. Two things make that safe:
- initialize fcmd->node: it came from kzalloc(), so list_empty() saw a
linked node and ublk_batch_cancel_cmd() would list_del_init() NULL
pointers
- on the -ENODEV path, complete the command with io_uring_cmd_done()
before freeing fcmd: that removes it from the cancelable list under
uring_lock, after which nothing can see fcmd
Also use data->cmd instead of fcmd->cmd after dropping evts_lock: once
fcmd is linked and not the active one, a control-path cancel may
complete and free it.
Fixes: a4d883755399 ("ublk: add UBLK_U_IO_FETCH_IO_CMDS for batch I/O processing")
Cc: stable@vger.kernel.org # v7.0+
Tested-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261011063555.1142277-4-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 6015fb2fb925f..5e37b8e9d9acb 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -815,6 +815,8 @@ ublk_batch_alloc_fcmd(struct io_uring_cmd *cmd)
if (fcmd) {
fcmd->cmd = cmd;
fcmd->buf_group = READ_ONCE(cmd->sqe->buf_index);
+ /* a cancel may look at it before it is linked */
+ INIT_LIST_HEAD(&fcmd->node);
}
return fcmd;
}
@@ -3915,6 +3917,15 @@ static int ublk_batch_attach(struct ublk_queue *ubq,
bool free = false;
struct ublk_uring_cmd_pdu *pdu = ublk_get_uring_cmd_pdu(data->cmd);
+ /*
+ * Mark it cancelable before linking it into fcmd_head, where a cancel
+ * from the control path can take and complete it: see
+ * ublk_prep_cancel(). evts_lock orders the mark before the link.
+ */
+ pdu->ubq = ubq;
+ pdu->fcmd = fcmd;
+ io_uring_cmd_mark_cancelable(fcmd->cmd, data->issue_flags);
+
spin_lock(&ubq->evts_lock);
if (unlikely(ubq->force_abort || ubq->canceling)) {
free = true;
@@ -3925,14 +3936,12 @@ static int ublk_batch_attach(struct ublk_queue *ubq,
spin_unlock(&ubq->evts_lock);
if (unlikely(free)) {
+ /* off the cancelable list first, then nothing can see fcmd */
+ io_uring_cmd_done(data->cmd, -ENODEV, data->issue_flags);
ublk_batch_free_fcmd(fcmd);
- return -ENODEV;
+ return -EIOCBQUEUED;
}
- pdu->ubq = ubq;
- pdu->fcmd = fcmd;
- io_uring_cmd_mark_cancelable(fcmd->cmd, data->issue_flags);
-
if (!new_fcmd)
goto out;
@@ -3940,9 +3949,12 @@ static int ublk_batch_attach(struct ublk_queue *ubq,
* If the two fetch commands are originated from same io_ring_ctx,
* run batch dispatch directly. Otherwise, schedule task work for
* doing it.
+ *
+ * Use data->cmd, not fcmd->cmd: once fcmd is linked and not active,
+ * a cancel from the control path may complete and free it.
*/
if (io_uring_cmd_ctx_handle(new_fcmd->cmd) ==
- io_uring_cmd_ctx_handle(fcmd->cmd)) {
+ io_uring_cmd_ctx_handle(data->cmd)) {
data->cmd = new_fcmd->cmd;
ublk_batch_dispatch(ubq, data, new_fcmd);
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0823/1257] ublk: reset the FETCH round in release also without a disk
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (821 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0822/1257] ublk: mark the batch fetch command cancelable before linking it Greg Kroah-Hartman
@ 2026-11-07 13:51 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0824/1257] ublk: reset the FETCH round under ub->mutex Greg Kroah-Hartman
` (175 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Ming Lei, Jens Axboe,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <tom.leiming@gmail.com>
[ Upstream commit f06ca594eafcdf58a399a0f92480631192e06032 ]
The release of /dev/ublkcN resets the queues only when the device has a
disk. Without one it skips ublk_reset_ch_dev():
server fetches, never starts; old server exits
or STOP_DEV removed the disk release: no disk → skip reset
ios stay ACTIVE / CANCELED,
nr_io_ready stays full
new server opens /dev/ublkcN FETCH: -EBUSY (still ready), or
-EINVAL after a partial round
→ the device can only be deleted
All uring_cmds are done when the release work runs, with or without a
disk, so the reset is safe either way. Do it in both cases. Then a new
server can fetch and start the device again, as the STOP_DEV entry in
Documentation/block/ublk.rst says ("ublk device is ready for the new
process").
Fixes: 82a8a30c581b ("ublk: improve detection and handling of ublk server exit")
Cc: stable@vger.kernel.org
Tested-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261011063555.1142277-5-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 5e37b8e9d9acb..8bf0739539c04 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2551,12 +2551,13 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
}
/*
- * disk isn't attached yet, either device isn't live, or it has
- * been removed already, so we needn't to do anything
+ * No disk: the device isn't live, or it has been removed already.
+ * There are no requests to abort, but the round still has to be
+ * reset, so that a new server can fetch and start the device.
*/
disk = ublk_get_disk(ub);
if (!disk)
- goto out;
+ goto reset;
/*
* All uring_cmd are done now, so abort any request outstanding to
@@ -2617,10 +2618,9 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
unlock:
mutex_unlock(&ub->mutex);
ublk_put_disk(disk);
-
+reset:
/* all uring_cmd has been done now, reset device & ubq */
ublk_reset_ch_dev(ub);
-out:
clear_bit(UB_STATE_OPEN, &ub->state);
/* put the reference grabbed in ublk_ch_release() */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0824/1257] ublk: reset the FETCH round under ub->mutex
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (822 preceding siblings ...)
2026-11-07 13:51 ` [PATCH 7.3 0823/1257] ublk: reset the FETCH round in release also without a disk Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0825/1257] ublk: let STOP_DEV cancel the servers commands before its release Greg Kroah-Hartman
` (174 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Ming Lei, Jens Axboe,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <tom.leiming@gmail.com>
[ Upstream commit 84824afdb5a4dc127fbd7036142d7611c5e53651 ]
The release work resets the FETCH round without ub->mutex, while
START_DEV checks it under ub->mutex:
START_DEV (ub->mutex) release work
all queues ready? yes
ublksrv_tgid matches? yes
ublk_reset_ch_dev():
io->cmd = NULL, nr_queue_ready = 0
go live: a request then reaches ublk_queue_cmd() with a NULL io->cmd
Do the reset under ub->mutex. Then START_DEV sees the round either ready
or reset. The work already takes ub->mutex when there is a disk, after
it has aborted the requests; nothing holding ub->mutex waits for it.
Fixes: 728cbac5fe21 ("ublk: move device reset into ublk_ch_release()")
Cc: stable@vger.kernel.org
Tested-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261011063555.1142277-6-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 8bf0739539c04..162a4d1a2e2a3 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2556,8 +2556,10 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
* reset, so that a new server can fetch and start the device.
*/
disk = ublk_get_disk(ub);
- if (!disk)
+ if (!disk) {
+ mutex_lock(&ub->mutex);
goto reset;
+ }
/*
* All uring_cmd are done now, so abort any request outstanding to
@@ -2589,7 +2591,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
/* double check after grabbing lock */
if (!ub->ub_disk)
- goto unlock;
+ goto reset;
/*
* Transition the device to the nosrv state. What exactly this
@@ -2615,12 +2617,14 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
WRITE_ONCE(ublk_get_queue(ub, i)->fail_io, true);
}
}
-unlock:
- mutex_unlock(&ub->mutex);
- ublk_put_disk(disk);
reset:
- /* all uring_cmd has been done now, reset device & ubq */
+ /*
+ * All uring_cmd has been done now, reset device & ubq. Under
+ * ub->mutex, so START_DEV sees the round either ready or reset.
+ */
ublk_reset_ch_dev(ub);
+ mutex_unlock(&ub->mutex);
+ ublk_put_disk(disk);
clear_bit(UB_STATE_OPEN, &ub->state);
/* put the reference grabbed in ublk_ch_release() */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0825/1257] ublk: let STOP_DEV cancel the servers commands before its release
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (823 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0824/1257] ublk: reset the FETCH round under ub->mutex Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0826/1257] net: skbuff: dont BUG() on a bad csum_start in skb_copy_and_csum_dev() Greg Kroah-Hartman
` (173 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Ming Lei, Jens Axboe,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <tom.leiming@gmail.com>
[ Upstream commit c8b349f9daf6d88ff21033028167d00e819dafb6 ]
STOP_DEV cancels the fetched commands after dropping ub->mutex, so
START_DEV and FETCH can run in between:
STOP_DEV START_DEV / FETCH
lock ub->mutex
ublk_stop_dev_unlocked() (not started: does nothing)
unlock ub->mutex
START_DEV goes live, schedules scan
FETCH publishes a new command
cancel_work_sync(scan) cancels the new disk's scan
ublk_cancel_dev() takes the new command: NULL io->cmd
on a queue which isn't canceling
A START_DEV after STOP_DEV also goes live over the canceled commands.
Hold a reference on the server's /dev/ublkcN while canceling:
STOP_DEV
lock ub->mutex
ublk_stop_dev_unlocked()
cancel_work_sync(scan)
server attached: take a reference on its file, set STOPPING
unlock ub->mutex
ublk_cancel_dev()
drop the reference
- STOPPING makes FETCH and PREP get UBLK_IO_RES_ABORT and START_DEV
-EBUSY; a START_DEV or END_USER_RECOVERY waiting for the device
to get ready wakes up too; the reset in the server's release
clears it
- the release can't run before the reference is dropped, so no new
server can attach, and the cancel only meets this server's commands
- the cancel still runs after the unlock: io_uring_cmd_done() may take
uring_lock, under which FETCH takes ub->mutex
ublk_ch_open() saves the file in ->ch_file and ublk_ch_release() clears
it, under cancel_mutex. The release runs after the last reference is
gone, so take ours with file_ref_get(). Drop it with __fput_sync(): if
it is the last one, fput() would defer the release to this task, which
DEL_DEV then makes wait for the device to be freed.
A server which opened the device but hasn't fetched is stopped too.
Document what a server sees after STOP_DEV in ublk.rst.
Fixes: 85248d670b71 ("ublk: move ublk_cancel_dev() out of ub->mutex")
Cc: stable@vger.kernel.org
Reported-by: Josef Bacik <josef@toxicpanda.com>
Closes: https://lore.kernel.org/linux-block/20260928-b4-ublk-cancel-stop-v1-0-4a4360232a46@toxicpanda.com/
Tested-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261011063555.1142277-8-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/block/ublk.rst | 7 ++++
drivers/block/ublk_drv.c | 80 ++++++++++++++++++++++++++++++++----
2 files changed, 79 insertions(+), 8 deletions(-)
diff --git a/Documentation/block/ublk.rst b/Documentation/block/ublk.rst
index 28300fee22bfc..ed3285e361ad5 100644
--- a/Documentation/block/ublk.rst
+++ b/Documentation/block/ublk.rst
@@ -126,6 +126,13 @@ managing and controlling ublk devices with help of several control commands:
ublk server will release resources (such as destroying I/O handler threads &
io_uring).
+ If a server has ``/dev/ublkc*`` open, its fetched I/O commands complete with
+ ``UBLK_IO_RES_ABORT``. Until it closes ``/dev/ublkc*``, new
+ ``UBLK_IO_FETCH_REQ`` and ``UBLK_U_IO_PREP_IO_CMDS`` commands complete with
+ ``UBLK_IO_RES_ABORT`` too, and ``UBLK_CMD_START_DEV`` fails with ``-EBUSY``,
+ even if the server hadn't fetched anything. The device can be started again
+ by a server that opens ``/dev/ublkc*`` after that.
+
- ``UBLK_CMD_DEL_DEV``
Remove ``/dev/ublkc*``. When this command returns, the allocated ublk device
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 162a4d1a2e2a3..a49bd30154e01 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -321,6 +321,8 @@ struct ublk_device {
#define UB_STATE_OPEN 0
#define UB_STATE_USED 1
#define UB_STATE_DELETED 2
+/* STOP_DEV canceled the server's commands, until its release */
+#define UB_STATE_STOPPING 3
unsigned long state;
int ub_number;
@@ -334,6 +336,8 @@ struct ublk_device {
u16 nr_queue_ready;
bool unprivileged_daemons;
struct mutex cancel_mutex;
+ /* the open /dev/ublkcN, protected by cancel_mutex */
+ struct file *ch_file;
/*
* A cancel started in this FETCH round. Set by ublk_set_canceling(),
* cleared only by ublk_reset_ch_dev() when a new round starts. While
@@ -2406,6 +2410,9 @@ static int ublk_ch_open(struct inode *inode, struct file *filp)
return -EBUSY;
filp->private_data = ub;
ub->ublksrv_tgid = current->tgid;
+ mutex_lock(&ub->cancel_mutex);
+ ub->ch_file = filp;
+ mutex_unlock(&ub->cancel_mutex);
return 0;
}
@@ -2432,6 +2439,7 @@ static void ublk_reset_ch_dev(struct ublk_device *ub)
ub->nr_queue_ready = 0;
ub->unprivileged_daemons = false;
ub->ublksrv_tgid = -1;
+ clear_bit(UB_STATE_STOPPING, &ub->state);
}
static struct gendisk *ublk_get_disk(struct ublk_device *ub)
@@ -2635,6 +2643,9 @@ static int ublk_ch_release(struct inode *inode, struct file *filp)
{
struct ublk_device *ub = filp->private_data;
+ mutex_lock(&ub->cancel_mutex);
+ ub->ch_file = NULL;
+ mutex_unlock(&ub->cancel_mutex);
/*
* Grab ublk device reference, so it won't be gone until we are
* really released from work function.
@@ -3023,13 +3034,54 @@ static void ublk_stop_dev_unlocked(struct ublk_device *ub)
put_disk(disk);
}
+static struct file *ublk_get_ch_file(struct ublk_device *ub)
+{
+ struct file *file;
+
+ mutex_lock(&ub->cancel_mutex);
+ file = ub->ch_file;
+ if (file && !file_ref_get(&file->f_ref))
+ file = NULL;
+ mutex_unlock(&ub->cancel_mutex);
+ return file;
+}
+
static void ublk_stop_dev(struct ublk_device *ub)
{
+ struct file *file;
+
+ /*
+ * FETCH, PREP and START_DEV take ub->mutex. If a server has
+ * /dev/ublkcN open, set STOPPING, which turns it away, and hold a
+ * reference on the file: the server's release, whose reset clears
+ * STOPPING and lets a new server attach, can't run before we drop it.
+ * So the cancel can run after the unlock and only meets this server's
+ * commands; it has to: io_uring_cmd_done() may take uring_lock, under
+ * which FETCH takes ub->mutex.
+ */
mutex_lock(&ub->mutex);
ublk_stop_dev_unlocked(ub);
- mutex_unlock(&ub->mutex);
cancel_work_sync(&ub->partition_scan_work);
+ file = ublk_get_ch_file(ub);
+ if (file) {
+ /*
+ * The server has to close /dev/ublkcN before this device can
+ * be started again: the reset in its release clears STOPPING.
+ */
+ set_bit(UB_STATE_STOPPING, &ub->state);
+ /* for wake_up_var() below, see wake_up_bit() */
+ smp_mb__after_atomic();
+ }
+ mutex_unlock(&ub->mutex);
+
+ /* no server: nothing to cancel */
+ if (!file)
+ return;
+
+ /* wake a START_DEV waiting for the device to get ready */
+ wake_up_var(&ub->nr_queue_ready);
ublk_cancel_dev(ub);
+ __fput_sync(file);
}
static void ublk_reset_io_flags(struct ublk_queue *ubq, struct ublk_io *io)
@@ -3295,6 +3347,9 @@ static int ublk_check_fetch_buf(const struct ublk_device *ub, __u64 buf_addr)
static int __ublk_fetch(struct io_uring_cmd *cmd, struct ublk_device *ub,
struct ublk_io *io, u16 q_id)
{
+ if (test_bit(UB_STATE_STOPPING, &ub->state))
+ return UBLK_IO_RES_ABORT;
+
/* UBLK_IO_FETCH_REQ is only allowed before dev is setup */
if (ublk_dev_ready(ub))
return -EBUSY;
@@ -4473,22 +4528,27 @@ static bool ublk_validate_user_pid(struct ublk_device *ub, pid_t ublksrv_pid)
return ub->ublksrv_tgid == ublksrv_pid;
}
+static bool ublk_dev_ready_or_stopping(const struct ublk_device *ub)
+{
+ return ublk_dev_ready(ub) || test_bit(UB_STATE_STOPPING, &ub->state);
+}
+
/*
- * Wait until all queues have fetched their I/O commands, and return with
- * ub->mutex held and readiness guaranteed. The queues stay canceling if
- * this round saw a cancel, see ublk_queue_reset_io_flags(). Ready may
- * regress between wakeup and mutex_lock() (F_BATCH UNPREP, daemon death),
- * so re-check it under the mutex and wait again.
+ * Wait until all queues have fetched their I/O commands, or STOP_DEV set
+ * UB_STATE_STOPPING, and return with ub->mutex held. The queues stay
+ * canceling if this round saw a cancel, see ublk_queue_reset_io_flags().
+ * Ready may regress between wakeup and mutex_lock() (F_BATCH UNPREP,
+ * daemon death), so re-check it under the mutex and wait again.
*/
static int ublk_wait_dev_ready_and_lock(struct ublk_device *ub)
{
while (true) {
if (wait_var_event_interruptible(&ub->nr_queue_ready,
- ublk_dev_ready(ub)))
+ ublk_dev_ready_or_stopping(ub)))
return -EINTR;
mutex_lock(&ub->mutex);
- if (ublk_dev_ready(ub))
+ if (ublk_dev_ready_or_stopping(ub))
return 0;
mutex_unlock(&ub->mutex);
}
@@ -4588,6 +4648,10 @@ static int ublk_ctrl_start_dev(struct ublk_device *ub,
ret = -EEXIST;
goto out_unlock;
}
+ if (test_bit(UB_STATE_STOPPING, &ub->state)) {
+ ret = -EBUSY;
+ goto out_unlock;
+ }
disk = blk_mq_alloc_disk(&ub->tag_set, &lim, NULL);
if (IS_ERR(disk)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0826/1257] net: skbuff: dont BUG() on a bad csum_start in skb_copy_and_csum_dev()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (824 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0825/1257] ublk: let STOP_DEV cancel the servers commands before its release Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0827/1257] rds: fix out-of-bounds conn_path walks via handshake exthdrs Greg Kroah-Hartman
` (172 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Jakub Kicinski,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 56453199d28f0072a8196fba14b2d702632e2219 ]
skb_copy_and_csum_dev() copies everything up to the checksum start out
of the linear area, and BUG()s if the checksum start is past the end of
the linear area. It misses the other direction: a CHECKSUM_PARTIAL skb
that has been pulled past its csum_start gives a negative offset, which
gets past the check and becomes a ~4GB copy. It also trusts
csum_offset when it stores the folded checksum. So far
skb_copy_and_csum_bits() BUG()ing on a short skb has covered for that,
but once it returns instead, a bad csum_offset would write past the end
of the caller's buffer.
The function returns void and its callers are drivers copying a frame
into a bounce buffer just before handing it to the hardware. There's
nothing for them to back out of, so check both ends of csum_start and
that the checksum field fits in the frame, and if not, copy the whole
frame with skb_copy_bits() without filling in the checksum, with a
DEBUG_NET_WARN_ON_ONCE() for debug kernels. The frame
goes out with a bad checksum and is dropped by the receiver. If even
that copy fails, zero the buffer so the driver doesn't send stale bytes.
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Cc: stable? The trailers only have Assisted-by: and Signed-off-by:. No
Link: https://patch.msgid.link/20261007-b4-skbuff-bug-on-v2-5-b9a5f732895b@toxicpanda.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/skbuff.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 2bfabde31ea93..ea4c38dee19f5 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3961,7 +3961,18 @@ void skb_copy_and_csum_dev(const struct sk_buff *skb, u8 *to)
else
csstart = skb_headlen(skb);
- BUG_ON(csstart > skb_headlen(skb));
+ if (unlikely(csstart < 0 || csstart > skb_headlen(skb) ||
+ (skb->ip_summed == CHECKSUM_PARTIAL &&
+ csstart + skb->csum_offset + sizeof(__sum16) >
+ skb->len))) {
+ DEBUG_NET_WARN_ON_ONCE(1);
+ /* Send the frame without the checksum filled in, or send
+ * zeroes if we can't even copy it.
+ */
+ if (skb_copy_bits(skb, 0, to, skb->len))
+ memset(to, 0, skb->len);
+ return;
+ }
skb_copy_from_linear_data(skb, to, csstart);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0827/1257] rds: fix out-of-bounds conn_path walks via handshake exthdrs
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (825 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0826/1257] net: skbuff: dont BUG() on a bad csum_start in skb_copy_and_csum_dev() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0828/1257] ipv6: defrag: orphan skb before queuing Greg Kroah-Hartman
` (171 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Henry Martin, Allison Henderson,
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <bsdhenrymartin@gmail.com>
[ Upstream commit 50f2103fce43922b6e562937b2d2fc62089ff7ec ]
Both the lane and the connection-generation negotiation are driven by
extension headers in handshake packets, and both are processed
unconditionally, even on transports that are not multipath capable.
A non-MP connection (t_mp_capable unset) owns exactly one
rds_conn_path slot, so a peer claiming up to RDS_MPATH_WORKERS lanes
makes every subsequent fan-out walk conn->c_path[0..7] at 504-byte
strides past the single allocated slot (KASAN: "Read of size 8 in
rds_conn_path_connect_if_down"); the generation negotiation opens a
similar out-of-bounds walk on the same array.
Only process handshake extension headers when the connection's
transport is multipath capable, so a peer can never make us walk
lanes that do not exist. Both call sites in rds_recv_incoming() are
gated.
This is a port of the Oracle UEK fix for the same issue, picked up
where Paula's series of the same change left off.
This issue was discovered by Tencent CodeBuddy Security.
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/netdev/20260825120132.51636-1-pamoutafpro@gmail.com/
Link: https://github.com/oracle/linux-uek/commit/2fdeb0513f18
Fixes: 840df162b3eb ("rds: reduce memory footprint for RDS when transport is RDMA")
Fixes: 905dd4184e07 ("RDS: TCP: Track peer's connection generation number")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Reviewed-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20261012025336.54756-1-bsdhenrymartin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/recv.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/rds/recv.c b/net/rds/recv.c
index 6204e577a90ae..93ee4546ae362 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -379,7 +379,8 @@ void rds_recv_incoming(struct rds_connection *conn, struct in6_addr *saddr,
rds_stats_inc(s_recv_ping);
rds_send_pong(cp, inc->i_hdr.h_sport);
/* if this is a handshake ping, start multipath if necessary */
- if (RDS_HS_PROBE(be16_to_cpu(inc->i_hdr.h_sport),
+ if (conn->c_trans->t_mp_capable &&
+ RDS_HS_PROBE(be16_to_cpu(inc->i_hdr.h_sport),
be16_to_cpu(inc->i_hdr.h_dport))) {
rds_recv_hs_exthdrs(&inc->i_hdr, cp->cp_conn);
rds_start_mprds(cp->cp_conn);
@@ -387,7 +388,8 @@ void rds_recv_incoming(struct rds_connection *conn, struct in6_addr *saddr,
goto out;
}
- if (be16_to_cpu(inc->i_hdr.h_dport) == RDS_FLAG_PROBE_PORT &&
+ if (conn->c_trans->t_mp_capable &&
+ be16_to_cpu(inc->i_hdr.h_dport) == RDS_FLAG_PROBE_PORT &&
inc->i_hdr.h_sport == 0) {
rds_recv_hs_exthdrs(&inc->i_hdr, cp->cp_conn);
/* if this is a handshake pong, start multipath if necessary */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0828/1257] ipv6: defrag: orphan skb before queuing
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (826 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0827/1257] rds: fix out-of-bounds conn_path walks via handshake exthdrs Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0829/1257] sctp: hold transport reference across connect wait Greg Kroah-Hartman
` (170 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Eric Dumazet,
Fernando Fernandez Mancera, Zixuan Chai, Ren Wei, Jakub Kicinski,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zixuan Chai <petalzu987@gmail.com>
[ Upstream commit 5dfa91a5ec53cfbf907a1fca095ac3ac7a4e94c9 ]
IPv4 and nf_conntrack fragment queues orphan skbs before returning
-EINPROGRESS, but ip6_frag_queue() leaves the socket association intact.
Commit 18685451fc4e ("inet: inet_defrag: prevent sk release while still in
use") moved skb_orphan() into ip_frag_queue() and nf_ct_frag6_queue(), but
missed ip6_frag_queue().
Without orphaning, inet_frag_reasm_finish() clears fp->sk on frag_list
skbs but leaves fp->destructor set to sock_pfree. Freeing the reassembled
skb then calls sock_pfree() with a NULL socket. A socket using
SOCK_RCU_FREE may also be released while its fragment is queued, leaving a
stale socket pointer; this is a second consequence of the same missing
orphan.
Orphan the skb before returning -EINPROGRESS so the queued fragment no
longer retains the socket association or destructor.
Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Zixuan Chai <petalzu987@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Link: https://patch.msgid.link/5c396b7011168cd98b9812df4d6bbd00a96048e7.1791008591.git.petalzu987@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/reassembly.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 05c51f669754a..a7964125c764c 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -232,6 +232,7 @@ static int ip6_frag_queue(struct net *net,
}
skb_dst_drop(skb);
+ skb_orphan(skb);
return -EINPROGRESS;
insert_error:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0829/1257] sctp: hold transport reference across connect wait
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (827 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0828/1257] ipv6: defrag: orphan skb before queuing Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0830/1257] RDS/IB: validate receive fragment completions Greg Kroah-Hartman
` (169 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xin Long, Seung Min Shin,
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seung Min Shin <guncraft2000@naver.com>
[ Upstream commit 5bef8649bb9ac4b2a014bcc227202ebd2df824be ]
sctp_sendmsg_to_asoc() selects a transport before waiting for a new
interleaved association to become established. sctp_wait_for_connect()
drops the socket lock while sleeping.
While the lock is dropped, backlog processing can handle a COOKIE ACK and
an ASCONF DEL-IP that removes the selected transport. sctp_assoc_rm_peer()
then marks the transport dead and drops its association-owned reference.
The transport can be freed through RCU before the send path resumes.
After the wait, the stale pointer is assigned to newly created DATA or
I-DATA chunks and later dereferenced by sctp_outq_select_transport().
Hold a reference to the selected transport across
sctp_wait_for_connect(). After the socket lock is reacquired, abort the
send if the transport was marked dead. Callers without a selected
transport pass NULL and retain their existing behavior.
Cc: stable@vger.kernel.org
Fixes: 668c9beb9020 ("sctp: implement assign_number for sctp_stream_interleave")
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Seung Min Shin <guncraft2000@naver.com>
Link: https://patch.msgid.link/20261011162750.1529631-1-guncraft2000@naver.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/socket.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 321898f22d80d..c616f1609d0cf 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -75,7 +75,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc,
struct sctp_transport *transport,
long *timeo_p, size_t msg_len);
static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
-static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
+static int sctp_wait_for_connect(struct sctp_association *,
+ struct sctp_transport *, long *timeo_p);
static int sctp_wait_for_accept(struct sock *sk, long timeo);
static void sctp_wait_for_close(struct sock *sk, long timeo);
static void sctp_destruct_sock(struct sock *sk);
@@ -1245,7 +1246,7 @@ static int __sctp_connect(struct sock *sk, struct sockaddr *kaddrs,
*assoc_id = asoc->assoc_id;
timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
- return sctp_wait_for_connect(asoc, &timeo);
+ return sctp_wait_for_connect(asoc, NULL, &timeo);
out_free:
pr_debug("%s: took out_free path with asoc:%p kaddrs:%p err:%d\n",
@@ -1847,7 +1848,7 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
if (asoc->ep->intl_enable) {
timeo = sock_sndtimeo(sk, 0);
- err = sctp_wait_for_connect(asoc, &timeo);
+ err = sctp_wait_for_connect(asoc, transport, &timeo);
if (err || sk->sk_shutdown & RCV_SHUTDOWN) {
err = -ESRCH;
goto err;
@@ -1890,7 +1891,7 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
if (unlikely(wait_connect)) {
timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
- sctp_wait_for_connect(asoc, &timeo);
+ sctp_wait_for_connect(asoc, NULL, &timeo);
}
err = msg_len;
@@ -9390,7 +9391,9 @@ static bool sctp_writeable(const struct sock *sk)
/* Wait for an association to go into ESTABLISHED state. If timeout is 0,
* returns immediately with EINPROGRESS.
*/
-static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
+static int sctp_wait_for_connect(struct sctp_association *asoc,
+ struct sctp_transport *transport,
+ long *timeo_p)
{
struct sock *sk = asoc->base.sk;
int err = 0;
@@ -9399,12 +9402,16 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
pr_debug("%s: asoc:%p, timeo:%ld\n", __func__, asoc, *timeo_p);
- /* Increment the association's refcnt. */
+ /* Hold references while the socket lock is dropped. */
+ if (transport)
+ sctp_transport_hold(transport);
sctp_association_hold(asoc);
for (;;) {
prepare_to_wait_exclusive(&asoc->wait, &wait,
TASK_INTERRUPTIBLE);
+ if (transport && transport->dead)
+ goto do_transport_dead;
if (!*timeo_p)
goto do_nonblock;
if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -9433,7 +9440,8 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
out:
finish_wait(&asoc->wait, &wait);
- /* Release the association's refcnt. */
+ if (transport)
+ sctp_transport_put(transport);
sctp_association_put(asoc);
return err;
@@ -9452,6 +9460,10 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
do_nonblock:
err = -EINPROGRESS;
goto out;
+
+do_transport_dead:
+ err = -EAGAIN;
+ goto out;
}
static int sctp_wait_for_accept(struct sock *sk, long timeo)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0830/1257] RDS/IB: validate receive fragment completions
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (828 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0829/1257] sctp: hold transport reference across connect wait Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0831/1257] net: bgmac: enable interrupts only after NAPI is ready Greg Kroah-Hartman
` (168 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sungbyeongchan, Giovanni Vignone,
Robert van Eijk, Paolo Gentry, Shubham Antil, Allison Henderson,
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubham Antil <shubham@octane.security>
[ Upstream commit 65cf6863606b0507a7c3bd1711317e4f5d6b8b7e ]
rds_ib_process_recv() accounts every receive fragment as contributing
min(i_recv_data_rem, RDS_FRAG_SIZE) bytes, regardless of the completion
length. When a completion is shorter than the header-declared amount,
receive accounting can advance beyond the payload supplied by the
completion.
Only an IB_WC_RECV completion has the buffer layout expected by this
receive path. Other successful completion opcodes must not be interpreted
as ordinary receive completions.
Reject successful completions with any other opcode before processing
their length. For ordinary receive completions, require enough payload
to cover the amount accounted to the fragment before linking its page
into the incoming message.
This is compatible with the current transmit paths. MSG_ZEROCOPY is
restricted to RDS/TCP, while RDS/IB copied and page-vector messages use
full-sized non-final scatterlist entries.
Found during an LLM-assisted source audit and validated under KMSAN with
a malformed short receive completion.
Reported-by: sungbyeongchan <tjdqudcks0424@naver.com>
Closes: https://lore.kernel.org/netdev/20261006205204.1322102-1-tjdqudcks0424@naver.com/
Reported-by: Giovanni Vignone <gio@octane.security>
Link: https://lore.kernel.org/netdev/8a6ee1d5336ae65b8ffdc8c40a1135657207e204.camel@kernel.org/
Reported-by: Robert van Eijk <robert@octane.security>
Link: https://lore.kernel.org/netdev/8a6ee1d5336ae65b8ffdc8c40a1135657207e204.camel@kernel.org/
Reported-by: Paolo Gentry <paolo@octane.security>
Link: https://lore.kernel.org/netdev/8a6ee1d5336ae65b8ffdc8c40a1135657207e204.camel@kernel.org/
Fixes: 1e23b3ee0e94 ("RDS/IB: Receive datagrams via IB")
Cc: stable@vger.kernel.org
Signed-off-by: Shubham Antil <shubham@octane.security>
Reviewed-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20261013025729.40815-1-shubham@octane.security
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/ib_recv.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index bd6cb3ffaa571..aa50b85b0f994 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -949,6 +949,12 @@ static void rds_ib_process_recv(struct rds_connection *conn,
}
}
+ if (data_len < min_t(u32, ic->i_recv_data_rem, RDS_FRAG_SIZE)) {
+ rds_ib_conn_error(conn,
+ "fragment shorter than header-declared length; forcing reconnect\n");
+ goto done;
+ }
+
list_add_tail(&recv->r_frag->f_item, &ibinc->ii_frags);
recv->r_frag = NULL;
@@ -1004,7 +1010,12 @@ void rds_ib_recv_cqe_handler(struct rds_ib_connection *ic,
* event is processed.
*/
if (wc->status == IB_WC_SUCCESS) {
- rds_ib_process_recv(conn, recv, wc->byte_len, state);
+ if (wc->opcode != IB_WC_RECV)
+ rds_ib_conn_error(conn,
+ "recv completion had unexpected opcode %u, disconnecting and reconnecting\n",
+ wc->opcode);
+ else
+ rds_ib_process_recv(conn, recv, wc->byte_len, state);
} else {
/* We expect errors as the qp is drained during shutdown */
if (rds_conn_up(conn) || rds_conn_connecting(conn))
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0831/1257] net: bgmac: enable interrupts only after NAPI is ready
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (829 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0830/1257] RDS/IB: validate receive fragment completions Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0832/1257] cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64 Greg Kroah-Hartman
` (167 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rosen Penev, Daniel Machon,
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit ac1f6e58cb77bb66b8811f7d98703e0f076a8f65 ]
bgmac_open() calls bgmac_chip_init(), which unmasks the interrupts and
enables the MAC receiver, before request_irq() and napi_enable().
bgmac_enet_resume() also enables NAPI only after bgmac_chip_init().
When frames arrive in that window, the first RX interrupt masks all
interrupts in bgmac_interrupt() and calls napi_schedule() on a NAPI
instance that is still disabled, so nothing is scheduled. Nothing
unmasks the interrupts again, the RX ring fills up and the interface
stays deaf until it is brought down and up without traffic.
On an Asus RT-N16 (BCM4716) a single "ip link set eth0 down/up" while
a host sends UDP to the router left INT_MASK at 0, INT_STATUS with RX
pending and the RX DMA idle on a full ring, with the RX packet and
interrupt counters no longer moving. With this change, 10 of 10 such
cycles recovered on their own.
Request the IRQ and enable NAPI before the chip is initialized.
Fixes: dd4544f05469 ("bgmac: driver for GBit MAC core on BCMA bus")
Fixes: f3537b3494c0 ("net: ethernet: bgmac: driver power manangement")
Cc: stable@vger.kernel.org
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
Link: https://patch.msgid.link/20261010070011.60403-1-rosenp@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/bgmac.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 3e9c57196a397..1835266fdd09f 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -1183,9 +1183,6 @@ static int bgmac_open(struct net_device *net_dev)
if (err)
return err;
- /* Specs say about reclaiming rings here, but we do that in DMA init */
- bgmac_chip_init(bgmac);
-
err = request_irq(bgmac->irq, bgmac_interrupt, IRQF_SHARED,
net_dev->name, net_dev);
if (err < 0) {
@@ -1195,6 +1192,9 @@ static int bgmac_open(struct net_device *net_dev)
}
napi_enable(&bgmac->napi);
+ /* Specs say about reclaiming rings here, but we do that in DMA init */
+ bgmac_chip_init(bgmac);
+
phy_start(net_dev->phydev);
netif_start_queue(net_dev);
@@ -1608,10 +1608,10 @@ int bgmac_enet_resume(struct bgmac *bgmac)
if (rc)
return rc;
- bgmac_chip_init(bgmac);
-
napi_enable(&bgmac->napi);
+ bgmac_chip_init(bgmac);
+
netif_tx_lock(bgmac->net_dev);
netif_device_attach(bgmac->net_dev);
netif_tx_unlock(bgmac->net_dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0832/1257] cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (830 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0831/1257] net: bgmac: enable interrupts only after NAPI is ready Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0833/1257] cpufreq: loongson3: Adjust the width of id and val in smc_message Greg Kroah-Hartman
` (166 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huacai Chen, Zhongqiu Han,
Viresh Kumar, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 48a82a3f44576a1b227f964fdb150e1cae7455bf ]
32BIT Loongson machines don't have SMC and FreqCtrl registers, so make
this driver depend on MACH_LOONGSON64 (only for LoongArch based 64bit
machines currently).
Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index db83f3365698c..edc1299098d47 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -288,6 +288,7 @@ endif
if LOONGARCH
config LOONGSON3_CPUFREQ
tristate "Loongson3 CPUFreq Driver"
+ depends on MACH_LOONGSON64
help
This option adds a CPUFreq driver for Loongson processors which
support software configurable cpu frequency.
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0833/1257] cpufreq: loongson3: Adjust the width of id and val in smc_message
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (831 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0832/1257] cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64 Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0834/1257] cpufreq: loongson3: Replace per-package mutex with per-node Greg Kroah-Hartman
` (165 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongliang Wang, Huacai Chen,
Zhongqiu Han, Viresh Kumar, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 290814d3c22b300eb36b74dc76ad36bd7fdc1220 ]
The id field of smc_message is usually stand for the CPU ID. In the past
this driver was only tested for desktop and laptop productions so 4-bits
are enough. But now we have servers that can have as many as 256 cores,
so we need 8-bits CPU ID.
On the other hand, the val field is usually stand for CPU frequency so
12-bits are enough to represent 4GHz, and for higher frequencies there
is an extra bit to extend (enough for 8GHz).
In theory, this is a incompatible change, but fortunately the old SMC
firmwares are not widely shipped and can be updated on the air, thus we
can safely adjust the widths.
Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/loongson3_cpufreq.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index 1e8715ea1b771..630f679aa7395 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -21,9 +21,9 @@
union smc_message {
u32 value;
struct {
- u32 id : 4;
+ u32 id : 8;
u32 info : 4;
- u32 val : 16;
+ u32 val : 12;
u32 cmd : 6;
u32 extra : 1;
u32 complete : 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0834/1257] cpufreq: loongson3: Replace per-package mutex with per-node
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (832 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0833/1257] cpufreq: loongson3: Adjust the width of id and val in smc_message Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0835/1257] cpufreq: loongson3: Use global physical CPU ID in get/target callbacks Greg Kroah-Hartman
` (164 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongliang Wang, Huacai Chen,
Zhongqiu Han, Viresh Kumar, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 5d7802ada30b3101f408706b7399b0e170d2febd ]
Our server productions (e.g. Loongson-3D6000/3E6000) can have multiple
nodes in one package and SMC mailboxes are also per-node. So replace the
per-package mutex with per-node one.
Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/loongson3_cpufreq.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index 630f679aa7395..e3cd78a5ab187 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -169,7 +169,7 @@ struct loongson3_freq_data {
struct cpufreq_frequency_table table[];
};
-static struct mutex cpufreq_mutex[MAX_PACKAGES];
+static struct mutex cpufreq_mutex[MAX_NUMNODES];
static struct cpufreq_driver loongson3_cpufreq_driver;
static DEFINE_PER_CPU(struct loongson3_freq_data *, freq_data);
@@ -177,14 +177,14 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
{
int retries;
unsigned int cpu = raw_smp_processor_id();
- unsigned int package = cpu_data[cpu].package;
+ unsigned int nid = cpu_to_node(cpu);
union smc_message msg, last;
- mutex_lock(&cpufreq_mutex[package]);
+ mutex_lock(&cpufreq_mutex[nid]);
last.value = iocsr_read32(LOONGARCH_IOCSR_SMCMBX);
if (!last.complete) {
- mutex_unlock(&cpufreq_mutex[package]);
+ mutex_unlock(&cpufreq_mutex[nid]);
return -EPERM;
}
@@ -208,11 +208,11 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
}
if (!msg.complete || msg.cmd != CMD_OK) {
- mutex_unlock(&cpufreq_mutex[package]);
+ mutex_unlock(&cpufreq_mutex[nid]);
return -EPERM;
}
- mutex_unlock(&cpufreq_mutex[package]);
+ mutex_unlock(&cpufreq_mutex[nid]);
return msg.val;
}
@@ -337,7 +337,7 @@ static int loongson3_cpufreq_probe(struct platform_device *pdev)
{
int i, ret;
- for (i = 0; i < MAX_PACKAGES; i++) {
+ for (i = 0; i < MAX_NUMNODES; i++) {
ret = devm_mutex_init(&pdev->dev, &cpufreq_mutex[i]);
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0835/1257] cpufreq: loongson3: Use global physical CPU ID in get/target callbacks
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (833 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0834/1257] cpufreq: loongson3: Replace per-package mutex with per-node Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0836/1257] cpufreq: loongson3: Replace IOCSR read/write with MMIO ones Greg Kroah-Hartman
` (163 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongliang Wang, Huacai Chen,
Zhongqiu Han, Viresh Kumar, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit e38360d7c62c8fa530b58905f99a4557d4d6b352 ]
Our server productions (e.g. Loongson-3D6000/3E6000) can have discrete
global physical CPU IDs while the core ID inside the packages are always
continuous. In these cases we should use global physical CPU IDs to get
and set frequencies.
Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/loongson3_cpufreq.c | 23 +++++++++++++----------
1 file changed, 13 insertions(+), 10 deletions(-)
diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index e3cd78a5ab187..1ae821e265fbf 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -16,6 +16,7 @@
#include <asm/idle.h>
#include <asm/loongarch.h>
#include <asm/loongson.h>
+#include <asm/smp.h>
/* Message */
union smc_message {
@@ -219,38 +220,40 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
static unsigned int loongson3_cpufreq_get(unsigned int cpu)
{
- int ret;
+ int ret, core = cpu_logical_map(cpu);
- ret = do_service_request(cpu, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_INFO, 0, 0);
+ ret = do_service_request(core, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_INFO, 0, 0);
- return ret * KILO;
+ return (ret < 0) ? 0 : ret * KILO;
}
static int loongson3_cpufreq_target(struct cpufreq_policy *policy, unsigned int index)
{
- int ret;
+ int ret, core = cpu_logical_map(policy->cpu);
- ret = do_service_request(cpu_data[policy->cpu].core,
- FREQ_INFO_TYPE_LEVEL, CMD_SET_FREQ_INFO, index, 0);
+ ret = do_service_request(core, FREQ_INFO_TYPE_LEVEL, CMD_SET_FREQ_INFO,
+ index, 0);
return (ret >= 0) ? 0 : ret;
}
static int configure_freq_table(int cpu)
{
- int i, ret, boost_level, max_level, freq_level;
+ int i, ret, core, boost_level, max_level, freq_level;
struct platform_device *pdev = cpufreq_get_driver_data();
struct loongson3_freq_data *data;
if (per_cpu(freq_data, cpu))
return 0;
- ret = do_service_request(cpu, 0, CMD_GET_FREQ_LEVEL_NUM, 0, 0);
+ core = cpu_logical_map(cpu);
+
+ ret = do_service_request(core, 0, CMD_GET_FREQ_LEVEL_NUM, 0, 0);
if (ret < 0)
return ret;
max_level = ret;
- ret = do_service_request(cpu, 0, CMD_GET_FREQ_BOOST_LEVEL, 0, 0);
+ ret = do_service_request(core, 0, CMD_GET_FREQ_BOOST_LEVEL, 0, 0);
if (ret < 0)
return ret;
boost_level = ret;
@@ -263,7 +266,7 @@ static int configure_freq_table(int cpu)
data->def_freq_level = boost_level - 1;
for (i = 0; i < freq_level; i++) {
- ret = do_service_request(cpu, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_LEVEL_INFO, i, 0);
+ ret = do_service_request(core, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_LEVEL_INFO, i, 0);
if (ret < 0) {
devm_kfree(&pdev->dev, data);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0836/1257] cpufreq: loongson3: Replace IOCSR read/write with MMIO ones
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (834 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0835/1257] cpufreq: loongson3: Use global physical CPU ID in get/target callbacks Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0837/1257] fuse: dont launder folios of a bad inode Greg Kroah-Hartman
` (162 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xi Ruoyao, Huacai Chen, Zhongqiu Han,
Viresh Kumar, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 81792daacfb41ca07b04bd3956ea9e672080cc98 ]
Our server productions (e.g. Loongson-3D6000/3E6000) can have multiple
nodes in one package and SMC mailboxes are also per-node. However, IOCSR
read/write can only perform on the current node, while sometimes we want
to perform on other nodes (e.g. when switch governor, the get and target
callbacks are not run on target core). So replace IOCSR read/write with
MMIO ones.
Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Tested-by: Xi Ruoyao <xry111@xry111.site>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/loongson3_cpufreq.c | 34 +++++++++++++++++++++++------
1 file changed, 27 insertions(+), 7 deletions(-)
diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index 1ae821e265fbf..aea7c31e155a4 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -17,6 +17,7 @@
#include <asm/loongarch.h>
#include <asm/loongson.h>
#include <asm/smp.h>
+#include <asm/numa.h>
/* Message */
union smc_message {
@@ -165,6 +166,12 @@ union smc_message {
#define FREQ_MAX_LEVEL 16
+#define MMIO_SMCMBX(node) \
+ ((void __iomem *)(nid_to_addrbase(node) | IO_BASE | LOONGSON_REG_BASE | LOONGARCH_IOCSR_SMCMBX))
+
+#define MMIO_MISC_FUNC(node) \
+ ((void __iomem *)(nid_to_addrbase(node) | IO_BASE | LOONGSON_REG_BASE | LOONGARCH_IOCSR_MISC_FUNC))
+
struct loongson3_freq_data {
unsigned int def_freq_level;
struct cpufreq_frequency_table table[];
@@ -177,13 +184,27 @@ static DEFINE_PER_CPU(struct loongson3_freq_data *, freq_data);
static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 extra)
{
int retries;
- unsigned int cpu = raw_smp_processor_id();
- unsigned int nid = cpu_to_node(cpu);
+ unsigned int cpu = 0, nid;
union smc_message msg, last;
+#ifdef CONFIG_SMP
+ switch (cmd) {
+ case CMD_GET_FREQ_INFO:
+ case CMD_SET_FREQ_INFO:
+ case CMD_GET_FREQ_LEVEL_NUM:
+ case CMD_GET_FREQ_LEVEL_INFO:
+ case CMD_GET_FREQ_BOOST_LEVEL:
+ cpu = cpu_number_map(id);
+ break;
+ default:
+ cpu = raw_smp_processor_id();
+ }
+#endif
+ nid = cpu_to_node(cpu);
+
mutex_lock(&cpufreq_mutex[nid]);
- last.value = iocsr_read32(LOONGARCH_IOCSR_SMCMBX);
+ last.value = readl(MMIO_SMCMBX(nid));
if (!last.complete) {
mutex_unlock(&cpufreq_mutex[nid]);
return -EPERM;
@@ -196,12 +217,11 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
msg.extra = extra;
msg.complete = 0;
- iocsr_write32(msg.value, LOONGARCH_IOCSR_SMCMBX);
- iocsr_write32(iocsr_read32(LOONGARCH_IOCSR_MISC_FUNC) | IOCSR_MISC_FUNC_SOFT_INT,
- LOONGARCH_IOCSR_MISC_FUNC);
+ writel(msg.value, MMIO_SMCMBX(nid));
+ writel(readl(MMIO_MISC_FUNC(nid)) | IOCSR_MISC_FUNC_SOFT_INT, MMIO_MISC_FUNC(nid));
for (retries = 0; retries < 10000; retries++) {
- msg.value = iocsr_read32(LOONGARCH_IOCSR_SMCMBX);
+ msg.value = readl(MMIO_SMCMBX(nid));
if (msg.complete)
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0837/1257] fuse: dont launder folios of a bad inode
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (835 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0836/1257] cpufreq: loongson3: Replace IOCSR read/write with MMIO ones Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0838/1257] virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree Greg Kroah-Hartman
` (161 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+e8200299b0556976e13c,
Joanne Koong, Horst Birthelmer, Miklos Szeredi, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <joannelkoong@gmail.com>
[ Upstream commit 01d0f3d294af126f517d92c11e100525537f8be4 ]
fuse_flush() and fuse_writepages() reject writing back dirty data for
any inode that has been marked bad, but fuse_launder_folio() doesn't.
This can cause the following warning in fuse_write_file_get() to
trigger, as reported by syzbot:
WARNING: fs/fuse/file.c:2043 at fuse_write_file_get fs/fuse/file.c:2043 [inline]
WARNING: fs/fuse/file.c:2043 at fuse_iomap_writeback_range+0x7c8/0x18f0 fs/fuse/file.c:2227
Call Trace:
iomap_writeback_folio+0x1526/0x2490 fs/iomap/buffered-io.c:2022
fuse_launder_folio+0x17b/0x240 fs/fuse/file.c:2331
folio_unmap_invalidate+0x4cd/0x830 mm/truncate.c:634
invalidate_inode_pages2_range+0x629/0xb30 mm/truncate.c:726
fuse_open+0x5a6/0x770 fs/fuse/file.c:297
This can be hit on a writeback cache mount:
1) a writeable file is open and a buffered write dirties some pages
2) another thread opens the same file read-only. fuse_open() passes the
bad inode check and sends OPEN to the server.
3) a SETATTR reply with the wrong file type marks the inode bad
4) the writeable file is closed. Flush and release skip writeback
because the inode is bad. The pages stay dirty but the file gets
removed from write_files.
5) server replies to the OPEN. The reply has no FOPEN_KEEP_CACHE, so
fuse_open() calls invalidate_inode_pages2().
6) the invalidation finds the dirty pages and calls
fuse_launder_folio(), which finds no wriable file and hits the
WARN_ON in fuse_write_file_get().
Instead of trying to write back dirty data for the bad inode,
fuse_launder_folio() should return -EIO.
Fixes: 5d069dbe8aaf ("fuse: fix bad inode")
Reported-by: syzbot+e8200299b0556976e13c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e8200299b0556976e13c
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Reviewed-by: Horst Birthelmer <hbirthelmer@ddn.com>
Tested-by: syzbot+e8200299b0556976e13c@syzkaller.appspotmail.com
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/file.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 0f2c9404af74a..49266440cbedb 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2347,6 +2347,9 @@ static int fuse_launder_folio(struct folio *folio)
.wb_ctx = &data,
};
+ if (fuse_is_bad(wpc.inode))
+ return -EIO;
+
if (folio_clear_dirty_for_io(folio)) {
err = iomap_writeback_folio(&wpc, folio);
err = fuse_iomap_writeback_submit(&wpc, err);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0838/1257] virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (836 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0837/1257] fuse: dont launder folios of a bad inode Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0839/1257] virtiofs: validate fixed-output response length Greg Kroah-Hartman
` (160 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Li, Fan Wu, Miklos Szeredi,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit e7ccc777a040343b80f95f4cc5c12ce1df3187f4 ]
The vring size was read after virtio_fs_find_instance() had dropped
virtio_fs_mutex, so a concurrent virtio_fs_remove() could free the
virtqueue first. The reference from the lookup keeps the virtio_fs
alive, but not its virtqueues.
Hold the mutex across the lookup and the read.
This issue was found by an in-house static analysis tool.
Fixes: a7f0d7aab0b4 ("virtiofs: split requests that exceed virtqueue size")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/virtio_fs.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index f15e516ebcb5c..8519dfa09ccf6 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -455,26 +455,23 @@ static int virtio_fs_add_instance(struct virtio_device *vdev,
return ret;
}
-/* Return the virtio_fs with a given tag, or NULL */
+/* Return the virtio_fs with a given tag, or NULL.
+ * Callers hold virtio_fs_mutex, which also keeps the virtqueues alive.
+ */
static struct virtio_fs *virtio_fs_find_instance(const char *tag)
{
struct virtio_fs *fs;
- mutex_lock(&virtio_fs_mutex);
+ lockdep_assert_held(&virtio_fs_mutex);
list_for_each_entry(fs, &virtio_fs_instances, list) {
if (strcmp(fs->tag, tag) == 0) {
kobject_get(&fs->kobj);
- goto found;
+ return fs;
}
}
- fs = NULL; /* not found */
-
-found:
- mutex_unlock(&virtio_fs_mutex);
-
- return fs;
+ return NULL; /* not found */
}
static void virtio_fs_free_devs(struct virtio_fs *fs)
@@ -1698,13 +1695,17 @@ static int virtio_fs_get_tree(struct fs_context *fsc)
* in chan->iq->priv. Once fuse_conn is going away, it calls ->put()
* to drop the reference to this object.
*/
+ mutex_lock(&virtio_fs_mutex);
fs = virtio_fs_find_instance(fsc->source);
+ if (fs)
+ virtqueue_size = virtqueue_get_vring_size(fs->vqs[VQ_REQUEST].vq);
+ mutex_unlock(&virtio_fs_mutex);
+
if (!fs) {
pr_info("virtio-fs: tag <%s> not found\n", fsc->source);
return -EINVAL;
}
- virtqueue_size = virtqueue_get_vring_size(fs->vqs[VQ_REQUEST].vq);
if (WARN_ON(virtqueue_size <= FUSE_HEADER_OVERHEAD))
goto out_err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0839/1257] virtiofs: validate fixed-output response length
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (837 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0838/1257] virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0840/1257] ASoC: amd: acp-config: force SoundWire probe on Dell 14S DS14265 Greg Kroah-Hartman
` (159 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sung Byeongchan, Miklos Szeredi,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sung Byeongchan <tjdqudcks0424@naver.com>
[ Upstream commit 5364d081125a34e90851fbb46ecc93f79339ce78 ]
A short successful virtiofs response can leave the fixed-output portion of
the request argument buffer unwritten. The completion path nevertheless
copies the full declared output to the request destination, allowing stale
allocator contents to reach callers such as fuse_statfs().
Require successful fixed-output responses to contain their complete
declared output. Continue to permit a shorter final argument only for
out_argvar requests. Reject positive and internal restart error values
and require valid error replies to be header-only. The error already
stored in the FUSE output header is returned by fuse_request_end(), so do
not copy output arguments from an error reply.
This was found by source review with AI assistance. A header-only
successful FUSE_STATFS reply returned stale fields in nine of nine calls
across three boots. The fixed kernel rejected the short response and
preserved complete replies, valid negative-error replies, and
variable-output replies.
Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/virtio_fs.c | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index 8519dfa09ccf6..0150c5cfc311b 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -727,6 +727,10 @@ static void copy_args_from_argbuf(struct fuse_args *args, struct fuse_req *req)
unsigned int num_out;
unsigned int i;
+ /* fuse_request_end() returns this error; there are no args to copy. */
+ if (req->out.h.error)
+ goto out;
+
remaining = req->out.h.len - sizeof(req->out.h);
num_in = args->in_numargs - args->in_pages;
num_out = args->out_numargs - args->out_pages;
@@ -752,6 +756,7 @@ static void copy_args_from_argbuf(struct fuse_args *args, struct fuse_req *req)
if (args->out_argvar)
args->out_args[args->out_numargs - 1].size = remaining;
+out:
kfree(req->argbuf);
req->argbuf = NULL;
}
@@ -759,7 +764,9 @@ static void copy_args_from_argbuf(struct fuse_args *args, struct fuse_req *req)
/* Verify that the server properly follows the FUSE protocol */
static bool virtio_fs_verify_response(struct fuse_req *req, unsigned int len)
{
+ struct fuse_args *args = req->args;
struct fuse_out_header *oh = &req->out.h;
+ unsigned int expected;
if (len < sizeof(*oh)) {
pr_warn("virtio-fs: response too short (%u)\n", len);
@@ -774,6 +781,29 @@ static bool virtio_fs_verify_response(struct fuse_req *req, unsigned int len)
oh->unique, req->in.h.unique);
return false;
}
+ if (oh->error <= -ERESTARTSYS || oh->error > 0) {
+ pr_warn("virtio-fs: invalid error value (%d)\n", oh->error);
+ return false;
+ }
+
+ if (oh->error) {
+ if (len != sizeof(*oh)) {
+ pr_warn("virtio-fs: error response too long (%u)\n", len);
+ return false;
+ }
+ return true;
+ }
+
+ expected = sizeof(*oh) +
+ fuse_len_args(args->out_numargs, args->out_args);
+ if (len > expected ||
+ (len < expected &&
+ (!args->out_argvar ||
+ expected - len > args->out_args[args->out_numargs - 1].size))) {
+ pr_warn("virtio-fs: invalid response length (%u, expected %u)\n",
+ len, expected);
+ return false;
+ }
return true;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0840/1257] ASoC: amd: acp-config: force SoundWire probe on Dell 14S DS14265
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (838 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0839/1257] virtiofs: validate fixed-output response length Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0841/1257] fuse: fix copy_file_range reply handling race Greg Kroah-Hartman
` (158 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Art O Cathain, Vijendar Mukunda,
Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Art O Cathain <art.home@gmail.com>
[ Upstream commit 38cb2ef26b6411277826da54c6bcf94523541058 ]
The BIOS on the Dell 14S DS14265 (ACP PCI revision 0x72) reports
acp-audio-config-flag = FLAG_AMD_LEGACY_ONLY_DMIC. As a result
snd_pci_ps returns early and the SoundWire links are never scanned,
while the legacy snd_acp_pci driver probes the device, finds no
matching machine driver ("No matching ASoC machine driver found") and
no internal sound card is created. The CS42L45 headset codec on link 0
and the two CS35L63 speaker amplifiers on link 1 never enumerate.
Add a DMI entry for the model to the ACP70 ACPI flag override table so
the firmware-provided flag is overridden and snd_pci_ps probes instead.
Match on the product name rather than the board name, as the same
symptom has been reported on several boards of this model (09PVND,
0M0J65, 0C7F12).
Tested on a DS14265 (board 09PVND, BIOS 1.5.3) with Debian's 7.2.6
kernel, with and without this entry. With it, snd_pci_ps binds, both
SoundWire links come up, the CS42L45 and both CS35L63 enumerate, the
existing CS42L45 + 2x CS35L63 machine entry matches, the amplifiers
load their firmware and calibration, and the amd-soundwire card plays
through both the internal speakers and the headphone jack. Also
build-tested on asoc-next with W=1.
Developed with AI assistance. Claude read the ACP driver source,
identified the BIOS flag as the cause and the override table as the
fix, wrote the DMI entry and the out-of-tree test module, and drafted
this changelog. All hardware testing was done by the submitter, who
has reviewed the change, understands it and takes responsibility for
it.
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Art O Cathain <art.home@gmail.com>
Reviewed-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20261016-dell-14s-acp-v1-1-89b40d95720c@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/amd/acp-config.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/sound/soc/amd/acp-config.c b/sound/soc/amd/acp-config.c
index 3d48bb0f100f2..f190d3cdc81e3 100644
--- a/sound/soc/amd/acp-config.c
+++ b/sound/soc/amd/acp-config.c
@@ -98,6 +98,13 @@ static const struct dmi_system_id acp70_acpi_flag_override_table[] = {
DMI_MATCH(DMI_BOARD_NAME, "8EA2"),
},
},
+ {
+ /* Dell 14S DS14265 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Dell 14S DS14265"),
+ },
+ },
{}
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0841/1257] fuse: fix copy_file_range reply handling race
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (839 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0840/1257] ASoC: amd: acp-config: force SoundWire probe on Dell 14S DS14265 Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0842/1257] ublk: pin module while release work is pending Greg Kroah-Hartman
` (157 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Miklos Szeredi,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <nicoyip.dev@gmail.com>
[ Upstream commit bf4ccbaad8bdff8c90fd290ed6135b63f89ee8a7 ]
__fuse_copy_file_range() selects its request opcode and output buffer
using fc->no_copy_file_range_64, then reads the flag again to handle the
reply. Copies to different destination inodes can run concurrently on
the same connection, so the flag may change while a request is pending.
For example, task A submits FUSE_COPY_FILE_RANGE_64 and waits for its
reply. Task B submits the same opcode, receives -ENOSYS and sets
no_copy_file_range_64. When A receives a successful reply, it reads the
uninitialized outarg.size instead of outarg_64.bytes_copied. This can
produce an incorrect return value, page cache invalidation range and
inode size update, and disclose stack contents if automatic stack
initialization is disabled.
If A also receives -ENOSYS, it instead mistakes that reply for rejection
of the legacy opcode and sets no_copy_file_range, skipping the legacy
fallback and unnecessarily disabling copy offload for the connection.
KCSAN reported the conflicting accesses:
BUG: KCSAN: data-race in __fuse_copy_file_range / __fuse_copy_file_range
read to 0xffff8881014a4d4d of 1 bytes by task 123 on cpu 4:
__fuse_copy_file_range+0x1a7/0x6e0
fuse_copy_file_range+0x54/0xd0
vfs_copy_file_range+0x290/0x9d0
__do_sys_copy_file_range+0x10f/0x2f0
write to 0xffff8881014a4d4d of 8 bytes by task 119 on cpu 0:
__fuse_copy_file_range+0x633/0x6e0
fuse_copy_file_range+0x54/0xd0
vfs_copy_file_range+0x290/0x9d0
__do_sys_copy_file_range+0x10f/0x2f0
The bug can lead to leak kernel base address for KASLR bypass, the
corresponding reproducer can be provided per request.
Use args.opcode for both -ENOSYS handling and output buffer selection.
It records the opcode actually sent and is updated on fallback, keeping
each reply tied to its request regardless of concurrent flag updates.
Fixes: 7a37f55af7af ("fuse: add COPY_FILE_RANGE_64 that allows large copies")
Cc: stable@vger.kernel.org
Assisted-by: GPT-6 Astra
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/file.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 49266440cbedb..bf79c6eb3062c 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -3042,7 +3042,7 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
}
err = fuse_simple_request(fm, &args);
if (err == -ENOSYS) {
- if (fc->no_copy_file_range_64) {
+ if (args.opcode == FUSE_COPY_FILE_RANGE) {
fc->no_copy_file_range = 1;
err = -EOPNOTSUPP;
} else {
@@ -3053,7 +3053,7 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
if (err)
goto out;
- bytes_copied = fc->no_copy_file_range_64 ?
+ bytes_copied = args.opcode == FUSE_COPY_FILE_RANGE ?
outarg.size : outarg_64.bytes_copied;
if (bytes_copied > len) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0842/1257] ublk: pin module while release work is pending
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (840 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0841/1257] fuse: fix copy_file_range reply handling race Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0843/1257] ipc, msg: Account msg_msg allocations with GFP_KERNEL_ACCOUNT again Greg Kroah-Hartman
` (156 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sonotri, Ming Lei, Jens Axboe,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: sonotri <sono7ri@gmail.com>
[ Upstream commit afc9cde716b29ce814798d649a95f9128ba42b43 ]
ublk_ch_release() takes a device reference and queues exit_work. The VFS
module reference held through the file operations is dropped after
->release() returns. A queued work item does not acquire its own module
reference for the callback.
Consequently, normal module removal can start while exit_work is pending or
executing. In addition to the worker callback itself, the final device put
can invoke ublk_cdev_rel(), which is also module code.
Take a module reference while ->release() is still covered by the file
operations reference and drop it only after the worker has completed its
final device put. A rearming worker retains the same reference.
Merely canceling exit_work during module exit is insufficient. The worker
is the terminal path for the device reference taken by ublk_ch_release(),
so its cancellation would strand that reference and skip the associated
cleanup.
Fixes: c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed")
Cc: stable@vger.kernel.org
Signed-off-by: sonotri <sono7ri@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261015120654.241354-1-sono7ri@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index a49bd30154e01..1ef01ce18f4f0 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2637,6 +2637,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
/* put the reference grabbed in ublk_ch_release() */
ublk_put_device(ub);
+ module_put(THIS_MODULE);
}
static int ublk_ch_release(struct inode *inode, struct file *filp)
@@ -2652,6 +2653,8 @@ static int ublk_ch_release(struct inode *inode, struct file *filp)
*/
ublk_get_device(ub);
+ /* Keep the worker's callback and final device release code resident. */
+ __module_get(THIS_MODULE);
INIT_DELAYED_WORK(&ub->exit_work, ublk_ch_release_work_fn);
schedule_delayed_work(&ub->exit_work, 0);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0843/1257] ipc, msg: Account msg_msg allocations with GFP_KERNEL_ACCOUNT again
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (841 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0842/1257] ublk: pin module while release work is pending Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0844/1257] mptcp: reset msk state on early connect failure Greg Kroah-Hartman
` (155 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kees Cook, Vlastimil Babka (SUSE),
Harry Yoo (Meta), Pedro Falcato, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <kees@kernel.org>
[ Upstream commit c57fbbe42e907fa26c5ffada52d913d4ca5fa66e ]
Since commit 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for
alloc_msg()"), alloc_msg() allocates with GFP_KERNEL, and a msg_msg is
accounted only through SLAB_ACCOUNT on its bucket caches. With
CONFIG_SLAB_BUCKETS=n, kmem_buckets_create() creates no caches and
kmem_buckets_alloc() is a GFP_KERNEL kmalloc() from the general caches,
which do not account it; the same happens when kmem_buckets_create()
fails. Either way, the allocation is not charged to the sender's memory
cgroup.
Allocate with GFP_KERNEL_ACCOUNT again, as before that commit, so the
allocation is charged whichever cache serves it.
Build tested ARCH=x86_64 defconfig with GCC 16.2.0, with
CONFIG_SLAB_BUCKETS as y and n.
Fixes: 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for alloc_msg()")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
Link: https://patch.msgid.link/20261014052344.384723-2-kees@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
ipc/msgutil.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/ipc/msgutil.c b/ipc/msgutil.c
index e28f0cecb2ec9..12663a40e9ae6 100644
--- a/ipc/msgutil.c
+++ b/ipc/msgutil.c
@@ -58,7 +58,8 @@ static struct msg_msg *alloc_msg(size_t len)
size_t alen;
alen = min(len, DATALEN_MSG);
- msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen, GFP_KERNEL);
+ msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen,
+ GFP_KERNEL_ACCOUNT);
if (msg == NULL)
return NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0844/1257] mptcp: reset msk state on early connect failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (842 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0843/1257] ipc, msg: Account msg_msg allocations with GFP_KERNEL_ACCOUNT again Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0845/1257] mptcp: fix subflow bitfield misuse Greg Kroah-Hartman
` (154 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quanye Yang, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quanye Yang <quanyeyang@proton.me>
[ Upstream commit 29afe67082b2d33ab2e90c56c337235d725f023f ]
mptcp_connect() can fall back before the subflow SYN is sent, for
example when the netns is in an MPTCP blackhole, token allocation fails,
or MD5SIG is in use. If the subsequent subflow connect() fails
immediately (EAFNOSUPPORT, ENETUNREACH, ...), __inet_stream_connect()
returns while the socket is still SS_UNCONNECTED and never calls
->disconnect(). This was reported by Clashiko [1].
The error path only dropped the token and moved the msk back to
TCP_CLOSE. MPTCP_FALLBACK_DONE, allow_subflows and
request_mptcp were left as after early fallback, so a later
connect() on the same fd stayed TCP-only.
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/633 [1]
Fixes: 0235d075a592 ("mptcp: mark as fallback even early ones")
Cc: stable@vger.kernel.org
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-1-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/protocol.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index b902e24acd68b..05c38564e8fdf 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -4233,9 +4233,16 @@ static int mptcp_connect(struct sock *sk, struct sockaddr_unsized *uaddr,
* subflow_finish_connect()
*/
if (unlikely(err)) {
- /* avoid leaving a dangling token in an unconnected socket */
mptcp_token_destroy(msk);
mptcp_set_state(sk, TCP_CLOSE);
+
+ spin_lock_bh(&msk->fallback_lock);
+ msk->allow_subflows = true;
+ msk->allow_infinite_fallback = true;
+ clear_bit(MPTCP_FALLBACK_DONE, &msk->flags);
+ spin_unlock_bh(&msk->fallback_lock);
+
+ mptcp_subflow_ctx_reset(mptcp_subflow_ctx(ssk));
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0845/1257] mptcp: fix subflow bitfield misuse
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (843 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0844/1257] mptcp: reset msk state on early connect failure Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0846/1257] ALSA: seq: oss: Skip events until fully initialized Greg Kroah-Hartman
` (153 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 7538fa33bb2f66b8b809ff39d58308be48e197a0 ]
The subflow status bitfield is protected by the subflow socket lock,
with one notable exception: the `close_event_done` bit is actually under
the msk socket lock protection.
As reported by Clashiko [1], flipping the latter bit may corrupt other
entries in the same bitfield.
Move the `close_event_done` outside the bitfield, in a 32bit hole.
Link: https://lore.kernel.org/178959153492.22033.1944011998010756543@kernel.org
Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-2-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/protocol.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 3c9ad99ee7ef0..4ed598febbf01 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -583,14 +583,16 @@ struct mptcp_subflow_context {
closing : 1, /* must not pass rx data to msk anymore */
valid_csum_seen : 1, /* at least one csum validated */
is_mptfo : 1, /* subflow is doing TFO */
- close_event_done : 1, /* has done the post-closed part */
mpc_drop : 1, /* the MPC option has been dropped in a rtx */
resetting : 1, /* subflow is resetting */
- __unused : 8;
+ __unused : 9;
bool data_avail;
bool scheduled;
bool pm_listener; /* a listener managed by the kernel PM? */
bool fully_established; /* path validated */
+ bool close_event_done; /* has done the post-closed part,
+ * protected by msk socket lock
+ */
u32 lent_mem_frag;
u32 remote_nonce;
u64 thmac;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0846/1257] ALSA: seq: oss: Skip events until fully initialized
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (844 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0845/1257] mptcp: fix subflow bitfield misuse Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0847/1257] ALSA: hda/realtek: Enable mute LEDs on HP OmniBook X Flip 14-fm0xxx Greg Kroah-Hartman
` (152 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 68d4a6ea6cc6091a05836f783bc17d525d266d0b ]
When an OSS sequencer device is opened, it creates a sequencer port,
then further initializes the internal states like a timer instance,
etc. Since the sequencer port is published, an event can be already
delivered, and this may hit unexpected event handling, which can
eventually cause a NULL dereference (like the timer start/stop event
triggered before the timer initialization).
For avoiding such a race, introduce a simple guard and skips the event
processing until the port is fully initialized.
At releasing the device, in turn, clear this guard, so that any input
events will be discarded during the teardown.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261016161930.482309-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/seq/oss/seq_oss_device.h | 1 +
sound/core/seq/oss/seq_oss_event.c | 3 +++
sound/core/seq/oss/seq_oss_init.c | 2 ++
3 files changed, 6 insertions(+)
diff --git a/sound/core/seq/oss/seq_oss_device.h b/sound/core/seq/oss/seq_oss_device.h
index 935cf3df0b30f..571186db4fa59 100644
--- a/sound/core/seq/oss/seq_oss_device.h
+++ b/sound/core/seq/oss/seq_oss_device.h
@@ -72,6 +72,7 @@ struct seq_oss_devinfo {
int cseq; /* sequencer client number */
int port; /* sequencer port number */
int queue; /* sequencer queue number */
+ bool initialized;
struct snd_seq_addr addr; /* address of this device */
diff --git a/sound/core/seq/oss/seq_oss_event.c b/sound/core/seq/oss/seq_oss_event.c
index 122735862044d..20f4c5ce763cc 100644
--- a/sound/core/seq/oss/seq_oss_event.c
+++ b/sound/core/seq/oss/seq_oss_event.c
@@ -425,6 +425,9 @@ snd_seq_oss_event_input(struct snd_seq_event *ev, int direct, void *private_data
struct seq_oss_devinfo *dp = (struct seq_oss_devinfo *)private_data;
union evrec *rec;
+ if (!dp || !smp_load_acquire(&dp->initialized))
+ return 0; /* ignored */
+
if (ev->type != SNDRV_SEQ_EVENT_ECHO)
return snd_seq_oss_midi_input(ev, direct, private_data);
diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
index 1aece46c8b064..a1063dc22d462 100644
--- a/sound/core/seq/oss/seq_oss_init.c
+++ b/sound/core/seq/oss/seq_oss_init.c
@@ -258,6 +258,7 @@ snd_seq_oss_open(struct file *file, int level)
client_table[dp->index] = dp;
num_clients++;
+ smp_store_release(&dp->initialized, true);
return 0;
@@ -403,6 +404,7 @@ snd_seq_oss_release(struct seq_oss_devinfo *dp)
client_table[dp->index] = NULL;
num_clients--;
+ smp_store_release(&dp->initialized, false);
snd_seq_oss_reset(dp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0847/1257] ALSA: hda/realtek: Enable mute LEDs on HP OmniBook X Flip 14-fm0xxx
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (845 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0846/1257] ALSA: seq: oss: Skip events until fully initialized Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0848/1257] ALSA: hda/realtek: Fix internal speakers on Acer Aspire AL16-31P Greg Kroah-Hartman
` (151 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches,
José Miguel Castellanos Valladolid, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Miguel Castellanos Valladolid <josstamy@gmail.com>
[ Upstream commit c80286aaa4acd52f9bd0b0d4914d2069fe6ba3a8 ]
The HP OmniBook X Flip Laptop 14-fm0xxx (subsystem ID 0x103c8d9f, ALC245
with two CS35L41 amplifiers over I2C) is currently handled by
ALC287_FIXUP_CS35L41_I2C_2. That binds the amplifiers but does not set up
the mute LEDs, so neither the speaker mute key LED nor the microphone mute
key LED lights up under Linux. With that fixup the codec GPIOs stay
disabled (IO[0..2] enable=0).
Switch the entry to ALC287_FIXUP_CS35L41_I2C_2_HP_MUTE_LEDS, which chains
cs35l41_fixup_i2c_two with ALC245_FIXUP_HP_X360_MUTE_LEDS. This keeps the
amplifier setup and adds the speaker mute LED through the ALC245 COEF
register and the mic mute LED through codec GPIO2. It is the same fixup
already used for the 17 Turbine OmniBook 7 DIS (0x103c8d9c).
Tested on the affected laptop with v7.2.11 using the equivalent
ALC245_FIXUP_HP_ENVY_X360_15_FH0XXX fixup, which has the identical
cs35l41_fixup_i2c_two + ALC245_FIXUP_HP_X360_MUTE_LEDS chain: hda::mute
and hda::micmute LED class devices appear and both key LEDs light up
when muting.
Fixes: 29951021367f ("ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA")
Cc: stable@vger.kernel.org
Signed-off-by: José Miguel Castellanos Valladolid <josstamy@gmail.com>
Link: https://patch.msgid.link/20261017050615.14481-1-josstamy@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 58948a3bbda04..946989d9315a5 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7762,7 +7762,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x103c, 0x8d9c, "HP 17 Turbine OmniBook 7 DIS", ALC287_FIXUP_CS35L41_I2C_2_HP_MUTE_LEDS),
SND_PCI_QUIRK(0x103c, 0x8d9d, "HP 17 Turbine OmniBook X UMA", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x103c, 0x8d9e, "HP 17 Turbine OmniBook X DIS", ALC287_FIXUP_CS35L41_I2C_2),
- SND_PCI_QUIRK(0x103c, 0x8d9f, "HP 14 Cadet (x360)", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8d9f, "HP 14 Cadet (x360)", ALC287_FIXUP_CS35L41_I2C_2_HP_MUTE_LEDS),
SND_PCI_QUIRK(0x103c, 0x8da0, "HP 16 Clipper OmniBook 7(X360)", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x103c, 0x8da1, "HP 16 Clipper OmniBook X", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x103c, 0x8da7, "HP 14 Enstrom OmniBook X", ALC287_FIXUP_CS35L41_I2C_2),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0848/1257] ALSA: hda/realtek: Fix internal speakers on Acer Aspire AL16-31P
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (846 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0847/1257] ALSA: hda/realtek: Enable mute LEDs on HP OmniBook X Flip 14-fm0xxx Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0849/1257] KVM: arm64: vgic-its: Dont map an LPI from more than one event Greg Kroah-Hartman
` (150 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luis Gerardo Lopez Hernandez,
Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Gerardo Lopez Hernandez <gamaerry@gmail.com>
[ Upstream commit d933955c456e0573b40eae4f72a3af37ab1c15c3 ]
The Acer Aspire AL16-31P (Intel Alder Lake-N, Realtek ALC269VC,
PCI/codec SSID 2782:1718) has its internal speakers wired to pin 0x1b,
but the BIOS marks that pin as not connected (0x411111f0) and only
exposes pin 0x14 as the speaker. As a result the internal speakers are
silent while headphones, HDMI and Bluetooth work.
This is the same layout as the Infinix Y4 Max and MEDION E15433, which
share the 0x2782 subsystem vendor. Reuse their fixup, which configures
pin 0x1b as an internal speaker and limits the internal mic boost.
Tested by booting with snd-hda-intel model=2782:1705: the fixup is
picked, pin 0x1b is used as a speaker output, the internal speakers
work, and they are muted when headphones are plugged in.
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Luis Gerardo Lopez Hernandez <gamaerry@gmail.com>
Link: https://patch.msgid.link/20261017005039.9139-1-gamaerry@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 946989d9315a5..e71f78b13a277 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -8460,6 +8460,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x2782, 0x1701, "Infinix Y4 Max", ALC269VC_FIXUP_INFINIX_Y4_MAX),
SND_PCI_QUIRK(0x2782, 0x1705, "MEDION E15433", ALC269VC_FIXUP_INFINIX_Y4_MAX),
SND_PCI_QUIRK(0x2782, 0x1707, "Vaio VJFE-ADL", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x2782, 0x1718, "Acer Aspire AL16-31P", ALC269VC_FIXUP_INFINIX_Y4_MAX),
SND_PCI_QUIRK(0x2782, 0x4900, "MEDION E15443", ALC233_FIXUP_MEDION_MTL_SPK),
SND_PCI_QUIRK(0x2782, 0xa128, "Positivo N15RPE-S", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x2782, 0xa212, "Lunnen Ground 14", ALC269VC_FIXUP_LUNNEN_GROUND_14),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0849/1257] KVM: arm64: vgic-its: Dont map an LPI from more than one event
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (847 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0848/1257] ALSA: hda/realtek: Fix internal speakers on Acer Aspire AL16-31P Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0850/1257] perf python: Free the parse error entries when parsing fails Greg Kroah-Hartman
` (149 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Zyngier, Fuad Tabba,
Oliver Upton, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fuad Tabba <fuad.tabba@linux.dev>
[ Upstream commit de81b28f0b83b22163d7d9a9b708d7aa912e0ef7 ]
KVM keeps one vgic_irq per LPI. A MAPTI of an LPI whose vgic_irq
already exists reuses it for the new ITE and leaves its target vCPU as
it was. Mapping one LPI from two events is UNPREDICTABLE (IHI 0069H.b,
5.2.10), but nothing stops a guest from doing it. If the first MAPTI
names a collection the guest never maps and the second a mapped one,
the LPI translates through the second event with a NULL target vCPU.
When the VMM routes an assigned device's MSI to that event on a host
with GICv4 enabled, kvm_vgic_v4_set_forwarding() takes the vPE from the
NULL target vCPU and the host oopses:
Unable to handle kernel paging request at virtual address 0000000000001980
[...]
Call trace:
its_build_vmapti_cmd (drivers/irqchip/irq-gic-v3-its.c:943) (P)
its_irq_set_vcpu_affinity (drivers/irqchip/irq-gic-v3-its.c:1380)
irq_set_vcpu_affinity (kernel/irq/manage.c:670)
its_map_vlpi (drivers/irqchip/irq-gic-v4.c:326)
kvm_vgic_v4_set_forwarding (arch/arm64/kvm/vgic/vgic-v4.c:485)
kvm_arch_irq_bypass_add_producer (arch/arm64/kvm/arm.c:2977)
irq_bypass_register_consumer (virt/lib/irqbypass.c:44)
kvm_irqfd (arch/arm64/kvm/../../../virt/kvm/eventfd.c:496)
kvm_vm_ioctl (arch/arm64/kvm/../../../virt/kvm/kvm_main.c:5270)
Track in each vgic_irq whether an ITE maps it. Drop a MAPTI of an LPI
that is already mapped, as a failed MAPTI already is. Restoring the ITS
tables keeps the first ITE it reads for each LPI and drops any later
one, so a guest saved with a double mapping still restores. Key the
check on the mapping, not on the vgic_irq. A vgic_irq outlives its ITE
while anything holds a reference to it, such as the vCPU it was last
queued on. A later MAPTI of such an LPI succeeds as before, and now
retargets it to its collection.
Fixes: 196b136498b35 ("KVM: arm/arm64: GICv4: Wire mapping/unmapping of VLPIs in VFIO irq bypass")
Suggested-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Reviewed-by: Oliver Upton <oupton@kernel.org>
Link: https://patch.msgid.link/20261013081646.933312-2-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/vgic/vgic-its.c | 26 ++++++++++++++++++++++++--
include/kvm/arm_vgic.h | 1 +
2 files changed, 25 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
index c10a11373e106..642dd6d0eb333 100644
--- a/arch/arm64/kvm/vgic/vgic-its.c
+++ b/arch/arm64/kvm/vgic/vgic-its.c
@@ -776,6 +776,7 @@ static void its_free_ite(struct kvm *kvm, struct its_ite *ite)
its_unmap_vlpi(ite->irq->host_irq);
irq->hw = false;
+ irq->mapped = false;
}
vgic_put_irq(kvm, ite->irq);
@@ -784,6 +785,23 @@ static void its_free_ite(struct kvm *kvm, struct its_ite *ite)
kfree(ite);
}
+/* Mapping one LPI from two events is UNPREDICTABLE: the first ITE keeps it. */
+static bool vgic_its_map_lpi(struct kvm *kvm, struct its_ite *ite,
+ struct vgic_irq *irq, struct kvm_vcpu *vcpu)
+{
+ scoped_guard(raw_spinlock_irqsave, &irq->irq_lock) {
+ if (!irq->mapped) {
+ irq->mapped = true;
+ irq->target_vcpu = vcpu;
+ ite->irq = irq;
+ return true;
+ }
+ }
+
+ vgic_put_irq(kvm, irq);
+ return false;
+}
+
static u64 its_cmd_mask_field(u64 *its_cmd, int word, int shift, int size)
{
return (le64_to_cpu(its_cmd[word]) >> shift) & (BIT_ULL(size) - 1);
@@ -1093,13 +1111,14 @@ static int vgic_its_cmd_handle_mapi(struct kvm *kvm, struct vgic_its *its,
vcpu = collection_to_vcpu(kvm, collection);
irq = vgic_add_lpi(kvm, lpi_nr, vcpu);
+ if (!IS_ERR(irq) && !vgic_its_map_lpi(kvm, ite, irq, vcpu))
+ irq = ERR_PTR(-EEXIST);
if (IS_ERR(irq)) {
if (new_coll)
vgic_its_free_collection(its, coll_id);
its_free_ite(kvm, ite);
return PTR_ERR(irq);
}
- ite->irq = irq;
return 0;
}
@@ -2208,7 +2227,10 @@ static int vgic_its_restore_ite(struct vgic_its *its, u32 event_id,
its_free_ite(kvm, ite);
return PTR_ERR(irq);
}
- ite->irq = irq;
+
+ /* Drop an ITE whose LPI another ITE maps, as MAPTI does. */
+ if (!vgic_its_map_lpi(kvm, ite, irq, vcpu))
+ its_free_ite(kvm, ite);
return offset;
}
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 086b7578e5f33..5c3a0154becc4 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -256,6 +256,7 @@ struct vgic_irq {
bool active:1;
bool hw:1; /* Tied to HW IRQ */
bool on_lr:1; /* Present in a CPU LR */
+ bool mapped:1; /* LPIs: mapped by an ITE */
refcount_t refcount; /* Used for LPIs */
u32 hwintid; /* HW INTID number */
unsigned int host_irq; /* linux irq corresponding to hwintid */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0850/1257] perf python: Free the parse error entries when parsing fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (848 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0849/1257] KVM: arm64: vgic-its: Dont map an LPI from more than one event Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0851/1257] sched_ext: Dont leave balance callbacks queued across a pick retry Greg Kroah-Hartman
` (148 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Ian Rogers,
Arnaldo Carvalho de Melo, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 39e0022c89abcdc1a811dfc0aeec2a2b9010b660 ]
pyrf__parse_events() prints the entries parse_events_error__print()
receives with the details of a failed parse, but returns without freeing
them, leaking whatever parse_events_error__handle() allocated, so call
parse_events_error__exit() on both paths, as the other parse_events()
callers do.
The perf test attr core PMU probe takes this failure path on machines
without a core PMU, where the leak then happens on every test run.
Fixes: f081defccd93 ("perf python: Add parse_events function")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/sashiko-outbox-173525@kernel.org
Reviewed-by: Ian Rogers <irogers@google.com>
Tested-by: Ian Rogers <irogers@google.com>
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/python.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index d8a842621cda0..c504b83be39fb 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -3469,10 +3469,12 @@ static PyObject *pyrf__parse_events(PyObject *self, PyObject *args)
perf_evlist__set_maps(evlist__core(evlist), cpus, threads);
if (parse_events(evlist, input, &err)) {
parse_events_error__print(&err, input);
+ parse_events_error__exit(&err);
PyErr_SetFromErrno(PyExc_OSError);
evlist__put(evlist);
return NULL;
}
+ parse_events_error__exit(&err);
result = pyrf_evlist__from_evlist(evlist);
evlist__put(evlist);
return result;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0851/1257] sched_ext: Dont leave balance callbacks queued across a pick retry
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (849 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0850/1257] perf python: Free the parse error entries when parsing fails Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0852/1257] power: supply: qcom_smbx: set the charge enable after software control Greg Kroah-Hartman
` (147 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrea Righi, Tejun Heo, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Righi <arighi@nvidia.com>
[ Upstream commit ff0545e0c263727b200f60af47d0364e4d041bde ]
The dispatch path can request deferred work to be run from a balance
callback and pick_task_scx() queues rq->scx.deferred_bal_cb right after
dispatching. However, a balance callback must be consumed before the rq
lock is released and pick_task_scx() is not necessarily the end of the
pick:
- it returns RETRY_TASK when a higher priority class task has been
enqueued while the dispatch had the rq lock released;
- the dl_server pick can return NULL, in which case the lower classes
are picked next.
In both cases the callback stays queued while the core keeps picking,
and the rq lock can be released again, either by prev_balance() or by
another dispatch. For example, with an RT task as prev:
__schedule()
__pick_next_task()
pick_task_scx()
dispatch_pick()
maybe_queue_balance_callback() <- deferred_bal_cb queued
return RETRY_TASK
prev_balance()
balance_rt()
pull_rt_task()
double_lock_balance() <- rq lock released
Any CPU acquiring the rq lock in that window finds a pending balance
callback and triggers the following warning in rq_pin_lock():
WARNING: kernel/sched/sched.h:1919 at rq_lock+0x7f/0xe0, CPU#10: stress-ng-sleep/533
CPU: 10 UID: 0 PID: 533 Comm: stress-ng-sleep Not tainted 7.2.0-rc6-virtme #61 PREEMPT(full)
Sched_ext: qmap (enabled+all)
Call Trace:
<IRQ>
try_to_wake_up+0x2c1/0x5c0
hrtimer_wakeup+0x22/0x30
__hrtimer_run_queues+0x1d5/0x350
hrtimer_interrupt+0x106/0x1e0
__sysvec_apic_timer_interrupt+0x6f/0x210
sysvec_apic_timer_interrupt+0x71/0x90
</IRQ>
This can be reproduced running scx_qmap -I together with a SCHED_FIFO
workload that frequently sleeps, e.g.:
$ vng -v --cpus 16 --memory 4G -- \
'tools/sched_ext/build/bin/scx_qmap -I >/dev/null & \
stress-ng --sleep 4 --sched fifo --sched-prio 1 -t 30 -q'
Fix this by queueing the balance callbacks only when the pick is final.
Otherwise, defer the pending work to the irq_work path, which doesn't
depend on the current rq lock section, and leave the kick sync wait
pending for the next pick.
Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/ext/ext.c | 73 ++++++++++++++++++++++++++----------------
1 file changed, 45 insertions(+), 28 deletions(-)
diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index 04167ed9b5803..8fc3f791c88f4 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -3335,7 +3335,8 @@ static struct task_struct *first_local_task(struct rq *rq)
}
/*
- * Run dispatch and queue the follow-up work for a pick.
+ * Run dispatch for a pick. The follow-up work is queued by do_pick_task_scx()
+ * once the pick is final.
*/
static enum scx_dsp_verdict dispatch_pick(struct rq *rq, struct rq_flags *rf,
struct task_struct *prev)
@@ -3345,18 +3346,6 @@ static enum scx_dsp_verdict dispatch_pick(struct rq *rq, struct rq_flags *rf,
rq_unpin_lock(rq, rf);
verdict = dispatch_one(rq, prev);
rq_repin_lock(rq, rf);
- maybe_queue_balance_callback(rq);
-
- /*
- * Defer to a balance callback which can drop rq lock and enable IRQs.
- * Waiting directly in the pick path would deadlock against CPUs sending
- * us IPIs (e.g. TLB flushes) while we wait for them.
- */
- if (unlikely(rq->scx.kick_sync_pending)) {
- rq->scx.kick_sync_pending = false;
- queue_balance_callback(rq, &rq->scx.kick_sync_bal_cb,
- kick_sync_wait_bal_cb);
- }
return verdict;
}
@@ -3383,16 +3372,8 @@ static enum scx_dsp_verdict dispatch_core_pick(struct rq *rq, struct rq_flags *r
verdict = dispatch_one(rq, prev);
- if (cpu_of(rq) == smp_processor_id()) {
- maybe_queue_balance_callback(rq);
-
- /* see dispatch_pick() */
- if (unlikely(rq->scx.kick_sync_pending)) {
- rq->scx.kick_sync_pending = false;
- queue_balance_callback(rq, &rq->scx.kick_sync_bal_cb,
- kick_sync_wait_bal_cb);
- }
- } else if (unlikely(rq->scx.flags & SCX_RQ_BAL_CB_PENDING)) {
+ if (cpu_of(rq) != smp_processor_id() &&
+ unlikely(rq->scx.flags & SCX_RQ_BAL_CB_PENDING)) {
/*
* Balance callbacks must run in the context that queued them,
* so they can't be queued on another CPU's rq. Run the deferred
@@ -3435,8 +3416,10 @@ do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
else
verdict = dispatch_pick(rq, rf, prev);
- if (verdict == SCX_DSP_RETRY)
- return RETRY_TASK;
+ if (verdict == SCX_DSP_RETRY) {
+ p = RETRY_TASK;
+ goto out;
+ }
/*
* If any higher-priority sched class enqueued a runnable task on this
@@ -3446,8 +3429,10 @@ do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
* If @force_scx is true, always try to pick a SCHED_EXT task,
* regardless of any higher-priority sched classes activity.
*/
- if (!force_scx && rq_modified_above(rq, &ext_sched_class))
- return RETRY_TASK;
+ if (!force_scx && rq_modified_above(rq, &ext_sched_class)) {
+ p = RETRY_TASK;
+ goto out;
+ }
/*
* If we're keeping @prev, replenish slice if necessary and keep running
@@ -3463,7 +3448,7 @@ do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
} else {
p = first_local_task(rq);
if (!p)
- return NULL;
+ goto out;
if (unlikely(!p->scx.slice) && scx_task_can_stay_on_cpu(rq, p)) {
struct scx_sched *sch = scx_task_sched(p);
@@ -3478,6 +3463,38 @@ do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
}
}
+out:
+ if (cpu_of(rq) != smp_processor_id())
+ return p;
+
+ /*
+ * Balance callbacks must be consumed before the rq lock is released, so
+ * queue them only when the pick is final. On RETRY_TASK, or after a
+ * NULL pick from the dl_server, the core continues picking and can
+ * release the rq lock (e.g., prev_balance() or another dispatch). In
+ * that case, run the deferred work from irq_work, which doesn't depend
+ * on the current rq lock section, and leave the kick sync wait pending
+ * for the next pick.
+ */
+ if (p != RETRY_TASK && (p || !force_scx)) {
+ maybe_queue_balance_callback(rq);
+
+ /*
+ * Defer to a balance callback which can drop rq lock and enable
+ * IRQs. Waiting directly in the pick path would deadlock against
+ * CPUs sending us IPIs (e.g., TLB flushes) while we wait for
+ * them.
+ */
+ if (unlikely(rq->scx.kick_sync_pending)) {
+ rq->scx.kick_sync_pending = false;
+ queue_balance_callback(rq, &rq->scx.kick_sync_bal_cb,
+ kick_sync_wait_bal_cb);
+ }
+ } else if (rq->scx.flags & SCX_RQ_BAL_CB_PENDING) {
+ rq->scx.flags &= ~SCX_RQ_BAL_CB_PENDING;
+ schedule_deferred(rq);
+ }
+
return p;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0852/1257] power: supply: qcom_smbx: set the charge enable after software control
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (850 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0851/1257] sched_ext: Dont leave balance callbacks queued across a pick retry Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0853/1257] power: supply: cros_charge-control: restore EC state on resume Greg Kroah-Hartman
` (146 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabricio Akio, Sebastian Reichel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabricio Akio <fabricioakio@gmail.com>
[ Upstream commit 1fba787142011145e1071cee9448b3677fb2323d ]
The init sequence sets CHARGING_ENABLE_CMD before CHGR_CFG2 selects
software control of the charge enable.
The Motorola Moto X4's bootloader leaves the charger watchdog armed to
disable charging when it bites, which it does after a few minutes in
fastboot. Charging then stays disabled in the next boot until the cable
is replugged. Setting the command after CHGR_CFG2 re-enables it.
Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Fabricio Akio <fabricioakio@gmail.com>
Link: https://patch.msgid.link/20261002-qcom-smbx-enable-order-v1-1-7df92bd809db@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_smbx.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index f5557b8cc92ae..8c6b7c46b85f0 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -819,11 +819,7 @@ static const struct smb_init_register smb_init_seq[] = {
.mask = SOC_LT_CHG_RECHARGE_THRESH_SEL_BIT |
VBT_LT_CHG_RECHARGE_THRESH_SEL_BIT,
.val = VBT_LT_CHG_RECHARGE_THRESH_SEL_BIT },
- /* Enable charging */
{ .addr = USBIN_OPTIONS_1_CFG, .mask = HVDCP_EN_BIT, .val = 0 },
- { .addr = CHARGING_ENABLE_CMD,
- .mask = CHARGING_ENABLE_CMD_BIT,
- .val = CHARGING_ENABLE_CMD_BIT },
/*
* Match downstream defaults
* CHG_EN_SRC_BIT - charger enable is controlled by software
@@ -844,6 +840,13 @@ static const struct smb_init_register smb_init_seq[] = {
AUTO_RECHG_BIT | EN_ANALOG_DROP_IN_VBATT_BIT |
CHARGER_INHIBIT_BIT,
.val = CHARGER_INHIBIT_BIT },
+ /*
+ * Set the enable command only once CHGR_CFG2 has selected software
+ * control, or a charger its watchdog has disabled stays disabled.
+ */
+ { .addr = CHARGING_ENABLE_CMD,
+ .mask = CHARGING_ENABLE_CMD_BIT,
+ .val = CHARGING_ENABLE_CMD_BIT },
/* STAT pin software override, match downstream. Parallel charging? */
{ .addr = STAT_CFG,
.mask = STAT_SW_OVERRIDE_CFG_BIT,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0853/1257] power: supply: cros_charge-control: restore EC state on resume
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (851 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0852/1257] power: supply: qcom_smbx: set the charge enable after software control Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0854/1257] power: supply: generic-adc-battery: fix status with no supplier Greg Kroah-Hartman
` (145 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Pam, Tzung-Bi Shih,
Thomas Weißschuh, Sebastian Reichel, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Pam <andrew@fastmailteam.com>
[ Upstream commit 1f2a40f954c848dff9d8bb6d81e404f9e47f0e81 ]
The EC resets its charge control configuration when the AP powers off,
so configured sustainer thresholds and charge behaviour are lost across
hibernation.
Nothing notices the reset. Commit 4fc88ba435da ("power: supply:
cros_charge-control: adopt EC charge state on probe"), in the
power-supply tree, made the driver adopt the EC's charge state, but only
at probe, and a resume is not a probe. Sysfs therefore keeps reporting
the configured values while the EC charges the battery to full. On a
Framework Laptop 16 (Ryzen AI 300, charge control command version 3)
with charge_control_end_threshold set to 80, a hibernate and resume
cycle leaves the attribute still reading 80 while the battery charges
past it to 100%.
Add a system sleep resume hook that reprograms the EC from the cached
state. The same EC behaviour and the same fix already exist for another
driver, see commit 2643187ccb86 ("platform/x86: ayaneo-ec: Add suspend
hook").
Reprogramming the EC is only strictly required after hibernation, but it
is cheap and idempotent, so hook every resume path rather than rely on
the EC preserving its state across each kind of sleep transition.
Note that re-reading the state from the EC on resume, by reusing
cros_chctl_init_state() or otherwise, would be wrong even on the command
versions that support GET: the EC has been reset to its defaults by the
time the hook runs, so adopting that state would silently discard the
configuration the user asked for. The driver's cached state is the only
remaining record of it, which is why it is pushed to the EC rather than
refreshed from it.
Fixes: c6ed48ef5259 ("power: supply: add ChromeOS EC based charge control driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Andrew Pam <andrew@fastmailteam.com>
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Acked-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://patch.msgid.link/20261005043418.243937-1-andrew@fastmailteam.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/cros_charge-control.c | 29 +++++++++++++++++++++-
1 file changed, 28 insertions(+), 1 deletion(-)
diff --git a/drivers/power/supply/cros_charge-control.c b/drivers/power/supply/cros_charge-control.c
index e0f168624807e..0b4aff1c29508 100644
--- a/drivers/power/supply/cros_charge-control.c
+++ b/drivers/power/supply/cros_charge-control.c
@@ -13,6 +13,7 @@
#include <linux/platform_data/cros_ec_commands.h>
#include <linux/platform_data/cros_ec_proto.h>
#include <linux/platform_device.h>
+#include <linux/pm.h>
#include <linux/types.h>
#define EC_CHARGE_CONTROL_BEHAVIOURS (BIT(POWER_SUPPLY_CHARGE_BEHAVIOUR_AUTO) | \
@@ -293,6 +294,7 @@ static int cros_chctl_probe(struct platform_device *pdev)
priv->dev = dev;
priv->cros_ec = cros_ec;
+ dev_set_drvdata(dev, priv);
if (priv->cmd_version == 1)
priv->psy_ext = &cros_chctl_psy_ext_v1;
@@ -318,6 +320,28 @@ static int cros_chctl_probe(struct platform_device *pdev)
return devm_battery_hook_register(dev, &priv->battery_hook);
}
+static int cros_chctl_resume(struct device *dev)
+{
+ struct cros_chctl_priv *priv = dev_get_drvdata(dev);
+ int ret;
+
+ /*
+ * The EC resets its charge control state when the AP powers off, so the
+ * configuration is lost across hibernation, while the values exposed to
+ * userspace still describe it. The cached state is the only remaining
+ * record of that configuration: reprogram the EC from it rather than
+ * re-reading the EC, which would adopt the reset defaults instead.
+ */
+ guard(mutex)(&priv->lock);
+ ret = cros_chctl_configure_ec(priv);
+ if (ret)
+ dev_err(dev, "failed to restore charge control state: %d\n", ret);
+
+ return ret;
+}
+
+static DEFINE_SIMPLE_DEV_PM_OPS(cros_chctl_pm_ops, NULL, cros_chctl_resume);
+
static const struct platform_device_id cros_chctl_id[] = {
{ .name = "cros-charge-control" },
{ }
@@ -325,7 +349,10 @@ static const struct platform_device_id cros_chctl_id[] = {
MODULE_DEVICE_TABLE(platform, cros_chctl_id);
static struct platform_driver cros_chctl_driver = {
- .driver.name = "cros-charge-control",
+ .driver = {
+ .name = "cros-charge-control",
+ .pm = pm_sleep_ptr(&cros_chctl_pm_ops),
+ },
.probe = cros_chctl_probe,
.id_table = cros_chctl_id,
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0854/1257] power: supply: generic-adc-battery: fix status with no supplier
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (852 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0853/1257] power: supply: cros_charge-control: restore EC state on resume Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0855/1257] power: supply: qcom_battmgr: Notify charger supplies of online changes Greg Kroah-Hartman
` (144 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Douglas, Sebastian Reichel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Douglas <me@timdoug.com>
[ Upstream commit 8ae5a3f40045ff486826ed6b6a83e39a0f380073 ]
power_supply_am_i_supplied() returns -ENODEV when no registered power
supply supplies the battery. generic-adc-battery's gab_work() tests this
return value as a boolean, so -ENODEV takes the supplied branch and
reports CHARGING, or NOT_CHARGING if the charge-finished GPIO is asserted,
instead of DISCHARGING.
This was noticed while bringing up an out-of-tree Linux port to the
WikiReader: the driver reported CHARGING on a device powered by two AAA
batteries with no charging hardware.
Only a positive return value indicates an online supplier, so treat zero
and negative returns as discharging.
Fixes: 46cecd130d55 ("power: supply: Fix power_supply_am_i_supplied to return -ENODEV when apropriate")
Cc: stable@vger.kernel.org
Signed-off-by: Tim Douglas <me@timdoug.com>
Link: https://patch.msgid.link/20261013022153.6707-1-me@timdoug.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/generic-adc-battery.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c
index f11a5c794e7e8..937b84e04ba27 100644
--- a/drivers/power/supply/generic-adc-battery.c
+++ b/drivers/power/supply/generic-adc-battery.c
@@ -135,7 +135,7 @@ static void gab_work(struct work_struct *work)
adc_bat = container_of(delayed_work, struct gab, bat_work);
status = adc_bat->status;
- if (!power_supply_am_i_supplied(adc_bat->psy))
+ if (power_supply_am_i_supplied(adc_bat->psy) <= 0)
adc_bat->status = POWER_SUPPLY_STATUS_DISCHARGING;
else if (gab_charge_finished(adc_bat))
adc_bat->status = POWER_SUPPLY_STATUS_NOT_CHARGING;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0855/1257] power: supply: qcom_battmgr: Notify charger supplies of online changes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (853 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0854/1257] power: supply: generic-adc-battery: fix status with no supplier Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0856/1257] sched_ext: Dont queue balance callbacks from a core-sched pick Greg Kroah-Hartman
` (143 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brandon Williams, Sebastian Reichel,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brandon Williams <turbine.bmw@gmail.com>
[ Upstream commit 87fd20da8ca8bacdaa9bff5860167f208077dc51 ]
On SC8280XP and X1E80100 the AC, USB and wireless supplies take their
online state from the charging source in the battery status response.
The firmware sends no notification for those supplies when the charging
source changes, and the driver only announces the battery, so userspace
never learns that the charger was plugged in or out. UPower keeps the
state it read at startup: a laptop booted on the charger never goes on
battery.
Call power_supply_changed() for a supply whose online state changes when
a status response is parsed. A supply that is not registered yet, when
the battery is read during probe, reports its state when it registers.
Tested on a Microsoft Surface Pro 11 (X1E80100): after restarting UPower
on the charger, unplugging now sets OnBattery, and plugging in clears it.
Fixes: 29e8142b5623 ("power: supply: Introduce Qualcomm PMIC GLINK power supply")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Brandon Williams <turbine.bmw@gmail.com>
Link: https://patch.msgid.link/20261013-upstream-battmgr-charger-online-v1-1-731973e133a0@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_battmgr.c | 26 +++++++++++++++++++++++---
1 file changed, 23 insertions(+), 3 deletions(-)
diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
index 7716eb9e1aff5..97c8501c29961 100644
--- a/drivers/power/supply/qcom_battmgr.c
+++ b/drivers/power/supply/qcom_battmgr.c
@@ -1254,6 +1254,23 @@ static unsigned int qcom_battmgr_sc8280xp_convert_temp(unsigned int temperature)
return DIV_ROUND_CLOSEST(temperature, 10);
}
+/*
+ * The charger supplies' online state comes from the battery status response,
+ * and the firmware sends no notification of its own when it changes, so
+ * announce the change here. A supply that is not registered yet announces its
+ * state when it is.
+ */
+static void qcom_battmgr_sc8280xp_set_online(struct power_supply *psy,
+ bool *online, bool value)
+{
+ if (*online == value)
+ return;
+
+ *online = value;
+ if (psy)
+ power_supply_changed(psy);
+}
+
static void qcom_battmgr_sc8280xp_callback(struct qcom_battmgr *battmgr,
const struct qcom_battmgr_message *resp,
size_t len)
@@ -1323,9 +1340,12 @@ static void qcom_battmgr_sc8280xp_callback(struct qcom_battmgr *battmgr,
battmgr->status.temperature = qcom_battmgr_sc8280xp_convert_temp(le32_to_cpu(resp->status.temperature));
source = le32_to_cpu(resp->status.charging_source);
- battmgr->ac.online = source == BATTMGR_CHARGING_SOURCE_AC;
- battmgr->usb.online = source == BATTMGR_CHARGING_SOURCE_USB;
- battmgr->wireless.online = source == BATTMGR_CHARGING_SOURCE_WIRELESS;
+ qcom_battmgr_sc8280xp_set_online(battmgr->ac_psy, &battmgr->ac.online,
+ source == BATTMGR_CHARGING_SOURCE_AC);
+ qcom_battmgr_sc8280xp_set_online(battmgr->usb_psy, &battmgr->usb.online,
+ source == BATTMGR_CHARGING_SOURCE_USB);
+ qcom_battmgr_sc8280xp_set_online(battmgr->wls_psy, &battmgr->wireless.online,
+ source == BATTMGR_CHARGING_SOURCE_WIRELESS);
if (battmgr->info.last_full_capacity != 0) {
/*
* 100 * battmgr->status.capacity can overflow a 32bit
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0856/1257] sched_ext: Dont queue balance callbacks from a core-sched pick
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (854 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0855/1257] power: supply: qcom_battmgr: Notify charger supplies of online changes Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0857/1257] alpha: handle VM_FAULT_HWPOISON in do_page_fault() Greg Kroah-Hartman
` (142 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrea Righi, Tejun Heo, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Righi <arighi@nvidia.com>
[ Upstream commit 680edc7f23ad71e0ecce8a2364af3ae7f30dd11a ]
Commit ff0545e0c263 ("sched_ext: Don't leave balance callbacks queued
across a pick retry") queues the deferred work as a balance callback
only when do_pick_task_scx() returns a final pick. However, under core
scheduling, a pick that returns a task isn't final either:
pick_next_task() goes on to pick the SMT siblings, and their dispatch
can release the shared rq lock with the callback still queued,
triggering the rq_pin_lock() warning.
Moreover, dispatch_core_pick() returns early when another dispatch is
in flight on the rq, and do_pick_task_scx() then consumes
%SCX_RQ_BAL_CB_PENDING set by that dispatch while it's still running.
This can be reproduced running scx_qmap -I on SMT siblings with
coresched-tagged workloads that frequently sleep, mixed with untagged
CPU-bound tasks.
Fix this by always deferring the pending work to the irq_work path from
dispatch_core_pick() under core scheduling, for both the local and the
sibling picks, and by leaving %SCX_RQ_BAL_CB_PENDING alone in
do_pick_task_scx(), so that it's handled by the dispatch that set it.
Sample the core scheduling state once at the start of the pick, since
core scheduling can get enabled while a non-core dispatch has the rq lock
released, and the follow-up work must match the dispatch path that ran.
Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/ext/ext.c | 35 ++++++++++++++++++++++++-----------
1 file changed, 24 insertions(+), 11 deletions(-)
diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index 8fc3f791c88f4..60e8bacc14bb9 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -3372,15 +3372,20 @@ static enum scx_dsp_verdict dispatch_core_pick(struct rq *rq, struct rq_flags *r
verdict = dispatch_one(rq, prev);
- if (cpu_of(rq) != smp_processor_id() &&
- unlikely(rq->scx.flags & SCX_RQ_BAL_CB_PENDING)) {
- /*
- * Balance callbacks must run in the context that queued them,
- * so they can't be queued on another CPU's rq. Run the deferred
- * work directly instead.
- */
+ /*
+ * A pick that returns a task isn't final under core scheduling: the
+ * selection goes on to pick the siblings, and their dispatch can
+ * release the rq lock, which can't happen with balance callbacks
+ * queued. Don't queue the deferred work as a balance callback, for this
+ * CPU or a sibling, and run it from irq_work instead.
+ *
+ * do_pick_task_scx() leaves %SCX_RQ_BAL_CB_PENDING alone under core
+ * scheduling, so that the early return above leaves it to the dispatch
+ * in flight, which handles it here.
+ */
+ if (unlikely(rq->scx.flags & SCX_RQ_BAL_CB_PENDING)) {
rq->scx.flags &= ~SCX_RQ_BAL_CB_PENDING;
- run_deferred(rq);
+ schedule_deferred(rq);
}
rq_repin_lock(rq, rf);
@@ -3403,6 +3408,7 @@ static struct task_struct *
do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
{
struct task_struct *prev = rq->curr;
+ bool core_sched = sched_core_enabled(rq);
enum scx_dsp_verdict verdict;
struct task_struct *p;
@@ -3411,7 +3417,12 @@ do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
rq_modified_begin(rq, &ext_sched_class);
- if (sched_core_enabled(rq))
+ /*
+ * Core scheduling can get enabled while dispatch_pick() has the rq lock
+ * released. Stick to @core_sched, so that the follow-up work below
+ * matches the dispatch that ran.
+ */
+ if (core_sched)
verdict = dispatch_core_pick(rq, rf, prev);
else
verdict = dispatch_pick(rq, rf, prev);
@@ -3477,7 +3488,9 @@ do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
* for the next pick.
*/
if (p != RETRY_TASK && (p || !force_scx)) {
- maybe_queue_balance_callback(rq);
+ /* under core scheduling, see dispatch_core_pick() */
+ if (!core_sched)
+ maybe_queue_balance_callback(rq);
/*
* Defer to a balance callback which can drop rq lock and enable
@@ -3490,7 +3503,7 @@ do_pick_task_scx(struct rq *rq, struct rq_flags *rf, bool force_scx)
queue_balance_callback(rq, &rq->scx.kick_sync_bal_cb,
kick_sync_wait_bal_cb);
}
- } else if (rq->scx.flags & SCX_RQ_BAL_CB_PENDING) {
+ } else if (!core_sched && (rq->scx.flags & SCX_RQ_BAL_CB_PENDING)) {
rq->scx.flags &= ~SCX_RQ_BAL_CB_PENDING;
schedule_deferred(rq);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0857/1257] alpha: handle VM_FAULT_HWPOISON in do_page_fault()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (855 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0856/1257] sched_ext: Dont queue balance callbacks from a core-sched pick Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0858/1257] alpha: load the MMU context when switch_mm() switches the current task Greg Kroah-Hartman
` (141 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Magnus Lindholm, Matt Turner,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
[ Upstream commit 4bef20bbb9e02568a009efa4d404ce2621289be5 ]
do_page_fault() handles VM_FAULT_OOM, VM_FAULT_SIGSEGV and
VM_FAULT_SIGBUS and then falls into BUG() for anything else in
VM_FAULT_ERROR. VM_FAULT_HWPOISON and VM_FAULT_HWPOISON_LARGE are in
that set, so a fault on a poisoned page takes down the kernel instead of
delivering a signal.
Alpha does not select ARCH_SUPPORTS_MEMORY_FAILURE, so the machine check
paths cannot produce these. UFFDIO_POISON can: it installs a poison PTE
marker without any memory failure support, and a subsequent access
returns VM_FAULT_HWPOISON. Registering an anonymous range with
userfaultfd, poisoning it and reading it back reliably hits the BUG():
Kernel bug at arch/alpha/mm/fault.c:188
poison(50809): Kernel Bug 1
pc is at do_page_fault+0x4e8/0x550
ra is at do_page_fault+0xfc/0x550
The BUG() fires with mmap_read_lock() still held, so the faulting task
is left unkillable in D state holding the lock, and shutdown stalls
behind it. A UFFD_USER_MODE_ONLY userfaultfd is always allowed, so any
local user can do this.
Deliver SIGBUS with BUS_MCEERR_AR instead, reporting the size of the
poisoned area, as the other architectures do. That is the huge page size
for VM_FAULT_HWPOISON_LARGE, which becomes reachable once alpha
implements huge pages.
Tested on an UP1500 (EV68AL): the reproducer above now takes a SIGBUS
and the kernel logs
poison[373]: hardware memory error at 0000020000030000 pc 00000200010007ec
with no oops, no wedged task and no taint.
A backport needs the show_signal_msg() call dropped, since alpha only
has it since commit 9ca6af1aac40 ("alpha: select
SYSCTL_EXCEPTION_TRACE").
Fixes: fc71884a5f59 ("mm: userfaultfd: add new UFFDIO_POISON ioctl")
Cc: stable@vger.kernel.org # 6.6+
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Link: https://lore.kernel.org/r/20261007-alpha-hugepages-v2-2-8e108af2d961@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/mm/fault.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index a9816bbc9f34d..f40ac0826a854 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -8,6 +8,7 @@
#include <linux/sched/signal.h>
#include <linux/kernel.h>
#include <linux/mm.h>
+#include <linux/hugetlb.h>
#include <asm/io.h>
#define __EXTERN_INLINE inline
@@ -89,6 +90,7 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
struct mm_struct *mm = current->mm;
const struct exception_table_entry *fixup;
int si_code = SEGV_MAPERR;
+ unsigned int lsb;
vm_fault_t fault;
unsigned int flags = FAULT_FLAG_DEFAULT;
@@ -161,6 +163,8 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
goto bad_area;
else if (fault & VM_FAULT_SIGBUS)
goto do_sigbus;
+ else if (fault & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
+ goto do_sigbus_mceerr;
BUG();
}
@@ -222,6 +226,21 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
goto no_context;
return;
+ do_sigbus_mceerr:
+ mmap_read_unlock(mm);
+ if (!user_mode(regs))
+ goto no_context;
+ /*
+ * Report the size of the poisoned area, which for a hugetlb fault
+ * is the size of the huge page that could not be mapped.
+ */
+ lsb = PAGE_SHIFT;
+ if (fault & VM_FAULT_HWPOISON_LARGE)
+ lsb = hstate_index_to_shift(VM_FAULT_GET_HINDEX(fault));
+ show_signal_msg(regs, address, SIGBUS, "hardware memory error");
+ force_sig_mceerr(BUS_MCEERR_AR, (void __user *) address, lsb);
+ return;
+
do_sigsegv:
force_sig_fault(SIGSEGV, si_code, (void __user *) address);
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0858/1257] alpha: load the MMU context when switch_mm() switches the current task
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (856 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0857/1257] alpha: handle VM_FAULT_HWPOISON in do_page_fault() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0859/1257] alpha: run check_mmu_context() from finish_arch_post_lock_switch() Greg Kroah-Hartman
` (140 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 9b8be19d5dc9525a408942e2e8012873199e7455 ]
ev5_switch_mm() only prepares the incoming PCB. The context is installed
by PAL_swpctx, which alpha_switch_to() issues against that PCB on the way
out of the scheduler.
Direct callers reach switch_mm() without going through alpha_switch_to():
kthread_use_mm(), which borrows an mm for the current kernel thread,
sched_force_init_mm() on the CPU-hotplug teardown path, and
do_shoot_lazy_tlb(), which switches to init_mm from an IPI. None explicitly
loads the context, so the task can carry on running under whatever was
loaded before. For kthread_use_mm(), current->mm then names the borrowed
mm even though its context has not been loaded. The other two callers
change active_mm while leaving current->mm NULL.
The stale page-table root need not be swapper_pg_dir; it may belong to a
user process that ran on the CPU earlier, and the kthread's user accesses
can then read and write that process's memory wherever the stale mappings
allow. Translations taken that way can also end up tagged with the
borrowed mm's ASN: ev5_switch_mm() writes that ASN into the PCB, which the
next PAL_swpctx installs against the stale ptbr. An address the stale
tables do not map faults instead, and since do_page_fault() resolves
faults against current->mm without reloading the context, the same access
can fault again on return.
sched_force_init_mm() needs CONFIG_HOTPLUG_CPU and do_shoot_lazy_tlb()
needs CONFIG_MMU_LAZY_TLB_SHOOTDOWN. Alpha selects neither, so only
kthread_use_mm() is reachable in practice. Test the caller's identity
rather than special-casing individual callers.
The scheduler passes the incoming task, which is not current until
alpha_switch_to() runs; all three direct callers pass current. Test for
that and load the context the way activate_mm() does. All three run with
interrupts disabled across the switch, so this completes before any
shootdown can be taken and needs no asn_lock handshake.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Tested-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-2-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/asm/mmu_context.h | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index eee8fe836a59e..d366f89fee585 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -130,6 +130,8 @@ __get_new_mm_context(struct mm_struct *mm, long cpu)
return next;
}
+extern void __load_new_mm_context(struct mm_struct *);
+
__EXTERN_INLINE void
ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
struct task_struct *next)
@@ -139,6 +141,16 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
unsigned long mmc;
long cpu = smp_processor_id();
+ /*
+ * kthread_use_mm(), sched_force_init_mm() and do_shoot_lazy_tlb()
+ * switch current's mm without alpha_switch_to(), which loads the
+ * context. The latter two require options Alpha does not select.
+ */
+ if (next == current) {
+ __load_new_mm_context(next_mm);
+ return;
+ }
+
#ifdef CONFIG_SMP
cpu_data[cpu].asn_lock = 1;
barrier();
@@ -160,7 +172,6 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
task_thread_info(next)->pcb.asn = mmc & HARDWARE_ASN_MASK;
}
-extern void __load_new_mm_context(struct mm_struct *);
asmlinkage void do_page_fault(unsigned long address, unsigned long mmcsr,
long cause, struct pt_regs *regs);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0859/1257] alpha: run check_mmu_context() from finish_arch_post_lock_switch()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (857 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0858/1257] alpha: load the MMU context when switch_mm() switches the current task Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0860/1257] alpha: only use a targeted tbi() when the target mm is really current Greg Kroah-Hartman
` (139 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 020d2e70b7538b66eee3c3480d2b8921fb182f0c ]
check_mmu_context() clears asn_lock and acts on need_new_asn, but it
runs only as the tail of switch_to(), after alpha_switch_to() returns.
A newly forked user task never gets there: its first context switch
resumes at ret_from_fork and reaches schedule_tail() without returning
to the code following alpha_switch_to().
asn_lock is left set on that CPU, so the new user task can run with
interrupts enabled while shootdown IPIs keep taking the deferred path.
The handshake meant to complete those invalidations never runs.
New kernel threads also reach schedule_tail(), but context_switch()
does not call switch_mm() for a task without an mm. They therefore do
not set asn_lock in the first place and are not affected by this bug.
Move check_mmu_context() to finish_arch_post_lock_switch(), which is
called by finish_task_switch() for both existing and newly created tasks.
Drop the now redundant call from switch_to().
The hook runs after finish_lock_switch() releases the rq lock and enables
interrupts. An IPI arriving before asn_lock is cleared retires the slot
through flush_tlb_other(); an IPI arriving afterwards can flush directly,
since PAL_swpctx has already installed the incoming context.
Set need_new_asn whether ev5_switch_mm() reuses or allocates an ASN. An
IPI in that interval can zero either slot. Without this, the allocated
case can return to user space with a live ASN but a zero context slot,
which a later context-based shootdown shortcut could mistake for an
inactive CPU. check_mmu_context() reloads only when the slot is zero.
Call the hook unconditionally. Alpha selects ARCH_NO_PREEMPT, and neither
kthread_use_mm() nor sched_force_init_mm() sleeps between the direct
switch and this hook. RCU_STRICT_GRACE_PERIOD can enable PREEMPT_COUNT,
but cannot make those callers migrate there. Testing preemptible() would
only leave asn_lock set in that configuration.
This requires the preceding direct-switch fix, "alpha: load the MMU
context when switch_mm() switches the current task". It installs the
borrowed context before kthread_use_mm() reaches this hook, so clearing
asn_lock cannot expose a targeted invalidate against the wrong context.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-3-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/asm/mmu_context.h | 15 +++++++++++++--
arch/alpha/include/asm/switch_to.h | 1 -
2 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index d366f89fee585..f41d7c73fdd64 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -162,8 +162,8 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
next_mm->context[cpu] = mmc;
}
#ifdef CONFIG_SMP
- else
- cpu_data[cpu].need_new_asn = 1;
+ /* A deferred shootdown can also invalidate a newly allocated ASN. */
+ cpu_data[cpu].need_new_asn = 1;
#endif
/* Always update the PCB ASN. Another thread may have allocated
@@ -192,6 +192,17 @@ do { \
#define check_mmu_context() do { } while(0)
#endif
+/*
+ * Also called from kthread_use_mm() with preemption enabled. Alpha has
+ * no kernel preemption, so the task is still on the CPU that ran
+ * switch_mm().
+ */
+#define finish_arch_post_lock_switch finish_arch_post_lock_switch
+static inline void finish_arch_post_lock_switch(void)
+{
+ check_mmu_context();
+}
+
__EXTERN_INLINE void
ev5_activate_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm)
{
diff --git a/arch/alpha/include/asm/switch_to.h b/arch/alpha/include/asm/switch_to.h
index 762b7f975310c..35c4b2c9d9923 100644
--- a/arch/alpha/include/asm/switch_to.h
+++ b/arch/alpha/include/asm/switch_to.h
@@ -9,7 +9,6 @@ extern struct task_struct *alpha_switch_to(unsigned long, struct task_struct *);
#define switch_to(P,N,L) \
do { \
(L) = alpha_switch_to(virt_to_phys(&task_thread_info(N)->pcb), (P)); \
- check_mmu_context(); \
} while (0)
#endif /* __ALPHA_SWITCH_TO_H */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0860/1257] alpha: only use a targeted tbi() when the target mm is really current
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (858 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0859/1257] alpha: run check_mmu_context() from finish_arch_post_lock_switch() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0861/1257] alpha: invalidate the local context in flush_tlb_page() Greg Kroah-Hartman
` (138 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 0d92845ac5dbc79e4ac4810b33c673f4c1c227e3 ]
ipi_flush_tlb_page() gates a targeted tbi() on current->active_mm.
tbi() acts on the address space context currently loaded on the CPU, so
it is only guaranteed to reach an mm's translations when a thread of
that mm is running there. current->active_mm is not sufficient: under
lazy TLB an idle or kernel task keeps an mm as its active_mm while a
different ASN is loaded, so the invalidate is issued against the wrong
context and the stale entry can survive. Nothing retires the old ASN
afterwards either, mm->context[cpu] still being valid, so the resuming
thread can reuse it.
Test current->mm instead and otherwise fall back to flush_tlb_other(),
which clears mm->context[cpu] and forces a fresh ASN at the next switch
whatever is loaded now.
For an mm borrowed through kthread_use_mm(), patch 1 of this series
installs the context before the task can take a shootdown IPI. The
current->mm test therefore covers that case as well.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-4-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/smp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index ed06367ece574..1ad448105201f 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -669,7 +669,8 @@ ipi_flush_tlb_page(void *x)
struct flush_tlb_page_struct *data = x;
struct mm_struct * mm = data->mm;
- if (mm == current->active_mm && !asn_locked())
+ /* A targeted tbi() needs a thread of MM to be current. */
+ if (mm == current->mm && !asn_locked())
flush_tlb_current_page(mm, data->vma, data->addr);
else
flush_tlb_other(mm);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0861/1257] alpha: invalidate the local context in flush_tlb_page()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (859 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0860/1257] alpha: only use a targeted tbi() when the target mm is really current Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0862/1257] alpha: fix the local TLB invalidate " Greg Kroah-Hartman
` (137 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit c0db730bf05eb3c10c1fae64b19f6913dce129fc ]
When the target mm is not the calling CPU's active_mm, flush_tlb_page()
does nothing locally, and smp_call_function() reaches only the other CPUs.
This CPU may still hold translations for the mm and can later reuse the
old ASN together with them.
Add the missing else branch. flush_tlb_other() clears mm->context[cpu] so
a fresh ASN is taken at the next switch. Add this before changing the
current->active_mm test to current->mm: that change will also send lazy
callers here, so their local invalidate must already be in place.
The uniprocessor implementations of flush_tlb_mm() and
flush_icache_user_page() in asm/tlbflush.h and asm/cacheflush.h already
contain exactly this branch.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-5-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/smp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 1ad448105201f..e4ba0aab8a669 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -697,6 +697,9 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
preempt_enable();
return;
}
+ } else {
+ /* smp_call_function() does not call back into this CPU. */
+ flush_tlb_other(mm);
}
data.vma = vma;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0862/1257] alpha: fix the local TLB invalidate in flush_tlb_page()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (860 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0861/1257] alpha: invalidate the local context in flush_tlb_page() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0863/1257] alpha: fix the local TLB invalidate in the UP flush_tlb_page() Greg Kroah-Hartman
` (136 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 32f4dd420d626f96128fcfeea2ab24760b4f21a6 ]
flush_tlb_page() invalidates the calling CPU itself before asking the
others, and gates that on current->active_mm. For a non-executable vma
that means a targeted tbi(2, addr), which acts on the context currently
loaded and is only guaranteed to invalidate the intended translations
when the target mm's context is the loaded one. A lazy active_mm does
not establish that, so as in ipi_flush_tlb_page() the target mm's stale
translations can survive, and nothing forces the old ASN to be retired
afterwards.
Test current->mm instead. A lazy caller then takes the flush_tlb_other()
branch added by the previous patch, retiring its local context. Adding
that branch first preserves the local invalidate at every step, including
on EV7 where a targeted tbi() against a foreign ASN appeared to work.
Which callers reach here with a foreign mm depends on the configuration.
folio_mkclean(), from the writeback flusher kworker that has no mm of its
own, accounted for about half the calls during writeback of a shared
mapping and none at all on anonymous memory. Those counts were measured
with CONFIG_COMPACTION=n: with COMPACTION=y, asm/pgtable.h overrides
ptep_clear_flush() to call migrate_flush_tlb_page(), which rendezvouses
with every CPU and handles the context itself, so folio_mkclean() does
not reach this function.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-6-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/smp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index e4ba0aab8a669..a5a42ae4a7d80 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -684,7 +684,8 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
preempt_disable();
- if (mm == current->active_mm) {
+ /* As in ipi_flush_tlb_page(): a targeted tbi() needs MM current. */
+ if (mm == current->mm) {
flush_tlb_current_page(mm, vma, addr);
if (atomic_read(&mm->mm_users) <= 1) {
int cpu, this_cpu = smp_processor_id();
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0863/1257] alpha: fix the local TLB invalidate in the UP flush_tlb_page()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (861 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0862/1257] alpha: fix the local TLB invalidate " Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0864/1257] alpha: invalidate the local context in flush_tlb_mm() Greg Kroah-Hartman
` (135 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit c825bf802a7a43fd302c879ef25c975e067a2e94 ]
The uniprocessor flush_tlb_page() in asm/tlbflush.h has the same wrong
test as the SMP one: a targeted tbi() is only guaranteed to invalidate
the intended translations when the target mm's context is loaded, but
the gate is current->active_mm, which a lazily borrowed mm also
satisfies.
Test current->mm instead. The else branch it falls to already exists
here, so unlike the SMP side this is the whole fix.
arch/alpha/kernel/smp.c is not built with CONFIG_SMP=n, so this is how
the same defect reaches a uniprocessor, where the flusher kworker
necessarily shares the only CPU with the writer.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-7-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/asm/tlbflush.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/include/asm/tlbflush.h b/arch/alpha/include/asm/tlbflush.h
index 0c8529997f54e..9ae1902faf8ec 100644
--- a/arch/alpha/include/asm/tlbflush.h
+++ b/arch/alpha/include/asm/tlbflush.h
@@ -87,7 +87,8 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
{
struct mm_struct *mm = vma->vm_mm;
- if (mm == current->active_mm)
+ /* A targeted tbi() needs a thread of MM to be current. */
+ if (mm == current->mm)
flush_tlb_current_page(mm, vma, addr);
else
flush_tlb_other(mm);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0864/1257] alpha: invalidate the local context in flush_tlb_mm()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (862 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0863/1257] alpha: fix the local TLB invalidate in the UP flush_tlb_page() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0865/1257] alpha: invalidate the local context in flush_icache_user_page() Greg Kroah-Hartman
` (134 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 721bb7a129771f0ff9cef1dd5abfc106ef65feba ]
flush_tlb_mm() has the same caller-CPU omission that was fixed in
flush_tlb_page(): when the target mm is not the calling CPU's active_mm
nothing happens locally, and smp_call_function() handles only the other
CPUs, so this CPU may later reuse the old ASN together with the
translations it still holds.
The active_mm test itself is left alone here. That path calls
flush_tlb_current(), which loads a fresh context through
__load_new_mm_context() rather than issuing a targeted tbi() against
whatever ASN happens to be loaded, so it does not depend on which context
is current.
The uniprocessor implementation in asm/tlbflush.h already has the missing
branch. Counted over a fork-heavy run, flush_tlb_mm() was entered with the
mm not this CPU's active_mm 2934 times, and 632 times while otherwise idle.
The proposed Alpha hugetlb support routes hugetlb invalidations through
flush_tlb_range(), which calls this function. Unmapping or migrating a
hugetlb folio from another context will also need this local invalidate.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-8-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/smp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index a5a42ae4a7d80..988e397b0b8a7 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -649,6 +649,9 @@ flush_tlb_mm(struct mm_struct *mm)
preempt_enable();
return;
}
+ } else {
+ /* smp_call_function() does not call back into this CPU. */
+ flush_tlb_other(mm);
}
smp_call_function(ipi_flush_tlb_mm, mm, 1);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0865/1257] alpha: invalidate the local context in flush_icache_user_page()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (863 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0864/1257] alpha: invalidate the local context in flush_tlb_mm() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0866/1257] alpha: do not clear remote MMU contexts in migrate_flush_tlb_page() Greg Kroah-Hartman
` (133 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 4244c555ac440a445cc168f860b2677099d761f9 ]
flush_icache_user_page() has the same caller-CPU omission that the
previous patch fixed in flush_tlb_mm(): when the target mm is not the
calling CPU's active_mm nothing happens locally, and smp_call_function()
handles only the other CPUs, so this CPU may later reuse the old ASN
together with the translations it still holds.
This matters here in particular because the function exists for
operating on another process's mappings: the comment above it describes
setting breakpoints through ptrace, and access_remote_vm() reaches it
through copy_to_user_page(). The calling CPU is therefore often running
something other than the target mm.
As in flush_tlb_mm(), the uniprocessor implementation in
asm/cacheflush.h already has the missing case.
No imb() is needed, here or in ipi_flush_icache_page(). Alpha's
user-space I-cache flush works by allocating a new ASN rather than by
invalidating the I-cache: the entries stay, but they are tagged with the
old ASN and can no longer match. An imb() is only required when the ASN
space wraps and numbers are reused, and __get_new_mm_context() already
does one in that case.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-9-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/smp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 988e397b0b8a7..e21bc3920bece 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -758,6 +758,9 @@ flush_icache_user_page(struct vm_area_struct *vma, struct page *page,
preempt_enable();
return;
}
+ } else {
+ /* smp_call_function() does not call back into this CPU. */
+ flush_tlb_other(mm);
}
smp_call_function(ipi_flush_icache_page, mm, 1);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0866/1257] alpha: do not clear remote MMU contexts in migrate_flush_tlb_page()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (864 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0865/1257] alpha: invalidate the local context in flush_icache_user_page() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0867/1257] alpha: do not skip TLB shootdown IPIs for kthread-borrowed mms Greg Kroah-Hartman
` (132 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit 16266d50c51eb5eb98f1c345c5aa9ff359a305aa ]
After the on_each_cpu() rendezvous, migrate_flush_tlb_page() walks the
other CPUs and zeroes their mm->context[cpu] when mm_users is at most one,
described as mimicking flush_tlb_mm()'s mm_users<=1 optimization.
It is not one. flush_tlb_mm() tests mm_users before deciding whether to
send the IPIs; here every CPU has already been visited and waited for, so
nothing is saved. The callback has also just set each CPU's own slot
correctly, so the loop only overwrites it, and does so while that CPU may
still be running in the address space.
Remove it. The shootdown shortcuts in flush_tlb_mm(), flush_tlb_page()
and flush_icache_user_page() clear remote slots too; once the next patch
removes those as well, every runtime update of mm->context[cpu] is made by
CPU cpu itself. That patch relies on the invariant when it reads those
slots to decide whether a shootdown can be skipped, so this one is tagged
for stable as its prerequisite.
Fixes: dd5712f3379c ("alpha: fix user-space corruption during memory compaction")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010144621.974850-2-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/mm/tlbflush.c | 16 ----------------
1 file changed, 16 deletions(-)
diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c
index ccbc317b9a348..239c72b8a7412 100644
--- a/arch/alpha/mm/tlbflush.c
+++ b/arch/alpha/mm/tlbflush.c
@@ -90,22 +90,6 @@ void migrate_flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
*/
preempt_disable();
on_each_cpu(ipi_flush_mm_and_page, &d, 1);
-
- /*
- * mimic flush_tlb_mm()'s mm_users<=1 optimization.
- */
- if (atomic_read(&mm->mm_users) <= 1) {
-
- int cpu, this_cpu;
- this_cpu = smp_processor_id();
-
- for (cpu = 0; cpu < NR_CPUS; cpu++) {
- if (!cpu_online(cpu) || cpu == this_cpu)
- continue;
- if (READ_ONCE(mm->context[cpu]))
- WRITE_ONCE(mm->context[cpu], 0);
- }
- }
preempt_enable();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0867/1257] alpha: do not skip TLB shootdown IPIs for kthread-borrowed mms
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (865 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0866/1257] alpha: do not clear remote MMU contexts in migrate_flush_tlb_page() Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0868/1257] ALSA: hda/via: Apply runtime PM workaround for ASUS X55A Greg Kroah-Hartman
` (131 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit fe221b7b2d3ecd042dd391f74ff6a6fdeb7c2038 ]
flush_tlb_mm(), flush_tlb_page() and flush_icache_user_page() skip the
shootdown IPI when mm_users <= 1, on the assumption that no other CPU can
be running the mm. A task that borrows an mm through kthread_use_mm()
takes mmgrab() rather than mmget(), so it never appears in mm_users, and
kthread_use_mm() may be handed an mm that is already the caller's
active_mm and loaded on that CPU. Such a CPU was not only left without
an IPI, its mm->context[cpu] was cleared from under it.
mm->context[cpu] is already the record of which CPUs hold an ASN for the
mm. Test it rather than clearing it: take the shortcut only when no
other CPU has one, and otherwise fall through to the IPI, which
invalidates those CPUs properly. A CPU that merely ran the mm in the
past also holds a context and now costs an IPI, which errs in the safe
direction.
Change ipi_flush_tlb_mm(), ipi_flush_icache_page() and the migration
callback ipi_flush_mm_and_page() to test current->mm, like
ipi_flush_tlb_page(). A CPU that only retains the mm lazily then clears
its own slot through flush_tlb_other(), rather than publishing a new ASN
on every IPI or migration rendezvous. The migration callback still does
its per-VA tbi() afterwards. Returning to the mm allocates a fresh ASN
through ev5_switch_mm(), or through the direct-load path when
kthread_use_mm() switches current's mm.
Once these historical slots are gone, the shortcut is available again
if mm_users remains at most one and no other CPU has taken or kept a
context. An explicit kthread_use_mm() borrower has current->mm set and
still receives the invalidate it needs.
The caller-side tests in flush_tlb_mm() and flush_icache_user_page()
remain current->active_mm. A kernel thread that flushes its lazily held
mm can therefore publish its own context slot. Those branches also
perform the shortcut check, which excludes the calling CPU's slot, so
leave them unchanged. This is distinct from a remote lazy CPU keeping
its slot populated through repeated callbacks.
Together with the preceding patch, dropping these clearing loops leaves
every runtime write to mm->context[] targeting the writing CPU's own slot,
so the array becomes a lockless publication of which CPUs may be using the
mm, with a single writer per slot. Mark the two stores that are now
observed from other CPUs; flush_tlb_other() already uses WRITE_ONCE().
The uniprocessor flush_icache_user_page() is left alone, as nothing reads
another CPU's slot there, and init_new_context() runs before the mm is
shared.
Order the slot reads after the page-table changes with smp_mb(). On the
publishing CPU, the store in ev5_switch_mm() precedes the mb() in Alpha's
arch_spin_unlock(), when finish_lock_switch() drops the rq lock. This
relies on Alpha's unlock implementation, not a generic scheduler promise
of a full barrier on unlock; document that reliance at the store. Also
issue smp_mb() after publishing in __load_new_mm_context(), before loading
and using the mm.
This covers every caller, including check_mmu_context(), which can
publish a replacement after finish_lock_switch() has already run.
This requires the preceding removal of remote slot clearing from
migrate_flush_tlb_page(). It also requires the stale-TLB series to set
need_new_asn on both the reused and newly allocated ASN paths. Otherwise
an IPI between finish_lock_switch() and check_mmu_context() can zero a
new slot while asn_lock is set, and the task can return to user space
with a live ASN that the shortcut cannot see.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: <stable@vger.kernel.org> # 53ab52cfe5ce: alpha: load the MMU context when switch_mm() switches the current task
Cc: <stable@vger.kernel.org> # 01df8f401888: alpha: run check_mmu_context() from finish_arch_post_lock_switch()
Cc: <stable@vger.kernel.org> # ef43cfc28c42: alpha: only use a targeted tbi() when the target mm is really current
Cc: <stable@vger.kernel.org> # 738cf8f7a78f: alpha: invalidate the local context in flush_tlb_page()
Cc: <stable@vger.kernel.org> # 62c92086f30e: alpha: fix the local TLB invalidate in flush_tlb_page()
Cc: <stable@vger.kernel.org> # 3faee097b939: alpha: fix the local TLB invalidate in the UP flush_tlb_page()
Cc: <stable@vger.kernel.org> # b2c3b654bb64: alpha: invalidate the local context in flush_tlb_mm()
Cc: <stable@vger.kernel.org> # f19ae6f51a38: alpha: invalidate the local context in flush_icache_user_page()
Cc: <stable@vger.kernel.org> # 471e7f9c890b: alpha: do not clear remote MMU contexts in migrate_flush_tlb_page()
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010144621.974850-3-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/asm/mmu_context.h | 7 +++-
arch/alpha/kernel/smp.c | 52 ++++++++++++++--------------
arch/alpha/mm/fault.c | 4 ++-
arch/alpha/mm/tlbflush.c | 2 +-
4 files changed, 36 insertions(+), 29 deletions(-)
diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index f41d7c73fdd64..09f356934b90a 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -159,7 +159,12 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
mmc = next_mm->context[cpu];
if ((mmc ^ asn) & ~HARDWARE_ASN_MASK) {
mmc = __get_new_mm_context(next_mm, cpu);
- next_mm->context[cpu] = mmc;
+ /*
+ * Ordered before any user access through the mm by the
+ * mb() in arch_spin_unlock(), when finish_lock_switch()
+ * drops the rq lock.
+ */
+ WRITE_ONCE(next_mm->context[cpu], mmc);
}
#ifdef CONFIG_SMP
/* A deferred shootdown can also invalidate a newly allocated ASN. */
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index e21bc3920bece..11768aa292a48 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -625,12 +625,30 @@ static void
ipi_flush_tlb_mm(void *x)
{
struct mm_struct *mm = x;
- if (mm == current->active_mm && !asn_locked())
+ if (mm == current->mm && !asn_locked())
flush_tlb_current(mm);
else
flush_tlb_other(mm);
}
+/* True if a CPU other than this one holds an ASN for MM. */
+static bool
+mm_context_elsewhere(struct mm_struct *mm)
+{
+ int cpu, this_cpu = smp_processor_id();
+
+ /* Pairs with the barrier the publishing CPU issues before using MM. */
+ smp_mb();
+
+ for_each_online_cpu(cpu) {
+ if (cpu == this_cpu)
+ continue;
+ if (READ_ONCE(mm->context[cpu]))
+ return true;
+ }
+ return false;
+}
+
void
flush_tlb_mm(struct mm_struct *mm)
{
@@ -638,14 +656,8 @@ flush_tlb_mm(struct mm_struct *mm)
if (mm == current->active_mm) {
flush_tlb_current(mm);
- if (atomic_read(&mm->mm_users) <= 1) {
- int cpu, this_cpu = smp_processor_id();
- for (cpu = 0; cpu < NR_CPUS; cpu++) {
- if (!cpu_online(cpu) || cpu == this_cpu)
- continue;
- if (mm->context[cpu])
- mm->context[cpu] = 0;
- }
+ if (atomic_read(&mm->mm_users) <= 1 &&
+ !mm_context_elsewhere(mm)) {
preempt_enable();
return;
}
@@ -690,14 +702,8 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
/* As in ipi_flush_tlb_page(): a targeted tbi() needs MM current. */
if (mm == current->mm) {
flush_tlb_current_page(mm, vma, addr);
- if (atomic_read(&mm->mm_users) <= 1) {
- int cpu, this_cpu = smp_processor_id();
- for (cpu = 0; cpu < NR_CPUS; cpu++) {
- if (!cpu_online(cpu) || cpu == this_cpu)
- continue;
- if (mm->context[cpu])
- mm->context[cpu] = 0;
- }
+ if (atomic_read(&mm->mm_users) <= 1 &&
+ !mm_context_elsewhere(mm)) {
preempt_enable();
return;
}
@@ -728,7 +734,7 @@ static void
ipi_flush_icache_page(void *x)
{
struct mm_struct *mm = (struct mm_struct *) x;
- if (mm == current->active_mm && !asn_locked())
+ if (mm == current->mm && !asn_locked())
__load_new_mm_context(mm);
else
flush_tlb_other(mm);
@@ -747,14 +753,8 @@ flush_icache_user_page(struct vm_area_struct *vma, struct page *page,
if (mm == current->active_mm) {
__load_new_mm_context(mm);
- if (atomic_read(&mm->mm_users) <= 1) {
- int cpu, this_cpu = smp_processor_id();
- for (cpu = 0; cpu < NR_CPUS; cpu++) {
- if (!cpu_online(cpu) || cpu == this_cpu)
- continue;
- if (mm->context[cpu])
- mm->context[cpu] = 0;
- }
+ if (atomic_read(&mm->mm_users) <= 1 &&
+ !mm_context_elsewhere(mm)) {
preempt_enable();
return;
}
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index f40ac0826a854..53e170e965915 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -46,7 +46,9 @@ __load_new_mm_context(struct mm_struct *next_mm)
struct pcb_struct *pcb;
mmc = __get_new_mm_context(next_mm, smp_processor_id());
- next_mm->context[smp_processor_id()] = mmc;
+ WRITE_ONCE(next_mm->context[smp_processor_id()], mmc);
+ /* Publish the context before this CPU can access the mm. */
+ smp_mb();
pcb = ¤t_thread_info()->pcb;
pcb->asn = mmc & HARDWARE_ASN_MASK;
diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c
index 239c72b8a7412..a2aef90e6234b 100644
--- a/arch/alpha/mm/tlbflush.c
+++ b/arch/alpha/mm/tlbflush.c
@@ -66,7 +66,7 @@ static void ipi_flush_mm_and_page(void *x)
struct tlb_mm_and_addr *d = x;
/* Part 1: mm context side (Alpha uses ASN/context as a key mechanism). */
- if (d->mm == current->active_mm && !asn_locked())
+ if (d->mm == current->mm && !asn_locked())
__load_new_mm_context(d->mm);
else
flush_tlb_other(d->mm);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0868/1257] ALSA: hda/via: Apply runtime PM workaround for ASUS X55A
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (866 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0867/1257] alpha: do not skip TLB shootdown IPIs for kthread-borrowed mms Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0869/1257] RDMA/uverbs: Fix uobject leak in DMABUF release Greg Kroah-Hartman
` (130 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Maksimov, Vasiliy Kovalev,
Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <kovalev@altlinux.org>
[ Upstream commit f6e8d5ebde5ceb7d3c0eef6e9e4d82862b503ade ]
ASUS X55A requires the same workaround like other machines with
VT1802, otherwise it loses the codec power on a few nodes and the
sound stays silent.
Link: https://bugzilla.altlinux.org/45606
Cc: <stable@vger.kernel.org>
Tested-by: Nikita Maksimov <nickstogramm@yandex.ru>
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Link: https://patch.msgid.link/20261017101257.215166-1-kovalev@altlinux.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/via.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/hda/codecs/via.c b/sound/hda/codecs/via.c
index 807312cffd358..0641fc14b346c 100644
--- a/sound/hda/codecs/via.c
+++ b/sound/hda/codecs/via.c
@@ -933,6 +933,7 @@ static const struct hda_fixup via_fixups[] = {
static const struct hda_quirk vt2002p_fixups[] = {
SND_PCI_QUIRK(0x1043, 0x13f7, "Asus B23E", VIA_FIXUP_POWER_SAVE),
SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75),
+ SND_PCI_QUIRK(0x1043, 0x1c33, "Asus X55A", VIA_FIXUP_POWER_SAVE),
SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST),
SND_PCI_QUIRK_VENDOR(0x1558, "Clevo", VIA_FIXUP_POWER_SAVE),
{}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0869/1257] RDMA/uverbs: Fix uobject leak in DMABUF release
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (867 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0868/1257] ALSA: hda/via: Apply runtime PM workaround for ASUS X55A Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0870/1257] spi: ch341: handle transfers without a TX or RX buffer Greg Kroah-Hartman
` (129 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Deep Shah, Leon Romanovsky,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deep Shah <deepshah146@gmail.com>
[ Upstream commit 4a953ee228f5544a3e5515eed88bf09d1a5adb94 ]
uverbs_dmabuf_release() treats a NULL uobj->context as an aborted
allocation, but normal ufile cleanup also clears it. Closing the uverbs
FD before the dma-buf FD therefore skips uverbs_uobject_release() and
leaks the uobject and ufile references.
Clear dmabuf->priv before dma_buf_put() on allocation failure and use
that NULL pointer to identify an abort. Otherwise, always call
uverbs_uobject_release(). This also avoids reading a freed uobject if
release is deferred until after the allocation has been aborted.
Fixes: 0ac6f4056c4a ("RDMA/uverbs: Add DMABUF object type and operations")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Deep Shah <deepshah146@gmail.com>
Link: https://patch.msgid.link/20261015083637.200958-2-deepshah146@gmail.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/uverbs_std_types_dmabuf.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/uverbs_std_types_dmabuf.c b/drivers/infiniband/core/uverbs_std_types_dmabuf.c
index 33bafadc695df..8d8c997a48834 100644
--- a/drivers/infiniband/core/uverbs_std_types_dmabuf.c
+++ b/drivers/infiniband/core/uverbs_std_types_dmabuf.c
@@ -68,9 +68,10 @@ static void uverbs_dmabuf_release(struct dma_buf *dmabuf)
struct ib_uverbs_dmabuf_file *priv = dmabuf->priv;
/*
- * This can only happen if the fput came from alloc_abort_fd_uobject()
+ * This can only happen if the fput came from the error unwind of
+ * UVERBS_METHOD_DMABUF_ALLOC. The abort cleans up the uobject.
*/
- if (!priv->uobj.context)
+ if (!priv)
return;
/*
@@ -161,6 +162,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_DMABUF_ALLOC)(
return 0;
err_revoked:
+ /* Tell uverbs_dmabuf_release() that the uobject is being aborted */
+ uverbs_dmabuf->dmabuf->priv = NULL;
dma_buf_put(uverbs_dmabuf->dmabuf);
err:
rdma_user_mmap_entry_put(mmap_entry);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0870/1257] spi: ch341: handle transfers without a TX or RX buffer
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (868 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0869/1257] RDMA/uverbs: Fix uobject leak in DMABUF release Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0871/1257] hwmon: (sht4x) Fix jiffies wraparound in heater-ready check Greg Kroah-Hartman
` (128 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weibin Liu, Mark Brown, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weibin Liu <liuwb@xiaopeng.com>
[ Upstream commit 84182c48999f856c3865e4a537c244f9569c9f6c ]
ch341_transfer_one() unconditionally copies from trans->tx_buf into the
TX packet and hands trans->rx_buf to usb_bulk_msg() for the readback.
The SPI core allows half-duplex transfers where either of the buffers
is NULL, so a transfer without TX data crashes the kernel on the memcpy
and a transfer without RX data makes usb_bulk_msg() store the received
data at address 0.
The CH341A clocks data in both directions on every transfer; there is
no mode to disable a direction. Set SPI_CONTROLLER_MUST_TX and
SPI_CONTROLLER_MUST_RX so the SPI core fills in dummy buffers for
half-duplex transfers.
Fixes: 8846739f52af ("spi: add ch341a usb2spi driver")
Cc: stable@vger.kernel.org # 6.11+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261013054339.77477-1-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-ch341.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/spi/spi-ch341.c b/drivers/spi/spi-ch341.c
index 6448a44a8b67e..56a5caa5975a4 100644
--- a/drivers/spi/spi-ch341.c
+++ b/drivers/spi/spi-ch341.c
@@ -189,6 +189,12 @@ static int ch341_probe(struct usb_interface *intf,
ctrl->transfer_one = ch341_transfer_one;
ctrl->set_cs = ch341_set_cs;
ctrl->auto_runtime_pm = false;
+ /*
+ * The CH341A SPI_STREAM command clocks data in both directions on
+ * every transfer, so the driver always needs a TX and an RX buffer;
+ * let the SPI core supply dummy buffers for half-duplex transfers.
+ */
+ ctrl->flags = SPI_CONTROLLER_MUST_TX | SPI_CONTROLLER_MUST_RX;
usb_set_intfdata(intf, ch341);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0871/1257] hwmon: (sht4x) Fix jiffies wraparound in heater-ready check
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (869 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0870/1257] spi: ch341: handle transfers without a TX or RX buffer Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0872/1257] hwmon: (coretemp) Return -ENODATA for invalid temperature readings Greg Kroah-Hartman
` (127 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Verdonck, Guenter Roeck,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Verdonck <tom.verdonck@inspiral.be>
[ Upstream commit ce3ff350c4a3b9466bd67bfe2adb2e3bea732b9e ]
sht4x stores in ->heating_complete the jiffies deadline at which the
current heater pulse finishes. It is set once at probe (to jiffies) and
only updated when the heater is explicitly enabled via sysfs, so in the
common case where the heater is never used it stays frozen at its probe
value.
->heating_complete is an unsigned long compared with time_before(),
whose signed difference is only meaningful while the two values are
within LONG_MAX jiffies of each other. Because the deadline is frozen,
jiffies keeps advancing away from it, and after 2^31 jiffies the
difference flips sign. On a 32-bit HZ=100 kernel that happens ~248.5
days after boot. time_before() in sht4x_read_values() then wrongly
reports that heating is still in progress and the read path executes
msleep(jiffies_to_msecs(data->heating_complete - curr_jiffies));
with a bogus, huge delta, blocking the temperature read for a very long
time instead of returning data. The heater_enable sysfs attributes are
affected the same way (spurious -EBUSY and "1" readback).
Store the deadline as a 64-bit jiffies value and compare it with
get_jiffies_64()/time_before64(), which does not wrap in any practical
uptime.
Fixes: 0eed6fc3d2b9 ("hwmon: (sht4x): add heater support")
Cc: stable@vger.kernel.org
Signed-off-by: Tom Verdonck <tom.verdonck@inspiral.be>
Link: https://patch.msgid.link/7b2087ccb963e097cf3f6333efaec0c46549003b.1790358356.git.tom.verdonck@inspiral.be
[groeck: Squashed 'Fix torn read' patch into this one]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/sht4x.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/hwmon/sht4x.c b/drivers/hwmon/sht4x.c
index a97dda9e92dc5..27fddff703542 100644
--- a/drivers/hwmon/sht4x.c
+++ b/drivers/hwmon/sht4x.c
@@ -67,7 +67,7 @@ DECLARE_CRC8_TABLE(sht4x_crc8_table);
*/
struct sht4x_data {
struct i2c_client *client;
- unsigned long heating_complete; /* in jiffies */
+ u64 heating_complete; /* in jiffies */
bool data_pending;
u32 heater_power; /* in milli-watts */
u32 heater_time; /* in milli-seconds */
@@ -92,14 +92,14 @@ static int sht4x_read_values(struct sht4x_data *data)
u8 crc;
u8 cmd[SHT4X_CMD_LEN] = {SHT4X_CMD_MEASURE_HPM};
u8 raw_data[SHT4X_RESPONSE_LENGTH];
- unsigned long curr_jiffies;
+ u64 curr_jiffies;
- curr_jiffies = jiffies;
- if (time_before(curr_jiffies, data->heating_complete))
+ curr_jiffies = get_jiffies_64();
+ if (time_before64(curr_jiffies, data->heating_complete))
msleep(jiffies_to_msecs(data->heating_complete - curr_jiffies));
if (data->data_pending &&
- time_before(jiffies, data->heating_complete + data->update_interval)) {
+ time_before64(get_jiffies_64(), data->heating_complete + data->update_interval)) {
data->data_pending = false;
} else {
next_update = data->last_updated +
@@ -237,7 +237,9 @@ static ssize_t heater_enable_show(struct device *dev,
{
struct sht4x_data *data = dev_get_drvdata(dev);
- return sysfs_emit(buf, "%u\n", time_before(jiffies, data->heating_complete));
+ guard(hwmon_lock)(dev);
+
+ return sysfs_emit(buf, "%u\n", time_before64(get_jiffies_64(), data->heating_complete));
}
static ssize_t heater_enable_store(struct device *dev,
@@ -279,14 +281,14 @@ static ssize_t heater_enable_store(struct device *dev,
guard(hwmon_lock)(dev);
- if (time_before(jiffies, data->heating_complete))
+ if (time_before64(get_jiffies_64(), data->heating_complete))
return -EBUSY;
ret = i2c_master_send(data->client, &cmd, SHT4X_CMD_LEN);
if (ret < 0)
return ret;
- data->heating_complete = jiffies + msecs_to_jiffies(heating_time_bound);
+ data->heating_complete = get_jiffies_64() + msecs_to_jiffies(heating_time_bound);
data->data_pending = true;
return count;
}
@@ -410,7 +412,7 @@ static int sht4x_probe(struct i2c_client *client)
data->client = client;
data->heater_power = 200;
data->heater_time = 1000;
- data->heating_complete = jiffies;
+ data->heating_complete = get_jiffies_64();
crc8_populate_msb(sht4x_crc8_table, SHT4X_CRC8_POLYNOMIAL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0872/1257] hwmon: (coretemp) Return -ENODATA for invalid temperature readings
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (870 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0871/1257] hwmon: (sht4x) Fix jiffies wraparound in heater-ready check Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0873/1257] hwmon: (sht4x) Reject incomplete heater command transfers Greg Kroah-Hartman
` (126 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Ricardo Neri,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
[ Upstream commit f63aaa529cbc73146ff0d52235e5479042285cae ]
IA32_THERM_STATUS and IA32_PACKAGE_THERM_STATUS have a valid bit, bit 31.
The Intel SDM documents it only for the former, but the package register
implements it too: x86_pkg_temp_thermal has required it since commit
f1a18a105660 ("Thermal: CPU Package temperature thermal").
This driver checked the bit for both registers as well, until
commit bf6ea084ebb5 ("hwmon: (coretemp) Do not return -EAGAIN for low
temperatures") made it ignore the bit because some CPUs clear it while
the temperature is too low to be measured. Since then, temp%d_input
reports such a reading as a real temperature. Userspace cannot tell it
apart from a genuinely low one.
Fail the read with -ENODATA while the CPU reports the reading as invalid.
On a CPU that clears the bit, reading temp%d_input now fails where it
used to return a low value. sensors(1) shows N/A in its place.
Cc: stable@vger.kernel.org
Suggested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/all/46f9f319-de71-412f-a424-6cb801478456@roeck-us.net/
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Link: https://patch.msgid.link/20261006-coretemp-enodata-v2-1-64e788acc7dc@linux.intel.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/hwmon/coretemp.rst | 3 +++
drivers/hwmon/coretemp.c | 21 +++++++++++++++------
2 files changed, 18 insertions(+), 6 deletions(-)
diff --git a/Documentation/hwmon/coretemp.rst b/Documentation/hwmon/coretemp.rst
index 3493016833814..09f885a847e30 100644
--- a/Documentation/hwmon/coretemp.rst
+++ b/Documentation/hwmon/coretemp.rst
@@ -50,6 +50,9 @@ All sysfs entries are named with their core_id (represented here by 'X').
================= ========================================================
tempX_input Core temperature (in millidegrees Celsius).
+ Reading fails with -ENODATA while the CPU reports the
+ temperature as invalid. Some CPUs do this when the
+ temperature is too low to be measured.
tempX_max Maximum recommended operating temperature (Tcontrol).
All cooling devices should be turned on.
tempX_crit Maximum junction temperature (in millidegrees Celsius).
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index ace51e08e72dc..bee2c9896d4c5 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -60,6 +60,8 @@ enum coretemp_attr_index {
/*
* Per-Core Temperature Data
+ * @temp_valid: Whether the CPU reported @temp as valid. @temp is not
+ * reported when this is false.
* @tjmax: The static tjmax value when tjmax cannot be retrieved from
* IA32_TEMPERATURE_TARGET MSR.
* @last_updated: The time when the current temperature value was updated
@@ -72,6 +74,7 @@ enum coretemp_attr_index {
*/
struct temp_data {
int temp;
+ bool temp_valid;
int tjmax;
unsigned long last_updated;
unsigned int cpu;
@@ -398,7 +401,8 @@ static ssize_t show_temp(struct device *dev,
{
struct msr val;
struct temp_data *tdata = container_of(devattr, struct temp_data, sd_attrs[ATTR_TEMP]);
- int tjmax;
+ int tjmax, temp;
+ bool valid;
mutex_lock(&tdata->update_lock);
@@ -407,17 +411,22 @@ static ssize_t show_temp(struct device *dev,
if (time_after(jiffies, tdata->last_updated + HZ)) {
rdmsrq_on_cpu(tdata->cpu, tdata->status_reg, &val.q);
/*
- * Ignore the valid bit. In all observed cases the register
- * value is either low or zero if the valid bit is 0.
- * Return it instead of reporting an error which doesn't
- * really help at all.
+ * Bit 31 indicates whether the reading is valid. Some CPUs
+ * clear it while the temperature is too low to be measured.
+ * Such a reading is not a temperature. Do not report it.
*/
+ tdata->temp_valid = (val.l >> 31) & 1;
tdata->temp = tjmax - ((val.l >> 16) & 0xff) * 1000;
tdata->last_updated = jiffies;
}
+ valid = tdata->temp_valid;
+ temp = tdata->temp;
mutex_unlock(&tdata->update_lock);
- return sprintf(buf, "%d\n", tdata->temp);
+
+ if (!valid)
+ return -ENODATA;
+ return sprintf(buf, "%d\n", temp);
}
static int create_core_attrs(struct temp_data *tdata, struct device *dev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0873/1257] hwmon: (sht4x) Reject incomplete heater command transfers
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (871 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0872/1257] hwmon: (coretemp) Return -ENODATA for invalid temperature readings Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0874/1257] hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe Greg Kroah-Hartman
` (125 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baek Kyu, Kim, Guenter Roeck,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baek Kyu, Kim <pocj8ur4in@gmail.com>
[ Upstream commit 0e1d292233c83d41530df6ffa4ec5a382f118b12 ]
heater_enable_store() treats a zero return from i2c_master_send() as
success. It updates the heater state and returns count, so another
attempt to enable the heater fails with -EBUSY.
i2c-virtio can return zero when the first message fails. Require
SHT4X_CMD_LEN before updating the heater state, as sht4x_probe()
already does for the reset command.
Fixes: 0eed6fc3d2b9 ("hwmon: (sht4x): add heater support")
Cc: stable@vger.kernel.org
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Link: https://patch.msgid.link/20261017205234.1084949-1-pocj8ur4in@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/sht4x.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hwmon/sht4x.c b/drivers/hwmon/sht4x.c
index 27fddff703542..0bb9227674a85 100644
--- a/drivers/hwmon/sht4x.c
+++ b/drivers/hwmon/sht4x.c
@@ -287,6 +287,8 @@ static ssize_t heater_enable_store(struct device *dev,
ret = i2c_master_send(data->client, &cmd, SHT4X_CMD_LEN);
if (ret < 0)
return ret;
+ if (ret != SHT4X_CMD_LEN)
+ return -EIO;
data->heating_complete = get_jiffies_64() + msecs_to_jiffies(heating_time_bound);
data->data_pending = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0874/1257] hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (872 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0873/1257] hwmon: (sht4x) Reject incomplete heater command transfers Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0875/1257] lib/buildid: reject file offsets that do not fit in pgoff_t Greg Kroah-Hartman
` (124 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+0f98b0c0bdeaab2dc2fd,
Sanan Hasanov, Guenter Roeck, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanan Hasanov <sanan.hasanov@ucf.edu>
[ Upstream commit e4fdc82f55cf0e3d5df5c88278da5baa76a109d1 ]
ccp_raw_event() is the HID ->raw_event() callback and takes
wait_input_report_lock with a plain spin_lock(). This callback can run
in very different contexts depending on the transport: from process
context (e.g. uhid, via a write() to /dev/uhid) with softirqs and
interrupts enabled, and from URB completion, which is softirq context
for HCDs using HCD_BH and hard interrupt context for HCDs that do not
(e.g. OHCI, UHCI).
Taking the lock from process context with softirqs enabled while the
same lock is also taken from softirq context can deadlock if the
softirq interrupts the lock holder on the same CPU. Lockdep reports:
WARNING: inconsistent lock state
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
...
spin_lock include/linux/spinlock.h:347 [inline]
ccp_raw_event+0x51/0x110 drivers/hwmon/corsair-cpro.c:161
__hid_input_report+0x41c/0x580 drivers/hid/hid-core.c:2175
hid_irq_in+0x492/0x710 drivers/hid/usbhid/hid-core.c:287
__usb_hcd_giveback_urb+0x378/0x540 drivers/usb/core/hcd.c:1657
dummy_timer+0xa91/0x4cc0 drivers/usb/gadget/udc/dummy_hcd.c:2023
For the same reason, the spin_lock_bh() in send_usb_cmd() is not
sufficient when ccp_raw_event() is called from hard interrupt context.
Use spin_lock_irqsave() in ccp_raw_event(), since it may be called with
interrupts already disabled, and spin_lock_irq() in send_usb_cmd(),
which always runs in process context.
Fixes: d02abd57e794 ("hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock")
Reported-by: syzbot+0f98b0c0bdeaab2dc2fd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0f98b0c0bdeaab2dc2fd
Cc: stable@vger.kernel.org
Signed-off-by: Sanan Hasanov <sanan.hasanov@ucf.edu>
Link: https://patch.msgid.link/20261008205310.30832-1-sanan.hasanou@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/corsair-cpro.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/hwmon/corsair-cpro.c b/drivers/hwmon/corsair-cpro.c
index c096451526132..e6d31d3676980 100644
--- a/drivers/hwmon/corsair-cpro.c
+++ b/drivers/hwmon/corsair-cpro.c
@@ -135,9 +135,9 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2,
* the raw event parsing and marked the ccp->wait_input_report
* completion as done.
*/
- spin_lock_bh(&ccp->wait_input_report_lock);
+ spin_lock_irq(&ccp->wait_input_report_lock);
reinit_completion(&ccp->wait_input_report);
- spin_unlock_bh(&ccp->wait_input_report_lock);
+ spin_unlock_irq(&ccp->wait_input_report_lock);
ret = hid_hw_output_report(ccp->hdev, ccp->cmd_buffer, OUT_BUFFER_SIZE);
if (ret < 0)
@@ -156,15 +156,16 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2,
static int ccp_raw_event(struct hid_device *hdev, struct hid_report *report, u8 *data, int size)
{
struct ccp_device *ccp = hid_get_drvdata(hdev);
+ unsigned long flags;
/* only copy buffer when requested */
- spin_lock(&ccp->wait_input_report_lock);
+ spin_lock_irqsave(&ccp->wait_input_report_lock, flags);
if (!completion_done(&ccp->wait_input_report)) {
memcpy(ccp->buffer, data, min(IN_BUFFER_SIZE, size));
ccp->buffer_recv_size = size;
complete_all(&ccp->wait_input_report);
}
- spin_unlock(&ccp->wait_input_report_lock);
+ spin_unlock_irqrestore(&ccp->wait_input_report_lock, flags);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0875/1257] lib/buildid: reject file offsets that do not fit in pgoff_t
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (873 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0874/1257] hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0876/1257] gpiolib: cdev: dont set GPIOD_FLAG_IS_OUT Greg Kroah-Hartman
` (123 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nickolai Zeldovich, Andrii Nakryiko,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
[ Upstream commit 0007654a7bf13ef2a19afd398bbc6507087f19fd ]
On a 32-bit kernel, parsing the build ID of a crafted ELF file can copy
far more than the intended bytes into a 64-byte on-stack buffer in
__build_id_parse(), corrupting the stack of whatever context fetches the
build ID. This might be reachable without privilege: perf records a build ID
for PERF_RECORD_MMAP2 on the no-fault path when a process mmaps its own file
(build_id_parse_nofault() from perf_event_mmap()), and BPF build-id stack
maps do the same.
freader_get_folio() turns a 64-bit file offset into a page cache index
with file_off >> PAGE_SHIFT and passes it to filemap_get_folio().
pgoff_t is unsigned long, 32-bit on a 32-bit kernel, so an ELF64 e_phoff
of 2^44 + k * PAGE_SIZE truncates to index k. filemap_get_folio()
returns the cached folio at index k, whose folio_pos() is far below the
requested file_off. In freader_fetch() the folio does not contain
file_off, so the "crossing folio boundaries" path computes
part_sz = folio_off + folio_sz - file_off as a large u64 (file_off is
much larger), and the following memcpy() truncates it to size_t and
copies a page into the 64-byte buffer. On a 64-bit kernel the index is
not truncated, the folio is not cached and the fetch returns -EFAULT, so
only 32-bit kernels are affected.
Reject a file offset that cannot be represented as a page cache index
before the lookup, so such a file fails the build ID parse cleanly as it
already does on 64-bit.
Reproduced on i386 under QEMU with CONFIG_STACKPROTECTOR_STRONG: mmapping
a crafted ELF (ELFCLASS64, e_phoff = 2^44) while a perf event with
attr.build_id is open panics with "stack-protector: Kernel stack is
corrupted in: __build_id_parse"; with this patch the parse returns
-EFAULT and the mmap completes cleanly. Built for i386 with W=1, no new
warnings.
Fixes: de3ec364c3c3 ("lib/buildid: add single folio-based file reader abstraction")
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/buildid.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/lib/buildid.c b/lib/buildid.c
index c4b7376406215..995a327f46ae7 100644
--- a/lib/buildid.c
+++ b/lib/buildid.c
@@ -47,6 +47,10 @@ static int freader_get_folio(struct freader *r, loff_t file_off)
freader_put_folio(r);
+ /* the page index must fit in pgoff_t */
+ if (file_off < 0 || file_off > MAX_LFS_FILESIZE)
+ return -EFAULT;
+
/* only use page cache lookup - fail if not already cached */
r->folio = filemap_get_folio(r->file->f_mapping, file_off >> PAGE_SHIFT);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0876/1257] gpiolib: cdev: dont set GPIOD_FLAG_IS_OUT
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (874 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0875/1257] lib/buildid: reject file offsets that do not fit in pgoff_t Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0877/1257] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3402VA Greg Kroah-Hartman
` (122 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Ambrozewicz, Kent Gibson,
Bartosz Golaszewski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
[ Upstream commit 974d2712cb15014019595799b3ed68fef5fe9695 ]
When a line is requested or reconfigured through the v2 uAPI,
gpio_v2_line_config_flags_to_desc_flags() copies the requested
configuration into the descriptor flags, GPIOD_FLAG_IS_OUT included,
before gpiod_direction_input_nonotify() or
gpiod_direction_output_nonotify() asks the driver for the direction.
If the driver refuses, for instance with -EOPNOTSUPP from
.direction_input() for a line that can only be an output, the ioctl
fails but the flag keeps the refused direction. gpiod_free_commit()
does not touch GPIOD_FLAG_IS_OUT, so this outlives the failed request,
and GPIO_V2_GET_LINEINFO_IOCTL reports the line as an input while the
hardware still drives it, until a request without direction flags
makes gpiod_request_commit() read the direction back from the driver:
GPIO_V2_GET_LINE_IOCTL, line 0, input: -EOPNOTSUPP
GPIO_V2_GET_LINEINFO_IOCTL, line 0: input
GPIO_V2_GET_LINE_IOCTL, line 0, no direction: ok
GPIO_V2_GET_LINEINFO_IOCTL, line 0: output
GPIO_V2_LINE_SET_CONFIG_IOCTL updates the flags in the same order.
There the line stays requested, and since commit 92ac7de3175e
("gpiolib: don't allow setting values on input lines")
GPIO_V2_LINE_SET_VALUES_IOCTL on it then fails with -EPERM, though the
line is still an output. A line whose driver refuses to make it an
output is likewise reported as one.
gpiod_direction_input_nonotify() and gpiod_direction_output_nonotify()
set or clear GPIOD_FLAG_IS_OUT themselves once the driver has accepted
the direction, emulated open drain and open source included, and
nothing between the copy and those calls reads the flag. Leave it to
them, as the v1 uAPI already does.
The other flags that the helper copies stay as they are. Active low,
drive and bias are what gpiod_direction_*() applies, drive and bias
possibly before the driver refuses the direction; edges and event
clock are the character device's own. None of them is read back from
the driver, so there is no earlier state that is more accurate to go
back to. A failed request releases the line, which clears them, and a
failed reconfiguration leaves the line, like the lines before it, with
what was applied up to the failure.
Reproduced under QEMU with a test GPIO chip whose line 0 refuses input
and line 1 refuses output: both refused requests and both refused
reconfigurations leave the line info with the refused direction, and
setting the value of the reconfigured output fails with -EPERM. With
this change the line info shows the direction of the hardware in all
four cases and setting the value works. First seen on real hardware
with v6.12.
Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
Reviewed-by: Kent Gibson <warthog618@gmail.com>
Link: https://patch.msgid.link/20261016-gpiolib-cdev-direction-v2-1-aambrozewicz@nvidia.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpiolib-cdev.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index 5d53bfcdf7268..f4d78113ade2c 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -1229,11 +1229,6 @@ static void gpio_v2_line_config_flags_to_desc_flags(u64 lflags,
assign_bit(GPIOD_FLAG_ACTIVE_LOW, &flags,
lflags & GPIO_V2_LINE_FLAG_ACTIVE_LOW);
- if (lflags & GPIO_V2_LINE_FLAG_OUTPUT)
- set_bit(GPIOD_FLAG_IS_OUT, &flags);
- else if (lflags & GPIO_V2_LINE_FLAG_INPUT)
- clear_bit(GPIOD_FLAG_IS_OUT, &flags);
-
assign_bit(GPIOD_FLAG_EDGE_RISING, &flags,
lflags & GPIO_V2_LINE_FLAG_EDGE_RISING);
assign_bit(GPIOD_FLAG_EDGE_FALLING, &flags,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0877/1257] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3402VA
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (875 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0876/1257] gpiolib: cdev: dont set GPIOD_FLAG_IS_OUT Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0878/1257] ALSA: usb-audio: Fix missing sample-rate control for PreSonus AudioBox USB Greg Kroah-Hartman
` (121 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, George Christidis, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Christidis <gxristidis@gmail.com>
[ Upstream commit 40409fa23d32c8ed51e832031daa6decd9d6fd11 ]
The UX3402VA (1043:16a3) BIOS leaves pin 0x19 unconfigured, so the
headset mic does not work. Use ALC294_FIXUP_ASUS_SPI_HEADSET_MIC like
the UX3405MA, it sets up the mic and keeps the CS35L41 speaker fixup.
Tested on a UX3402VA: headset mic, internal mic and speakers work.
Fixes: 07058dceb038 ("ALSA: hda/realtek: Splitting the UX3402 into two separate models")
Cc: stable@vger.kernel.org
Signed-off-by: George Christidis <gxristidis@gmail.com>
Link: https://patch.msgid.link/20261018-for-linus-v1-1-4d8e9ff27d89@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index e71f78b13a277..68650004ce0f9 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7907,7 +7907,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZI/ZJ/ZQ/ZU/ZV", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1664, "ASUS ExpertBook PM3406CHA", ALC256_FIXUP_ASUS_PM3406CHA),
SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2),
- SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC294_FIXUP_ASUS_SPI_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
SND_PCI_QUIRK(0x1043, 0x16d3, "ASUS UX5304VA", ALC245_FIXUP_CS35L41_SPI_2),
SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0878/1257] ALSA: usb-audio: Fix missing sample-rate control for PreSonus AudioBox USB
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (876 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0877/1257] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3402VA Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0879/1257] netfilter: nf_reject: initialize IPCB at inet ingress Greg Kroah-Hartman
` (120 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Nemer, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Nemer <thomas.nemer@fortytwo.fr>
[ Upstream commit 1869c47e5d59c6940823a58d58b647645cb69017 ]
The fixed audio formats for the PreSonus AudioBox USB declare
.attributes = 0, dropping UAC_EP_CS_ATTR_SAMPLE_RATE that the device
advertises in its class-specific endpoint descriptors (EP_GENERAL
bmAttributes 0x01 on both EP 0x01 and EP 0x82).
As a result set_sample_rate_v1() bails out and the kernel never sends
the UAC1 SET_CUR SAMPLING_FREQ request, leaving the device on its
power-on default clock. Playback and capture then run distorted
whenever the stream rate differs from that default. The device keeps
the last rate set by a host as long as it stays powered, which made the
regression look intermittent (e.g. it disappears after the device was
initialized by a host running a kernel without this quirk entry).
Restore the sample-rate attribute on both streams.
Fixes: 34fe4a9df247 ("ALSA: usb-audio: Add quirk for PreSonus AudioBox USB")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Nemer <thomas.nemer@fortytwo.fr>
Link: https://patch.msgid.link/20261018111519.191844-1-thomas.nemer@fortytwo.fr
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/quirks-table.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index dd02c6294edf2..0426cbda314b0 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -2719,7 +2719,7 @@ YAMAHA_DEVICE(0x7010, "UB99"),
.iface = 2,
.altsetting = 1,
.altset_idx = 1,
- .attributes = 0,
+ .attributes = UAC_EP_CS_ATTR_SAMPLE_RATE,
.endpoint = 0x01,
.ep_attr = USB_ENDPOINT_XFER_ISOC,
.rates = SNDRV_PCM_RATE_44100 |
@@ -2740,7 +2740,7 @@ YAMAHA_DEVICE(0x7010, "UB99"),
.iface = 3,
.altsetting = 1,
.altset_idx = 1,
- .attributes = 0,
+ .attributes = UAC_EP_CS_ATTR_SAMPLE_RATE,
.endpoint = 0x82,
.ep_attr = USB_ENDPOINT_XFER_ISOC,
.rates = SNDRV_PCM_RATE_44100 |
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0879/1257] netfilter: nf_reject: initialize IPCB at inet ingress
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (877 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0878/1257] ALSA: usb-audio: Fix missing sample-rate control for PreSonus AudioBox USB Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0880/1257] hwmon: (coretemp) Fix handling of isolated SMT siblings Greg Kroah-Hartman
` (119 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kyle Zeng, David Lee,
Pablo Neira Ayuso, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
[ Upstream commit 73a73d442f9986353fe284bd1b504d0313d0f153 ]
The inet ingress hook runs before ip_rcv_core() and ip6_rcv_core(), so
neither IPCB nor IP6CB has been initialized when nft_reject_inet passes
a packet to nf_send_unreach() or nf_send_unreach6(). skb->cb can
therefore retain metadata from an earlier protocol layer.
For IPv4, icmp_send() treats IPCB(skb)->opt as parsed IPv4 options.
Stale option offsets can make __ip_options_echo() copy an
attacker-controlled length into its 40-byte reply option buffer and
overflow the stack. On an unpatched v7.2-rc5 kernel, the IPv4
reproducer produced:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo()
Write of size 255
For IPv6, icmpv6_send() consumes IP6CB(skb) as parsed IPv6 metadata. It
always uses iif for source selection and, when MIP6 is enabled, uses
dsthao as an extension-header offset. These fields must not be stale.
For NF_INET_INGRESS, clear the address-family-specific control block and
restore its input interface before constructing the ICMP error. This
matches similar initialization normally performed by ip_rcv_core() and
ip6_rcv_core().
Fixes: 117ca1f8920c ("netfilter: nft_reject_inet: allow to use reject from inet ingress")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/netfilter/nf_reject_ipv4.c | 5 +++++
net/ipv6/netfilter/nf_reject_ipv6.c | 5 +++++
2 files changed, 10 insertions(+)
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index 59ec465a9df98..7cb33af671e26 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -357,6 +357,11 @@ void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)
if (!skb_valid_dst(skb_in) && nf_reject_fill_skb_dst(skb_in) < 0)
return;
+ if (hook == NF_INET_INGRESS) {
+ memset(IPCB(skb_in), 0, sizeof(*IPCB(skb_in)));
+ IPCB(skb_in)->iif = skb_in->skb_iif;
+ }
+
if (skb_csum_unnecessary(skb_in) ||
!nf_reject_verify_csum(skb_in, dataoff, proto)) {
icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index 07cdaa10da0d0..5e08d8529cc88 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -444,6 +444,11 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in,
if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)
skb_in->dev = net->loopback_dev;
+ if (hooknum == NF_INET_INGRESS) {
+ memset(IP6CB(skb_in), 0, sizeof(*IP6CB(skb_in)));
+ IP6CB(skb_in)->iif = skb_in->skb_iif;
+ }
+
if (!skb_valid_dst(skb_in) && nf_reject6_fill_skb_dst(skb_in) < 0)
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0880/1257] hwmon: (coretemp) Fix handling of isolated SMT siblings
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (878 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0879/1257] netfilter: nf_reject: initialize IPCB at inet ingress Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0881/1257] hwmon: (gigabyte_waterforce) reject short input reports Greg Kroah-Hartman
` (118 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marcelo Tosatti, Ximing Zhang,
Asaf Nuri Bertizlioğlu, Guenter Roeck, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ximing Zhang <xzhangjr@gmail.com>
[ Upstream commit 37c1974a0ec4ec4624a270291a179c53f8f4fbca ]
Commit 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to
isolated CPUs") prevents create_core_data() from creating temperature
data for an isolated CPU. coretemp_cpu_online(), however, still adds
that CPU to pdata->cpumask.
When an isolated SMT thread is processed before a housekeeping sibling,
the mask makes coretemp_cpu_online() believe that the core is already
represented. The housekeeping sibling then gets no temperature
attributes. Package attributes are similarly not retried when the first
CPU processed in a die is isolated.
The mask is also used to select a replacement CPU when a sensor target
goes offline. Including isolated CPUs permits the driver to retarget a
sensor to one, causing subsequent sysfs reads to send an RDMSR IPI to an
isolated CPU.
Keep isolated CPUs out of pdata->cpumask by moving the housekeeping check
to coretemp_cpu_online(). Sensor creation is then deferred to an eligible
CPU, and hotplug replacement targets remain on housekeeping CPUs.
Tested on an Intel Core i7-10510U running 6.18.50-3-cachyos-lts, with
nohz_full=1 on CPU 1 and its housekeeping SMT sibling on CPU 5. The stock
driver omitted Core 1 after module load and retained its readable sensor
after CPU 5 was offlined. The patched driver exposed Core 1, removed it
when CPU 5 went offline, and restored it when CPU 5 returned.
Fixes: 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to isolated CPUs")
Cc: stable@vger.kernel.org
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Ximing Zhang <xzhangjr@gmail.com>
Tested-by: Asaf Nuri Bertizlioğlu <ycistak@gmail.com>
Link: https://patch.msgid.link/20261016-codex-coretemp-housekeeping-v1-1-96618c5676b2@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/coretemp.c | 26 ++++++++++++++++----------
1 file changed, 16 insertions(+), 10 deletions(-)
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index bee2c9896d4c5..9ed21c8c093a5 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -568,9 +568,6 @@ static int create_core_data(struct platform_device *pdev, unsigned int cpu,
u64 val;
int err;
- if (!housekeeping_cpu(cpu, HK_TYPE_MISC))
- return 0;
-
tdata = init_temp_data(pdata, cpu, pkg_flag);
if (!tdata)
return -ENOMEM;
@@ -690,6 +687,14 @@ static int coretemp_cpu_online(unsigned int cpu)
if (!cpu_has(c, X86_FEATURE_DTHERM))
return -ENODEV;
+ /*
+ * Keep isolated CPUs out of pdata->cpumask. Besides tracking the CPUs
+ * available to this driver, the mask is used to select the CPU on which
+ * to read the temperature MSRs.
+ */
+ if (!housekeeping_cpu(cpu, HK_TYPE_MISC))
+ return 0;
+
pdata = platform_get_drvdata(pdev);
if (!pdata->hwmon_dev) {
struct device *hwmon;
@@ -719,8 +724,8 @@ static int coretemp_cpu_online(unsigned int cpu)
}
/*
- * Check whether a thread sibling is already online. If not add the
- * interface for this CPU core.
+ * Check whether a housekeeping thread sibling is already online. If
+ * not, add the interface for this CPU core.
*/
if (!cpumask_intersects(&pdata->cpumask, topology_sibling_cpumask(cpu)))
coretemp_add_core(pdev, cpu, 0);
@@ -750,9 +755,9 @@ static int coretemp_cpu_offline(unsigned int cpu)
cpumask_clear_cpu(cpu, &pd->cpumask);
/*
- * If this is the last thread sibling, remove the CPU core
- * interface, If there is still a sibling online, transfer the
- * target cpu of that core interface to it.
+ * If this is the last housekeeping thread sibling, remove the CPU core
+ * interface. If there is still a housekeeping sibling online, transfer
+ * the target CPU of that core interface to it.
*/
target = cpumask_any_and(&pd->cpumask, topology_sibling_cpumask(cpu));
if (target >= nr_cpu_ids) {
@@ -764,7 +769,8 @@ static int coretemp_cpu_offline(unsigned int cpu)
}
/*
- * If all cores in this pkg are offline, remove the interface.
+ * If all housekeeping cores in this pkg are offline, remove the
+ * interface.
*/
tdata = get_temp_data(pd, -1);
if (cpumask_empty(&pd->cpumask)) {
@@ -777,7 +783,7 @@ static int coretemp_cpu_offline(unsigned int cpu)
/*
* Check whether this core is the target for the package
- * interface. We need to assign it to some other cpu.
+ * interface. We need to assign it to some other housekeeping CPU.
*/
if (tdata && tdata->cpu == cpu) {
target = cpumask_first(&pd->cpumask);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0881/1257] hwmon: (gigabyte_waterforce) reject short input reports
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (879 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0880/1257] hwmon: (coretemp) Fix handling of isolated SMT siblings Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0882/1257] bnxt_en: dont leave an XDP program installed when the open fails Greg Kroah-Hartman
` (117 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Guenter Roeck,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit 400be69515c327ced60082b27ede902a8d93cbdb ]
The HID raw_event callback runs before HID core validates the received
report length. waterforce_raw_event() reads command bytes and then accesses
fixed offsets for firmware or status data without any length checks. A
truncated report can therefore cause out-of-bounds reads and update hwmon
state with unrelated data.
Require every report to contain the firmware response fields, which also
covers both command bytes. After identifying a status response, require
the byte at the highest status offset before accessing its payload.
Fixes: 42ac68e3d4ba ("hwmon: Add driver for Gigabyte AORUS Waterforce AIO coolers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Link: https://patch.msgid.link/20260927084959.893708-1-yaojiale02@163.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/gigabyte_waterforce.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hwmon/gigabyte_waterforce.c b/drivers/hwmon/gigabyte_waterforce.c
index 4eea05f8b569c..f4d0376dd68e0 100644
--- a/drivers/hwmon/gigabyte_waterforce.c
+++ b/drivers/hwmon/gigabyte_waterforce.c
@@ -257,6 +257,9 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo
{
struct waterforce_data *priv = hid_get_drvdata(hdev);
+ if (size <= FIRMWARE_VER_START_OFFSET_2)
+ return 0;
+
if (data[0] == get_firmware_ver_cmd[0] && data[1] == get_firmware_ver_cmd[1]) {
/* Received a firmware version report */
priv->firmware_version =
@@ -269,6 +272,8 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo
if (data[0] != get_status_cmd[0] || data[1] != get_status_cmd[1])
return 0;
+ if (size <= WATERFORCE_TEMP_SENSOR)
+ return 0;
priv->temp_input[0] = data[WATERFORCE_TEMP_SENSOR] * 1000;
priv->speed_input[0] = get_unaligned_le16(data + WATERFORCE_FAN_SPEED);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0882/1257] bnxt_en: dont leave an XDP program installed when the open fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (880 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0881/1257] hwmon: (gigabyte_waterforce) reject short input reports Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0883/1257] f2fs: flush SIT journal during filesystem resize Greg Kroah-Hartman
` (116 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vaibhav Nagare, Simon Horman,
Paolo Abeni, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Nagare <vnagare@redhat.com>
[ Upstream commit 78731b46967e3e7102b5cd5062bef185f3404b5c ]
bnxt_xdp_set() stores the new program and drops the reference on the old
one before reopening the NIC. If bnxt_open_nic() then fails, ndo_bpf()
returns an error with the new program still in bp->xdp_prog. The caller
treats the error as "nothing was installed" and drops its own reference,
so bp->xdp_prog is left pointing at a freed program and the next XDP
update dereferences it:
BUG: unable to handle page fault for address: ff78ecc80ddd1038
RIP: 0010:__bpf_prog_put+0x5/0x80
Call Trace:
bnxt_xdp_set+0xad/0x1b0 [bnxt_en]
dev_xdp_propagate+0x36/0xa0
bond_xdp_set+0xeb/0x2d0 [bonding]
dev_xdp_install+0x1b1/0x350
bpf_xdp_link_update+0xc5/0x1b0
link_update+0x104/0x1e0
__sys_bpf+0x662/0xcf0
Seen on a 6.12 based kernel after bnxt_alloc_mem() failed an order-4
allocation on a fragmented host:
bnxt_en 0000:a0:00.1 ens4f1np1: nic open fail (rc: fffffff4)
bond1: (slave ens4f1np1): Error -12 calling ndo_bpf
Bonding is not required to hit this; a plain XDP attach on a bnxt
interface takes the same path.
Restore the previous program when an attach or a replace fails, and
recompute the page-mode and XDP TX ring configuration from it. The
configuration matters because bnxt_init_one_rx_ring() only assigns
rxr->xdp_prog in page mode, and __bnxt_set_rx_skb_mode() derives
dev->max_mtu from the installed program. Release the old program only
once the change has been committed.
A detach is not undone. dev_xdp_detach_link() clears the core's record
of the program even when the driver returns an error, so putting the
program back would leave the driver running a program the core has
already dropped. If the reopen fails during a detach, bnxt_xdp_set()
therefore returns 0 with the device closed; bnxt_open_nic() has already
logged the failure.
Found in a crash dump; the change was not tested on hardware.
Fixes: c6d30e8391b8 ("bnxt_en: Add basic XDP support.")
Cc: stable@vger.kernel.org
Signed-off-by: Vaibhav Nagare <vnagare@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261012072802.2153706-1-vnagare@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 49 +++++++++++++------
1 file changed, 33 insertions(+), 16 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
index 9e5009be8e989..96845c8646e06 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
@@ -381,11 +381,31 @@ int bnxt_xdp_xmit(struct net_device *dev, int num_frames,
return nxmit;
}
+static void bnxt_xdp_apply_cfg(struct bnxt *bp, int tx_xdp)
+{
+ struct net_device *dev = bp->dev;
+ int tc = bp->num_tc ? : 1;
+
+ if (bp->xdp_prog) {
+ bnxt_set_rx_skb_mode(bp, true);
+ xdp_features_set_redirect_target_locked(dev, true);
+ } else {
+ xdp_features_clear_redirect_target_locked(dev);
+ bnxt_set_rx_skb_mode(bp, false);
+ }
+ bp->tx_nr_rings_xdp = tx_xdp;
+ bp->tx_nr_rings = bp->tx_nr_rings_per_tc * tc + tx_xdp;
+ bnxt_set_cp_rings(bp, true);
+ bnxt_set_tpa_flags(bp);
+ bnxt_set_ring_params(bp);
+}
+
static int bnxt_xdp_set(struct bnxt *bp, struct bpf_prog *prog)
{
struct net_device *dev = bp->dev;
int tx_xdp = 0, rc, tc;
struct bpf_prog *old;
+ int old_tx_xdp;
netdev_assert_locked(dev);
@@ -418,25 +438,22 @@ static int bnxt_xdp_set(struct bnxt *bp, struct bpf_prog *prog)
if (netif_running(dev))
bnxt_close_nic(bp, true, false);
+ old_tx_xdp = bp->tx_nr_rings_xdp;
old = xchg(&bp->xdp_prog, prog);
- if (old)
- bpf_prog_put(old);
-
- if (prog) {
- bnxt_set_rx_skb_mode(bp, true);
- xdp_features_set_redirect_target_locked(dev, true);
- } else {
- xdp_features_clear_redirect_target_locked(dev);
- bnxt_set_rx_skb_mode(bp, false);
+ bnxt_xdp_apply_cfg(bp, tx_xdp);
+
+ if (netif_running(dev)) {
+ rc = bnxt_open_nic(bp, true, false);
+ /* a detach cannot be undone, only an attach */
+ if (rc && prog) {
+ WRITE_ONCE(bp->xdp_prog, old);
+ bnxt_xdp_apply_cfg(bp, old_tx_xdp);
+ return rc;
+ }
}
- bp->tx_nr_rings_xdp = tx_xdp;
- bp->tx_nr_rings = bp->tx_nr_rings_per_tc * tc + tx_xdp;
- bnxt_set_cp_rings(bp, true);
- bnxt_set_tpa_flags(bp);
- bnxt_set_ring_params(bp);
- if (netif_running(dev))
- return bnxt_open_nic(bp, true, false);
+ if (old)
+ bpf_prog_put(old);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0883/1257] f2fs: flush SIT journal during filesystem resize
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (881 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0882/1257] bnxt_en: dont leave an XDP program installed when the open fails Greg Kroah-Hartman
@ 2026-11-07 13:52 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0884/1257] f2fs: fix submit accounting for IPU writeback Greg Kroah-Hartman
` (115 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Wenjie Qi, Daeho Jeong,
Chao Yu, Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjie Qi <qwjhust@gmail.com>
[ Upstream commit a6ede405455106bf42164ec96fd84008c5aabdd9 ]
During a filesystem resize, SBI_IS_RESIZEFS prevents new SIT entries
from being added to the journal and forces existing entries to the SIT
area. However, f2fs_flush_sit_entries() returns early when there are no
new dirty sentries, leaving existing journal entries behind.
After the main area shrinks, a later checkpoint can access a journal
entry whose segment number is outside the new geometry and trigger
f2fs_bug_on().
Only take the zero-dirty fast path when entries may be written back to
the journal. This lets resize drain existing entries through
remove_sits_in_journal() even when there are no new dirty sentries.
Cc: stable@kernel.org
Fixes: 04f0b2eaa3b3 ("f2fs: ioctl for removing a range from F2FS")
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/segment.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index db4af7a6b138e..118e7edb600c1 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -4868,7 +4868,7 @@ void f2fs_flush_sit_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc)
down_write(&sit_i->sentry_lock);
- if (!sit_i->dirty_sentries)
+ if (!sit_i->dirty_sentries && to_journal)
goto out;
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0884/1257] f2fs: fix submit accounting for IPU writeback
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (882 preceding siblings ...)
2026-11-07 13:52 ` [PATCH 7.3 0883/1257] f2fs: flush SIT journal during filesystem resize Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0885/1257] dax: fix wrong error code returned from dax_dedupe_file_range_compare() Greg Kroah-Hartman
` (114 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Seongjae Jeong, Chao Yu,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seongjae Jeong <jsjlee1020@gmail.com>
[ Upstream commit 6d1f622b9c069378cdb83088be2b15a9b480b8a3 ]
f2fs_write_cache_pages() uses the submitted count, which is set to
fio.submitted in f2fs_write_single_data_page(), to update nwritten
and decrement wbc->nr_to_write.
In the OPU path, f2fs_submit_page_write() sets fio->submitted to 1.
However, in the IPU path, fio->submitted is never set and remains zero.
As a result, successful IPU writes are not accounted for.
This can cause asynchronous writeback to continue beyond its budget.
Set fio->submitted in f2fs_inplace_write_data() after a page is
successfully merged into a bio or submitted, so that successful
IPU writes are included in the writeback accounting.
Cc: stable@kernel.org
Fixes: d68f735b3bc9 ("f2fs: check io submission more precisely")
Signed-off-by: Seongjae Jeong <jsjlee1020@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/segment.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 118e7edb600c1..381b0a9875946 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -4268,6 +4268,7 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
else
err = f2fs_submit_page_bio(fio);
if (!err) {
+ fio->submitted = 1;
f2fs_update_device_state(fio->sbi, fio->ino,
fio->new_blkaddr, 1);
f2fs_update_iostat(fio->sbi, fio_inode(fio),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0885/1257] dax: fix wrong error code returned from dax_dedupe_file_range_compare()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (883 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0884/1257] f2fs: fix submit accounting for IPU writeback Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0886/1257] rtc: cmos: Disable ACPI RTC event before handling it Greg Kroah-Hartman
` (113 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jianyun Gao, Jan Kara,
Darrick J. Wong, Alison Schofield, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianyun Gao <jianyungao89@gmail.com>
[ Upstream commit 9b036546a02c6c9a5133f9c1e93503896595c6ba ]
When dax_range_compare_iter() returns a negative error code (e.g. -EIO),
dax_dedupe_file_range_compare() incorrectly returns 'ret' which holds the
positive return value from iomap_iter() indicating more iterations remain.
This positive value leaks to the caller, where vfs_dedupe_file_range()
interprets it as success (bytes_deduped = len), causing userspace to
incorrectly believe deduplication completed.
Return 'status' instead to propagate the actual error code.
Fixes: 0e79e3736d54 ("fsdax: dedupe: iter two files at the same time")
Cc: stable@vger.kernel.org
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Link: https://patch.msgid.link/20261015143426.17620-1-jianyungao89@gmail.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dax.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/dax.c b/fs/dax.c
index dbb58692efecf..61dce4601aaa5 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -2266,7 +2266,7 @@ int dax_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
status = dax_range_compare_iter(&src_iter, &dst_iter,
min(src_iter.len, dst_iter.len), same);
if (status < 0)
- return ret;
+ return status;
src_iter.status = dst_iter.status = status;
}
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0886/1257] rtc: cmos: Disable ACPI RTC event before handling it
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (884 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0885/1257] dax: fix wrong error code returned from dax_dedupe_file_range_compare() Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0887/1257] rtc: cmos: Honor explicit use_acpi_alarm parameter value Greg Kroah-Hartman
` (112 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta),
Alexandre Belloni, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 3f67038df8b5cba07254d1cff60d73e988b49ab7 ]
Users of RTC_UIE_ON can stop receiving update interrupts when rtc-cmos
handles alarms through ACPI. In one 50-run test, 40 runs passed and 10
timed out after receiving between one and four of five expected events.
The ACPI ff_rt_clk counter stopped at 218, exactly matching the number
of events delivered to userspace, and reported:
218 STS disabled unmasked
rtc_handler() runs in the threaded ACPI SCI handler and calls
cmos_interrupt(), which schedules rtc->irqwork. The work can run before
rtc_handler() returns:
ACPI SCI thread rtc->irqwork
cmos_interrupt()
schedule_work()
__rtc_set_alarm()
rtc_wake_on()
acpi_clear_event()
acpi_disable_event()
The SCI thread then disables the event that the worker enabled for the
next alarm. That alarm sets its status while delivery remains disabled,
so no update interrupt reaches userspace.
Clear and disable the current ACPI RTC event before cmos_interrupt()
schedules the work. The worker can then enable the next event without
the handler undoing it. With this ordering, 150 runs delivered all 750
events without a stall.
Fixes: 311ee9c151ad ("rtc: cmos: allow using ACPI for RTC alarm instead of HPET")
Cc: stable@vger.kernel.org
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Link: https://patch.msgid.link/20261015173029.3091872-2-gourry@gourry.net
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-cmos.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index fa04ece151b8b..fe514b1aa3433 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -758,7 +758,9 @@ static u32 rtc_handler(void *context)
unsigned char rtc_intr;
unsigned long flags;
-
+ /* Quiesce this event before rtc->irqwork can arm the next one. */
+ acpi_clear_event(ACPI_EVENT_RTC);
+ acpi_disable_event(ACPI_EVENT_RTC, 0);
/*
* Always update rtc irq when ACPI is used as RTC Alarm.
* Or else, ACPI SCI is enabled during suspend/resume only,
@@ -781,8 +783,6 @@ static u32 rtc_handler(void *context)
}
pm_wakeup_hard_event(dev);
- acpi_clear_event(ACPI_EVENT_RTC);
- acpi_disable_event(ACPI_EVENT_RTC, 0);
return ACPI_INTERRUPT_HANDLED;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0887/1257] rtc: cmos: Honor explicit use_acpi_alarm parameter value
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (885 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0886/1257] rtc: cmos: Disable ACPI RTC event before handling it Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0888/1257] platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc() Greg Kroah-Hartman
` (111 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price (Meta),
Alexandre Belloni, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 3c7acb209e1d630b734a2ec72bd988f5da2ac55c ]
An explicit rtc_cmos.use_acpi_alarm=0 command-line argument is ignored
on systems where use_acpi_alarm_quirks() enables ACPI RTC alarms. The
argument appears in /proc/cmdline, but the read-only parameter reports Y.
The boolean parameter defaults to false, so the driver cannot distinguish
an omitted argument from an explicit false value. Use a custom setter to
record whether parsing occurred and skip automatic selection when it did.
Preserve the bool parameter type metadata. Automatic selection remains
unchanged when the parameter is omitted.
On the affected system, the explicit false value reports N after this
change. The HPET-emulated path completed 100 test runs without a failure
while the ACPI RTC event counter remained at zero.
Fixes: 36d91a4d401c ("rtc: cmos: introduce quirks to enable use_acpi_alarm mode")
Cc: stable@vger.kernel.org
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Link: https://patch.msgid.link/20261015173029.3091872-3-gourry@gourry.net
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-cmos.c | 26 +++++++++++++++++++++++++-
1 file changed, 25 insertions(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index fe514b1aa3433..209aa4ec732c8 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -57,7 +57,28 @@
*/
static bool use_acpi_alarm;
-module_param(use_acpi_alarm, bool, 0444);
+static bool use_acpi_alarm_explicit;
+
+static int set_use_acpi_alarm(const char *val, const struct kernel_param *kp)
+{
+ int ret;
+
+ ret = param_set_bool(val, kp);
+ if (!ret)
+ use_acpi_alarm_explicit = true;
+
+ return ret;
+}
+
+static const struct kernel_param_ops use_acpi_alarm_ops = {
+ .flags = KERNEL_PARAM_OPS_FL_NOARG,
+ .set = set_use_acpi_alarm,
+ .get = param_get_bool,
+};
+
+param_check_bool(use_acpi_alarm, &use_acpi_alarm);
+module_param_cb(use_acpi_alarm, &use_acpi_alarm_ops, &use_acpi_alarm, 0444);
+__MODULE_PARM_TYPE(use_acpi_alarm, "bool");
static inline int cmos_use_acpi_alarm(void)
{
@@ -822,6 +843,9 @@ static void rtc_wake_off(struct device *dev)
#ifdef CONFIG_X86
static void use_acpi_alarm_quirks(void)
{
+ if (use_acpi_alarm_explicit)
+ return;
+
if (acpi_gbl_FADT.flags & ACPI_FADT_FIXED_RTC)
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0888/1257] platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (886 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0887/1257] rtc: cmos: Honor explicit use_acpi_alarm parameter value Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0889/1257] rtc: pcf8563: pass the driver data to the alarm interrupt handler Greg Kroah-Hartman
` (110 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ma Ke, Mario Limonciello (AMD),
Alexandre Belloni, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit 22b9306f1fcf86f80b55f05f08d10a9951ba970a ]
amd_pmc_verify_czn_rtc() opens the RTC with rtc_class_open(), which
takes both a device reference and a module reference on the RTC
driver. The matching release is rtc_class_close(), and it is never
called. Every return path after the device has been opened, the ones
that return 0 as well as the ones that report an error, leaves both
references behind, so each S0i3 suspend leaks them.
Release the reference with a __free() cleanup on the declaration,
which covers every return path without adding labels.
rtc_class_close() does not accept a NULL argument, so the cleanup
helper has to guard against one: rtc_class_open() may fail and the
declaration still has to be cleaned up.
Found by code review.
Fixes: 59348401ebed ("platform/x86: amd-pmc: Add special handling for timer based S0i3 wakeup")
Cc: stable@vger.kernel.org
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20261011121759.3267678-1-make_ruc2021@163.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/pmc/pmc.c | 5 +++--
include/linux/rtc.h | 2 ++
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c
index e384b56d67559..f93c35efeaa00 100644
--- a/drivers/platform/x86/amd/pmc/pmc.c
+++ b/drivers/platform/x86/amd/pmc/pmc.c
@@ -14,6 +14,7 @@
#include <linux/array_size.h>
#include <linux/bitfield.h>
#include <linux/bits.h>
+#include <linux/cleanup.h>
#include <linux/debugfs.h>
#include <linux/delay.h>
#include <linux/dmi.h>
@@ -648,7 +649,6 @@ static int amd_pmc_wa_irq1(struct amd_pmc_dev *pdev)
static int amd_pmc_verify_czn_rtc(struct amd_pmc_dev *pdev, u32 *arg)
{
- struct rtc_device *rtc_device;
time64_t then, now, duration;
struct rtc_wkalrm alarm;
struct rtc_time tm;
@@ -664,7 +664,8 @@ static int amd_pmc_verify_czn_rtc(struct amd_pmc_dev *pdev, u32 *arg)
if (pdev->major < 64 || (pdev->major == 64 && pdev->minor < 53))
return 0;
- rtc_device = rtc_class_open("rtc0");
+ struct rtc_device *rtc_device __free(rtc_class_close) =
+ rtc_class_open("rtc0");
if (!rtc_device)
return 0;
rc = rtc_read_next_alarm(rtc_device, &alarm);
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index c09fc22819d0c..0f43b50272354 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -13,6 +13,7 @@
#define _LINUX_RTC_H_
+#include <linux/cleanup.h>
#include <linux/types.h>
#include <linux/interrupt.h>
#include <linux/nvmem-provider.h>
@@ -201,6 +202,7 @@ extern void rtc_update_irq(struct rtc_device *rtc,
extern struct rtc_device *rtc_class_open(const char *name);
extern void rtc_class_close(struct rtc_device *rtc);
+DEFINE_FREE(rtc_class_close, struct rtc_device *, if (_T) rtc_class_close(_T));
extern int rtc_irq_set_state(struct rtc_device *rtc, int enabled);
extern int rtc_irq_set_freq(struct rtc_device *rtc, int freq);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0889/1257] rtc: pcf8563: pass the driver data to the alarm interrupt handler
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (887 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0888/1257] platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc() Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0890/1257] hwmon: (mcp9982) Update the interval cache only after successful writes Greg Kroah-Hartman
` (109 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Igor Velkov, Nobuhiro Iwamtasu,
Alexandre Belloni, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Velkov <iav@iav.lv>
[ Upstream commit 5831f5fef10030c175e585d51b0e793dc6fef6ab ]
pcf8563_irq() takes its dev_id as struct pcf8563, but probe still
registers the interrupt with the i2c client. The handler then takes the
regmap pointer from the wrong structure: the first alarm oopses, the
level-low INT is never acknowledged, and the interrupt gets disabled as
spurious.
Only an RTC that has an interrupt (client->irq > 0) reaches this path.
Fixes: 00f1bb9b8486 ("rtc: pcf8563: Switch to regmap")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Igor Velkov <iav@iav.lv>
Reviewed-by: Nobuhiro Iwamtasu <iwamatsu@nigauri.org>
Link: https://patch.msgid.link/20261004-pcf8563-irq-data-v1-1-f176763ddf2f@iav.lv
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-pcf8563.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index 7eebdb0580674..0767331a2cc7a 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -531,7 +531,7 @@ static int pcf8563_probe(struct i2c_client *client)
err = devm_request_threaded_irq(&client->dev, client->irq,
NULL, pcf8563_irq,
IRQF_SHARED | IRQF_ONESHOT | irqflags,
- pcf8563_driver.driver.name, client);
+ pcf8563_driver.driver.name, pcf8563);
if (err) {
dev_err(&client->dev, "unable to request IRQ %d\n",
client->irq);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0890/1257] hwmon: (mcp9982) Update the interval cache only after successful writes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (888 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0889/1257] rtc: pcf8563: pass the driver data to the alarm interrupt handler Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0891/1257] hwmon: (sht3x) Return the consumed count for heater writes Greg Kroah-Hartman
` (108 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baek Kyu, Kim, Duicu Victor,
Guenter Roeck, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baek Kyu, Kim <pocj8ur4in@gmail.com>
[ Upstream commit fcf9aa9beb773bed9d2183bf34f822de12b2c91c ]
mcp9982_write() updates interval_idx before writing the conversion-rate
register. If the write fails without changing the register, subsequent
update_interval reads report the requested interval instead of the
previous setting.
Update interval_idx only after regmap_write() succeeds, leaving the
previous cached interval in place on error.
Fixes: e2fe950f34e5 ("hwmon: add support for MCP998X")
Cc: stable@vger.kernel.org
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Acked-by: Duicu Victor <victor.duicu@microchip.com>
Link: https://patch.msgid.link/20261018055750.1318723-1-pocj8ur4in@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/mcp9982.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/hwmon/mcp9982.c b/drivers/hwmon/mcp9982.c
index 3918dc36c9463..2cd41dcbd9af7 100644
--- a/drivers/hwmon/mcp9982.c
+++ b/drivers/hwmon/mcp9982.c
@@ -624,6 +624,7 @@ static int mcp9982_write(struct device *dev, enum hwmon_sensor_types type, u32 a
{
struct mcp9982_priv *priv = dev_get_drvdata(dev);
unsigned int idx;
+ int ret;
u8 addr;
switch (type) {
@@ -640,9 +641,13 @@ static int mcp9982_write(struct device *dev, enum hwmon_sensor_types type, u32 a
idx = find_closest_descending(val, mcp9982_update_interval,
ARRAY_SIZE(mcp9982_update_interval));
+ ret = regmap_write(priv->regmap, MCP9982_CONV_ADDR, idx);
+ if (ret)
+ return ret;
+
priv->interval_idx = idx;
- return regmap_write(priv->regmap, MCP9982_CONV_ADDR, idx);
+ return 0;
default:
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0891/1257] hwmon: (sht3x) Return the consumed count for heater writes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (889 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0890/1257] hwmon: (mcp9982) Update the interval cache only after successful writes Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0892/1257] hwmon: (acpi_power_meter) Fix 18.45 TW bug Greg Kroah-Hartman
` (107 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baek Kyu, Kim, Guenter Roeck,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baek Kyu, Kim <pocj8ur4in@gmail.com>
[ Upstream commit 817ac527100c8e20684211eb919ffd6d875adc7a ]
heater_enable_store() returns the result of i2c_master_send(), which is
the two-byte command length on success rather than the sysfs input
count. This can report more bytes than were supplied, or a partial write
for a fully processed input. For example, writing "on\n" returns two
instead of three, so a caller retrying the remaining newline gets
-EINVAL even though the heater command succeeded. Retrying the remainder
of "off\n" can also send the heater-off command twice.
Return count after a complete command transfer. Preserve negative I2C
errors and return -EIO for nonnegative incomplete transfers, so a
zero-message transfer is not reported as a successful zero-byte write.
Keep the existing boolean parsing, command selection and locking.
Fixes: 50c22cd154e5 ("hwmon: (sht3x) add humidity heater element control")
Cc: stable@vger.kernel.org
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Link: https://patch.msgid.link/20261019154718.2328055-1-pocj8ur4in@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/sht3x.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/hwmon/sht3x.c b/drivers/hwmon/sht3x.c
index b46de050e20ad..a0f5ba5c888dd 100644
--- a/drivers/hwmon/sht3x.c
+++ b/drivers/hwmon/sht3x.c
@@ -543,7 +543,10 @@ static ssize_t heater_enable_store(struct device *dev,
mutex_unlock(&data->i2c_lock);
- return ret;
+ if (ret != SHT3X_CMD_LENGTH)
+ return ret < 0 ? ret : -EIO;
+
+ return count;
}
static int update_interval_read(struct device *dev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0892/1257] hwmon: (acpi_power_meter) Fix 18.45 TW bug
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (890 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0891/1257] hwmon: (sht3x) Return the consumed count for heater writes Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0893/1257] Input: always accept EV_SYN in input_event() Greg Kroah-Hartman
` (106 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Grant Slater, Armin Wolf,
Guenter Roeck, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit 0b6eda22f9ab67ddb2a872b0c3fc578ad9f4e27e ]
The ACPI specification says:
"If an error occurs while obtaining the meter reading or if the value
is not available then an Integer with all bits set is returned"
This integer can also be 64-bit wide on ACPI 2.0 and later systems,
so we have to check for that too.
Compile-tested only.
Reported-by: Grant Slater <github@firefishy.com>
Closes: https://github.com/lm-sensors/lm-sensors/issues/460
Fixes: 1fefca6c57fb ("hwmon: (acpi_power_meter) Fix 4.29 MW bug")
Cc: stable@vger.kernel.org
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20261006234618.10943-1-W_Armin@gmx.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/acpi_power_meter.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
index 8a539e8d1334b..d3886adddf40f 100644
--- a/drivers/hwmon/acpi_power_meter.c
+++ b/drivers/hwmon/acpi_power_meter.c
@@ -10,6 +10,7 @@
#include <linux/hwmon.h>
#include <linux/hwmon-sysfs.h>
#include <linux/jiffies.h>
+#include <linux/limits.h>
#include <linux/mutex.h>
#include <linux/dmi.h>
#include <linux/slab.h>
@@ -30,7 +31,12 @@
#define POWER_METER_CAN_NOTIFY (1 << 3)
#define POWER_METER_IS_BATTERY (1 << 8)
#define UNKNOWN_HYSTERESIS 0xFFFFFFFF
-#define UNKNOWN_POWER 0xFFFFFFFF
+/*
+ * ACPI integers can either be 32-bit or 64-bit wide, so
+ * we have to check for both values.
+ */
+#define UNKNOWN_POWER_32 U32_MAX
+#define UNKNOWN_POWER_64 U64_MAX
#define METER_NOTIFY_CONFIG 0x80
#define METER_NOTIFY_TRIP 0x81
@@ -452,7 +458,7 @@ static int power_meter_read(struct device *dev, enum hwmon_sensor_types type,
ret = update_meter(res);
if (ret)
return ret;
- if (res->power == UNKNOWN_POWER)
+ if (res->power == UNKNOWN_POWER_32 || res->power == UNKNOWN_POWER_64)
return -ENODATA;
*val = res->power * 1000;
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0893/1257] Input: always accept EV_SYN in input_event()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (891 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0892/1257] hwmon: (acpi_power_meter) Fix 18.45 TW bug Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0894/1257] Revert "Input: matrix_keypad - force switch rows to input mode" Greg Kroah-Hartman
` (105 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Kosina, Dmitry Torokhov,
Sasha Levin, Karlos Abel
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[ Upstream commit c1d13bfdb9c75c2885d10332174a887349eb0b51 ]
Commit 0cd587735205 ("Input: preallocate memory to hold event values")
moved allocation of dev->vals into input_allocate_device(), which caused
input core to accumulate events reported while seeding initial device
state before input_register_device().
However, because EV_SYN is only set in dev->evbit during
input_register_device() (and some drivers also overwrite dev->evbit
directly before registration), any EV_SYN/SYN_REPORT events sent before
registration were dropped by is_event_supported(), leaving those seeded
events stuck in dev->vals until the next SYN_REPORT after registration.
Always accept EV_SYN in input_event() and input_inject_event() without
checking dev->evbit so input_sync() flushes dev->vals as intended.
Reported-by: Karlos Abel <kabel@voidship.net>,
Fixes: 0cd587735205 ("Input: preallocate memory to hold event values")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/asx50uz6iafsyAd5@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/input.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 01c91fec9b7eb..6c45a158047f2 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -391,7 +391,7 @@ void input_handle_event(struct input_dev *dev,
void input_event(struct input_dev *dev,
unsigned int type, unsigned int code, int value)
{
- if (is_event_supported(type, dev->evbit, EV_MAX)) {
+ if (type == EV_SYN || is_event_supported(type, dev->evbit, EV_MAX)) {
guard(spinlock_irqsave)(&dev->event_lock);
input_handle_event(dev, type, code, value);
}
@@ -415,7 +415,7 @@ void input_inject_event(struct input_handle *handle,
struct input_dev *dev = handle->dev;
struct input_handle *grab;
- if (is_event_supported(type, dev->evbit, EV_MAX)) {
+ if (type == EV_SYN || is_event_supported(type, dev->evbit, EV_MAX)) {
guard(spinlock_irqsave)(&dev->event_lock);
guard(rcu)();
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0894/1257] Revert "Input: matrix_keypad - force switch rows to input mode"
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (892 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0893/1257] Input: always accept EV_SYN in input_event() Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0895/1257] sched_ext: Reset runnable_at when a task leaves its scheduler Greg Kroah-Hartman
` (104 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Kochetkov, Siarhei Volkau,
Paul Cercueil, Dmitry Torokhov, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Kochetkov <al.kochet@gmail.com>
[ Upstream commit 1527451f87dfe368b8ddeeb501c24ac9bde6b589 ]
This reverts commit 01c84b03d80aab9f04c4e3e1f9085f4202ff7c29.
The commit makes every scan call gpiod_direction_input() on the row
GPIOs. On pin controllers where GPIO input and interrupt are separate
pinmux functions this switches the row pins out of interrupt mode, and
enable_row_irqs() does not switch them back: it only unmasks the
interrupts. Row interrupts then never arrive and the keypad stops
working. Seen with a matrix keypad on an Allwinner A64 board (PINE
A64-LTS); it works again with the commit reverted.
The workaround is not needed on Ingenic either: the author of the
reverted commit re-tested all available JZ47xx SoCs and they all report
the live pin state in interrupt mode, see the thread in Link.
Fixes: 01c84b03d80a ("Input: matrix_keypad - force switch rows to input mode")
Link: https://lore.kernel.org/all/4130C026-2A83-408B-836A-ECA044491C47@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
Acked-by: Siarhei Volkau <lis8215@gmail.com>
Acked-by: Paul Cercueil <paul@crapouillou.net>
Link: https://patch.msgid.link/20261002100935.449473-1-al.kochet@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/keyboard/matrix_keypad.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index 8863b741d1a32..cda2888b2e562 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -134,9 +134,6 @@ static void matrix_keypad_scan(struct work_struct *work)
memset(new_state, 0, sizeof(new_state));
- for (row = 0; row < keypad->num_row_gpios; row++)
- gpiod_direction_input(keypad->row_gpios[row]);
-
/* assert each column and read the row status out */
for (col = 0; col < keypad->num_col_gpios; col++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0895/1257] sched_ext: Reset runnable_at when a task leaves its scheduler
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (893 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0894/1257] Revert "Input: matrix_keypad - force switch rows to input mode" Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0896/1257] cgroup: fix cgroup.kill for exited thread group leader Greg Kroah-Hartman
` (103 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Blaszczyk, Andrea Righi,
Tejun Heo, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Blaszczyk <michalblk@google.com>
[ Upstream commit 993e8fbfecbbf284b9644c6f10741b28fb914094 ]
The watchdog measures how long a task has been waiting from
p->scx.runnable_at, which set_task_runnable() resets when the task becomes
runnable after it last ran. ops_dequeue() never asks for a reset, as the
dequeue of a waiting task is temporary, e.g. for a migration or an
attribute change.
Leaving the scheduler isn't temporary. A task which is switched out of
SCHED_EXT while it's waiting keeps its runnable_at. When it's switched back
and becomes runnable, its wait appears to have started before it left, and
the time it spent in another class counts towards the timeout. If the
watchdog checks before the task runs, it aborts the scheduler:
sched_ext: class_switch_stall: runner[418] failed to run for 3.010s
Here, the task waited for a few milliseconds before it was switched to
SCHED_OTHER, slept outside of SCHED_EXT for three seconds, and was charged
for all of it as soon as it woke up on SCHED_EXT again.
The same happens when scx_sub_enable_workfn() hands a waiting task over to
a new sub-scheduler, which can then be blamed for time the task waited
under the parent. scx_rehome_task() isn't affected, as it moves the task
through SCX_TASK_INIT, which resets runnable_at. The stale runnable_at also
skews the default core-sched ordering in scx_prio_less().
Reset runnable_at in scx_disable_task(), when the task leaves the control
of its scheduler.
Fixes: 8a010b81b3a5 ("sched_ext: Implement runnable task stall watchdog")
Cc: stable@vger.kernel.org # v6.12+
Assisted-by: LLM
Signed-off-by: Michal Blaszczyk <michalblk@google.com>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/ext/ext.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index 60e8bacc14bb9..84774147a1d5b 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -2232,7 +2232,11 @@ static void ops_dequeue(struct rq *rq, struct task_struct *p, u64 deq_flags)
struct scx_sched *sch = scx_task_sched(p);
unsigned long opss;
- /* dequeue is always temporary, don't reset runnable_at */
+ /*
+ * Don't reset runnable_at. If @p is waiting, the wait continues across
+ * temporary dequeues, e.g. for a migration or an attribute change.
+ * scx_disable_task() ends it if @p leaves its scheduler.
+ */
clr_task_runnable(p, false);
retry:
@@ -4102,6 +4106,14 @@ static void scx_disable_task(struct scx_sched *sch, struct task_struct *p)
scx_set_task_slice(p, 0);
p->scx.reenq_cnt = 0;
+ /*
+ * If @p is runnable but not running, its wait started at runnable_at,
+ * which ops_dequeue() didn't reset. Leaving @sch ends the wait. Reset
+ * runnable_at the next time @p is enqueued on SCX, so that the watchdog
+ * doesn't count the time @p spends elsewhere.
+ */
+ p->scx.flags |= SCX_TASK_RESET_RUNNABLE_AT;
+
/*
* Verify the task is not in BPF scheduler's custody. If flag
* transitions are consistent, the flag should always be clear
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0896/1257] cgroup: fix cgroup.kill for exited thread group leader
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (894 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0895/1257] sched_ext: Reset runnable_at when a task leaves its scheduler Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0897/1257] netdevsim: reject cls_bpf programs bound to another device Greg Kroah-Hartman
` (102 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kir Kolyshkin, Oleg Nesterov,
Tejun Heo, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kir Kolyshkin <kolyshkin@gmail.com>
[ Upstream commit da13e0e72a7329c95642c44b2d03d194ab071e04 ]
cgroup.kill does not work in case a process' thread group leader is gone
but other threads are still running. This is because __cgroup_kill()
only walks the thread group leaders and sends SIGKILL to each of them
with send_sig(), which uses PIDTYPE_PID:
1. The exited leader is still listed by CSS_TASK_ITER_PROCS as long as
the process has live threads, but a signal directed at a single
exiting task never takes effect: complete_signal() does not look for
another thread to deliver it to, and __send_signal_locked() now drops
it altogether. The process keeps running.
2. The live threads of such a process can be migrated to another cgroup
by writing any of their IDs to cgroup.procs, while the exited leader
stays behind. The destination cgroup has no thread group leader to
iterate, so writing to its cgroup.kill does nothing at all.
In both cases the cgroup stays populated after cgroup.kill, and a
process inside a container can use this to survive the container being
killed. This also works with a private PID namespace when the init of
the container is the process, as the PID namespace is not torn down
while init has live threads.
Case 1 can be fixed by using do_send_sig_info(..., PIDTYPE_TGID) instead
of send_sig(), so that the signal is taken by a live thread even if the
task found by the iterator is exiting. Note it was pointed out by Eric
in [1] while reviewing v2 of cgroup.kill patchset, and v3 was meant to
switch to it, but the change was only made in cgroup_post_fork(),
leaving __cgroup_kill() with send_sig().
Case 2 can only be fixed by iterating over all threads, so this is what
the fix also does. Once a thread group is being killed, its other
threads are skipped since they already have a fatal signal pending.
I ran some performance checks and the added cost is ~60 ns per every
thread on my laptop (and less than a millisecond for 10K threads),
which seems low. The time to "populated 0" seems unchanged.
The issue was found in crun by Anthropic's OSS Scanner, and crun is
getting a workaround for it [2] (which does what we needed to do
before cgroup.kill was added).
[1] https://lore.kernel.org/all/m1v97x6niq.fsf@fess.ebiederm.org/
[2] https://github.com/containers/crun/pull/2351
Fixes: 661ee6280931 ("cgroup: introduce cgroup.kill")
Cc: stable@vger.kernel.org # v5.14+
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cgroup/cgroup.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 42cc77dfa1c8a..a1cc11009e49e 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4289,7 +4289,7 @@ static void __cgroup_kill(struct cgroup *cgrp)
cgrp->kill_seq++;
spin_unlock_irq(&css_set_lock);
- css_task_iter_start(&cgrp->self, CSS_TASK_ITER_PROCS | CSS_TASK_ITER_THREADED, &it);
+ css_task_iter_start(&cgrp->self, CSS_TASK_ITER_THREADED, &it);
while ((task = css_task_iter_next(&it))) {
/* Ignore kernel threads here. */
if (task->flags & PF_KTHREAD)
@@ -4299,7 +4299,7 @@ static void __cgroup_kill(struct cgroup *cgrp)
if (__fatal_signal_pending(task))
continue;
- send_sig(SIGKILL, task, 0);
+ do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, task, PIDTYPE_TGID);
}
css_task_iter_end(&it);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0897/1257] netdevsim: reject cls_bpf programs bound to another device
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (895 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0896/1257] cgroup: fix cgroup.kill for exited thread group leader Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0898/1257] net: gro: dont chain linear parts larger than gso_size into frag_list Greg Kroah-Hartman
` (101 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko (nipa), Victor Nogueira,
Jamal Hadi Salim, Simon Horman, Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
[ Upstream commit 5820ca58b409402505b9e904d1ded4908e0b6b81 ]
The issue:
nsim_bpf_setup_tc_block_cb() installs any device-bound SCHED_CLS program
without checking that its offload device matches the target netdev. The
core cls_bpf attach path rejects a mismatching program, but a netdev that
joins a shared block later is replayed the stored filter by
cls_bpf_reoffload() before it is inserted into block->ports, so the
attach-time check cannot see it. The driver callback is the
authoritative per-device acceptance boundary and must enforce the match
itself, as nfp already does in nfp_net_bpf_offload().
Without the check, replaying a device-bound program onto a different
bpf_offload_dev installs it into that device's netdevsim state, which
trips the WARN in nsim_bpf_uninit() (ns->bpf_offloaded set on a foreign
device) and can dereference a NULL prog->aux->offload in
nsim_prog_set_loaded().
The Fix:
Reject a device-bound program whose offload device does not match the
target netdev, with -EINVAL and an extack so the rejected replay is not
silent. The check is intentionally narrower than nfp's: it fires only
for a dev-bound program, so nsim's bpf_tc_non_bound_accept mode (which
admits an unbound program onto the device) is unaffected. Teardown is
never blocked: the guard is on the program being installed and an unbind
passes cls_bpf.prog = NULL.
Conditions to recreate the bug:
- CONFIG_NETDEVSIM=y, CONFIG_NET_CLS_BPF=y
- load and pin a dev-bound SCHED_CLS program for netdevsim device B
- install the program on a shared block owned by B
- add an independently backed netdevsim device C to that block; the
bind replays the filter to C's callback, and C's
ports/0/bpf_offloaded_id takes the B-bound program id.
The reported Sashiko review is at
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260809094418.901607-1-jhs@mojatatu.com
Fixes: 31d3ad832948 ("netdevsim: add bpf offload support")
Reported-by: Sashiko (nipa) <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/netdev/20260809094418.901607-1-jhs@mojatatu.com/
Link: https://lore.kernel.org/netdev/QDISC-PYC7.v1.20261003103747@mojatatu.com/
Cc: stable@vger.kernel.org
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/QDISC-PYC7.v2.20261010165947-2@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/netdevsim/bpf.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
index 16aa882783984..f45c1c8f0584c 100644
--- a/drivers/net/netdevsim/bpf.c
+++ b/drivers/net/netdevsim/bpf.c
@@ -144,6 +144,17 @@ int nsim_bpf_setup_tc_block_cb(enum tc_setup_type type,
return -EOPNOTSUPP;
}
+ /* A dev-bound program can be replayed here when a netdev joins
+ * a shared block, after the core attach-time check has run;
+ * enforce the device match as nfp does.
+ */
+ if (prog && bpf_prog_is_dev_bound(prog->aux) &&
+ !bpf_offload_dev_match(prog, ns->netdev)) {
+ NSIM_EA(cls_bpf->common.extack,
+ "program bound to a different device");
+ return -EINVAL;
+ }
+
if (cls_bpf->command != TC_CLSBPF_OFFLOAD)
return -EOPNOTSUPP;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0898/1257] net: gro: dont chain linear parts larger than gso_size into frag_list
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (896 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0897/1257] netdevsim: reject cls_bpf programs bound to another device Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0899/1257] ALSA: usb-audio: Skip sample-rate read-back on PreSonus AudioBox USB Greg Kroah-Hartman
` (100 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sorah Fukumori, Chase Hiltz,
Eric Dumazet, Jason Xing, Paolo Abeni, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sorah Fukumori <her@sorah.jp>
[ Upstream commit 679f6929a66db9f5a6611dad37545fbd705962d5 ]
skb_gro_receive() chains an skb into the frag_list of the held packet
when its payload cannot be attached as page frags: when its head is
not a page fragment and still holds payload, or when its head and
frags would overflow the frags[] array of the last packet. Since commit
5eddb24901ee ("gro: add support of (hw)gro packets to gro stack"), that
skb may itself be a GSO packet whose linear part holds several
gso_size segments. skb_segment() cannot split the linear part of a
frag_list member across segments, so segmenting the aggregate in
software, e.g. when forwarding it to a device without NETIF_F_FRAGLIST,
hits
BUG_ON(skb_headlen(list_skb) > len);
Fully linear GSO packets come from generic XDP. When the program does
not support frags, netif_skb_check_for_xdp() linearizes any nonlinear
skb with pskb_expand_head() and skb_linearize() and keeps its GSO
metadata. GRO on the device runs before generic XDP, so each aggregate
passed by the program carries all of its payload in a kmalloc'ed head.
A tunnel that decapsulates these packets and runs GRO again through
gro_cells then builds the bad frag_list. This was first seen on a
router that forwards TCP received over VXLAN, with a non-frags XDP
program attached in SKB mode to the underlying bond because one slave
lacks native XDP:
kernel BUG at net/core/skbuff.c:4917!
RIP: 0010:skb_segment+0xbb6/0xf40
Call Trace:
tcp_gso_segment
ipv6_gso_segment
skb_mac_gso_segment
__skb_gso_segment
validate_xmit_skb
__dev_queue_xmit
ip6_output
ip6_sublist_rcv_finish
ipv6_list_rcv
netif_receive_skb_list_internal
gro_complete
dev_gro_receive
gro_receive_skb
gro_cell_poll
__napi_poll
net_rx_action
It reproduces with three network namespaces: TCP sent over VXLAN on an
IPv6 veth link to a router namespace that has an XDP_PASS program
without frags support attached to the underlay veth in generic mode
and GRO enabled on its VXLAN device, and forwards to a veth with
tx-scatter-gather-fraglist disabled.
A program with frags support in generic mode gives similar packets.
skb_pp_cow_data() rebuilds the skb with up to about a page of linear
data in a page_pool head_frag and keeps the GSO metadata, so once
frags[] is full the next such packet is chained through frag_list
with more than gso_size bytes in its head as well.
Refuse the merge when the linear part to be chained exceeds the held
packet's gso_size. tcp_gro_receive() then flushes the held packet and
the skb starts a new GRO packet as its head, whose linear length
skb_segment() handles.
Fixes: 5eddb24901ee ("gro: add support of (hw)gro packets to gro stack")
Cc: stable@vger.kernel.org
Assisted-by: claude-opus-5-5
Signed-off-by: Sorah Fukumori <her@sorah.jp>
Tested-by: Chase Hiltz <me@chasehil.tz>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Link: https://patch.msgid.link/20261013130250.3643916-1-her@sorah.jp
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/gro.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/core/gro.c b/net/core/gro.c
index 29b4d02bf5198..ff828a3dce3ca 100644
--- a/net/core/gro.c
+++ b/net/core/gro.c
@@ -187,6 +187,10 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
}
merge:
+ /* skb_segment() cannot split the linear part of a frag_list member. */
+ if (unlikely(headlen > offset + skb_shinfo(p)->gso_size))
+ return -E2BIG;
+
/* sk ownership - if any - completely transferred to the aggregated packet */
skb->destructor = NULL;
skb->sk = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0899/1257] ALSA: usb-audio: Skip sample-rate read-back on PreSonus AudioBox USB
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (897 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0898/1257] net: gro: dont chain linear parts larger than gso_size into frag_list Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0900/1257] ALSA: compress: fix buffer leak on failed SET_PARAMS Greg Kroah-Hartman
` (99 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Nemer, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Nemer <thomas.nemer@fortytwo.fr>
[ Upstream commit 20b9cae98ddcff87828d033e35b31f9e6a14dd6a ]
The AudioBox USB stalls the UAC1 GET_CUR SAMPLING_FREQ request on both
streaming endpoints. After the sample rate is set, the read-back
verification in set_sample_rate_v1() fails and logs
usb 1-3.1.2: 2:1: cannot get freq at ep 0x1
usb 1-3.1.2: 3:1: cannot get freq at ep 0x82
on each endpoint configuration until the sample_rate_read_error counter
gives up. Set QUIRK_FLAG_GET_SAMPLE_RATE to skip the read-back on this
device.
Fixes: 1869c47e5d59 ("ALSA: usb-audio: Fix missing sample-rate control for PreSonus AudioBox USB")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Nemer <thomas.nemer@fortytwo.fr>
Link: https://patch.msgid.link/20261019204944.28302-1-thomas.nemer@fortytwo.fr
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/quirks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index b9e89e94e95f5..b96cb3421cc15 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2462,6 +2462,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY),
DEVICE_FLG(0x1901, 0x0191, /* GE B850V3 CP2114 audio interface */
QUIRK_FLAG_GET_SAMPLE_RATE),
+ DEVICE_FLG(0x194f, 0x0301, /* PreSonus AudioBox USB */
+ QUIRK_FLAG_GET_SAMPLE_RATE),
DEVICE_FLG(0x19f7, 0x0003, /* RODE NT-USB */
QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE),
DEVICE_FLG(0x19f7, 0x0035, /* RODE NT-USB+ */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0900/1257] ALSA: compress: fix buffer leak on failed SET_PARAMS
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (898 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0899/1257] ALSA: usb-audio: Skip sample-rate read-back on PreSonus AudioBox USB Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0901/1257] ALSA: compress: reject buffer geometry change on gapless next_track Greg Kroah-Hartman
` (98 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit fbc74ca9fbf7e0b8f6872ccac62f9f4a1f3b5e53 ]
When the driver has neither ops->copy nor a preallocated dma_buffer_p,
snd_compr_allocate_buffer() kmallocs runtime->buffer. If
ops->set_params() then rejects the parameters, SET_PARAMS fails, the
stream stays in the OPEN state and keeps the buffer. The next
SET_PARAMS allocates a new buffer and overwrites the pointer, so
repeated SET_PARAMS calls with parameters that the driver rejects leak
one buffer per call.
Release the framework-owned buffer when ops->set_params() fails on an
OPEN stream, so that a failed SET_PARAMS leaves no buffer behind and
the buffer is allocated only once per successful setup. Use the same
ownership check as snd_compr_free().
Fixes: b21c60a4edd2 ("ALSA: core: add support for compress_offload")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261019144533.30665-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/compress_offload.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 7c397b1c9231f..85abcca385024 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -674,8 +674,15 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
return -ENOMEM;
retval = stream->ops->set_params(stream, params);
- if (retval)
+ if (retval) {
+ /* the stream stays OPEN: drop the buffer of the rejected setup */
+ if (stream->runtime->state == SNDRV_PCM_STATE_OPEN &&
+ !stream->runtime->dma_buffer_p) {
+ kfree(stream->runtime->buffer);
+ stream->runtime->buffer = NULL;
+ }
return retval;
+ }
if (stream->next_track)
return retval;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0901/1257] ALSA: compress: reject buffer geometry change on gapless next_track
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (899 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0900/1257] ALSA: compress: fix buffer leak on failed SET_PARAMS Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0902/1257] ALSA: compress: add missing OPEN-state gate to SET_METADATA Greg Kroah-Hartman
` (97 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Takashi Iwai,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 82da1acad6fd60b6072dd5f3383e6a55efdd2ac7 ]
snd_compr_set_params() is invoked from the gapless next_track
re-entry path, which calls snd_compr_allocate_buffer() again and lets
buffer_size change while total_bytes_available and
total_bytes_transferred still hold values computed for the previous
buffer. snd_compr_calc_avail() then derives an avail/count value from
those stale counters against the new buffer_size, and
snd_compr_write_data() copy_from_user()s that many bytes into the
new, potentially smaller buffer, overflowing it with user-controlled
length and content.
The buffer is set up once, with the initial SET_PARAMS, and neither the
core nor the DSP expects it to change for a gapless track transition.
Do not call snd_compr_allocate_buffer() on the next_track path and
reject a request that changes the buffer geometry, so that the codec
parameters that the driver receives match the buffer in use.
Fixes: 9727b490e543 ("ALSA: compress: add support for gapless playback")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261019144533.30665-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/compress_offload.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 85abcca385024..6edd1375a867a 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -669,9 +669,19 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
if (retval)
return retval;
- retval = snd_compr_allocate_buffer(stream, params);
- if (retval)
- return -ENOMEM;
+ if (stream->next_track) {
+ /*
+ * total_bytes_available/transferred still refer to the
+ * current buffer; its geometry must not change.
+ */
+ if (params->buffer.fragment_size != stream->runtime->fragment_size ||
+ params->buffer.fragments != stream->runtime->fragments)
+ return -EINVAL;
+ } else {
+ retval = snd_compr_allocate_buffer(stream, params);
+ if (retval)
+ return retval;
+ }
retval = stream->ops->set_params(stream, params);
if (retval) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0902/1257] ALSA: compress: add missing OPEN-state gate to SET_METADATA
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (900 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0901/1257] ALSA: compress: reject buffer geometry change on gapless next_track Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0903/1257] ALSA: compress: reject restarting an ACTIVE task via origin_seqno Greg Kroah-Hartman
` (96 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Vinod Koul,
Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 931f5714b7921290cd1a4742e185aeeae7270ee6 ]
snd_compr_set_metadata() calls stream->ops->set_metadata() straight
after copy_from_user(), without ever checking runtime->state, even
though the function's own comment says a parameter change should only
be allowed once the stream has left the OPEN state. Every other
metadata/param entry point in this file (SET_PARAMS, WRITE, ...)
enforces that gate.
A codec driver's set_metadata callback can assume SET_PARAMS has
already run and initialised its private state; calling it while the
stream is still OPEN can operate on that uninitialised state.
Add the OPEN-state check the existing comment already documents.
Fixes: 9727b490e543 ("ALSA: compress: add support for gapless playback")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Link: https://patch.msgid.link/20261019144533.30665-4-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/compress_offload.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 6edd1375a867a..ce806ca875d3a 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -761,6 +761,9 @@ snd_compr_set_metadata(struct snd_compr_stream *stream, unsigned long arg)
* we should allow parameter change only when stream has been
* opened not in other cases
*/
+ if (stream->runtime->state == SNDRV_PCM_STATE_OPEN)
+ return -EBADFD;
+
if (copy_from_user(&metadata, (void __user *)arg, sizeof(metadata)))
return -EFAULT;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0903/1257] ALSA: compress: reject restarting an ACTIVE task via origin_seqno
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (901 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0902/1257] ALSA: compress: add missing OPEN-state gate to SET_METADATA Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0904/1257] l2tp: snapshot sequencing state when building transmit headers Greg Kroah-Hartman
` (95 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Vinod Koul,
Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 0ade01edd33181b65393cf3864cb2ac7c5eb1487 ]
snd_compr_task_start_prepare() only rejects tasks with
state >= SND_COMPRESS_TASK_STATE_FINISHED. Since the enum is
IDLE(0) < ACTIVE(1) < FINISHED(2), this accepts ACTIVE tasks and
rejects FINISHED ones, the opposite of what the origin_seqno
mechanism needs: origin_seqno is meant to let a caller reuse a
FINISHED task's buffers for a new job, not to restart a task that is
still queued with the driver.
The seqno lookup path in snd_compr_task_start() has its own explicit
"task->state != IDLE" guard, but the origin_seqno lookup path relies
solely on this function, so it can restart an ACTIVE task, causing
ops->task_start() to be called twice for the same task and
runtime->active_tasks to be incremented twice without a matching
finish/stop.
Accept IDLE and FINISHED, reject ACTIVE, on both entry paths.
Fixes: 04177158cf98 ("ALSA: compress_offload: introduce accel operation mode")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Link: https://patch.msgid.link/20261019144533.30665-5-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/compress_offload.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index ce806ca875d3a..77503bcdc53b4 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -1156,7 +1156,9 @@ static int snd_compr_task_start_prepare(struct snd_compr_task_runtime *task,
{
if (task == NULL)
return -EINVAL;
- if (task->state >= SND_COMPRESS_TASK_STATE_FINISHED)
+ /* only an unqueued or already finished task may be (re)started */
+ if (task->state != SND_COMPRESS_TASK_STATE_IDLE &&
+ task->state != SND_COMPRESS_TASK_STATE_FINISHED)
return -EBUSY;
if (utask->input_size > task->input->size)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0904/1257] l2tp: snapshot sequencing state when building transmit headers
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (902 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0903/1257] ALSA: compress: reject restarting an ACTIVE task via origin_seqno Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0905/1257] ntfs: read MFT writeback bounds under size_lock Greg Kroah-Hartman
` (94 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Paolo Abeni,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <nicoyip.dev@gmail.com>
[ Upstream commit d06ae66516e1aaf023808912af6292aef09d46c3 ]
Updates to send_seq from netlink, PPP setsockopt and receive-side
negotiation race with packet transmission. The header length is updated
separately, while transmit reads both fields repeatedly without
synchronization.
For example, transmit can push a ten-byte L2TPv2 header, then a concurrent
writer clears send_seq before the header builder reads it. The builder
writes only six bytes, leaving four bytes of uninitialized skb headroom
in the outgoing packet. The reverse mismatch overwrites the beginning of
the payload. A later hdr_len read can also make the UDP length disagree
with the skb length.
KCSAN reported:
BUG: KCSAN: data-race in l2tp_session_set_header_len / l2tp_xmit_skb
write to 0xffff888100d0944a of 2 bytes by task 116 on cpu 1:
l2tp_session_set_header_len+0x81/0xc0
l2tp_nl_cmd_session_modify+0x122/0x2c0
genl_family_rcv_msg_doit+0x170/0x1d0
read to 0xffff888100d0944a of 2 bytes by task 115 on cpu 0:
l2tp_xmit_skb+0x9c/0xc80
pppol2tp_sendmsg+0x21c/0x2a0
__sys_sendto+0x28c/0x2a0
The bug can lead to leak kernel base address for KASLR bypass, the
corresponding reproducer can be provided per request.
Initialize hdr_len to the maximum header size and leave it unchanged
when sequencing is toggled. Snapshot send_seq once per packet and use
that snapshot for the actual header length and header construction,
including the sequence flag. Use the same length for headroom, the header
push and the UDP length. PPP callers can safely reserve the maximum size;
L2TPv3 header sizes do not depend on sequencing.
Make send_seq a separate bool so READ_ONCE() and WRITE_ONCE() can be used
without sharing a bitfield storage unit with other configuration flags.
Preserve the netlink attribute's existing low-bit truncation.
Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core")
Cc: stable@vger.kernel.org
Assisted-by: GPT-6 Astra
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Link: https://patch.msgid.link/20261013090500.1180376-1-nicoyip.dev@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/l2tp/l2tp_core.c | 51 +++++++++++++++++++----------------------
net/l2tp/l2tp_core.h | 6 ++---
net/l2tp/l2tp_debugfs.c | 4 ++--
net/l2tp/l2tp_netlink.c | 11 ++++-----
net/l2tp/l2tp_ppp.c | 8 +++----
5 files changed, 35 insertions(+), 45 deletions(-)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 4712cc41881a3..7e042a3e648ce 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -915,11 +915,9 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
* check if we sre sending sequence numbers and if not,
* configure it so.
*/
- if (!session->lns_mode && !session->send_seq) {
+ if (!session->lns_mode && !READ_ONCE(session->send_seq)) {
trace_session_seqnum_lns_enable(session);
- session->send_seq = 1;
- l2tp_session_set_header_len(session, tunnel->version,
- tunnel->encap);
+ WRITE_ONCE(session->send_seq, true);
}
} else {
/* No sequence numbers.
@@ -937,12 +935,10 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
* If we're the LNS and we're sending sequence numbers, the
* LAC is broken. Discard the frame.
*/
- if (!session->lns_mode && session->send_seq) {
+ if (!session->lns_mode && READ_ONCE(session->send_seq)) {
trace_session_seqnum_lns_disable(session);
- session->send_seq = 0;
- l2tp_session_set_header_len(session, tunnel->version,
- tunnel->encap);
- } else if (session->send_seq) {
+ WRITE_ONCE(session->send_seq, false);
+ } else if (READ_ONCE(session->send_seq)) {
pr_debug_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n",
session->name);
atomic_long_inc(&session->stats.rx_seq_discards);
@@ -1138,7 +1134,8 @@ static void l2tp_udp_encap_err_recv(struct sock *sk, struct sk_buff *skb, int er
/* Build an L2TP header for the session into the buffer provided.
*/
-static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
+static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf,
+ bool send_seq)
{
struct l2tp_tunnel *tunnel = session->tunnel;
__be16 *bufp = buf;
@@ -1147,14 +1144,14 @@ static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
u32 tunnel_id = tunnel->peer_tunnel_id;
u32 session_id = session->peer_session_id;
- if (session->send_seq)
+ if (send_seq)
flags |= L2TP_HDRFLAG_S;
/* Setup L2TP header. */
*bufp++ = htons(flags);
*bufp++ = htons(tunnel_id);
*bufp++ = htons(session_id);
- if (session->send_seq) {
+ if (send_seq) {
*bufp++ = htons(session->ns);
*bufp++ = 0;
session->ns++;
@@ -1165,7 +1162,8 @@ static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
return bufp - optr;
}
-static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
+static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf,
+ bool send_seq)
{
struct l2tp_tunnel *tunnel = session->tunnel;
char *bufp = buf;
@@ -1191,7 +1189,7 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
u32 l2h = 0;
- if (session->send_seq) {
+ if (send_seq) {
l2h = 0x40000000 | session->ns;
session->ns++;
session->ns &= 0xffffff;
@@ -1225,19 +1223,24 @@ static int l2tp_xmit_queue(struct l2tp_tunnel *tunnel, struct sk_buff *skb, stru
static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, unsigned int *len)
{
struct l2tp_tunnel *tunnel = session->tunnel;
+ bool send_seq = READ_ONCE(session->send_seq);
unsigned int data_len = skb->len;
struct sock *sk = tunnel->sock;
+ u16 hdr_len = session->hdr_len;
int headroom, uhlen, udp_len;
int ret = NET_XMIT_SUCCESS;
struct inet_sock *inet;
struct udphdr *uh;
+ if (tunnel->version == L2TP_HDR_VER_2 && !send_seq)
+ hdr_len -= 4;
+
/* Check that there's enough headroom in the skb to insert IP,
* UDP and L2TP headers. If not enough, expand it to
* make room. Adjust truesize.
*/
uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(*uh) : 0;
- headroom = NET_SKB_PAD + sizeof(struct iphdr) + uhlen + session->hdr_len;
+ headroom = NET_SKB_PAD + sizeof(struct iphdr) + uhlen + hdr_len;
if (skb_cow_head(skb, headroom)) {
kfree_skb(skb);
return NET_XMIT_DROP;
@@ -1245,9 +1248,9 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, uns
/* Setup L2TP header */
if (tunnel->version == L2TP_HDR_VER_2)
- l2tp_build_l2tpv2_header(session, __skb_push(skb, session->hdr_len));
+ l2tp_build_l2tpv2_header(session, __skb_push(skb, hdr_len), send_seq);
else
- l2tp_build_l2tpv3_header(session, __skb_push(skb, session->hdr_len));
+ l2tp_build_l2tpv3_header(session, __skb_push(skb, hdr_len), send_seq);
/* Reset control buffer */
memset(skb->cb, 0, sizeof(skb->cb));
@@ -1290,7 +1293,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, uns
uh = udp_hdr(skb);
uh->source = inet->inet_sport;
uh->dest = inet->inet_dport;
- udp_len = uhlen + session->hdr_len + data_len;
+ udp_len = uhlen + hdr_len + data_len;
if (udp_len > U16_MAX) {
kfree_skb(skb);
ret = NET_XMIT_DROP;
@@ -1759,16 +1762,11 @@ static void l2tp_session_del_work(struct work_struct *work)
l2tp_session_put(session);
}
-/* We come here whenever a session's send_seq, cookie_len or
- * l2specific_type parameters are set.
- */
-void l2tp_session_set_header_len(struct l2tp_session *session, int version,
- enum l2tp_encap_type encap)
+static void l2tp_session_set_header_len(struct l2tp_session *session, int version,
+ enum l2tp_encap_type encap)
{
if (version == L2TP_HDR_VER_2) {
- session->hdr_len = 6;
- if (session->send_seq)
- session->hdr_len += 4;
+ session->hdr_len = 10;
} else {
session->hdr_len = 4 + session->cookie_len;
session->hdr_len += l2tp_get_l2specific_len(session);
@@ -1776,7 +1774,6 @@ void l2tp_session_set_header_len(struct l2tp_session *session, int version,
session->hdr_len += 4;
}
}
-EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id,
u32 peer_session_id, struct l2tp_session_cfg *cfg)
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index ffd8ced3a51ff..25ae4c25d3eff 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -76,7 +76,7 @@ struct l2tp_session {
u8 peer_cookie[8];
int peer_cookie_len;
u16 l2specific_type;
- u16 hdr_len;
+ u16 hdr_len; /* maximum L2TP header length */
u32 nr; /* session NR state (receive) */
u32 ns; /* session NR state (send) */
struct sk_buff_head reorder_q; /* receive reorder queue */
@@ -94,8 +94,8 @@ struct l2tp_session {
char name[L2TP_SESSION_NAME_MAX]; /* for logging */
char ifname[IFNAMSIZ];
+ bool send_seq; /* send packets with sequence numbers? */
unsigned int recv_seq:1; /* expect receive packets with sequence numbers? */
- unsigned int send_seq:1; /* send packets with sequence numbers? */
unsigned int lns_mode:1; /* behave as LNS?
* LAC enables sequence numbers under LNS control.
*/
@@ -257,8 +257,6 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb);
/* Transmit path helpers for sending packets over the tunnel socket. */
-void l2tp_session_set_header_len(struct l2tp_session *session, int version,
- enum l2tp_encap_type encap);
int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb);
/* Pseudowire management.
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index c12d5e1ee550c..58d1d6a7768ef 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -182,12 +182,12 @@ static void l2tp_dfs_seq_session_show(struct seq_file *m, void *v)
session->pwtype == L2TP_PWTYPE_ETH ? "ETH" :
session->pwtype == L2TP_PWTYPE_PPP ? "PPP" :
"");
- if (session->send_seq || session->recv_seq)
+ if (READ_ONCE(session->send_seq) || session->recv_seq)
seq_printf(m, " nr %u, ns %u\n", session->nr, session->ns);
seq_printf(m, " refcnt %d\n", refcount_read(&session->ref_count));
seq_printf(m, " config 0/0/%c/%c/-/%s %08x %u\n",
session->recv_seq ? 'R' : '-',
- session->send_seq ? 'S' : '-',
+ READ_ONCE(session->send_seq) ? 'S' : '-',
session->lns_mode ? "LNS" : "LAC",
0,
jiffies_to_msecs(session->reorder_timeout));
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 38aac59d052c4..89ef04c78787d 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -700,12 +700,9 @@ static int l2tp_nl_cmd_session_modify(struct sk_buff *skb, struct genl_info *inf
if (info->attrs[L2TP_ATTR_RECV_SEQ])
session->recv_seq = nla_get_u8(info->attrs[L2TP_ATTR_RECV_SEQ]);
- if (info->attrs[L2TP_ATTR_SEND_SEQ]) {
- struct l2tp_tunnel *tunnel = session->tunnel;
-
- session->send_seq = nla_get_u8(info->attrs[L2TP_ATTR_SEND_SEQ]);
- l2tp_session_set_header_len(session, tunnel->version, tunnel->encap);
- }
+ if (info->attrs[L2TP_ATTR_SEND_SEQ])
+ WRITE_ONCE(session->send_seq,
+ nla_get_u8(info->attrs[L2TP_ATTR_SEND_SEQ]) & 1);
if (info->attrs[L2TP_ATTR_LNS_MODE])
session->lns_mode = nla_get_u8(info->attrs[L2TP_ATTR_LNS_MODE]);
@@ -748,7 +745,7 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq, int fl
(session->peer_cookie_len &&
nla_put(skb, L2TP_ATTR_PEER_COOKIE, session->peer_cookie_len, session->peer_cookie)) ||
nla_put_u8(skb, L2TP_ATTR_RECV_SEQ, session->recv_seq) ||
- nla_put_u8(skb, L2TP_ATTR_SEND_SEQ, session->send_seq) ||
+ nla_put_u8(skb, L2TP_ATTR_SEND_SEQ, READ_ONCE(session->send_seq)) ||
nla_put_u8(skb, L2TP_ATTR_LNS_MODE, session->lns_mode) ||
(l2tp_tunnel_uses_xfrm(tunnel) &&
nla_put_u8(skb, L2TP_ATTR_USING_IPSEC, 1)) ||
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index ef8fdfaf051d4..4f311d473a646 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1195,9 +1195,7 @@ static int pppol2tp_session_setsockopt(struct sock *sk,
err = -EINVAL;
break;
}
- session->send_seq = !!val;
- l2tp_session_set_header_len(session, session->tunnel->version,
- session->tunnel->encap);
+ WRITE_ONCE(session->send_seq, !!val);
break;
case PPPOL2TP_SO_LNSMODE:
@@ -1307,7 +1305,7 @@ static int pppol2tp_session_getsockopt(struct sock *sk,
break;
case PPPOL2TP_SO_SENDSEQ:
- *val = session->send_seq;
+ *val = READ_ONCE(session->send_seq);
break;
case PPPOL2TP_SO_LNSMODE:
@@ -1546,7 +1544,7 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
state, user_data_ok);
seq_printf(m, " 0/0/%c/%c/%s %08x %u\n",
session->recv_seq ? 'R' : '-',
- session->send_seq ? 'S' : '-',
+ READ_ONCE(session->send_seq) ? 'S' : '-',
session->lns_mode ? "LNS" : "LAC",
0,
jiffies_to_msecs(session->reorder_timeout));
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0905/1257] ntfs: read MFT writeback bounds under size_lock
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (903 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0904/1257] l2tp: snapshot sequencing state when building transmit headers Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0906/1257] ntfs: validate the MFT I/O geometry Greg Kroah-Hartman
` (93 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit 50ed298b6a4be68cac85801d21a5e25555f64668 ]
Read the MFT inode size and allocated size under the size_lock critical
section before deriving the folio writeback limits. This prevents
writeback from combining an old allocation boundary with a concurrently
updated file size while the MFT is extended.
Fixes: 115380f9a2f9 ("ntfs: update mft operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/mft.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 4b74494953757..c9ea11198aa64 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -2901,9 +2901,17 @@ static int ntfs_write_mft_block(struct folio *folio, struct writeback_control *w
struct ntfs_inode *tni;
s64 lcn;
s64 vcn = ntfs_pidx_to_cluster(vol, folio->index);
- s64 end_vcn = ntfs_bytes_to_cluster(vol, ni->allocated_size);
+ s64 end_vcn;
unsigned int folio_sz;
- loff_t i_size = i_size_read(vi);
+ loff_t i_size;
+ s64 allocated_size;
+ unsigned long flags;
+
+ read_lock_irqsave(&ni->size_lock, flags);
+ i_size = i_size_read(vi);
+ allocated_size = ni->allocated_size;
+ read_unlock_irqrestore(&ni->size_lock, flags);
+ end_vcn = ntfs_bytes_to_cluster(vol, allocated_size);
ntfs_debug("Entering for inode 0x%llx, attribute type 0x%x, folio index 0x%lx.",
ni->mft_no, ni->type, folio->index);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0906/1257] ntfs: validate the MFT I/O geometry
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (904 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0905/1257] ntfs: read MFT writeback bounds under size_lock Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0907/1257] ntfs: write MFT mirror data in mapped I/O units Greg Kroah-Hartman
` (92 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit dfe7ed335b686d53e4441a15382024058b664d3a ]
MFT writes must consider both the device logical block size and the NTFS
record geometry. Validate those values at mount time, then cache the MFT
I/O unit used by all MFT write paths.
Use the larger of the device logical block and MFT record sizes as the MFT
I/O unit. Keep valid geometries that the current write paths cannot safely
handle read-only until their mapping support is generalized.
Fixes: 115380f9a2f9 ("ntfs: update mft operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/super.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++--
fs/ntfs/volume.h | 8 +++++
2 files changed, 82 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 4066bacabe377..99a95ee32f228 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -286,6 +286,12 @@ static int ntfs_reconfigure(struct fs_context *fc)
static const char *es = ". Cannot remount read-write.";
/* Remounting read-write. */
+ if (!vol->mft_write_supported) {
+ ntfs_error(sb,
+ "MFT writeback is unsupported for this geometry%s",
+ es);
+ return -EROFS;
+ }
if (NVolErrors(vol)) {
ntfs_error(sb, "Volume has errors and is read-only%s",
es);
@@ -530,6 +536,8 @@ int ntfs_write_volume_label(struct ntfs_volume *vol, char *label)
static bool is_boot_sector_ntfs(const struct super_block *sb,
const struct ntfs_boot_sector *b, const bool silent)
{
+ u16 sector_size = le16_to_cpu(b->bpb.bytes_per_sector);
+
/*
* Check that checksum == sum of u32 values from b to the checksum
* field. If checksum is zero, no checking is done. We will work when
@@ -550,8 +558,8 @@ static bool is_boot_sector_ntfs(const struct super_block *sb,
if (b->oem_id != magicNTFS)
goto not_ntfs;
/* Check bytes per sector value is between 256 and 4096. */
- if (le16_to_cpu(b->bpb.bytes_per_sector) < 0x100 ||
- le16_to_cpu(b->bpb.bytes_per_sector) > 0x1000)
+ if (sector_size < 0x100 || sector_size > 0x1000 ||
+ !is_power_of_2(sector_size))
goto not_ntfs;
/*
* Check sectors per cluster value is valid and the cluster size
@@ -632,6 +640,60 @@ static char *read_ntfs_boot_sector(struct super_block *sb,
return boot_sector;
}
+static bool ntfs_validate_mft_io_geometry(struct ntfs_volume *vol,
+ const unsigned int logical_block_size)
+{
+ struct super_block *sb = vol->sb;
+ u32 mft_io_unit_size = 0;
+ bool mft_write_supported = true;
+
+ if (!is_power_of_2(logical_block_size) ||
+ logical_block_size > PAGE_SIZE ||
+ !is_power_of_2(vol->sector_size) ||
+ vol->sector_size < logical_block_size ||
+ vol->sector_size % logical_block_size ||
+ !is_power_of_2(vol->cluster_size) ||
+ !is_power_of_2(vol->mft_record_size) ||
+ vol->mft_record_size > PAGE_SIZE)
+ goto err;
+
+ mft_io_unit_size = max(logical_block_size, vol->mft_record_size);
+ if (mft_io_unit_size > PAGE_SIZE ||
+ mft_io_unit_size % logical_block_size ||
+ mft_io_unit_size % vol->mft_record_size)
+ goto err;
+
+ /*
+ * The current direct-write path stores at most two MFT runlist
+ * segments. Keep valid but larger records read-only until that path
+ * can map an arbitrary number of segments.
+ */
+ if (vol->mft_record_size > 2 * (u64)vol->cluster_size)
+ mft_write_supported = false;
+
+ /*
+ * A containing device block is currently mapped through one MFT
+ * runlist element. Keep valid geometries that require crossing a
+ * cluster read-only until the mapping is generalized.
+ */
+ if (mft_io_unit_size > vol->mft_record_size &&
+ (vol->cluster_size < mft_io_unit_size ||
+ vol->cluster_size % mft_io_unit_size))
+ mft_write_supported = false;
+
+ vol->mft_io_unit_size = mft_io_unit_size;
+ vol->mft_write_supported = mft_write_supported;
+ return true;
+
+err:
+ ntfs_error(sb,
+ "Unsupported MFT I/O geometry (logical %u, block %lu, sector %u, cluster %u, MFT record %u, I/O unit %u).",
+ logical_block_size, sb->s_blocksize,
+ (unsigned int)vol->sector_size, vol->cluster_size,
+ vol->mft_record_size, mft_io_unit_size);
+ return false;
+}
+
/*
* parse_ntfs_boot_sector - parse the boot sector and store the data in @vol
* @vol: volume structure to initialise with data from boot sector
@@ -644,9 +706,11 @@ static bool parse_ntfs_boot_sector(struct ntfs_volume *vol,
const struct ntfs_boot_sector *b)
{
unsigned int sectors_per_cluster, sectors_per_cluster_bits, nr_hidden_sects;
+ unsigned int logical_block_size;
int clusters_per_mft_record, clusters_per_index_record;
u64 ll;
+ logical_block_size = bdev_logical_block_size(vol->sb->s_bdev);
vol->sector_size = le16_to_cpu(b->bpb.bytes_per_sector);
vol->sector_size_bits = ffs(vol->sector_size) - 1;
ntfs_debug("vol->sector_size = %i (0x%x)", vol->sector_size,
@@ -719,6 +783,9 @@ static bool parse_ntfs_boot_sector(struct ntfs_volume *vol,
ntfs_warning(vol->sb, "Mft record size (%i) is smaller than the sector size (%i).",
vol->mft_record_size, vol->sector_size);
}
+ if (!ntfs_validate_mft_io_geometry(vol, logical_block_size))
+ return false;
+
clusters_per_index_record = b->clusters_per_index_record;
ntfs_debug("clusters_per_index_record = %i (0x%x)",
clusters_per_index_record, clusters_per_index_record);
@@ -2290,6 +2357,11 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
ntfs_error(sb, "Unsupported NTFS filesystem.");
goto err_out_now;
}
+ if (!vol->mft_write_supported && !sb_rdonly(sb)) {
+ sb->s_flags |= SB_RDONLY;
+ ntfs_warning(sb,
+ "MFT writeback is unsupported for this geometry. Mounting read-only.");
+ }
if (vol->sector_size > blocksize) {
blocksize = sb_set_blocksize(sb, vol->sector_size);
diff --git a/fs/ntfs/volume.h b/fs/ntfs/volume.h
index bc85a95922458..8c17a66b4f22c 100644
--- a/fs/ntfs/volume.h
+++ b/fs/ntfs/volume.h
@@ -43,6 +43,7 @@
* @mft_record_size: in bytes
* @mft_record_size_mask: mft_record_size - 1
* @mft_record_size_bits: log2(mft_record_size)
+ * @mft_write_supported: Whether the MFT write paths support the geometry.
* @index_record_size: in bytes
* @index_record_size_mask: index_record_size - 1
* @index_record_size_bits: log2(index_record_size)
@@ -111,6 +112,13 @@ struct ntfs_volume {
u32 mft_record_size;
u32 mft_record_size_mask;
u8 mft_record_size_bits;
+ bool mft_write_supported;
+ /*
+ * Unit size used for MFT I/O. This is the MFT record size when
+ * it is at least as large as the device logical block, or the
+ * containing device logical block when the record is smaller.
+ */
+ u32 mft_io_unit_size;
u32 index_record_size;
u32 index_record_size_mask;
u8 index_record_size_bits;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0907/1257] ntfs: write MFT mirror data in mapped I/O units
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (905 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0906/1257] ntfs: validate the MFT I/O geometry Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0908/1257] ntfs: serialize raw MFT updates against folio writeback Greg Kroah-Hartman
` (91 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit b9fa884a39874091a10706fca69483ca957138f3 ]
Replace the record-specific mirror writer with a unit-based helper
and use a stack-allocated BIO for synchronous mirror writes.
Route write_mft_record_nolock() and ntfs_write_mft_block() through
the common mirror primitive. The helper only returns errors, So callers
handle volume error reporting and retry policy.
Fixes: 115380f9a2f9 ("ntfs: update mft operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/mft.c | 142 ++++++++++++++++++++++++++------------------------
fs/ntfs/mft.h | 2 -
2 files changed, 73 insertions(+), 71 deletions(-)
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index c9ea11198aa64..b102e0204eba9 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -429,6 +429,12 @@ void __mark_mft_record_dirty(struct ntfs_inode *ni)
__mark_inode_dirty(VFS_I(base_ni), I_DIRTY_DATASYNC);
}
+struct ntfs_mft_io_unit {
+ sector_t sector;
+ unsigned int folio_ofs;
+ unsigned int len;
+};
+
/*
* ntfs_bio_end_io - bio completion callback for MFT record writes
*
@@ -445,65 +451,60 @@ static void ntfs_bio_end_io(struct bio *bio)
}
/*
- * ntfs_sync_mft_mirror - synchronize an mft record to the mft mirror
- * @vol: ntfs volume on which the mft record to synchronize resides
- * @mft_no: mft record number of mft record to synchronize
- * @m: mapped, mst protected (extent) mft record to synchronize
- *
- * Write the mapped, mst protected (extent) mft record @m with mft record
- * number @mft_no to the mft mirror ($MFTMirr) of the ntfs volume @vol.
- *
- * On success return 0. On error return -errno and set the volume errors flag
- * in the ntfs volume @vol.
- *
- * NOTE: We always perform synchronous i/o.
+ * Write one MFT I/O unit to $MFTMirr. The source folio contains the MST
+ * protected image that will be written to $MFT.
*/
-int ntfs_sync_mft_mirror(struct ntfs_volume *vol, const u64 mft_no,
- struct mft_record *m)
+static int ntfs_sync_mft_mirror_unit(struct ntfs_volume *vol,
+ struct folio *source, u64 mirror_file_ofs,
+ const struct ntfs_mft_io_unit *unit)
{
- u8 *kmirr;
- struct folio *folio;
- unsigned int folio_ofs;
- int err = 0;
- struct bio *bio;
+ struct folio *mirror;
+ struct bio_vec bvec;
+ struct bio bio;
+ u64 mirror_size;
+ unsigned int mirror_ofs;
+ u8 *src, *dst;
+ int err;
- ntfs_debug("Entering for inode 0x%llx.", mft_no);
+ if (unlikely(!vol->mftmirr_ino))
+ return -EIO;
+
+ mirror_size = (u64)vol->mftmirr_size * vol->mft_record_size;
+ if (mirror_file_ofs >= mirror_size ||
+ unit->len > mirror_size - mirror_file_ofs)
+ return -EIO;
+ if (unit->folio_ofs + unit->len > folio_size(source))
+ return -EIO;
- if (unlikely(!vol->mftmirr_ino)) {
- /* This could happen during umount... */
+ mirror = read_mapping_folio(vol->mftmirr_ino->i_mapping,
+ mirror_file_ofs >> PAGE_SHIFT, NULL);
+ if (IS_ERR(mirror))
+ return PTR_ERR(mirror);
+
+ folio_lock(mirror);
+ if (folio_test_writeback(mirror))
+ folio_wait_writeback(mirror);
+ mirror_ofs = mirror_file_ofs - folio_pos(mirror);
+ if (mirror_ofs + unit->len > folio_size(mirror)) {
err = -EIO;
- goto err_out;
- }
- /* Get the page containing the mirror copy of the mft record @m. */
- folio = read_mapping_folio(vol->mftmirr_ino->i_mapping,
- NTFS_MFT_NR_TO_PIDX(vol, mft_no), NULL);
- if (IS_ERR(folio)) {
- ntfs_error(vol->sb, "Failed to map mft mirror page.");
- err = PTR_ERR(folio);
- goto err_out;
+ goto out_unlock;
}
- folio_lock(folio);
- folio_clear_uptodate(folio);
- /* Offset of the mft mirror record inside the page. */
- folio_ofs = NTFS_MFT_NR_TO_POFS(vol, mft_no);
- /* The address in the page of the mirror copy of the mft record @m. */
- kmirr = kmap_local_folio(folio, 0) + folio_ofs;
- /* Copy the mst protected mft record to the mirror. */
- memcpy(kmirr, m, vol->mft_record_size);
- kunmap_local(kmirr);
-
- bio = bio_alloc(vol->sb->s_bdev, 1, REQ_OP_WRITE, GFP_NOIO);
- bio->bi_iter.bi_sector =
- ntfs_bytes_to_bio_sector(NTFS_CLU_TO_B(vol, vol->mftmirr_lcn) +
- ((u64)folio->index << PAGE_SHIFT) +
- folio_ofs);
-
- if (bio_add_folio(bio, folio, vol->mft_record_size, folio_ofs))
- err = submit_bio_wait(bio);
- else
+ folio_clear_uptodate(mirror);
+ src = kmap_local_folio(source, unit->folio_ofs);
+ dst = kmap_local_folio(mirror, mirror_ofs);
+ memcpy(dst, src, unit->len);
+ kunmap_local(dst);
+ kunmap_local(src);
+
+ bio_init(&bio, vol->sb->s_bdev, &bvec, 1, REQ_OP_WRITE);
+ bio.bi_iter.bi_sector = ntfs_bytes_to_bio_sector(NTFS_CLU_TO_B(vol, vol->mftmirr_lcn) +
+ mirror_file_ofs);
+ if (!bio_add_folio(&bio, mirror, unit->len, mirror_ofs))
err = -EIO;
- bio_put(bio);
+ else
+ err = submit_bio_wait(&bio);
+ bio_uninit(&bio);
/*
* The in-memory mirror is now valid because we just memcpy()'d the
@@ -512,23 +513,26 @@ int ntfs_sync_mft_mirror(struct ntfs_volume *vol, const u64 mft_no,
* the stale on-disk mirror and overwrite this copy. The error is
* propagated to the caller via @err.
*/
- folio_mark_uptodate(folio);
+ folio_mark_uptodate(mirror);
- folio_unlock(folio);
- folio_put(folio);
- if (likely(!err)) {
- ntfs_debug("Done.");
- } else {
- ntfs_error(vol->sb, "I/O error while writing mft mirror record 0x%llx!", mft_no);
-err_out:
- ntfs_error(vol->sb,
- "Failed to synchronize $MFTMirr (error code %i). Volume will be left marked dirty on umount. Run chkdsk on the partition after umounting to correct this.",
- err);
- NVolSetErrors(vol);
- }
+out_unlock:
+ folio_unlock(mirror);
+ folio_put(mirror);
return err;
}
+static int ntfs_sync_mft_mirror_record(struct ntfs_volume *vol,
+ struct folio *source, const u64 mft_no)
+{
+ struct ntfs_mft_io_unit unit = {
+ .folio_ofs = NTFS_MFT_NR_TO_POFS(vol, mft_no),
+ .len = vol->mft_record_size,
+ };
+
+ return ntfs_sync_mft_mirror_unit(vol, source,
+ (u64)mft_no * vol->mft_record_size, &unit);
+}
+
/*
* write_mft_record_nolock - write out a mapped (extent) mft record
* @ni: ntfs inode describing the mapped (extent) mft record
@@ -600,8 +604,8 @@ int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int syn
/* Synchronize the mft mirror now if not @sync. */
if (!sync && ni->mft_no < vol->mftmirr_size) {
- int sub_err = ntfs_sync_mft_mirror(vol, ni->mft_no,
- fixup_m);
+ int sub_err = ntfs_sync_mft_mirror_record(vol, folio,
+ ni->mft_no);
if (unlikely(sub_err) && !err)
err = sub_err;
}
@@ -624,7 +628,8 @@ int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int syn
/* If @sync, now synchronize the mft mirror. */
if (sync && ni->mft_no < vol->mftmirr_size) {
- int sub_err = ntfs_sync_mft_mirror(vol, ni->mft_no, fixup_m);
+ int sub_err =
+ ntfs_sync_mft_mirror_record(vol, folio, ni->mft_no);
if (unlikely(sub_err) && !err)
err = sub_err;
@@ -3031,8 +3036,7 @@ static int ntfs_write_mft_block(struct folio *folio, struct writeback_control *w
prev_mft_ofs = mft_ofs;
if (mft_no < vol->mftmirr_size) {
- int sub_err = ntfs_sync_mft_mirror(vol, mft_no,
- (struct mft_record *)(kaddr + mft_ofs));
+ int sub_err = ntfs_sync_mft_mirror_record(vol, folio, mft_no);
if (unlikely(sub_err) && !err)
err = sub_err;
diff --git a/fs/ntfs/mft.h b/fs/ntfs/mft.h
index ed5c1d595c0d3..eb8a6f0d7944f 100644
--- a/fs/ntfs/mft.h
+++ b/fs/ntfs/mft.h
@@ -42,8 +42,6 @@ static inline void mark_mft_record_dirty(struct ntfs_inode *ni)
__mark_mft_record_dirty(ni);
}
-int ntfs_sync_mft_mirror(struct ntfs_volume *vol, const u64 mft_no,
- struct mft_record *m);
int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int sync);
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0908/1257] ntfs: serialize raw MFT updates against folio writeback
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (906 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0907/1257] ntfs: write MFT mirror data in mapped I/O units Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0909/1257] ntfs: track direct MFT writes until BIO completion Greg Kroah-Hartman
` (90 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit ec0a5dd2e385e11839e8846dabe1f9f7042ac202 ]
Because MFT folio writeback can remain active until its asynchronous BIO
completes, raw MFT record formatting and allocation must not modify the
folio while it is still used as a BIO source.
Wait for existing folio writeback after taking the folio lock in both
raw MFT update paths.
Fixes: 115380f9a2f9 ("ntfs: update mft operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/mft.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index b102e0204eba9..c7577c3224541 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -2022,6 +2022,8 @@ static int ntfs_mft_record_format(const struct ntfs_volume *vol, const s64 mft_n
return PTR_ERR(folio);
}
folio_lock(folio);
+ if (folio_test_writeback(folio))
+ folio_wait_writeback(folio);
folio_clear_uptodate(folio);
m = (struct mft_record *)((u8 *)kmap_local_folio(folio, 0) + ofs);
err = ntfs_mft_record_layout(vol, mft_no, m);
@@ -2539,6 +2541,8 @@ int ntfs_mft_record_alloc(struct ntfs_volume *vol, const int mode,
goto undo_mftbmp_alloc;
}
folio_lock(folio);
+ if (folio_test_writeback(folio))
+ folio_wait_writeback(folio);
folio_clear_uptodate(folio);
m = (struct mft_record *)((u8 *)kmap_local_folio(folio, 0) + ofs);
/* If we just formatted the mft record no need to do it again. */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0909/1257] ntfs: track direct MFT writes until BIO completion
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (907 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0908/1257] ntfs: serialize raw MFT updates against folio writeback Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0910/1257] ntfs: write MFT folios through mapped I/O units Greg Kroah-Hartman
` (89 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit 4576ffbded9ad1dd4216f4f2a18a2efa12aeea58 ]
Use an aggregate parent BIO, with optional chained child BIOs, for direct
MFT record writes. Keep the folio reference and PG_writeback set until all
physical segments complete.
For asynchronous writes, release the parent BIO embedded in the write
context before ending folio writeback. Synchronous callers retain ownership
of the parent BIO after waiting.
Wait for any prior folio writeback before modifying a direct MFT record.
Fixes: 115380f9a2f9 ("ntfs: update mft operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/mft.c | 236 ++++++++++++++++++++++++++++++++++++++----------
fs/ntfs/mft.h | 15 +--
fs/ntfs/super.c | 10 ++
3 files changed, 206 insertions(+), 55 deletions(-)
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index c7577c3224541..51066b403757c 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -10,6 +10,7 @@
#include <linux/writeback.h>
#include <linux/bio.h>
+#include <linux/completion.h>
#include <linux/iomap.h>
#include "bitmap.h"
@@ -450,6 +451,91 @@ static void ntfs_bio_end_io(struct bio *bio)
bio_put(bio);
}
+struct ntfs_mft_write_ctx {
+ struct folio *folio;
+ struct address_space *mapping;
+ struct ntfs_volume *vol;
+ struct completion *done;
+ int error;
+ bool writeback_started;
+ struct bio bio;
+};
+
+static struct bio_set ntfs_mft_bioset;
+
+int ntfs_mft_bioset_init(void)
+{
+ return bioset_init(&ntfs_mft_bioset, BIO_POOL_SIZE,
+ offsetof(struct ntfs_mft_write_ctx, bio),
+ BIOSET_NEED_BVECS);
+}
+
+void ntfs_mft_bioset_exit(void)
+{
+ bioset_exit(&ntfs_mft_bioset);
+}
+
+static void ntfs_mft_end_io(struct bio *bio)
+{
+ struct ntfs_mft_write_ctx *ctx =
+ container_of(bio, struct ntfs_mft_write_ctx, bio);
+ struct folio *folio = ctx->folio;
+ struct completion *done = ctx->done;
+ int err;
+
+ if (bio->bi_status)
+ err = blk_status_to_errno(bio->bi_status);
+ else
+ err = ctx->error;
+ if (err) {
+ mapping_set_error(ctx->mapping, err);
+ NVolSetErrors(ctx->vol);
+ ntfs_error(ctx->vol->sb, "I/O error while writing MFT: %d",
+ err);
+ }
+
+ if (!done)
+ bio_put(bio);
+ folio_end_writeback(folio);
+ folio_put(folio);
+ if (done)
+ complete(done);
+}
+
+static void ntfs_start_mft_writeback(struct ntfs_mft_write_ctx *ctx)
+{
+ if (ctx->writeback_started)
+ return;
+
+ inode_attach_wb(ctx->mapping->host, NULL);
+ folio_get(ctx->folio);
+ folio_start_writeback(ctx->folio);
+ ctx->writeback_started = true;
+}
+
+static struct bio *ntfs_alloc_mft_parent_bio(struct ntfs_volume *vol,
+ struct folio *folio,
+ struct completion *done)
+{
+ struct ntfs_mft_write_ctx *ctx;
+ struct bio *parent;
+
+ parent = bio_alloc_bioset(vol->sb->s_bdev, 1, REQ_OP_WRITE, GFP_NOIO,
+ &ntfs_mft_bioset);
+ if (!parent)
+ return NULL;
+
+ ctx = container_of(parent, struct ntfs_mft_write_ctx, bio);
+ ctx->folio = folio;
+ ctx->mapping = folio->mapping;
+ ctx->vol = vol;
+ ctx->done = done;
+ ctx->error = 0;
+ ctx->writeback_started = false;
+ parent->bi_end_io = ntfs_mft_end_io;
+ return parent;
+}
+
/*
* Write one MFT I/O unit to $MFTMirr. The source folio contains the MST
* protected image that will be written to $MFT.
@@ -533,6 +619,42 @@ static int ntfs_sync_mft_mirror_record(struct ntfs_volume *vol,
(u64)mft_no * vol->mft_record_size, &unit);
}
+static int ntfs_prepare_mft_record_io_units(struct ntfs_inode *ni,
+ struct ntfs_mft_io_unit units[2])
+{
+ struct ntfs_volume *vol = ni->vol;
+ u64 record_byte = (u64)ni->mft_no * vol->mft_record_size;
+ u64 disk_byte;
+ unsigned int nr_units = ni->mft_lcn_count;
+ unsigned int cluster_ofs;
+ unsigned int i;
+
+ if (!nr_units || nr_units > ARRAY_SIZE(ni->mft_lcn))
+ return -EIO;
+ for (i = 0; i < nr_units; i++)
+ if (ni->mft_lcn[i] < 0)
+ return -EIO;
+
+ cluster_ofs = ntfs_bytes_to_cluster_off(vol, record_byte);
+ disk_byte = NTFS_CLU_TO_B(vol, ni->mft_lcn[0]) + cluster_ofs;
+ units[0] = (struct ntfs_mft_io_unit){
+ .sector = ntfs_bytes_to_bio_sector(disk_byte),
+ .folio_ofs = ni->folio_ofs,
+ .len = vol->mft_record_size,
+ };
+ if (nr_units == 1)
+ return 1;
+
+ units[0].len = vol->cluster_size;
+ disk_byte = NTFS_CLU_TO_B(vol, ni->mft_lcn[1]);
+ units[1] = (struct ntfs_mft_io_unit){
+ .sector = ntfs_bytes_to_bio_sector(disk_byte),
+ .folio_ofs = ni->folio_ofs + vol->cluster_size,
+ .len = vol->mft_record_size - vol->cluster_size,
+ };
+ return 2;
+}
+
/*
* write_mft_record_nolock - write out a mapped (extent) mft record
* @ni: ntfs inode describing the mapped (extent) mft record
@@ -553,17 +675,23 @@ int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int syn
{
struct ntfs_volume *vol = ni->vol;
struct folio *folio = ni->folio;
- int err = 0, i = 0;
+ DECLARE_COMPLETION_ONSTACK(done);
+ struct ntfs_mft_io_unit units[2];
+ struct ntfs_mft_write_ctx *ctx;
+ struct bio *parent, *child = NULL;
+ unsigned int nr_units;
+ int err = 0;
u8 *kaddr;
struct mft_record *fixup_m;
- struct bio *bio;
- unsigned int offset = 0, folio_size;
ntfs_debug("Entering for inode 0x%llx.", ni->mft_no);
WARN_ON(NInoAttr(ni));
WARN_ON(!folio_test_locked(folio));
+ if (folio_test_writeback(folio))
+ folio_wait_writeback(folio);
+
/*
* If the struct ntfs_inode is clean no need to do anything. If it is dirty,
* mark it as clean now so that it can be redirtied later on if needed.
@@ -573,6 +701,11 @@ int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int syn
if (!NInoTestClearDirty(ni))
goto done;
+ err = ntfs_prepare_mft_record_io_units(ni, units);
+ if (err < 0)
+ goto err_out;
+ nr_units = err;
+
kaddr = kmap_local_folio(folio, 0);
fixup_m = (struct mft_record *)(kaddr + ni->folio_ofs);
memcpy(fixup_m, m, vol->mft_record_size);
@@ -584,69 +717,74 @@ int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int syn
goto unmap_err_out;
}
- folio_size = vol->mft_record_size / ni->mft_lcn_count;
- while (i < ni->mft_lcn_count) {
- unsigned int clu_off;
-
- clu_off = (unsigned int)((s64)ni->mft_no * vol->mft_record_size + offset) &
- vol->cluster_size_mask;
-
- bio = bio_alloc(vol->sb->s_bdev, 1, REQ_OP_WRITE, GFP_NOIO);
- bio->bi_iter.bi_sector =
- ntfs_bytes_to_bio_sector(NTFS_CLU_TO_B(vol, ni->mft_lcn[i]) +
- clu_off);
+ parent = ntfs_alloc_mft_parent_bio(vol, folio, sync ? &done : NULL);
+ if (!parent) {
+ err = -ENOMEM;
+ goto unmap_err_out;
+ }
+ ctx = container_of(parent, struct ntfs_mft_write_ctx, bio);
- if (!bio_add_folio(bio, folio, folio_size,
- ni->folio_ofs + offset)) {
- err = -EIO;
- goto put_bio_out;
+ parent->bi_iter.bi_sector = units[0].sector;
+ if (!bio_add_folio(parent, folio, units[0].len, units[0].folio_ofs)) {
+ err = -EIO;
+ goto put_bios_out;
+ }
+
+ if (nr_units == 2) {
+ if (bio_end_sector(parent) != units[1].sector ||
+ !bio_add_folio(parent, folio, units[1].len,
+ units[1].folio_ofs)) {
+ child = bio_alloc(vol->sb->s_bdev, 1, REQ_OP_WRITE,
+ GFP_NOIO);
+ if (!child) {
+ err = -ENOMEM;
+ goto put_bios_out;
+ }
+ child->bi_iter.bi_sector = units[1].sector;
+ if (!bio_add_folio(child, folio, units[1].len,
+ units[1].folio_ofs)) {
+ err = -EIO;
+ goto put_bios_out;
+ }
}
+ }
- /* Synchronize the mft mirror now if not @sync. */
- if (!sync && ni->mft_no < vol->mftmirr_size) {
- int sub_err = ntfs_sync_mft_mirror_record(vol, folio,
- ni->mft_no);
- if (unlikely(sub_err) && !err)
- err = sub_err;
- }
+ if (ni->mft_no < vol->mftmirr_size) {
+ err = ntfs_sync_mft_mirror_record(vol, folio, ni->mft_no);
+ if (err)
+ ctx->error = err;
+ }
- if (sync) {
- int sub_err = submit_bio_wait(bio);
+ kunmap_local(kaddr);
- bio_put(bio);
- if (unlikely(sub_err) && !err)
- err = sub_err;
- } else {
- folio_get(folio);
- bio->bi_private = folio;
- bio->bi_end_io = ntfs_bio_end_io;
- submit_bio(bio);
- }
- offset += vol->cluster_size;
- i++;
+ ntfs_start_mft_writeback(ctx);
+ if (child) {
+ bio_chain(child, parent);
+ submit_bio(child);
}
+ submit_bio(parent);
- /* If @sync, now synchronize the mft mirror. */
- if (sync && ni->mft_no < vol->mftmirr_size) {
- int sub_err =
- ntfs_sync_mft_mirror_record(vol, folio, ni->mft_no);
-
- if (unlikely(sub_err) && !err)
- err = sub_err;
+ if (sync) {
+ wait_for_completion(&done);
+ if (!err && parent->bi_status)
+ err = blk_status_to_errno(parent->bi_status);
+ bio_put(parent);
}
- kunmap_local(kaddr);
+
if (unlikely(err)) {
/* I/O error during writing. This is really bad! */
ntfs_error(vol->sb,
"I/O error while writing mft record 0x%llx! Marking base inode as bad. You should unmount the volume and run chkdsk.",
ni->mft_no);
- goto err_out;
+ return err;
}
done:
ntfs_debug("Done.");
return 0;
-put_bio_out:
- bio_put(bio);
+put_bios_out:
+ if (child)
+ bio_put(child);
+ bio_put(parent);
unmap_err_out:
kunmap_local(kaddr);
err_out:
diff --git a/fs/ntfs/mft.h b/fs/ntfs/mft.h
index eb8a6f0d7944f..28a79bf4c1c67 100644
--- a/fs/ntfs/mft.h
+++ b/fs/ntfs/mft.h
@@ -42,6 +42,8 @@ static inline void mark_mft_record_dirty(struct ntfs_inode *ni)
__mark_mft_record_dirty(ni);
}
+int ntfs_mft_bioset_init(void);
+void ntfs_mft_bioset_exit(void);
int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int sync);
/*
@@ -51,16 +53,17 @@ int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int syn
* @sync: if true, wait for i/o completion
*
* This is just a wrapper for write_mft_record_nolock() (see mft.c), which
- * locks the page for the duration of the write. This ensures that there are
- * no race conditions between writing the mft record via the dirty inode code
- * paths and via the page cache write back code paths or between writing
- * neighbouring mft records residing in the same page.
+ * locks the folio for the duration of the write. The folio lock prevents
+ * races between writing the mft record via the dirty inode code paths and via
+ * page cache writeback or between neighbouring mft records residing in the
+ * same folio.
*
* Locking the page also serializes us against ->read_folio() if the page is not
* uptodate.
*
- * On success, clean the mft record and return 0. On error, leave the mft
- * record dirty and return -errno.
+ * On success, clean the mft record and return 0. On allocation failure,
+ * redirty the record for retry and return 0. On other errors, return -errno
+ * and mark the volume with errors.
*/
static inline int write_mft_record(struct ntfs_inode *ni, struct mft_record *m, int sync)
{
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 99a95ee32f228..49ec1eb1520c1 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -18,6 +18,7 @@
#include "sysctl.h"
#include "logfile.h"
#include "index.h"
+#include "mft.h"
#include "ntfs.h"
#include "ea.h"
#include "volume.h"
@@ -2685,6 +2686,13 @@ static int __init init_ntfs_fs(void)
return err;
}
+ err = ntfs_mft_bioset_init();
+ if (err) {
+ pr_crit("Failed to initialize NTFS MFT bioset!\n");
+ ntfs_workqueue_destroy();
+ return err;
+ }
+
ntfs_index_ctx_cache = kmem_cache_create(ntfs_index_ctx_cache_name,
sizeof(struct ntfs_index_context), 0 /* offset */,
SLAB_HWCACHE_ALIGN, NULL /* ctor */);
@@ -2752,6 +2760,7 @@ static int __init init_ntfs_fs(void)
actx_err_out:
kmem_cache_destroy(ntfs_index_ctx_cache);
ictx_err_out:
+ ntfs_mft_bioset_exit();
if (!err) {
pr_crit("Aborting NTFS filesystem driver registration...\n");
err = -ENOMEM;
@@ -2770,6 +2779,7 @@ static void __exit exit_ntfs_fs(void)
* destroy cache.
*/
rcu_barrier();
+ ntfs_mft_bioset_exit();
#ifdef CONFIG_NTFS_FS_WOF_COMPRESSION
ntfs_wof_free_workspaces();
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0910/1257] ntfs: write MFT folios through mapped I/O units
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (908 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0909/1257] ntfs: track direct MFT writes until BIO completion Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0911/1257] ntfs: write MFT records through containing " Greg Kroah-Hartman
` (88 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit 1df655bcddc212fc1e38b44c3172b6172c11b77a ]
Replace the legacy MFT folio writeback loop with a mapped I/O-unit
writeback path. Map the I/O units covering selected records under the
runlist lock and submit them through an aggregate parent BIO with optional
chained child BIOs.
Defer transient mapping failures, preserve partial-progress redirty
semantics, and complete folio writeback from aggregate parent completion.
Do not set defer for records that generic writeback does not own. Dirty
FILE records remain under direct inode writeback. other rejected records
and the special $MFT extent are skipped rather than treated as transient
failures.
Fixes: 115380f9a2f9 ("ntfs: update mft operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/mft.c | 483 ++++++++++++++++++++++++++++++--------------------
1 file changed, 290 insertions(+), 193 deletions(-)
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 51066b403757c..bbbe0d4426ecf 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -10,8 +10,10 @@
#include <linux/writeback.h>
#include <linux/bio.h>
+#include <linux/blkdev.h>
#include <linux/completion.h>
#include <linux/iomap.h>
+#include <linux/math64.h>
#include "bitmap.h"
#include "lcnalloc.h"
@@ -436,21 +438,6 @@ struct ntfs_mft_io_unit {
unsigned int len;
};
-/*
- * ntfs_bio_end_io - bio completion callback for MFT record writes
- *
- * Decrements the folio reference count that was incremented before
- * submit_bio(). This prevents a race condition where umount could
- * evict the inode and release the folio while I/O is still in flight,
- * potentially causing data corruption or use-after-free.
- */
-static void ntfs_bio_end_io(struct bio *bio)
-{
- if (bio->bi_private)
- folio_put((struct folio *)bio->bi_private);
- bio_put(bio);
-}
-
struct ntfs_mft_write_ctx {
struct folio *folio;
struct address_space *mapping;
@@ -584,8 +571,8 @@ static int ntfs_sync_mft_mirror_unit(struct ntfs_volume *vol,
kunmap_local(src);
bio_init(&bio, vol->sb->s_bdev, &bvec, 1, REQ_OP_WRITE);
- bio.bi_iter.bi_sector = ntfs_bytes_to_bio_sector(NTFS_CLU_TO_B(vol, vol->mftmirr_lcn) +
- mirror_file_ofs);
+ bio.bi_iter.bi_sector = ntfs_bytes_to_bio_sector(
+ NTFS_CLU_TO_B(vol, vol->mftmirr_lcn) + mirror_file_ofs);
if (!bio_add_folio(&bio, mirror, unit->len, mirror_ofs))
err = -EIO;
else
@@ -857,7 +844,8 @@ static int ntfs_test_inode_wb(struct inode *vi, u64 ino, void *data)
* it in @ref_vi instead of calling iput() directly. The caller must call
* iput() on @ref_vi after releasing the folio lock.
*
- * Return 'true' if the mft record may be written out and 'false' if not.
+ * Return 'true' if the mft record may be written out by this path and 'false'
+ * if direct inode writeback owns it.
*
* The caller has locked the page and cleared the uptodate flag on it which
* means that we can safely write out any dirty mft records that do not have
@@ -954,9 +942,10 @@ static bool ntfs_may_write_mft_record(struct ntfs_volume *vol, const u64 mft_no,
mft_no);
/*
* The write has to occur while we hold the mft record lock so
- * return the locked ntfs inode.
+ * return the locked ntfs inode and its vfs inode reference.
*/
*locked_ni = ni;
+ *ref_vi = vi;
return true;
}
ntfs_debug("Inode 0x%llx is not in icache.", mft_no);
@@ -3001,19 +2990,141 @@ int ntfs_mft_record_free(struct ntfs_volume *vol, struct ntfs_inode *ni)
return err;
}
-static s64 lcn_from_index(struct ntfs_volume *vol, struct ntfs_inode *ni,
- unsigned long index)
+static bool ntfs_add_mft_io_unit(struct bio *bio, struct folio *folio,
+ const struct ntfs_mft_io_unit *unit)
{
- s64 vcn;
- s64 lcn;
+ if (!bio->bi_iter.bi_size)
+ bio->bi_iter.bi_sector = unit->sector;
+ else if (bio_end_sector(bio) != unit->sector)
+ return false;
+
+ return bio_add_folio(bio, folio, unit->len, unit->folio_ofs);
+}
+
+static void ntfs_release_mft_write_refs(struct ntfs_inode **locked_nis,
+ unsigned int nr_locked_nis,
+ struct inode **ref_inos,
+ unsigned int nr_ref_inos)
+{
+ while (nr_locked_nis-- > 0) {
+ struct ntfs_inode *tni = locked_nis[nr_locked_nis];
+
+ mutex_unlock(&tni->mrec_lock);
+ atomic_dec(&tni->count);
+ }
+
+ while (nr_ref_inos-- > 0)
+ iput(ref_inos[nr_ref_inos]);
+}
+
+static int ntfs_map_mft_io_locked(struct ntfs_inode *ni, u64 folio_byte,
+ struct ntfs_mft_io_unit *unit)
+{
+ struct ntfs_volume *vol = ni->vol;
+ u64 file_ofs = folio_byte + unit->folio_ofs;
+ s64 vcn, lcn;
+
+ lockdep_assert_held(&ni->runlist.lock);
+ if (!ni->runlist.rl)
+ return -EIO;
+
+ vcn = ntfs_bytes_to_cluster(vol, file_ofs);
+ /*
+ * $MFT is fully mapped at mount time and extensions merge already
+ * mapped runs under the write lock. Do not remap here: the generic
+ * helper may drop this read lock while upgrading it.
+ */
+ lcn = ntfs_rl_vcn_to_lcn(ni->runlist.rl, vcn);
+ if (lcn == LCN_RL_NOT_MAPPED)
+ return -EAGAIN;
+ if (lcn < 0)
+ return -EIO;
+ if (ntfs_bytes_to_cluster_off(vol, file_ofs) + unit->len >
+ vol->cluster_size)
+ return -EIO;
+
+ unit->sector = ntfs_bytes_to_bio_sector(
+ NTFS_CLU_TO_B(vol, lcn) +
+ ntfs_bytes_to_cluster_off(vol, file_ofs));
+ return 0;
+}
- vcn = ntfs_pidx_to_cluster(vol, index);
+static int ntfs_map_mft_io_for_folio(struct ntfs_inode *ni, u64 folio_byte,
+ struct ntfs_mft_io_unit *unit)
+{
+ int err;
- down_read(&ni->runlist.lock);
- lcn = ntfs_attr_vcn_to_lcn_nolock(ni, vcn, false);
+ if (!down_read_trylock(&ni->runlist.lock))
+ return -EAGAIN;
+ err = ntfs_map_mft_io_locked(ni, folio_byte, unit);
up_read(&ni->runlist.lock);
+ return err;
+}
+
+static int ntfs_prepare_mft_folio_units(struct ntfs_inode *ni, u64 folio_byte,
+ u64 file_limit,
+ const unsigned long *record_writable,
+ struct ntfs_mft_io_unit *units,
+ unsigned int *nr_units,
+ unsigned int max_units, bool *defer)
+{
+ struct ntfs_volume *vol = ni->vol;
+ u64 folio_end = folio_byte + PAGE_SIZE;
+ u64 unit_byte = folio_byte;
+
+ while (unit_byte < folio_end && unit_byte < file_limit) {
+ struct ntfs_mft_io_unit unit;
+ u64 record_byte;
+ u64 cluster_end = ntfs_cluster_to_bytes(
+ vol, ntfs_bytes_to_cluster(vol, unit_byte) + 1);
+ u64 record_end =
+ round_down(unit_byte, (u64)vol->mft_record_size) +
+ vol->mft_record_size;
+ u64 unit_end = min3(record_end, cluster_end, folio_end);
+ bool writable = false;
+ int err;
+
+ record_byte = round_down(unit_byte, (u64)vol->mft_record_size);
+ while (record_byte < min(unit_end, file_limit)) {
+ unsigned int record;
+
+ record = div_u64(record_byte - folio_byte,
+ vol->mft_record_size);
+ if (test_bit(record, record_writable)) {
+ writable = true;
+ break;
+ }
+ record_byte += vol->mft_record_size;
+ }
+ if (!writable)
+ goto next;
+
+ unit = (struct ntfs_mft_io_unit){
+ .folio_ofs = unit_byte - folio_byte,
+ .len = unit_end - unit_byte,
+ };
+ err = ntfs_map_mft_io_for_folio(ni, folio_byte, &unit);
+ if (err == -EAGAIN) {
+ *defer = true;
+ goto next;
+ }
+ if (err)
+ return err;
+ if (*nr_units >= max_units)
+ return -EOVERFLOW;
+ units[(*nr_units)++] = unit;
+next:
+ unit_byte = unit_end;
+ }
+ return 0;
+}
- return lcn;
+static void ntfs_mft_write_error(struct ntfs_volume *vol,
+ struct address_space *mapping, int err)
+{
+ mapping_set_error(mapping, err);
+ NVolSetErrors(vol);
+ ntfs_error(vol->sb, "Error while writing MFT folio: %d", err);
}
/*
@@ -3022,9 +3133,8 @@ static s64 lcn_from_index(struct ntfs_volume *vol, struct ntfs_inode *ni,
* @wbc: Writeback control structure
*
* This function is called as part of the address_space_operations
- * .writepages implementation for the $MFT inode (or $MFTMirr).
- * It handles writing one folio (normally 4KiB page) worth of MFT records
- * to the underlying block device.
+ * .writepages implementation for the $MFT inode. Despite its historical
+ * name, it handles one folio containing MFT records.
*
* Return: 0 on success, or -errno on error.
*/
@@ -3034,202 +3144,189 @@ static int ntfs_write_mft_block(struct folio *folio, struct writeback_control *w
struct inode *vi = mapping->host;
struct ntfs_inode *ni = NTFS_I(vi);
struct ntfs_volume *vol = ni->vol;
- u8 *kaddr;
- struct ntfs_inode **locked_nis __free(kfree) = kmalloc_objs(struct ntfs_inode *,
- PAGE_SIZE / NTFS_BLOCK_SIZE,
- GFP_NOFS);
- int nr_locked_nis = 0, err = 0, mft_ofs, prev_mft_ofs;
- struct inode **ref_inos __free(kfree) = kmalloc_objs(struct inode *,
- PAGE_SIZE / NTFS_BLOCK_SIZE,
- GFP_NOFS);
- int nr_ref_inos = 0;
- struct bio *bio = NULL;
- u64 mft_no;
- struct ntfs_inode *tni;
- s64 lcn;
- s64 vcn = ntfs_pidx_to_cluster(vol, folio->index);
- s64 end_vcn;
- unsigned int folio_sz;
+ struct ntfs_inode **locked_nis __free(kfree) =
+ kmalloc_objs(struct ntfs_inode *, PAGE_SIZE / NTFS_BLOCK_SIZE,
+ GFP_NOFS);
+ struct inode **ref_inos __free(kfree) =
+ kmalloc_objs(struct inode *, PAGE_SIZE / NTFS_BLOCK_SIZE, GFP_NOFS);
+ struct ntfs_mft_io_unit *units __free(kfree) = NULL;
+ struct bio *parent = NULL, *child = NULL;
+ struct ntfs_mft_write_ctx *ctx = NULL;
+ u8 *kaddr = NULL;
+ DECLARE_BITMAP(record_writable, PAGE_SIZE / NTFS_BLOCK_SIZE) = {};
+ u64 folio_byte, file_limit, folio_end, mirror_size;
+ unsigned int nr_records, nr_units = 0, max_units;
+ unsigned int nr_locked_nis = 0, nr_ref_inos = 0;
+ unsigned int record, unit_idx;
+ unsigned long flags;
loff_t i_size;
s64 allocated_size;
- unsigned long flags;
+ bool defer = false, redirty = false;
+ int err = 0;
read_lock_irqsave(&ni->size_lock, flags);
i_size = i_size_read(vi);
allocated_size = ni->allocated_size;
read_unlock_irqrestore(&ni->size_lock, flags);
- end_vcn = ntfs_bytes_to_cluster(vol, allocated_size);
- ntfs_debug("Entering for inode 0x%llx, attribute type 0x%x, folio index 0x%lx.",
- ni->mft_no, ni->type, folio->index);
+ ntfs_debug("Entering for inode 0x%llx, folio index 0x%lx.", ni->mft_no,
+ folio->index);
+ WARN_ON(!folio_test_locked(folio));
- if (!locked_nis || !ref_inos) {
- folio_redirty_for_writepage(wbc, folio);
- folio_unlock(folio);
- return -ENOMEM;
+ folio_byte = folio_pos(folio);
+ folio_end = folio_byte + PAGE_SIZE;
+ mirror_size = (u64)vol->mftmirr_size * vol->mft_record_size;
+
+ if (i_size <= folio_byte)
+ folio_zero_segment(folio, 0, PAGE_SIZE);
+ else if ((u64)i_size < folio_end)
+ folio_zero_segment(folio, i_size - folio_byte, PAGE_SIZE);
+
+ file_limit = min_t(u64, i_size, allocated_size);
+ nr_records = PAGE_SIZE / vol->mft_record_size;
+ max_units = PAGE_SIZE / min(vol->cluster_size, vol->mft_record_size);
+ units = kmalloc_array(max_units, sizeof(*units), GFP_NOFS);
+ if (!locked_nis || !ref_inos || !units) {
+ err = -ENOMEM;
+ goto out_noio;
}
- /* We have to zero every time due to mmap-at-end-of-file. */
- if (folio->index >= (i_size >> folio_shift(folio)))
- /* The page straddles i_size. */
- folio_zero_segment(folio,
- offset_in_folio(folio, i_size),
- folio_size(folio));
+ kaddr = kmap_local_folio(folio, 0);
+ folio_clear_uptodate(folio);
+
+ for (record = 0; record < nr_records; record++) {
+ struct ntfs_inode *tni = NULL;
+ struct inode *ref_vi = NULL;
+ u64 record_byte =
+ folio_byte + (u64)record * vol->mft_record_size;
+ u64 mft_no;
+
+ if (record_byte >= file_limit)
+ continue;
+ mft_no = record_byte >> vol->mft_record_size_bits;
+ if (!ntfs_may_write_mft_record(
+ vol, mft_no,
+ (struct mft_record *)(kaddr +
+ record * vol->mft_record_size),
+ &tni, &ref_vi)) {
+ if (ref_vi)
+ ref_inos[nr_ref_inos++] = ref_vi;
+ continue;
+ }
+ if (ref_vi)
+ ref_inos[nr_ref_inos++] = ref_vi;
+ if (tni) {
+ locked_nis[nr_locked_nis++] = tni;
+ if (tni->nr_extents < 0 &&
+ tni->ext.base_ntfs_ino == NTFS_I(vol->mft_ino))
+ continue;
+ }
+ __set_bit(record, record_writable);
+ }
- lcn = lcn_from_index(vol, ni, folio->index);
- if (lcn <= LCN_HOLE) {
+ err = ntfs_prepare_mft_folio_units(ni, folio_byte, file_limit,
+ record_writable, units, &nr_units,
+ max_units, &defer);
+ if (err)
+ goto out_noio;
+ if (!nr_units) {
+ if (defer)
+ goto out_noio;
+ folio_mark_uptodate(folio);
+ kunmap_local(kaddr);
folio_start_writeback(folio);
folio_unlock(folio);
folio_end_writeback(folio);
- return -EIO;
+ ntfs_release_mft_write_refs(locked_nis, nr_locked_nis, ref_inos,
+ nr_ref_inos);
+ return 0;
}
- /* Map folio so we can access its contents. */
- kaddr = kmap_local_folio(folio, 0);
- /* Clear the page uptodate flag whilst the mst fixups are applied. */
- folio_clear_uptodate(folio);
+ parent = ntfs_alloc_mft_parent_bio(vol, folio, NULL);
+ if (!parent) {
+ err = -ENOMEM;
+ goto out_noio;
+ }
+ ctx = container_of(parent, struct ntfs_mft_write_ctx, bio);
- for (mft_ofs = 0; mft_ofs < PAGE_SIZE && vcn < end_vcn;
- mft_ofs += vol->mft_record_size) {
- /* Get the mft record number. */
- mft_no = (((s64)folio->index << PAGE_SHIFT) + mft_ofs) >>
- vol->mft_record_size_bits;
- vcn = ntfs_mft_no_to_cluster(vol, mft_no);
- /* Check whether to write this mft record. */
- tni = NULL;
- if (ntfs_may_write_mft_record(vol, mft_no,
- (struct mft_record *)(kaddr + mft_ofs),
- &tni, &ref_inos[nr_ref_inos])) {
- unsigned int mft_record_off = 0;
- s64 vcn_off = vcn;
- s64 rl_len = 0;
+ if (!ntfs_add_mft_io_unit(parent, folio, &units[0])) {
+ err = -EIO;
+ goto out_noio;
+ }
- /*
- * The record should be written. If a locked ntfs
- * inode was returned, add it to the array of locked
- * ntfs inodes.
- */
- if (tni)
- locked_nis[nr_locked_nis++] = tni;
- else if (ref_inos[nr_ref_inos])
- nr_ref_inos++;
-
- if (bio && (mft_ofs != prev_mft_ofs + vol->mft_record_size)) {
-flush_bio:
- bio->bi_end_io = ntfs_bio_end_io;
- submit_bio(bio);
- bio = NULL;
- }
+ for (unit_idx = 0; unit_idx < nr_units; unit_idx++) {
+ struct ntfs_mft_io_unit *unit = &units[unit_idx];
+ u64 file_ofs = folio_byte + unit->folio_ofs;
- if (vol->cluster_size < folio_size(folio)) {
- struct runlist_element *rl;
+ if (unit_idx) {
+ struct bio *target = child ? child : parent;
- down_write(&ni->runlist.lock);
- rl = ntfs_attr_vcn_to_rl(ni, vcn_off, &lcn);
- if (!IS_ERR(rl))
- rl_len = rl->length - (vcn_off - rl->vcn);
- up_write(&ni->runlist.lock);
- if (IS_ERR(rl) || lcn < 0) {
- err = -EIO;
- goto unm_done;
+ if (!ntfs_add_mft_io_unit(target, folio, unit)) {
+ if (child) {
+ ntfs_start_mft_writeback(ctx);
+ bio_chain(child, parent);
+ submit_bio(child);
+ child = NULL;
}
-
- if (bio &&
- (bio_end_sector(bio) >> (vol->cluster_size_bits - 9)) !=
- lcn) {
- bio->bi_end_io = ntfs_bio_end_io;
- submit_bio(bio);
- bio = NULL;
+ child = bio_alloc(vol->sb->s_bdev, 1,
+ REQ_OP_WRITE, GFP_NOIO);
+ if (!child) {
+ defer = true;
+ break;
+ }
+ if (!ntfs_add_mft_io_unit(child, folio, unit)) {
+ bio_put(child);
+ child = NULL;
+ if (!ctx->error)
+ ctx->error = -EIO;
+ redirty = true;
+ err = -EIO;
+ break;
}
}
+ }
+ if (file_ofs < mirror_size) {
+ int mirror_err = ntfs_sync_mft_mirror_unit(
+ vol, folio, file_ofs, unit);
- if (!bio) {
- unsigned int off;
-
- off = ((mft_no << vol->mft_record_size_bits) +
- mft_record_off) & vol->cluster_size_mask;
-
- bio = bio_alloc(vol->sb->s_bdev, 1, REQ_OP_WRITE,
- GFP_NOIO);
- bio->bi_iter.bi_sector =
- ntfs_bytes_to_bio_sector(
- ntfs_cluster_to_bytes(vol, lcn) + off);
- }
-
- if (vol->cluster_size == NTFS_BLOCK_SIZE &&
- (mft_record_off ||
- rl_len == 1 ||
- mft_ofs + NTFS_BLOCK_SIZE >= PAGE_SIZE))
- folio_sz = NTFS_BLOCK_SIZE;
- else
- folio_sz = vol->mft_record_size;
- if (!bio_add_folio(bio, folio, folio_sz,
- mft_ofs + mft_record_off)) {
- err = -EIO;
- bio_put(bio);
- goto unm_done;
- }
- mft_record_off += folio_sz;
-
- if (mft_record_off != vol->mft_record_size) {
- vcn_off++;
- goto flush_bio;
- }
- prev_mft_ofs = mft_ofs;
-
- if (mft_no < vol->mftmirr_size) {
- int sub_err = ntfs_sync_mft_mirror_record(vol, folio, mft_no);
-
- if (unlikely(sub_err) && !err)
- err = sub_err;
- }
- } else if (ref_inos[nr_ref_inos])
- nr_ref_inos++;
+ if (mirror_err && !ctx->error)
+ ctx->error = mirror_err;
+ }
}
- if (bio) {
- bio->bi_end_io = ntfs_bio_end_io;
- submit_bio(bio);
+ if (child) {
+ ntfs_start_mft_writeback(ctx);
+ bio_chain(child, parent);
+ submit_bio(child);
}
-unm_done:
+ ntfs_start_mft_writeback(ctx);
folio_mark_uptodate(folio);
+ if (defer || redirty)
+ folio_redirty_for_writepage(wbc, folio);
kunmap_local(kaddr);
-
- folio_start_writeback(folio);
+ kaddr = NULL;
folio_unlock(folio);
- folio_end_writeback(folio);
-
- /* Unlock any locked inodes. */
- while (nr_locked_nis-- > 0) {
- struct ntfs_inode *base_tni;
-
- tni = locked_nis[nr_locked_nis];
- mutex_unlock(&tni->mrec_lock);
-
- /* Get the base inode. */
- mutex_lock(&tni->extent_lock);
- if (tni->nr_extents >= 0)
- base_tni = tni;
- else
- base_tni = tni->ext.base_ntfs_ino;
- mutex_unlock(&tni->extent_lock);
- ntfs_debug("Unlocking %s inode 0x%llx.",
- tni == base_tni ? "base" : "extent",
- tni->mft_no);
- atomic_dec(&tni->count);
- iput(VFS_I(base_tni));
- }
+ submit_bio(parent);
+ ntfs_release_mft_write_refs(locked_nis, nr_locked_nis, ref_inos,
+ nr_ref_inos);
+ return 0;
- /* Dropping deferred references */
- while (nr_ref_inos-- > 0) {
- if (ref_inos[nr_ref_inos])
- iput(ref_inos[nr_ref_inos]);
+out_noio:
+ if (kaddr) {
+ folio_mark_uptodate(folio);
+ kunmap_local(kaddr);
}
-
- if (unlikely(err && err != -ENOMEM))
- NVolSetErrors(vol);
- if (likely(!err))
- ntfs_debug("Done.");
+ if (err && err != -ENOMEM)
+ ntfs_mft_write_error(vol, mapping, err);
+ if (parent)
+ bio_put(parent);
+ if (redirty || defer || err == -ENOMEM)
+ folio_redirty_for_writepage(wbc, folio);
+ folio_unlock(folio);
+ ntfs_release_mft_write_refs(locked_nis, nr_locked_nis, ref_inos,
+ nr_ref_inos);
+ if (err == -ENOMEM || (defer && !err))
+ return 0;
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0911/1257] ntfs: write MFT records through containing I/O units
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (909 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0910/1257] ntfs: write MFT folios through mapped I/O units Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0912/1257] ntfs: use sync flag for direct MFT writes Greg Kroah-Hartman
` (87 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit 4437d9d787185520c4798a942de9b5ef986d2141 ]
Use the configured MFT I/O unit for direct writes, mirror updates, and
generic folio writeback. On native 4Kn devices, multiple MFT records can
share a device block, so submit complete containing units while preserving
unselected neighboring records.
Track selected records separately from records owned by direct inode
writeback, and retain the existing runlist and cluster-boundary checks.
Force direct MFT writes to complete synchronously when the I/O unit is
larger than an individual record. the following patch restores
caller-controlled completion.
Fixes: 115380f9a2f9 ("ntfs: update mft operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/mft.c | 61 +++++++++++++++++++++++++++++++++++++--------------
1 file changed, 45 insertions(+), 16 deletions(-)
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index bbbe0d4426ecf..77acc26a85d90 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -597,13 +597,18 @@ static int ntfs_sync_mft_mirror_unit(struct ntfs_volume *vol,
static int ntfs_sync_mft_mirror_record(struct ntfs_volume *vol,
struct folio *source, const u64 mft_no)
{
+ u64 mirror_file_ofs = (u64)mft_no * vol->mft_record_size;
struct ntfs_mft_io_unit unit = {
.folio_ofs = NTFS_MFT_NR_TO_POFS(vol, mft_no),
.len = vol->mft_record_size,
};
- return ntfs_sync_mft_mirror_unit(vol, source,
- (u64)mft_no * vol->mft_record_size, &unit);
+ mirror_file_ofs =
+ round_down(mirror_file_ofs, (u64)vol->mft_io_unit_size);
+ unit.folio_ofs = round_down(unit.folio_ofs, vol->mft_io_unit_size);
+ unit.len = vol->mft_io_unit_size;
+
+ return ntfs_sync_mft_mirror_unit(vol, source, mirror_file_ofs, &unit);
}
static int ntfs_prepare_mft_record_io_units(struct ntfs_inode *ni,
@@ -623,6 +628,18 @@ static int ntfs_prepare_mft_record_io_units(struct ntfs_inode *ni,
return -EIO;
cluster_ofs = ntfs_bytes_to_cluster_off(vol, record_byte);
+ if (vol->mft_io_unit_size > vol->mft_record_size) {
+ cluster_ofs = round_down(cluster_ofs, vol->mft_io_unit_size);
+ disk_byte = NTFS_CLU_TO_B(vol, ni->mft_lcn[0]) + cluster_ofs;
+ units[0] = (struct ntfs_mft_io_unit){
+ .sector = ntfs_bytes_to_bio_sector(disk_byte),
+ .folio_ofs = round_down(ni->folio_ofs,
+ vol->mft_io_unit_size),
+ .len = vol->mft_io_unit_size,
+ };
+ return 1;
+ }
+
disk_byte = NTFS_CLU_TO_B(vol, ni->mft_lcn[0]) + cluster_ofs;
units[0] = (struct ntfs_mft_io_unit){
.sector = ntfs_bytes_to_bio_sector(disk_byte),
@@ -676,6 +693,8 @@ int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int syn
WARN_ON(NInoAttr(ni));
WARN_ON(!folio_test_locked(folio));
+ if (vol->mft_io_unit_size > vol->mft_record_size)
+ sync = 1;
if (folio_test_writeback(folio))
folio_wait_writeback(folio);
@@ -3063,7 +3082,7 @@ static int ntfs_map_mft_io_for_folio(struct ntfs_inode *ni, u64 folio_byte,
static int ntfs_prepare_mft_folio_units(struct ntfs_inode *ni, u64 folio_byte,
u64 file_limit,
- const unsigned long *record_writable,
+ const unsigned long *record_selected,
struct ntfs_mft_io_unit *units,
unsigned int *nr_units,
unsigned int max_units, bool *defer)
@@ -3075,28 +3094,37 @@ static int ntfs_prepare_mft_folio_units(struct ntfs_inode *ni, u64 folio_byte,
while (unit_byte < folio_end && unit_byte < file_limit) {
struct ntfs_mft_io_unit unit;
u64 record_byte;
- u64 cluster_end = ntfs_cluster_to_bytes(
- vol, ntfs_bytes_to_cluster(vol, unit_byte) + 1);
- u64 record_end =
- round_down(unit_byte, (u64)vol->mft_record_size) +
- vol->mft_record_size;
- u64 unit_end = min3(record_end, cluster_end, folio_end);
- bool writable = false;
+ u64 unit_end;
+ u64 io_unit_end;
+ u64 cluster_end;
+ bool selected = false;
int err;
+ io_unit_end =
+ round_down(unit_byte, (u64)vol->mft_io_unit_size) +
+ vol->mft_io_unit_size;
+ cluster_end = ntfs_cluster_to_bytes(
+ vol, ntfs_bytes_to_cluster(vol, unit_byte) + 1);
+ unit_end = min3(io_unit_end, cluster_end, folio_end);
+
record_byte = round_down(unit_byte, (u64)vol->mft_record_size);
while (record_byte < min(unit_end, file_limit)) {
unsigned int record;
record = div_u64(record_byte - folio_byte,
vol->mft_record_size);
- if (test_bit(record, record_writable)) {
- writable = true;
+ if (test_bit(record, record_selected)) {
+ selected = true;
break;
}
record_byte += vol->mft_record_size;
}
- if (!writable)
+ /*
+ * Direct inode writeback owns unselected records. Their folio
+ * images are stable while this folio is locked, so a containing
+ * unit can preserve them when writing a selected record.
+ */
+ if (!selected)
goto next;
unit = (struct ntfs_mft_io_unit){
@@ -3153,7 +3181,7 @@ static int ntfs_write_mft_block(struct folio *folio, struct writeback_control *w
struct bio *parent = NULL, *child = NULL;
struct ntfs_mft_write_ctx *ctx = NULL;
u8 *kaddr = NULL;
- DECLARE_BITMAP(record_writable, PAGE_SIZE / NTFS_BLOCK_SIZE) = {};
+ DECLARE_BITMAP(record_selected, PAGE_SIZE / NTFS_BLOCK_SIZE) = {};
u64 folio_byte, file_limit, folio_end, mirror_size;
unsigned int nr_records, nr_units = 0, max_units;
unsigned int nr_locked_nis = 0, nr_ref_inos = 0;
@@ -3221,11 +3249,11 @@ static int ntfs_write_mft_block(struct folio *folio, struct writeback_control *w
tni->ext.base_ntfs_ino == NTFS_I(vol->mft_ino))
continue;
}
- __set_bit(record, record_writable);
+ __set_bit(record, record_selected);
}
err = ntfs_prepare_mft_folio_units(ni, folio_byte, file_limit,
- record_writable, units, &nr_units,
+ record_selected, units, &nr_units,
max_units, &defer);
if (err)
goto out_noio;
@@ -3309,6 +3337,7 @@ static int ntfs_write_mft_block(struct folio *folio, struct writeback_control *w
submit_bio(parent);
ntfs_release_mft_write_refs(locked_nis, nr_locked_nis, ref_inos,
nr_ref_inos);
+
return 0;
out_noio:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0912/1257] ntfs: use sync flag for direct MFT writes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (910 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0911/1257] ntfs: write MFT records through containing " Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0913/1257] ntfs: trigger page_mkwrite for native 4Kn size extension Greg Kroah-Hartman
` (86 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit 43e2fff9f4ec9ff5a9731bf874327eca21259867 ]
Use the supplied sync flag for direct MFT writes instead of forcing
containing-unit writes to complete synchronously.
Pass sync=1 from ntfs_mft_record_free() so the MFT bitmap entry is not
released until the record write completes. Other direct-write callers keep
the completion mode requested by their caller.
The folio lock serializes write preparation, and PG_writeback keeps the
whole unit stable until all chained BIOs complete, so asynchronous
containing-unit writes remain safe.
Fixes: 115380f9a2f9 ("ntfs: update mft operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/mft.c | 17 ++++++++++-------
fs/ntfs/mft.h | 14 ++++++++------
2 files changed, 18 insertions(+), 13 deletions(-)
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 77acc26a85d90..8bb8b4085c8b0 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -671,9 +671,13 @@ static int ntfs_prepare_mft_record_io_units(struct ntfs_inode *ni,
*
* We only write the mft record if the ntfs inode @ni is dirty.
*
- * On success, clean the mft record and return 0.
- * On error (specifically ENOMEM), we redirty the record so it can be retried.
- * For other errors, we mark the volume with errors.
+ * On success, clean the mft record and return 0. On ENOMEM, redirty the
+ * record so it can be retried. Asynchronous callers return success after
+ * redirtying while synchronous callers receive the error. For other errors,
+ * mark the volume with errors.
+ *
+ * If @sync is false, PG_writeback keeps the folio stable and serializes later
+ * writers until the I/O completes.
*/
int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int sync)
{
@@ -693,8 +697,6 @@ int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int syn
WARN_ON(NInoAttr(ni));
WARN_ON(!folio_test_locked(folio));
- if (vol->mft_io_unit_size > vol->mft_record_size)
- sync = 1;
if (folio_test_writeback(folio))
folio_wait_writeback(folio);
@@ -804,7 +806,8 @@ int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int syn
ntfs_error(vol->sb,
"Not enough memory to write mft record. Redirtying so the write is retried later.");
mark_mft_record_dirty(ni);
- err = 0;
+ if (!sync)
+ err = 0;
} else
NVolSetErrors(vol);
return err;
@@ -2959,7 +2962,7 @@ int ntfs_mft_record_free(struct ntfs_volume *vol, struct ntfs_inode *ni)
* record to be freed is guaranteed to do it already.
*/
NInoSetDirty(ni);
- err = write_mft_record(ni, ni_mrec, 0);
+ err = write_mft_record(ni, ni_mrec, 1);
if (err)
goto sync_rollback;
diff --git a/fs/ntfs/mft.h b/fs/ntfs/mft.h
index 28a79bf4c1c67..d2a31205e08c7 100644
--- a/fs/ntfs/mft.h
+++ b/fs/ntfs/mft.h
@@ -53,17 +53,19 @@ int write_mft_record_nolock(struct ntfs_inode *ni, struct mft_record *m, int syn
* @sync: if true, wait for i/o completion
*
* This is just a wrapper for write_mft_record_nolock() (see mft.c), which
- * locks the folio for the duration of the write. The folio lock prevents
- * races between writing the mft record via the dirty inode code paths and via
- * page cache writeback or between neighbouring mft records residing in the
- * same folio.
+ * locks the folio while preparing the write. write_mft_record_nolock() waits
+ * for prior folio writeback before modifying the folio and keeps PG_writeback
+ * set until the submitted I/O completes. Together these serialize dirty
+ * inode writes, page cache writeback, and neighbouring mft record writes in
+ * the same folio.
*
* Locking the page also serializes us against ->read_folio() if the page is not
* uptodate.
*
* On success, clean the mft record and return 0. On allocation failure,
- * redirty the record for retry and return 0. On other errors, return -errno
- * and mark the volume with errors.
+ * redirty the record for retry. Asynchronous callers return 0 after
+ * redirtying, while synchronous callers receive -ENOMEM. On other errors,
+ * return -errno and mark the volume with errors.
*/
static inline int write_mft_record(struct ntfs_inode *ni, struct mft_record *m, int sync)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0913/1257] ntfs: trigger page_mkwrite for native 4Kn size extension
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (911 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0912/1257] ntfs: use sync flag for direct MFT writes Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0914/1257] ntfs: wait for attribute folio writeback before update Greg Kroah-Hartman
` (85 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit 7823d72305f03928f3093e91cd7159542981162b ]
On native 4Kn volumes, pagecache_isize_extended() can leave a writable
mapping for a partial old-EOF page. A subsequent shared mmap write can
then bypass ntfs_filemap_page_mkwrite(), leaving NTFS initialized_size at
the old EOF.
Invalidate the partial old-EOF page after size extension, independent of
the filesystem block size, so the next mmap write enters the NTFS
page_mkwrite path. Apply the same helper to zero-fill fallocate
extensions and compare the actual new size after the operation so
extensions overlapping the old EOF are handled as well.
Fixes: 115380f9a2f9 ("ntfs: update mft operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/file.c | 33 +++++++++++++++++++++++++--------
1 file changed, 25 insertions(+), 8 deletions(-)
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index 007d1614b9ac6..7c7cbd16e9446 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -252,6 +252,22 @@ static int ntfs_file_fsync(struct file *filp, loff_t start, loff_t end,
return ret;
}
+static void ntfs_pagecache_extend(struct inode *vi, loff_t from, loff_t to)
+{
+ pagecache_isize_extended(vi, from, to);
+
+ /*
+ * NTFS initialized_size is byte-granular, so a partial old-EOF page
+ * must stay write-protected until page_mkwrite() updates it. The
+ * generic helper skips this when the block size is at least a page,
+ * the extension ends before the rounded block boundary, or that
+ * boundary is page-aligned.
+ */
+ if (from < to && from & (PAGE_SIZE - 1))
+ unmap_mapping_range(vi->i_mapping, round_down(from, PAGE_SIZE),
+ PAGE_SIZE, 0);
+}
+
static int ntfs_setattr_size(struct inode *vi, struct iattr *attr)
{
struct ntfs_inode *ni = NTFS_I(vi);
@@ -281,7 +297,7 @@ static int ntfs_setattr_size(struct inode *vi, struct iattr *attr)
if (attr->ia_size > old_size) {
truncate_pagecache(vi, old_size);
i_size_write(vi, attr->ia_size);
- pagecache_isize_extended(vi, old_size, attr->ia_size);
+ ntfs_pagecache_extend(vi, old_size, attr->ia_size);
} else {
truncate_setsize(vi, attr->ia_size);
}
@@ -1131,7 +1147,7 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t offset, loff_t le
struct ntfs_inode *ni = NTFS_I(vi);
struct ntfs_volume *vol = ni->vol;
int err = 0;
- loff_t old_size;
+ loff_t old_size, new_size;
if (mode & ~(NTFS_FALLOC_FL_SUPPORTED))
return -EOPNOTSUPP;
@@ -1159,13 +1175,12 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t offset, loff_t le
return err;
}
- old_size = i_size_read(vi);
-
inode_lock(vi);
if (NInoCompressed(ni) || NInoEncrypted(ni) || NInoWofCompressed(ni)) {
inode_unlock(vi);
return -EOPNOTSUPP;
}
+ old_size = i_size_read(vi);
inode_dio_wait(vi);
/* Take invalidate_lock for all fallocate operations to prevent races */
@@ -1194,10 +1209,12 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t offset, loff_t le
err = file_modified(file);
out:
- if (!err && mode == 0 && NInoNonResident(ni) &&
- offset > old_size) {
- truncate_pagecache(vi, old_size);
- pagecache_isize_extended(vi, old_size, offset);
+ if (!err && mode == 0 && NInoNonResident(ni)) {
+ new_size = i_size_read(vi);
+ if (new_size > old_size) {
+ truncate_pagecache(vi, old_size);
+ ntfs_pagecache_extend(vi, old_size, new_size);
+ }
}
filemap_invalidate_unlock(vi->i_mapping);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0914/1257] ntfs: wait for attribute folio writeback before update
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (912 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0913/1257] ntfs: trigger page_mkwrite for native 4Kn size extension Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0915/1257] ntfs: NULL vol->vol_ino in the load_system_files() error teardown Greg Kroah-Hartman
` (84 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit 418452b43d722b3c1e9a711c9f49f3dbe2afaf34 ]
ntfs_inode_attr_pwrite() locks an attribute folio before copying a new
attribute image into it, but taking the folio lock does not wait for an
already-running writeback BIO to complete. The writeback path can unlock
the folio while PG_writeback remains set and the BIO still references the
folio memory.
Fixes: 115380f9a2f9 ("ntfs: update mft operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/inode.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index a777de8a80c72..b3c5219c7b770 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -3739,6 +3739,8 @@ static s64 __ntfs_inode_non_resident_attr_pwrite(struct inode *vi,
folio_lock(folio);
}
+ folio_wait_writeback(folio);
+
if (count == PAGE_SIZE) {
offset = 0;
attr_len = count;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0915/1257] ntfs: NULL vol->vol_ino in the load_system_files() error teardown
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (913 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0914/1257] ntfs: wait for attribute folio writeback before update Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0916/1257] ntfs: use fatal_signal_pending() for fallocate interruption checks Greg Kroah-Hartman
` (83 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongling Zeng, Baolin Liu,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit a0c022c1da5b0fa30c61bd5b28db9f639ace5bf5 ]
The error unwind of load_system_files() drops vol->vol_ino on two
paths but leaves the stale pointer in place while it keeps iput()ing
the remaining system inodes ($Bitmap, $MFT bitmap, $MFTMirr; $MFT
itself is dropped by the caller, ntfs_fill_super()). A third path
carried an iput() that can never execute: it sits inside the
IS_ERR(vol->vol_ino) branch guarded by !IS_ERR(vol->vol_ino), and is
removed along with the stale pointers. Nothing in the teardown
dereferences vol_ino today, so this is pure hygiene, but a stale
pointer to a freed inode surviving the unwind is a trap for any
future code walking the volume during teardown.
ntfs_put_super() and the ntfs_fill_super() error path already NULL it
after their iput(); do the same here.
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/super.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 49ec1eb1520c1..9f5cf65fd3a55 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -1536,8 +1536,7 @@ static bool load_system_files(struct ntfs_volume *vol)
*/
vol->vol_ino = ntfs_iget(sb, FILE_Volume);
if (IS_ERR(vol->vol_ino)) {
- if (!IS_ERR(vol->vol_ino))
- iput(vol->vol_ino);
+ vol->vol_ino = NULL;
volume_failed:
ntfs_error(sb, "Failed to load $Volume.");
goto iput_lcnbmp_err_out;
@@ -1546,6 +1545,7 @@ static bool load_system_files(struct ntfs_volume *vol)
if (IS_ERR(m)) {
iput_volume_failed:
iput(vol->vol_ino);
+ vol->vol_ino = NULL;
goto volume_failed;
}
@@ -1706,6 +1706,8 @@ static bool load_system_files(struct ntfs_volume *vol)
if (vol->logfile_ino)
iput(vol->logfile_ino);
iput(vol->vol_ino);
+ /* Do not leave a stale pointer behind for the rest of the teardown. */
+ vol->vol_ino = NULL;
iput_lcnbmp_err_out:
iput(vol->lcnbmp_ino);
iput_attrdef_err_out:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0916/1257] ntfs: use fatal_signal_pending() for fallocate interruption checks
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (914 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0915/1257] ntfs: NULL vol->vol_ino in the load_system_files() error teardown Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0917/1257] ntfs: avoid truncate and writeback deadlock Greg Kroah-Hartman
` (82 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongling Zeng, Baolin Liu,
Hyunchul Lee, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit 338abaf0dc9230a6627de1a532b7fea5f13623eb ]
The fallocate implementation uses signal checks to let a long allocation
loop abort early. However, signal_pending() also returns true for
TIF_NOTIFY_SIGNAL, which io_uring uses to deliver task_work completions
to the submitting task.
generic/616 is an io_uring fsx soak test that issues fsx-style
read/write requests through io_uring and calls fallocate() directly in
between. A pending io_uring task_work notification can therefore make
signal_pending() true inside ntfs_attr_fallocate() even though no real
signal was delivered.
That caused the previous signal-interruption patch to return -EINTR for
an io_uring notification, which fsx treats as a fatal failure. Switch
both checks to fatal_signal_pending() so only fatal signals interrupt
the allocation loop. A real fatal signal still returns -EINTR, and any
other error still takes precedence.
Fixes: 4dc8f4ee2d46 ("ntfs: handle signal interruption in fallocate")
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/attrib.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index c949ff7650759..c7c09a751c6a4 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -5855,7 +5855,7 @@ int ntfs_attr_fallocate(struct ntfs_inode *ni, loff_t start, loff_t byte_len, bo
goto out;
}
- if (signal_pending(current))
+ if (fatal_signal_pending(current))
goto signal_out;
vcn += alloc_cnt;
@@ -5876,7 +5876,7 @@ int ntfs_attr_fallocate(struct ntfs_inode *ni, loff_t start, loff_t byte_len, bo
try_alloc_cnt, &balloc, false, false);
up_write(&ni->runlist.lock);
mutex_unlock(&ni->mrec_lock);
- if (err || signal_pending(current))
+ if (err || fatal_signal_pending(current))
goto signal_out;
vcn += alloc_cnt;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0917/1257] ntfs: avoid truncate and writeback deadlock
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (915 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0916/1257] ntfs: use fatal_signal_pending() for fallocate interruption checks Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0918/1257] ntfs: fix volume flag update races Greg Kroah-Hartman
` (81 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit fca746064d56329cd81b4f2b1961a3b928c3fe5a ]
ntfs_non_resident_attr_shrink() drops page-cache folios after freeing
clusters and truncating the runlist. The VFS truncate path calls it with
mrec_lock held. A folio writeback can need the same lock to resolve its
iomap mapping, so truncate can wait for writeback while writeback waits
for mrec_lock.
A hung-task call stack:
truncate: mrec_lock -> truncate_inode_pages() -> folio lock/writeback
writeback: folio lock/writeback -> ntfs_write_iomap_begin() ->
mrec_lock
ntfs_setattr_size() already calls truncate_setsize() before
ntfs_truncate_vfs() acquires mrec_lock. Reuse that page-cache truncation
in the VFS path and skip the duplicate truncation under mrec_lock. Keep
the cleanup for internal attribute callers, which do not call
truncate_setsize(). This avoids synchronously flushing the whole
discarded tail while preserving page-cache correctness.
Fixes: 4e646ecd4475 ("ntfs: drop stale page-cache when shrinking a non-resident attr")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/attrib.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index c7c09a751c6a4..b01cbc9eea4ad 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -4234,12 +4234,14 @@ static int ntfs_attr_make_resident(struct ntfs_inode *ni, struct ntfs_attr_searc
* ntfs_non_resident_attr_shrink - shrink a non-resident, open ntfs attribute
* @ni: non-resident ntfs attribute to shrink
* @newsize: new size (in bytes) to which to shrink the attribute
+ * @pagecache_truncated: page cache was already truncated to @newsize
*
* Reduce the size of a non-resident, open ntfs attribute @na to @newsize bytes.
*/
static int ntfs_non_resident_attr_shrink(struct ntfs_inode *ni,
const s64 newsize,
- struct ntfs_inode *locked_ni)
+ struct ntfs_inode *locked_ni,
+ bool pagecache_truncated)
{
struct ntfs_volume *vol;
struct ntfs_attr_search_ctx *ctx;
@@ -4389,7 +4391,8 @@ static int ntfs_non_resident_attr_shrink(struct ntfs_inode *ni,
* later writeback map a vcn past the new allocation, which fails with
* -ENOENT and loses the write.
*/
- truncate_inode_pages(VFS_I(ni)->i_mapping, newsize);
+ if (!pagecache_truncated)
+ truncate_inode_pages(VFS_I(ni)->i_mapping, newsize);
/* Update data size in the index. */
if (ni->type == AT_DATA && ni->name == AT_UNNAMED)
@@ -4991,7 +4994,7 @@ int __ntfs_attr_truncate_vfs(struct ntfs_inode *ni, const s64 newsize,
up_write(&ni->runlist.lock);
} else
err = ntfs_non_resident_attr_shrink(
- ni, newsize, NULL);
+ ni, newsize, NULL, true);
} else
err = ntfs_resident_attr_resize(ni, newsize, 0,
NVolDisableSparse(ni->vol) ?
@@ -5104,7 +5107,7 @@ int ntfs_attr_truncate_i_locked(struct ntfs_inode *ni, const s64 newsize,
ni, newsize, 0, holes, locked_ni);
else
err = ntfs_non_resident_attr_shrink(
- ni, newsize, locked_ni);
+ ni, newsize, locked_ni, false);
} else
err = ntfs_resident_attr_resize(ni, newsize, 0, holes);
ntfs_debug("Return status %d\n", err);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0918/1257] ntfs: fix volume flag update races
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (916 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0917/1257] ntfs: avoid truncate and writeback deadlock Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0919/1257] ntfs: set the volume dirty bit unconditionally on metadata changes Greg Kroah-Hartman
` (80 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongling Zeng, Hyunchul Lee,
Baolin Liu, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit 56a64ee0f99d4ca1756cf743f951c110d39401e5 ]
ntfs_set_volume_flags() and ntfs_clear_volume_flags() both read
vol->vol_flags outside any lock to compute the new value before handing
it to ntfs_write_volume_flags(), which only takes ni->mrec_lock around
the actual write. The read-modify-write is therefore not atomic, and two
concurrent callers can lose an update: ntfs_sync_fs() may derive a
"clean" value from vol->vol_flags while a writer concurrently records an
error and sets VOLUME_IS_DIRTY; the locked write then silently
overwrites the freshly-set dirty bit. The on-disk volume looks clean
despite the recorded errors, so chkdsk will not run on the next mount
and corrupted metadata can persist.
Fix by moving the read-modify-write inside the mrec_lock: pass the bits
to set and to clear separately, and combine them with the current flag
state under the lock inside ntfs_write_volume_flags(). The set/clear
helpers pass only the bits to modify, not the complete flag state. The
bit manipulation is done on CPU-endian values, and the result is
converted back to little-endian before storing it. The wrappers keep
their signatures so callers are unchanged.
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/super.c | 63 +++++++++++++++++++++++++++++++++++--------------
1 file changed, 45 insertions(+), 18 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 9f5cf65fd3a55..57584f157f154 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -360,31 +360,45 @@ void ntfs_handle_error(struct super_block *sb)
}
/*
- * ntfs_write_volume_flags - write new flags to the volume information flags
+ * ntfs_write_volume_flags - apply flag changes to the volume information flags
* @vol: ntfs volume on which to modify the flags
- * @flags: new flags value for the volume information flags
+ * @set_bits: bits to set in the volume information flags
+ * @clear_bits: bits to clear in the volume information flags
*
* Internal function. You probably want to use ntfs_{set,clear}_volume_flags()
* instead (see below).
*
- * Replace the volume information flags on the volume @vol with the value
- * supplied in @flags. Note, this overwrites the volume information flags, so
- * make sure to combine the flags you want to modify with the old flags and use
- * the result when calling ntfs_write_volume_flags().
+ * Combine @set_bits and @clear_bits with the current in-memory flag state and
+ * write the result back. The set/clear helpers pass only the bits to modify,
+ * not the complete flag state. The read-modify-write happens under
+ * ni->mrec_lock so that concurrent set/clear operations cannot lose updates.
+ * All bit manipulation is done on CPU-endian values, and the result is
+ * converted back to little-endian before storing it.
*
* Return 0 on success and -errno on error.
*/
-static int ntfs_write_volume_flags(struct ntfs_volume *vol, const __le16 flags)
+static int ntfs_write_volume_flags(struct ntfs_volume *vol,
+ const __le16 set_bits, const __le16 clear_bits,
+ const bool skip_if_errors)
{
struct ntfs_inode *ni = NTFS_I(vol->vol_ino);
struct volume_information *vi;
struct ntfs_attr_search_ctx *ctx;
+ u16 flags;
int err;
- ntfs_debug("Entering, old flags = 0x%x, new flags = 0x%x.",
- le16_to_cpu(vol->vol_flags), le16_to_cpu(flags));
mutex_lock(&ni->mrec_lock);
- if (vol->vol_flags == flags)
+
+ if (skip_if_errors && NVolErrors(vol))
+ goto done;
+
+ flags = le16_to_cpu(vol->vol_flags);
+ flags |= le16_to_cpu(set_bits) & le16_to_cpu(VOLUME_FLAGS_MASK);
+ flags &= ~(le16_to_cpu(clear_bits) & le16_to_cpu(VOLUME_FLAGS_MASK));
+ ntfs_debug("Entering, old flags = 0x%x, new flags = 0x%x.",
+ le16_to_cpu(vol->vol_flags), flags);
+
+ if (le16_to_cpu(vol->vol_flags) == flags)
goto done;
ctx = ntfs_attr_get_search_ctx(ni, NULL);
@@ -400,7 +414,7 @@ static int ntfs_write_volume_flags(struct ntfs_volume *vol, const __le16 flags)
vi = (struct volume_information *)((u8 *)ctx->attr +
le16_to_cpu(ctx->attr->data.resident.value_offset));
- vol->vol_flags = vi->flags = flags;
+ vol->vol_flags = vi->flags = cpu_to_le16(flags);
mark_mft_record_dirty(ctx->ntfs_ino);
ntfs_attr_put_search_ctx(ctx);
done:
@@ -421,13 +435,14 @@ static int ntfs_write_volume_flags(struct ntfs_volume *vol, const __le16 flags)
* @flags: flags to set on the volume
*
* Set the bits in @flags in the volume information flags on the volume @vol.
+ * The bits are combined with the current flag state under the lock in
+ * ntfs_write_volume_flags(), so concurrent updates are not lost.
*
* Return 0 on success and -errno on error.
*/
int ntfs_set_volume_flags(struct ntfs_volume *vol, __le16 flags)
{
- flags &= VOLUME_FLAGS_MASK;
- return ntfs_write_volume_flags(vol, vol->vol_flags | flags);
+ return ntfs_write_volume_flags(vol, flags, 0, false);
}
/*
@@ -436,14 +451,27 @@ int ntfs_set_volume_flags(struct ntfs_volume *vol, __le16 flags)
* @flags: flags to clear on the volume
*
* Clear the bits in @flags in the volume information flags on the volume @vol.
+ * The bits are combined with the current flag state under the lock in
+ * ntfs_write_volume_flags(), so concurrent updates are not lost.
*
* Return 0 on success and -errno on error.
*/
int ntfs_clear_volume_flags(struct ntfs_volume *vol, __le16 flags)
{
- flags &= VOLUME_FLAGS_MASK;
- flags = vol->vol_flags & cpu_to_le16(~le16_to_cpu(flags));
- return ntfs_write_volume_flags(vol, flags);
+ return ntfs_write_volume_flags(vol, 0, flags, false);
+}
+
+/*
+ * ntfs_clear_volume_dirty_if_no_errors - clear dirty bit if no errors exist
+ * @vol: ntfs volume whose dirty bit should be cleared
+ *
+ * Check NVolErrors() and clear VOLUME_IS_DIRTY under the same mrec_lock so
+ * ntfs_sync_fs() cannot clear the dirty bit after a concurrent error has been
+ * recorded.
+ */
+static int ntfs_clear_volume_dirty_if_no_errors(struct ntfs_volume *vol)
+{
+ return ntfs_write_volume_flags(vol, 0, VOLUME_IS_DIRTY, true);
}
int ntfs_write_volume_label(struct ntfs_volume *vol, char *label)
@@ -1932,8 +1960,7 @@ static int ntfs_sync_fs(struct super_block *sb, int wait)
return 0;
/* If there are some dirty buffers in the bdev inode */
- if (!NVolErrors(vol) &&
- ntfs_clear_volume_flags(vol, VOLUME_IS_DIRTY)) {
+ if (ntfs_clear_volume_dirty_if_no_errors(vol)) {
ntfs_warning(sb, "Failed to clear dirty bit in volume information flags. Run chkdsk.");
err = -EIO;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0919/1257] ntfs: set the volume dirty bit unconditionally on metadata changes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (917 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0918/1257] ntfs: fix volume flag update races Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0920/1257] ntfs: sync the volume dirty bit with the recorded error state Greg Kroah-Hartman
` (79 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baolin Liu, Hongling Zeng,
Hyunchul Lee, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit 55af94ca0ee3512c08d12ffbbb948229da4e1565 ]
The callers in file.c and namei.c skip ntfs_set_volume_flags() when
the in-memory vol_flags already show VOLUME_IS_DIRTY, but that check
runs without any lock: if it observes the bit set and ntfs_sync_fs()
clears it under the mrec_lock before the caller's metadata update
completes, the set is skipped and the volume can end up clean on disk
despite the modification, so chkdsk will not run on the next mount.
Drop the caller-side checks and call ntfs_set_volume_flags()
unconditionally: ntfs_write_volume_flags() already skips the write
under the mrec_lock when the combined value is unchanged. That
unconditional call costs one mrec_lock acquisition per metadata
operation even in the already-dirty steady state; it cannot be
avoided, because deciding to skip the call without the lock is itself
what allows a concurrent ntfs_sync_fs() clear to lose the set.
The IOCB_NOWAIT path in ntfs_file_write_iter() goes through the same
sleeping call: a RWF_NOWAIT write can block in the marking, as it
already could before this change whenever the volume appeared clean.
Giving that path a non-blocking variant is left as follow-up work.
The callers keep the pre-existing behavior of proceeding when the
marking fails, so the dirty bit remains best-effort.
This closes the variant where the set is skipped outright. A clear
for a concurrent, error-free sync can still land between the set and
the end of the metadata operation; that mark-at-start lifecycle is
pre-existing and is not changed by this patch.
Reported-by: Baolin Liu <liubaolin@kylinos.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/file.c | 20 +++++++++++---------
fs/ntfs/namei.c | 24 ++++++++----------------
2 files changed, 19 insertions(+), 25 deletions(-)
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index 7c7cbd16e9446..e3020a4bf805a 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -341,8 +341,7 @@ int ntfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
goto out;
}
- if (!(vol->vol_flags & VOLUME_IS_DIRTY))
- ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
+ ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
if (ia_valid & ATTR_SIZE) {
err = ntfs_setattr_size(vi, attr);
@@ -636,8 +635,13 @@ static ssize_t ntfs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
goto out_lock;
}
- if (!(vol->vol_flags & VOLUME_IS_DIRTY))
- ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
+ /*
+ * The volume must be marked dirty before the modification is made,
+ * without an unlocked check of the in-memory flag: ntfs_sync_fs()
+ * can clear the bit concurrently and the modification would then
+ * land on a volume that is clean on disk.
+ */
+ ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
pos = iocb->ki_pos;
count = ret;
@@ -1169,11 +1173,9 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t offset, loff_t le
return err;
}
- if (!(vol->vol_flags & VOLUME_IS_DIRTY)) {
- err = ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
- if (err)
- return err;
- }
+ err = ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
+ if (err)
+ return err;
inode_lock(vi);
if (NInoCompressed(ni) || NInoEncrypted(ni) || NInoWofCompressed(ni)) {
diff --git a/fs/ntfs/namei.c b/fs/ntfs/namei.c
index fdf52fac43291..3e0adb9a0ea42 100644
--- a/fs/ntfs/namei.c
+++ b/fs/ntfs/namei.c
@@ -757,8 +757,7 @@ static int ntfs_create(struct mnt_idmap *idmap, struct inode *dir,
return err;
}
- if (!(vol->vol_flags & VOLUME_IS_DIRTY))
- ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
+ ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
ni = __ntfs_create(idmap, dir, uname, uname_len, S_IFREG | mode, 0, NULL, 0);
kmem_cache_free(ntfs_name_cache, uname);
@@ -1032,8 +1031,7 @@ static int ntfs_unlink(struct inode *dir, struct dentry *dentry)
return err;
}
- if (!(vol->vol_flags & VOLUME_IS_DIRTY))
- ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
+ ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
err = ntfs_delete(ni, NTFS_I(dir), uname, uname_len, true);
if (err)
@@ -1076,8 +1074,7 @@ static struct dentry *ntfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
return ERR_PTR(err);
}
- if (!(vol->vol_flags & VOLUME_IS_DIRTY))
- ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
+ ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
ni = __ntfs_create(idmap, dir, uname, uname_len, mode, 0, NULL, 0);
kmem_cache_free(ntfs_name_cache, uname);
@@ -1118,8 +1115,7 @@ static int ntfs_rmdir(struct inode *dir, struct dentry *dentry)
return err;
}
- if (!(vol->vol_flags & VOLUME_IS_DIRTY))
- ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
+ ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
err = ntfs_delete(ni, NTFS_I(dir), uname, uname_len, true);
if (err)
@@ -1305,8 +1301,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
new_dir_first = is_subdir(new_dentry->d_parent,
old_dentry->d_parent);
- if (!(vol->vol_flags & VOLUME_IS_DIRTY))
- ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
+ ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
mutex_lock_nested(&old_ni->mrec_lock, NTFS_INODE_MUTEX_NORMAL);
if (new_ni)
@@ -1429,8 +1424,7 @@ static int ntfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
goto out;
}
- if (!(vol->vol_flags & VOLUME_IS_DIRTY))
- ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
+ ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
ni = __ntfs_create(idmap, dir, usrc, usrc_len, S_IFLNK | 0777, 0,
symname, symlen);
@@ -1474,8 +1468,7 @@ static int ntfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
return err;
}
- if (!(vol->vol_flags & VOLUME_IS_DIRTY))
- ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
+ ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
switch (mode & S_IFMT) {
case S_IFCHR:
@@ -1521,8 +1514,7 @@ static int ntfs_link(struct dentry *old_dentry, struct inode *dir,
return -ENOMEM;
}
- if (!(vol->vol_flags & VOLUME_IS_DIRTY))
- ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
+ ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
ihold(vi);
mutex_lock_nested(&ni->mrec_lock, NTFS_INODE_MUTEX_NORMAL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0920/1257] ntfs: sync the volume dirty bit with the recorded error state
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (918 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0919/1257] ntfs: set the volume dirty bit unconditionally on metadata changes Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0921/1257] ntfs: persist the dirty state after the final put_super() commits Greg Kroah-Hartman
` (78 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongling Zeng, Hyunchul Lee,
Baolin Liu, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit 521978c4f4441953d67297286e5804485ae05698 ]
The runtime metadata-corruption paths in fs/ntfs only record the
in-memory NVolErrors() flag; whether VOLUME_IS_DIRTY ever reaches disk
depends on ntfs_set_volume_flags() being called by some other path,
which for most error sites never happens. A volume can therefore
unmount with a clean on-disk flag despite recorded corruption, and
chkdsk will not run on the next mount.
Persisting the dirty bit from the error paths themselves does not work:
they run under a wide variety of ntfs locks, and the dirty-bit write
takes the $Volume mrec_lock and maps the $Volume mft record, which on
an $MFT page-cache miss takes the $MFT runlist lock for writing. That
is enough to self-deadlock or form ABBA cycles from several of them:
the $MFT extend undo paths hold the $MFT runlist lock and then take
vol->lcnbmp_lock inside ntfs_cluster_free(); the cluster allocation and
free rollback paths hold vol->lcnbmp_lock; and the whole mft record
allocation tree is reachable from ntfs_write_volume_label()'s
attribute-list maintenance while it holds the $Volume mrec_lock itself.
Instead, make the persistence a property of the sync paths, which run
without ntfs locks held. The new ntfs_sync_volume_dirty_state() sets
VOLUME_IS_DIRTY when NVolErrors() is recorded and clears it otherwise,
evaluating the error flag under the $Volume mrec_lock. It is called
from ntfs_sync_fs(), from the remount-to-read-only path of
ntfs_reconfigure(), and from ntfs_put_super(), which previously
evaluated NVolErrors() outside the lock before clearing the dirty bit
unconditionally, and which now also persists the dirty bit for volumes
with recorded errors so they unmount with chkdsk scheduled. The
ntfs_clear_volume_flags() wrapper, whose last callers this patch
replaces, has no users left and is removed.
The guarantee this provides is eventual, not instantaneous: the error
paths record NVolErrors() with a lock-free set_bit(), so a persistence
point that evaluates the flag just before an error is recorded can
still leave the on-disk bit clean until the next one. This is sound
because NVolErrors() is sticky for the lifetime of the mount and every
persistence point re-derives the on-disk bit from it; the last one,
ntfs_put_super(), runs after evict_inodes() on a quiesced filesystem,
so a volume that is read-write at unmount time cannot unmount clean.
A volume that is already read-only when the error is recorded
(errors=remount-ro flips the superblock on the first error, as does an
earlier remount-ro) has no persistence point left and keeps whatever
on-disk bit it had; that behaviour is unchanged. The residual window
is a crash between the error and the next persistence point.
The persistence paths never write a hibernated volume: resuming Windows
from a modified image corrupts it. Record the mount-time hibernation
verdict in the new NV_Hibernated volume flag and make
ntfs_sync_volume_dirty_state() a no-op while it is set, so the dirty
bit is left exactly as it is on disk and only the in-memory error
state is kept. Without this, an rw mount of a hibernated volume with
the default errors=continue would gain a filesystem-internal write on
the first sync, remount or unmount. Other writes to such a mount,
like the mount-time logfile emptying, are pre-existing and unchanged.
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/ntfs.h | 1 -
fs/ntfs/super.c | 129 ++++++++++++++++++++++++++++++++---------------
fs/ntfs/volume.h | 4 ++
3 files changed, 93 insertions(+), 41 deletions(-)
diff --git a/fs/ntfs/ntfs.h b/fs/ntfs/ntfs.h
index 45f77848a9cf3..a5cd5493c5011 100644
--- a/fs/ntfs/ntfs.h
+++ b/fs/ntfs/ntfs.h
@@ -219,7 +219,6 @@ struct option_t {
};
extern const struct option_t on_errors_arr[];
int ntfs_set_volume_flags(struct ntfs_volume *vol, __le16 flags);
-int ntfs_clear_volume_flags(struct ntfs_volume *vol, __le16 flags);
int ntfs_write_volume_label(struct ntfs_volume *vol, char *label);
/* From fs/ntfs/mst.c */
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 57584f157f154..afde27d74ff59 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -263,6 +263,8 @@ static int ntfs_parse_param(struct fs_context *fc, struct fs_parameter *param)
return 0;
}
+static int ntfs_sync_volume_dirty_state(struct ntfs_volume *vol);
+
static int ntfs_reconfigure(struct fs_context *fc)
{
struct super_block *sb = fc->root->d_sb;
@@ -319,10 +321,24 @@ static int ntfs_reconfigure(struct fs_context *fc)
}
} else if (!sb_rdonly(sb) && (fc->sb_flags & SB_RDONLY)) {
/* Remounting read-only. */
- if (!NVolErrors(vol)) {
- if (ntfs_clear_volume_flags(vol, VOLUME_IS_DIRTY))
- ntfs_warning(sb,
- "Failed to clear dirty bit in volume information flags. Run chkdsk.");
+ /*
+ * With errors recorded the dirty bit is set rather than
+ * cleared, and it is committed right away: the VFS does
+ * not sync the filesystem during a remount, and once the
+ * remount succeeds no further persistence point exists -
+ * ntfs_sync_fs() is only ever invoked for read-write
+ * superblocks (all its VFS callers skip read-only ones)
+ * and ntfs_put_super() skips them, so the only remaining
+ * write would be the evict-time commit at unmount, which
+ * a crash never reaches. An error recorded only after
+ * the remount is still never persisted.
+ */
+ if (ntfs_sync_volume_dirty_state(vol)) {
+ ntfs_warning(sb,
+ "Failed to update dirty bit in volume information flags. Run chkdsk.");
+ } else if (NInoDirty(NTFS_I(vol->vol_ino))) {
+ ntfs_commit_inode(vol->vol_ino);
+ blkdev_issue_flush(sb->s_bdev);
}
}
@@ -364,9 +380,10 @@ void ntfs_handle_error(struct super_block *sb)
* @vol: ntfs volume on which to modify the flags
* @set_bits: bits to set in the volume information flags
* @clear_bits: bits to clear in the volume information flags
+ * @dirty_if_errors: force VOLUME_IS_DIRTY on when NVolErrors() is set
*
* Internal function. You probably want to use ntfs_{set,clear}_volume_flags()
- * instead (see below).
+ * or ntfs_sync_volume_dirty_state() instead (see below).
*
* Combine @set_bits and @clear_bits with the current in-memory flag state and
* write the result back. The set/clear helpers pass only the bits to modify,
@@ -375,11 +392,18 @@ void ntfs_handle_error(struct super_block *sb)
* All bit manipulation is done on CPU-endian values, and the result is
* converted back to little-endian before storing it.
*
+ * When @dirty_if_errors is true and errors have been recorded on @vol,
+ * VOLUME_IS_DIRTY is forced on after the requested changes. NVolErrors() is
+ * evaluated under the same mrec_lock, which orders this against other
+ * locked flag updates; the runtime error paths themselves record the flag
+ * lock-free, so see ntfs_sync_volume_dirty_state() for the guarantee this
+ * provides against them.
+ *
* Return 0 on success and -errno on error.
*/
static int ntfs_write_volume_flags(struct ntfs_volume *vol,
const __le16 set_bits, const __le16 clear_bits,
- const bool skip_if_errors)
+ const bool dirty_if_errors)
{
struct ntfs_inode *ni = NTFS_I(vol->vol_ino);
struct volume_information *vi;
@@ -389,12 +413,11 @@ static int ntfs_write_volume_flags(struct ntfs_volume *vol,
mutex_lock(&ni->mrec_lock);
- if (skip_if_errors && NVolErrors(vol))
- goto done;
-
flags = le16_to_cpu(vol->vol_flags);
flags |= le16_to_cpu(set_bits) & le16_to_cpu(VOLUME_FLAGS_MASK);
flags &= ~(le16_to_cpu(clear_bits) & le16_to_cpu(VOLUME_FLAGS_MASK));
+ if (dirty_if_errors && NVolErrors(vol))
+ flags |= le16_to_cpu(VOLUME_IS_DIRTY);
ntfs_debug("Entering, old flags = 0x%x, new flags = 0x%x.",
le16_to_cpu(vol->vol_flags), flags);
@@ -446,31 +469,43 @@ int ntfs_set_volume_flags(struct ntfs_volume *vol, __le16 flags)
}
/*
- * ntfs_clear_volume_flags - clear bits in the volume information flags
- * @vol: ntfs volume on which to modify the flags
- * @flags: flags to clear on the volume
+ * ntfs_sync_volume_dirty_state - persist the dirty bit per the error state
+ * @vol: ntfs volume whose dirty bit to persist
*
- * Clear the bits in @flags in the volume information flags on the volume @vol.
- * The bits are combined with the current flag state under the lock in
- * ntfs_write_volume_flags(), so concurrent updates are not lost.
+ * Set VOLUME_IS_DIRTY if errors have been recorded on @vol and clear it
+ * otherwise, under the $Volume mrec_lock.
*
- * Return 0 on success and -errno on error.
- */
-int ntfs_clear_volume_flags(struct ntfs_volume *vol, __le16 flags)
-{
- return ntfs_write_volume_flags(vol, 0, flags, false);
-}
-
-/*
- * ntfs_clear_volume_dirty_if_no_errors - clear dirty bit if no errors exist
- * @vol: ntfs volume whose dirty bit should be cleared
+ * The guarantee this provides is eventual, not instantaneous: the runtime
+ * error paths record NVolErrors() with a lock-free set_bit(), so a
+ * persistence point that evaluates the flag just before an error is
+ * recorded can still leave the on-disk bit clean. This is sound because
+ * NVolErrors() is sticky (nothing clears it for the lifetime of the mount)
+ * and every persistence point re-derives the on-disk bit from it; the
+ * last one, ntfs_put_super(), runs after evict_inodes() on a quiesced
+ * filesystem, so a volume that is read-write at unmount time cannot
+ * unmount clean. A volume that is already read-only when the error is
+ * recorded (errors=remount-ro flips the superblock on the first error,
+ * as does an earlier remount-ro) has no persistence point left and
+ * keeps whatever on-disk bit it had; that behaviour is unchanged. The
+ * residual window is a crash between the error and the next
+ * persistence point.
+ *
+ * This is the single point that persists the in-memory error state to disk.
+ * The runtime error paths only record NVolErrors() because they run under a
+ * variety of ntfs locks the dirty-bit write cannot be taken under (runlist
+ * locks, vol->lcnbmp_lock, vol->mftbmp_lock, mrec_locks); the first
+ * ntfs_sync_fs(), a remount, or the unmount then persists the flag here.
+ *
+ * A hibernated volume is not written from these persistence paths:
+ * resuming Windows from a modified image corrupts it, so the dirty bit
+ * is left as it is on disk and only the in-memory error state is kept.
*
- * Check NVolErrors() and clear VOLUME_IS_DIRTY under the same mrec_lock so
- * ntfs_sync_fs() cannot clear the dirty bit after a concurrent error has been
- * recorded.
+ * Return 0 on success and -errno on error.
*/
-static int ntfs_clear_volume_dirty_if_no_errors(struct ntfs_volume *vol)
+static int ntfs_sync_volume_dirty_state(struct ntfs_volume *vol)
{
+ if (NVolHibernated(vol))
+ return 0;
return ntfs_write_volume_flags(vol, 0, VOLUME_IS_DIRTY, true);
}
@@ -1689,6 +1724,11 @@ static bool load_system_files(struct ntfs_volume *vol)
ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
}
NVolSetErrors(vol);
+ /*
+ * Remember it for the lifetime of the mount: see
+ * ntfs_sync_volume_dirty_state().
+ */
+ NVolSetHibernated(vol);
}
/* If (still) a read-write mount, empty the logfile. */
@@ -1846,22 +1886,31 @@ static void ntfs_put_super(struct super_block *sb)
ntfs_commit_inode(vol->mft_ino);
/*
- * If a read-write mount and no volume errors have occurred, mark the
- * volume clean. Also, re-commit all affected inodes.
+ * If a read-write mount, persist the error state in the volume flags:
+ * mark the volume clean if no volume errors have occurred, and make
+ * sure VOLUME_IS_DIRTY is on disk if any have, so chkdsk runs on the
+ * next mount. Also, re-commit all affected inodes.
*/
if (!sb_rdonly(sb)) {
+ if (ntfs_sync_volume_dirty_state(vol)) {
+ ntfs_warning(sb,
+ "Failed to sync dirty bit in volume information flags. Run chkdsk.");
+ } else if (NVolErrors(vol)) {
+ /*
+ * The dirty bit is on disk now; only warn when the
+ * sync actually succeeded, or this message would
+ * contradict the one above.
+ */
+ ntfs_warning(sb,
+ "Volume has errors. Leaving volume marked dirty. Run chkdsk.");
+ }
+ /* Commits the updated volume flags if they were written. */
+ ntfs_commit_inode(vol->vol_ino);
if (!NVolErrors(vol)) {
- if (ntfs_clear_volume_flags(vol, VOLUME_IS_DIRTY))
- ntfs_warning(sb,
- "Failed to clear dirty bit in volume information flags. Run chkdsk.");
- ntfs_commit_inode(vol->vol_ino);
ntfs_commit_inode(vol->root_ino);
if (vol->mftmirr_ino)
ntfs_commit_inode(vol->mftmirr_ino);
ntfs_commit_inode(vol->mft_ino);
- } else {
- ntfs_warning(sb,
- "Volume has errors. Leaving volume marked dirty. Run chkdsk.");
}
}
@@ -1960,8 +2009,8 @@ static int ntfs_sync_fs(struct super_block *sb, int wait)
return 0;
/* If there are some dirty buffers in the bdev inode */
- if (ntfs_clear_volume_dirty_if_no_errors(vol)) {
- ntfs_warning(sb, "Failed to clear dirty bit in volume information flags. Run chkdsk.");
+ if (ntfs_sync_volume_dirty_state(vol)) {
+ ntfs_warning(sb, "Failed to sync dirty bit in volume information flags. Run chkdsk.");
err = -EIO;
}
sync_inodes_sb(sb);
diff --git a/fs/ntfs/volume.h b/fs/ntfs/volume.h
index 8c17a66b4f22c..fdb57279de84c 100644
--- a/fs/ntfs/volume.h
+++ b/fs/ntfs/volume.h
@@ -189,6 +189,8 @@ struct ntfs_volume {
* Windows-reserved names (CON, AUX, NUL, COM1,
* LPT1, etc.) or invalid characters.
*
+ * NV_Hibernated Windows is hibernated on the volume; the sync
+ * paths must not write the volume flags.
* NV_Discard Issue discard/TRIM commands for freed clusters.
* NV_DisableSparse Disable creation of sparse regions.
* NV_NativeSymlinkRel Translate absolute Windows reparse targets (native_symlink=rel).
@@ -207,6 +209,7 @@ enum {
NV_ShowHiddenFiles,
NV_HideDotFiles,
NV_CheckWindowsNames,
+ NV_Hibernated,
NV_Discard,
NV_DisableSparse,
NV_NativeSymlinkRel,
@@ -245,6 +248,7 @@ DEFINE_NVOL_BIT_OPS(SysImmutable)
DEFINE_NVOL_BIT_OPS(ShowHiddenFiles)
DEFINE_NVOL_BIT_OPS(HideDotFiles)
DEFINE_NVOL_BIT_OPS(CheckWindowsNames)
+DEFINE_NVOL_BIT_OPS(Hibernated)
DEFINE_NVOL_BIT_OPS(Discard)
DEFINE_NVOL_BIT_OPS(DisableSparse)
DEFINE_NVOL_BIT_OPS(NativeSymlinkRel)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0921/1257] ntfs: persist the dirty state after the final put_super() commits
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (919 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0920/1257] ntfs: sync the volume dirty bit with the recorded error state Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0922/1257] ntfs: do not clear the volume dirty bit during sync Greg Kroah-Hartman
` (77 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baolin Liu, Hongling Zeng,
Hyunchul Lee, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit 5d0e57ea8e37db3e32d1b1b7fa4f3c7a94ff8e56 ]
The just-in-case mftmirr/mft commits and the final write_inode_now()
in ntfs_put_super() can record NVolErrors() after the dirty state has
been persisted, so errors from those points would leave the volume
unmounted with a clean on-disk dirty bit - contradicting the "cannot
unmount clean" guarantee ntfs_sync_volume_dirty_state() is meant to
provide.
Move the persistence to the end of ntfs_put_super(): keep the gated
re-commits and the tail commits where they are, run
ntfs_sync_volume_dirty_state() and the $Volume commit after the last
write_inode_now(), and release vol->vol_ino only after the sync.
The release order of the special inodes matters for the $Volume
commit: writing the $Volume record mirrors it through
ntfs_sync_mft_mirror() (record number 3 is below vol->mftmirr_size),
which fails with -EIO and leaves the mirror stale once
vol->mftmirr_ino is gone, so the mirror inode is released only after
that commit. vol->vol_ino is then put before vol->mft_ino is dropped:
if the commit failed before it could clear the dirty flag,
ntfs_evict_big_inode() commits the inode again on its way out, and
__ntfs_write_inode() resolves the runlist through vol->mft_ino.
Reported-by: Baolin Liu <liubaolin@kylinos.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/super.c | 75 ++++++++++++++++++++++++++++++++++---------------
1 file changed, 52 insertions(+), 23 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index afde27d74ff59..e13ede3cd836f 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -1886,26 +1886,13 @@ static void ntfs_put_super(struct super_block *sb)
ntfs_commit_inode(vol->mft_ino);
/*
- * If a read-write mount, persist the error state in the volume flags:
- * mark the volume clean if no volume errors have occurred, and make
- * sure VOLUME_IS_DIRTY is on disk if any have, so chkdsk runs on the
- * next mount. Also, re-commit all affected inodes.
+ * If a read-write mount, re-commit all affected inodes once more.
+ * The dirty state itself is persisted at the end of ntfs_put_super(),
+ * after the last commits and the final write_inode_now(): those can
+ * still record errors via __ntfs_write_inode(), and the sync must
+ * evaluate NVolErrors() with the last setter already run.
*/
if (!sb_rdonly(sb)) {
- if (ntfs_sync_volume_dirty_state(vol)) {
- ntfs_warning(sb,
- "Failed to sync dirty bit in volume information flags. Run chkdsk.");
- } else if (NVolErrors(vol)) {
- /*
- * The dirty bit is on disk now; only warn when the
- * sync actually succeeded, or this message would
- * contradict the one above.
- */
- ntfs_warning(sb,
- "Volume has errors. Leaving volume marked dirty. Run chkdsk.");
- }
- /* Commits the updated volume flags if they were written. */
- ntfs_commit_inode(vol->vol_ino);
if (!NVolErrors(vol)) {
ntfs_commit_inode(vol->root_ino);
if (vol->mftmirr_ino)
@@ -1914,9 +1901,6 @@ static void ntfs_put_super(struct super_block *sb)
}
}
- iput(vol->vol_ino);
- vol->vol_ino = NULL;
-
/* NTFS 3.0+ specific clean up. */
if (vol->major_ver >= 3) {
if (vol->extend_ino) {
@@ -1946,8 +1930,6 @@ static void ntfs_put_super(struct super_block *sb)
/* Re-commit the mft mirror and mft just in case. */
ntfs_commit_inode(vol->mftmirr_ino);
ntfs_commit_inode(vol->mft_ino);
- iput(vol->mftmirr_ino);
- vol->mftmirr_ino = NULL;
}
/*
* We should have no dirty inodes left, due to
@@ -1957,6 +1939,53 @@ static void ntfs_put_super(struct super_block *sb)
ntfs_commit_inode(vol->mft_ino);
write_inode_now(vol->mft_ino, 1);
+ /*
+ * If a read-write mount, persist the error state in the volume flags:
+ * mark the volume clean if no volume errors have occurred, and make
+ * sure VOLUME_IS_DIRTY is on disk if any have, so chkdsk runs on the
+ * next mount.
+ */
+ if (!sb_rdonly(sb)) {
+ if (ntfs_sync_volume_dirty_state(vol)) {
+ ntfs_warning(sb,
+ "Failed to sync dirty bit in volume information flags. Run chkdsk.");
+ } else if (NVolErrors(vol)) {
+ /*
+ * The dirty bit is on disk now; only warn when the
+ * sync actually succeeded, or this message would
+ * contradict the one above.
+ */
+ ntfs_warning(sb,
+ "Volume has errors. Leaving volume marked dirty. Run chkdsk.");
+ }
+ /*
+ * Commits the updated volume flags if they were written.
+ * The mft mirror must still be around for this: the
+ * $Volume record (mft record number 3, below
+ * vol->mftmirr_size) is mirrored by write_mft_record()
+ * through ntfs_sync_mft_mirror(), which fails with -EIO
+ * and leaves the mirror stale once vol->mftmirr_ino is
+ * gone, so the mirror inode is only released after this
+ * commit.
+ */
+ ntfs_commit_inode(vol->vol_ino);
+ }
+
+ /*
+ * Release $Volume while the mft inode is still available: if the
+ * commit above failed before it could clear the dirty flag,
+ * ntfs_evict_big_inode() commits the inode again on its way out,
+ * and __ntfs_write_inode() needs vol->mft_ino to look up the
+ * runlist of the record to write.
+ */
+ iput(vol->vol_ino);
+ vol->vol_ino = NULL;
+
+ if (vol->mftmirr_ino) {
+ iput(vol->mftmirr_ino);
+ vol->mftmirr_ino = NULL;
+ }
+
iput(vol->mft_ino);
vol->mft_ino = NULL;
blkdev_issue_flush(sb->s_bdev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0922/1257] ntfs: do not clear the volume dirty bit during sync
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (920 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0921/1257] ntfs: persist the dirty state after the final put_super() commits Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0923/1257] ntfs: check the dirty-state commit on remount and unmount Greg Kroah-Hartman
` (76 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baolin Liu, Hongling Zeng,
Hyunchul Lee, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit 4a1bb54f571cbef67a7c470a3139ffec1a15a8e4 ]
ntfs_sync_fs() clears VOLUME_IS_DIRTY while the volume is still mounted
read-write, so a sync running concurrently with an in-flight metadata
modification can clear and persist a bit that was just set: the
modification then lands on a volume that is clean on disk, and a crash
does not run chkdsk.
Stop clearing the bit in ntfs_sync_fs() and leave the clearing to the
remount-to-read-only path, which the VFS reaches only after
sb_prepare_remount_readonly() has drained in-flight writers, and to
ntfs_put_super(), which runs after evict_inodes() on a quiesced
filesystem. A mounted read-write volume now keeps the dirty bit until
it is dismounted cleanly, which matches the NTFS semantics; the cost is
a needless chkdsk if the machine crashes between a sync and the unmount.
A recorded error state is still persisted right away when the
filesystem is synced: with NVolErrors() set,
ntfs_sync_volume_dirty_state() can only set the bit, never clear it,
so it cannot lose a modification the way the old unconditional call
did. This keeps the error report from being lost to a crash on a
volume that has seen no modification; an error recorded after the
last sync is still only persisted at the next quiescent transition.
sync_blockdev() and blkdev_issue_flush() are both called and the first
error is returned, so a writeback failure neither hides a flush failure
nor skips it.
A RWF_NOWAIT write still blocks in the marking when the volume looks
clean, as it already did on the base; a non-blocking marking is
follow-up work.
Reported-by: Baolin Liu <liubaolin@kylinos.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/file.c | 7 ++++---
fs/ntfs/super.c | 31 ++++++++++++++++++++++++-------
2 files changed, 28 insertions(+), 10 deletions(-)
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index e3020a4bf805a..e290616be07d0 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -637,9 +637,10 @@ static ssize_t ntfs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
/*
* The volume must be marked dirty before the modification is made,
- * without an unlocked check of the in-memory flag: ntfs_sync_fs()
- * can clear the bit concurrently and the modification would then
- * land on a volume that is clean on disk.
+ * without an unlocked check of the in-memory flag: the dirty bit
+ * is only cleared at the quiescent transitions, under the same
+ * $Volume mrec_lock this call takes, so an unlocked skip could
+ * lose the set to one of them.
*/
ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY);
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index e13ede3cd836f..c3d73cd6909eb 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -493,8 +493,9 @@ int ntfs_set_volume_flags(struct ntfs_volume *vol, __le16 flags)
* This is the single point that persists the in-memory error state to disk.
* The runtime error paths only record NVolErrors() because they run under a
* variety of ntfs locks the dirty-bit write cannot be taken under (runlist
- * locks, vol->lcnbmp_lock, vol->mftbmp_lock, mrec_locks); the first
- * ntfs_sync_fs(), a remount, or the unmount then persists the flag here.
+ * locks, vol->lcnbmp_lock, vol->mftbmp_lock, mrec_locks); a sync of a
+ * volume with recorded errors, a remount to read-only, or the unmount,
+ * then persists the flag here.
*
* A hibernated volume is not written from these persistence paths:
* resuming Windows from a modified image corrupts it, so the dirty bit
@@ -2029,7 +2030,7 @@ static void ntfs_shutdown(struct super_block *sb)
static int ntfs_sync_fs(struct super_block *sb, int wait)
{
struct ntfs_volume *vol = NTFS_SB(sb);
- int err = 0;
+ int ret, err = 0;
if (NVolShutdown(vol))
return -EIO;
@@ -2037,14 +2038,30 @@ static int ntfs_sync_fs(struct super_block *sb, int wait)
if (!wait)
return 0;
- /* If there are some dirty buffers in the bdev inode */
- if (ntfs_sync_volume_dirty_state(vol)) {
+ /*
+ * The volume dirty bit is deliberately not cleared here: a sync
+ * running concurrently with an in-flight modification could clear
+ * and persist a bit that was just set, leaving the modification
+ * on a volume that is clean on disk. The bit is only cleared at
+ * the quiescent state transitions, remounting read-only and clean
+ * unmount. A recorded error state, however, is persisted right
+ * away so that it is not lost to a crash on a volume that has
+ * seen no modification; with NVolErrors() set this can only set
+ * the bit, never clear it.
+ */
+ if (NVolErrors(vol) &&
+ ntfs_sync_volume_dirty_state(vol)) {
ntfs_warning(sb, "Failed to sync dirty bit in volume information flags. Run chkdsk.");
err = -EIO;
}
sync_inodes_sb(sb);
- sync_blockdev(sb->s_bdev);
- blkdev_issue_flush(sb->s_bdev);
+ ret = sync_blockdev(sb->s_bdev);
+ if (ret && !err)
+ err = ret;
+
+ ret = blkdev_issue_flush(sb->s_bdev);
+ if (ret && !err)
+ err = ret;
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0923/1257] ntfs: check the dirty-state commit on remount and unmount
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (921 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0922/1257] ntfs: do not clear the volume dirty bit during sync Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0924/1257] ntfs: fail remount on sync errors and keep the dirty bit on SB_FORCE Greg Kroah-Hartman
` (75 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baolin Liu, Hongling Zeng,
Hyunchul Lee, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit 1a3883b3685cc4c8bc41927cc9df539239d7c961 ]
The remount-to-read-only path commits the updated volume flags with
ntfs_commit_inode(), a void wrapper around __ntfs_write_inode(), and
ignores the blkdev_issue_flush() return value, so a failed commit or
flush is reported as success. Once the remount has succeeded no
persistence point is ever reached again: ntfs_put_super() skips
read-only superblocks and the VFS never syncs one, so fail the
remount unless the commit and the flush succeed. The superblock
then stays read-write and ntfs_put_super() retries the persistence
at unmount. The errors=remount-ro downgrade does not go through
ntfs_reconfigure() and is unchanged.
A zero-return commit is not trusted blindly: write_mft_record()
redirties the record on allocation failure and reports success, so
the $Volume inode is required to be clean afterwards.
ntfs_put_super() discards the same commit error. Call
__ntfs_write_inode() there with the same dirty re-check and warn on
failure, as put_super() cannot return an error. The commit is
skipped when the dirty-state sync itself failed, as that could write
back an inconsistent flag state; a record left dirty by an earlier
update is still committed at evict time.
NVolErrors() is deliberately not used to detect the failure: it is
sticky for the lifetime of the mount, so it cannot distinguish a
fresh commit failure from errors recorded before the remount.
Hibernated volumes: ntfs_sync_volume_dirty_state() is a no-op for
them and never dirties the $Volume inode on such a mount, since the
on-disk flags are already dirty and ntfs_set_volume_flags() has
nothing to change. The commit only runs if something dirtied the
inode independently, as before this patch; mounting hibernated
volumes read-only removes even that.
Reported-by: Baolin Liu <liubaolin@kylinos.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/super.c | 76 +++++++++++++++++++++++++++++++++++--------------
1 file changed, 54 insertions(+), 22 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index c3d73cd6909eb..486336508b8c7 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -269,6 +269,7 @@ static int ntfs_reconfigure(struct fs_context *fc)
{
struct super_block *sb = fc->root->d_sb;
struct ntfs_volume *vol = NTFS_SB(sb);
+ int err;
ntfs_debug("Entering with remount");
@@ -331,14 +332,39 @@ static int ntfs_reconfigure(struct fs_context *fc)
* and ntfs_put_super() skips them, so the only remaining
* write would be the evict-time commit at unmount, which
* a crash never reaches. An error recorded only after
- * the remount is still never persisted.
+ * the remount is still never persisted; a failed commit
+ * or flush fails the remount, leaving the superblock
+ * read-write so ntfs_put_super() retries at unmount.
*/
- if (ntfs_sync_volume_dirty_state(vol)) {
+ err = ntfs_sync_volume_dirty_state(vol);
+ if (err) {
ntfs_warning(sb,
"Failed to update dirty bit in volume information flags. Run chkdsk.");
- } else if (NInoDirty(NTFS_I(vol->vol_ino))) {
- ntfs_commit_inode(vol->vol_ino);
- blkdev_issue_flush(sb->s_bdev);
+ return err;
+ }
+ if (NInoDirty(NTFS_I(vol->vol_ino))) {
+ /* ntfs_commit_inode() would discard the error. */
+ err = __ntfs_write_inode(vol->vol_ino, 1);
+ if (err) {
+ ntfs_warning(sb,
+ "Failed to commit volume information flags. Run chkdsk.");
+ return err;
+ }
+ /*
+ * write_mft_record() redirties the record on
+ * -ENOMEM and still reports success.
+ */
+ if (NInoDirty(NTFS_I(vol->vol_ino))) {
+ ntfs_warning(sb,
+ "Volume information flags remain dirty after commit. Run chkdsk.");
+ return -EIO;
+ }
+ err = blkdev_issue_flush(sb->s_bdev);
+ if (err) {
+ ntfs_warning(sb,
+ "Failed to flush volume information flags. Run chkdsk.");
+ return err;
+ }
}
}
@@ -1950,26 +1976,32 @@ static void ntfs_put_super(struct super_block *sb)
if (ntfs_sync_volume_dirty_state(vol)) {
ntfs_warning(sb,
"Failed to sync dirty bit in volume information flags. Run chkdsk.");
- } else if (NVolErrors(vol)) {
+ } else {
/*
- * The dirty bit is on disk now; only warn when the
- * sync actually succeeded, or this message would
- * contradict the one above.
+ * __ntfs_write_inode(), not the void
+ * ntfs_commit_inode() wrapper: the error can only
+ * be warned about here. The mirror inode is only
+ * released below: writing the $Volume record (mft
+ * record number 3, below vol->mftmirr_size) mirrors
+ * it through ntfs_sync_mft_mirror(), which fails
+ * with -EIO once vol->mftmirr_ino is gone.
*/
- ntfs_warning(sb,
- "Volume has errors. Leaving volume marked dirty. Run chkdsk.");
+ if (__ntfs_write_inode(vol->vol_ino, 1)) {
+ ntfs_warning(sb,
+ "Failed to commit volume information flags. Run chkdsk.");
+ } else if (NInoDirty(NTFS_I(vol->vol_ino))) {
+ ntfs_warning(sb,
+ "Volume information flags remain dirty after commit. Run chkdsk.");
+ } else if (NVolErrors(vol)) {
+ /*
+ * Only warn once the commit has succeeded,
+ * or this could contradict a failure
+ * reported above.
+ */
+ ntfs_warning(sb,
+ "Volume has errors. Leaving volume marked dirty. Run chkdsk.");
+ }
}
- /*
- * Commits the updated volume flags if they were written.
- * The mft mirror must still be around for this: the
- * $Volume record (mft record number 3, below
- * vol->mftmirr_size) is mirrored by write_mft_record()
- * through ntfs_sync_mft_mirror(), which fails with -EIO
- * and leaves the mirror stale once vol->mftmirr_ino is
- * gone, so the mirror inode is only released after this
- * commit.
- */
- ntfs_commit_inode(vol->vol_ino);
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0924/1257] ntfs: fail remount on sync errors and keep the dirty bit on SB_FORCE
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (922 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0923/1257] ntfs: check the dirty-state commit on remount and unmount Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0925/1257] ntfs: include the final partial cluster in sync writes Greg Kroah-Hartman
` (74 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Hongling Zeng,
Baolin Liu, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit 17a1edda75fd371f36085b1568e0b70baff99969 ]
ntfs_reconfigure() currently ignores sync_filesystem() errors, allowing
a regular read-only remount to succeed even when dirty data was not
synced. Check the error and fail regular remounts, leaving the
superblock read-write so ntfs_put_super() can retry at unmount.
SB_FORCE does not wait for writers already in progress, so it must not
clear the on-disk dirty bit. Warn and continue on sync errors for
SB_FORCE. A forced remount updates the dirty state only when errors
have been recorded, and never clears the dirty bit. Skip the commit if
that state update fails, since the in-memory flags may be inconsistent.
Reported-by: Hyunchul Lee <hyc.lee@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/super.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 486336508b8c7..c6f820707ef21 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -273,7 +273,13 @@ static int ntfs_reconfigure(struct fs_context *fc)
ntfs_debug("Entering with remount");
- sync_filesystem(sb);
+ err = sync_filesystem(sb);
+ if (err) {
+ ntfs_warning(sb, "Failed to sync the filesystem.");
+ /* A forced remount must still turn the superblock read-only. */
+ if (!(fc->sb_flags & SB_FORCE))
+ return err;
+ }
/*
* For the read-write compiled driver, if we are remounting read-write,
@@ -336,11 +342,20 @@ static int ntfs_reconfigure(struct fs_context *fc)
* or flush fails the remount, leaving the superblock
* read-write so ntfs_put_super() retries at unmount.
*/
- err = ntfs_sync_volume_dirty_state(vol);
- if (err) {
- ntfs_warning(sb,
- "Failed to update dirty bit in volume information flags. Run chkdsk.");
- return err;
+ /*
+ * A forced remount does not drain writers in progress,
+ * so one may still be modifying metadata when the flags
+ * are committed: never clear the dirty bit then; if
+ * errors have been recorded, the update preserves or
+ * sets it; otherwise, skip the update entirely.
+ */
+ if (!(fc->sb_flags & SB_FORCE) || NVolErrors(vol)) {
+ err = ntfs_sync_volume_dirty_state(vol);
+ if (err) {
+ ntfs_warning(sb,
+ "Failed to update dirty bit in volume information flags. Run chkdsk.");
+ return err;
+ }
}
if (NInoDirty(NTFS_I(vol->vol_ino))) {
/* ntfs_commit_inode() would discard the error. */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0925/1257] ntfs: include the final partial cluster in sync writes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (923 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0924/1257] ntfs: fail remount on sync errors and keep the dirty bit on SB_FORCE Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0926/1257] ntfs: mount hibernated volumes read-only regardless of errors= Greg Kroah-Hartman
` (73 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit fa5489ebc8bc7c663311b0f35943fe7edd0dfe56 ]
ntfs_attrlist_repack() synchronously writes the replacement attribute
list before updating its mapping pairs and freeing the old run. With
512-byte clusters, a 544-byte list submits a 512-byte bio, but the
write returns 544 and repack accepts it as complete. If the later
buffered update does not reach disk, the replacement list lacks its
final 32 bytes.
__ntfs_inode_non_resident_attr_pwrite() converts attr_len to clusters
with ntfs_bytes_to_cluster(), which rounds down. Before repack, its
synchronous callers used either cluster-aligned lengths or lengths
smaller than one cluster, where max_t() selects one.
Round attr_len up so repack writes the final partial cluster before
publishing the new mapping pairs.
Fixes: b1d732e62a5b ("ntfs: repack $MFT/$ATTRIBUTE LIST")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/inode.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index b3c5219c7b770..86e359a7c53af 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -3760,7 +3760,9 @@ static s64 __ntfs_inode_non_resident_attr_pwrite(struct inode *vi,
struct runlist_element *rl;
int bio_err;
- lcn_count = max_t(s64, 1, ntfs_bytes_to_cluster(vol, attr_len));
+ lcn_count = max_t(s64, 1,
+ ntfs_bytes_to_cluster(vol, attr_len +
+ vol->cluster_size - 1));
vcn = ntfs_pidx_to_cluster(vol, folio->index);
do {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0926/1257] ntfs: mount hibernated volumes read-only regardless of errors=
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (924 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0925/1257] ntfs: include the final partial cluster in sync writes Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0927/1257] ntfs: validate attribute-list sizes before allocation Greg Kroah-Hartman
` (72 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baolin Liu, Hyunchul Lee,
Hongling Zeng, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit 749357bd48c16c4cdc09093450deca609492f012 ]
The hibernation check in load_system_files() only converts the
superblock to read-only under errors=remount-ro. With the default
errors=continue (and with errors=panic), a hibernated volume is
mounted read-write and the mount-time $LogFile emptying writes to it,
although a hibernated volume must not be written to at all.
Drop the on_errors term so that a hibernated volume, or a volume whose
hibernation state cannot be determined, always mounts read-only.
NVolErrors() is still recorded, so ntfs_reconfigure() keeps refusing
remounts to read-write, and the $LogFile emptying is skipped by its
!sb_rdonly() check.
The check itself must not apply the errors= policy either: it runs
before SB_RDONLY is set, and ntfs_lookup_inode_by_name() and ntfs_iget()
call ntfs_error() internally on corruption or I/O errors, which under
errors=panic would panic the machine before the read-only fallback has
made its decision. Temporarily substitute errors=remount-ro for
errors=panic around the check: nested ntfs_error() calls then fall
back to read-only, and any read-only transition they trigger is
preserved even when the error is not propagated to the check's return
value or recorded in NVolErrors(). This is safe during initial mount,
before the super block is published.
If the check reports hibernation or fails, set SB_RDONLY and record
NVolErrors() unconditionally: hibernation safety takes precedence over
the errors= policy. A volume with errors recorded during the check or
earlier in the mount, e.g. when loading the LogFile, also stays
read-only, matching what ntfs_reconfigure() enforces for remounts.
Fixes: 6251f0b0de7d ("ntfs: update super block operations")
Cc: stable@vger.kernel.org
Suggested-by: Baolin Liu <liubaolin@kylinos.cn>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/super.c | 26 +++++++++++++++++++++-----
1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index c6f820707ef21..6d70352136b0c 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -1577,6 +1577,7 @@ static bool load_system_files(struct ntfs_volume *vol)
struct ntfs_attr_search_ctx *ctx;
struct restart_page_header *rp;
int err;
+ u8 saved_on_errors;
ntfs_debug("Entering.");
/* Get mft mirror inode compare the contents of $MFT and $MFTMirr. */
@@ -1751,8 +1752,19 @@ static bool load_system_files(struct ntfs_volume *vol)
* NVolErrors() without setting the dirty volume flag and mount
* read-only. This will prevent read-write remounting and it will also
* prevent all writes.
+ *
+ * Nested lookup and inode-loading errors must not panic before the
+ * read-only fallback has run. Temporarily use errors=remount-ro
+ * instead of errors=panic, preserving any read-only transition even
+ * if an error is not propagated to the check's return value or
+ * recorded in NVolErrors(). This is safe during initial mount,
+ * before the super block is published.
*/
+ saved_on_errors = vol->on_errors;
+ if (saved_on_errors == ON_ERRORS_PANIC)
+ vol->on_errors = ON_ERRORS_REMOUNT_RO;
err = check_windows_hibernation_status(vol);
+ vol->on_errors = saved_on_errors;
if (unlikely(err)) {
static const char *es1a = "Failed to determine if Windows is hibernated";
static const char *es1b = "Windows is hibernated";
@@ -1760,17 +1772,21 @@ static bool load_system_files(struct ntfs_volume *vol)
const char *es1;
es1 = err < 0 ? es1a : es1b;
- /* If a read-write mount, convert it to a read-only mount. */
- if (!sb_rdonly(sb) && vol->on_errors == ON_ERRORS_REMOUNT_RO) {
- sb->s_flags |= SB_RDONLY;
- ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
- }
+ /* Hibernation safety takes precedence over the errors= policy. */
+ sb->s_flags |= SB_RDONLY;
NVolSetErrors(vol);
+ ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
+
/*
* Remember it for the lifetime of the mount: see
* ntfs_sync_volume_dirty_state().
*/
NVolSetHibernated(vol);
+ } else if (!sb_rdonly(sb) && NVolErrors(vol)) {
+ /* Match the read-write remount restriction for recorded errors. */
+ sb->s_flags |= SB_RDONLY;
+ ntfs_error(sb,
+ "Errors were recorded during mount. Mounting read-only. Run chkdsk.");
}
/* If (still) a read-write mount, empty the logfile. */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0927/1257] ntfs: validate attribute-list sizes before allocation
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (925 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0926/1257] ntfs: mount hibernated volumes read-only regardless of errors= Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0928/1257] ntfs: do not map an unmappable runlist fragment as a hole Greg Kroah-Hartman
` (71 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Morris, Hyunchul Lee,
Baolin Liu, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunchul Lee <hyc.lee@gmail.com>
[ Upstream commit ca43660672050337f4b845e36f732e3af1e308ca ]
The NULL point dereference could occur when an on-disk
$ATTRIBUTE_LIST size was truncated before it was validated and allocated.
To fix this issue and prevent excessive memory allocation, limit the
$ATTRIBUTE_LIST size to 256 KiB.
The following existing implementation and Windows test provide evidence
for this 256 KiB compatibility limit:
NTFS already treats 256 KiB as the $ATTRIBUTE_LIST limit in its
attribute-size checks and $MFT attribute list repack/expand paths.
For additional Windows testing, when $MFT's attribute-list data_size was
above 256 KiB, Windows attached the disk partition but did not mount a NTFS
volume and target access failed.
Fixes: af0db57d4293 ("ntfs: update inode operations")
Link: https://lore.kernel.org/ntfs/88468.1790006025@30-10-12.wireless.csail.mit.edu/T/#u
Cc: stable@vger.kernel.org
Cc: Robert Morris <rtm@mit.edu>
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/attrib.c | 2 +-
fs/ntfs/attrlist.c | 2 --
fs/ntfs/inode.c | 21 +++++++++++++++------
fs/ntfs/ntfs.h | 2 ++
4 files changed, 18 insertions(+), 9 deletions(-)
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index b01cbc9eea4ad..e8a672c84a02f 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -1775,7 +1775,7 @@ int ntfs_attr_size_bounds_check(const struct ntfs_volume *vol, const __le32 type
* $ATTRIBUTE_LIST has a maximum size of 256kiB, but this is not
* listed in $AttrDef.
*/
- if (unlikely(type == AT_ATTRIBUTE_LIST && size > 256 * 1024))
+ if (unlikely(type == AT_ATTRIBUTE_LIST && size > NTFS_MAX_ATTR_LIST_SIZE))
return -ERANGE;
/* Get the $AttrDef entry for the attribute @type. */
ad = ntfs_attr_find_in_attrdef(vol, type);
diff --git a/fs/ntfs/attrlist.c b/fs/ntfs/attrlist.c
index bb191953dcb1b..1abe0ec2a398a 100644
--- a/fs/ntfs/attrlist.c
+++ b/fs/ntfs/attrlist.c
@@ -14,8 +14,6 @@
#include "attrlist.h"
#include "lcnalloc.h"
-#define NTFS_MAX_ATTR_LIST_SIZE (256 * 1024)
-
/*
* ntfs_attrlist_need - check whether inode need attribute list
* @ni: opened ntfs inode for which perform check
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index 86e359a7c53af..a6700c5f93791 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -805,6 +805,8 @@ static int ntfs_read_locked_inode(struct inode *vi)
goto unm_err_out;
}
} else {
+ s64 attr_list_size;
+
if (vi->i_ino == FILE_MFT)
goto skip_attr_list_load;
ntfs_debug("Attribute list found in inode 0x%llx.", ni->mft_no);
@@ -827,11 +829,14 @@ static int ntfs_read_locked_inode(struct inode *vi)
ni->mft_no);
}
/* Now allocate memory for the attribute list. */
- ni->attr_list_size = (u32)ntfs_attr_size(a);
- if (!ni->attr_list_size) {
- ntfs_error(vi->i_sb, "Attr_list_size is zero");
+ attr_list_size = ntfs_attr_size(a);
+ if (attr_list_size <= 0 ||
+ attr_list_size > NTFS_MAX_ATTR_LIST_SIZE) {
+ ntfs_error(vi->i_sb, "Invalid attribute list size %lld (mft_no 0x%llx).",
+ (long long)attr_list_size, ni->mft_no);
goto unm_err_out;
}
+ ni->attr_list_size = (u32)attr_list_size;
ni->attr_list = kvzalloc(ni->attr_list_size, GFP_NOFS);
if (!ni->attr_list) {
ntfs_error(vi->i_sb,
@@ -1955,6 +1960,7 @@ int ntfs_read_inode_mount(struct inode *vi)
} else /* if (!err) */ {
struct attr_list_entry *al_entry, *next_al_entry;
u8 *al_end;
+ s64 attr_list_size;
static const char *es = " Not allowed. $MFT is corrupt. You should run chkdsk.";
ntfs_debug("Attribute list attribute found in $MFT.");
@@ -1978,11 +1984,14 @@ int ntfs_read_inode_mount(struct inode *vi)
"Resident attribute list attribute in $MFT system file is marked encrypted/sparse which is not true. However, Windows allows this and chkdsk does not detect or correct it so we will just ignore the invalid flags and pretend they are not set.");
}
/* Now allocate memory for the attribute list. */
- ni->attr_list_size = (u32)ntfs_attr_size(a);
- if (!ni->attr_list_size) {
- ntfs_error(sb, "Attr_list_size is zero");
+ attr_list_size = ntfs_attr_size(a);
+ if (attr_list_size <= 0 ||
+ attr_list_size > NTFS_MAX_ATTR_LIST_SIZE) {
+ ntfs_error(sb, "Invalid attribute list size %lld (mft_no 0x%llx).%s",
+ (long long)attr_list_size, ni->mft_no, es);
goto put_err_out;
}
+ ni->attr_list_size = (u32)attr_list_size;
ni->attr_list = kvzalloc(round_up(ni->attr_list_size, SECTOR_SIZE),
GFP_NOFS);
if (!ni->attr_list) {
diff --git a/fs/ntfs/ntfs.h b/fs/ntfs/ntfs.h
index a5cd5493c5011..cb69707c3f3d5 100644
--- a/fs/ntfs/ntfs.h
+++ b/fs/ntfs/ntfs.h
@@ -80,6 +80,8 @@ enum {
NTFS_MAX_LABEL_LEN = 128,
};
+#define NTFS_MAX_ATTR_LIST_SIZE (256 * 1024)
+
enum {
CASE_SENSITIVE = 0,
IGNORE_CASE = 1,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0928/1257] ntfs: do not map an unmappable runlist fragment as a hole
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (926 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0927/1257] ntfs: validate attribute-list sizes before allocation Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0929/1257] ntfs: do not turn an unmappable runlist fragment into delalloc on write Greg Kroah-Hartman
` (70 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Goergens, Hyunchul Lee,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
[ Upstream commit 2b451a65658fb44017480be8818ab93e9115b420 ]
When the extent mft record holding part of a file's runlist cannot be
read, ntfs_attr_vcn_to_rl() ignores the failed ntfs_map_runlist_nolock()
retry and returns with *lcn == LCN_RL_NOT_MAPPED. The iomap read path
only rejects lcn < LCN_ENOENT, so it maps the range as a hole and read()
returns zeros with no error. The first read already does this:
ntfs_attr_map_whole_runlist() keeps the fragments it could read,
readahead drops its error, and the next lookup finds the unmapped tail.
On a file whose runlist is split between its base record (vcn 0-214) and
one extent record (vcn 215-1499), breaking only the extent record's FILE
magic makes the kernel log "Failed to map extent mft record", yet read()
returns 1285 clusters of zeros for vcn 215-1499. A damaged attribute
list entry, which makes the retry fail with -ENOENT, gives the same
zeros.
Return -ENOMEM if the retry ran out of memory and -EIO otherwise. Both
callers already handle an ERR_PTR; other negative lcns, including
LCN_ENOENT, are returned as before, and so is LCN_RL_NOT_MAPPED at or
beyond allocated_size, where nothing is mapped: the runlist ends there
with LCN_RL_NOT_MAPPED when only the last extent is mapped, as after a
write into it, and with clusters smaller than a page every read of a
file's last folio looks up such vcns.
Reads of vcn 215-1499 now fail with -EIO. An intact volume exercised
with buffered, mmap and O_DIRECT I/O, fallocate, truncate, sparse and
compressed files behaves as before.
Fixes: 495e90fa3348 ("ntfs: update attrib operations")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/attrib.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index e8a672c84a02f..91726e4fd3934 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -317,7 +317,7 @@ int ntfs_map_runlist(struct ntfs_inode *ni, s64 vcn)
struct runlist_element *ntfs_attr_vcn_to_rl(struct ntfs_inode *ni, s64 vcn, s64 *lcn)
{
struct runlist_element *rl = ni->runlist.rl;
- int err;
+ int err = 0;
bool is_retry = false;
if (!rl) {
@@ -335,12 +335,32 @@ struct runlist_element *ntfs_attr_vcn_to_rl(struct ntfs_inode *ni, s64 vcn, s64
if (*lcn <= LCN_RL_NOT_MAPPED && is_retry == false) {
is_retry = true;
- if (!ntfs_map_runlist_nolock(ni, vcn, NULL)) {
+ err = ntfs_map_runlist_nolock(ni, vcn, NULL);
+ if (!err) {
rl = ni->runlist.rl;
goto remap_rl;
}
}
+ /*
+ * The runlist fragment containing @vcn could not be mapped, e.g.
+ * because the extent mft record holding it is corrupt. Do not hand
+ * LCN_RL_NOT_MAPPED back to callers, which would treat it as a hole.
+ * At or beyond the allocated size nothing is mapped, and the runlist
+ * ends there with LCN_RL_NOT_MAPPED if only a later extent has been
+ * mapped, so return that end as it is.
+ */
+ if (*lcn == LCN_RL_NOT_MAPPED) {
+ unsigned long flags;
+ s64 allocated_size;
+
+ read_lock_irqsave(&ni->size_lock, flags);
+ allocated_size = ni->allocated_size;
+ read_unlock_irqrestore(&ni->size_lock, flags);
+ if ((s64)ntfs_cluster_to_bytes(ni->vol, vcn) < allocated_size)
+ return ERR_PTR(err == -ENOMEM ? -ENOMEM : -EIO);
+ }
+
return rl;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0929/1257] ntfs: do not turn an unmappable runlist fragment into delalloc on write
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (927 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0928/1257] ntfs: do not map an unmappable runlist fragment as a hole Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0930/1257] ntfs: fail the mount when $MFT needs its own extent records Greg Kroah-Hartman
` (69 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Goergens, Hyunchul Lee,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
[ Upstream commit 26e51efbcb60b2eeddc3e7488fd214a02586851a ]
ntfs_write_simple_iomap_begin_non_resident() has the same unchecked
retry. LCN_RL_NOT_MAPPED passes its "lcn <= LCN_HOLE" test, so a
buffered write into a range whose extent record cannot be read is
merged into the runlist as LCN_DELALLOC over clusters that are already
allocated on disk, and write() succeeds. If the record stays
unreadable, writeback fails too and the data never reaches the disk;
the error only shows up at a later fsync() or a synchronous write.
On the volume from the previous patch, after a read of the file, an
8 KiB pwrite() at vcn 1000 returns 8192, fsync() returns -EIO, and
after remount the range is unchanged.
Fail the lookup here too, with -ENOMEM or -EIO. That pwrite() now
fails with -EIO. Writes whose range can be mapped are unaffected.
Fixes: b041ca562526 ("ntfs: update iomap and address space operations")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/iomap.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs/iomap.c b/fs/ntfs/iomap.c
index c812d7f19b360..b4475963e57a7 100644
--- a/fs/ntfs/iomap.c
+++ b/fs/ntfs/iomap.c
@@ -394,7 +394,7 @@ static int ntfs_write_simple_iomap_begin_non_resident(struct inode *inode, loff_
loff_t vcn_ofs, rl_length;
struct runlist_element *rl, *rlc;
bool is_retry = false;
- int err = 0;
+ int err = 0, map_err = 0;
s64 vcn, lcn;
s64 max_clu_count =
ntfs_bytes_to_cluster(vol, round_up(length, vol->cluster_size));
@@ -429,12 +429,24 @@ static int ntfs_write_simple_iomap_begin_non_resident(struct inode *inode, loff_
if (lcn <= LCN_RL_NOT_MAPPED && is_retry == false) {
is_retry = true;
- if (!ntfs_map_runlist_nolock(ni, vcn, NULL)) {
+ map_err = ntfs_map_runlist_nolock(ni, vcn, NULL);
+ if (!map_err) {
rl = ni->runlist.rl;
goto remap_rl;
}
}
+ /*
+ * As in ntfs_attr_vcn_to_rl(): a runlist fragment that could not be
+ * mapped is not a hole. Treating it as one would put a delalloc
+ * extent over clusters that are allocated on disk but unknown to us.
+ */
+ if (lcn == LCN_RL_NOT_MAPPED) {
+ up_write(&ni->runlist.lock);
+ mutex_unlock(&ni->mrec_lock);
+ return map_err == -ENOMEM ? -ENOMEM : -EIO;
+ }
+
max_clu_count = min(max_clu_count, rl->length - (vcn - rl->vcn));
if (max_clu_count == 0) {
ntfs_error(inode->i_sb,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0930/1257] ntfs: fail the mount when $MFT needs its own extent records
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (928 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0929/1257] ntfs: do not turn an unmappable runlist fragment into delalloc on write Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0931/1257] ntfs: do not map a vcn as a hole when its runlist lookup failed Greg Kroah-Hartman
` (68 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Matthias Goergens,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
[ Upstream commit 5562eaecdaf9deb3f750441c95a5f2c440b3293b ]
Mounting a crafted image hangs the mount process forever, unkillable at
0% CPU. Only the hung-task detector reports it:
INFO: task mount:74 blocked in I/O wait for more than 30 seconds.
folio_wait_bit_common <- waits forever
filemap_read_folio
map_mft_record_folio
map_mft_record
ntfs_map_runlist_nolock
ntfs_attr_vcn_to_rl
__ntfs_read_iomap_begin
iomap_read_folio
ntfs_read_folio <- already holds that folio's lock
ntfs_read_inode_mount
ntfs_fill_super
ntfs_read_inode_mount() assembles $MFT's runlist one $DATA extent at a
time, hoping, as its comment says, that it never needs a part of $MFT it
has not decoded yet. If $MFT's attribute list puts one of its
attributes or later $DATA extents in an extent record outside the
runlist decoded so far, reading that record re-enters
ntfs_map_runlist_nolock() for $MFT. Depending on the layout, that waits
on the folio lock it already holds, as above, blocks on $MFT's runlist
lock, or dereferences NULL in map_extent_mft_record().
Mark the volume for the whole $DATA enumeration and have
ntfs_map_runlist_nolock() refuse $MFT with -EIO while the mark is set.
The enumeration decodes each extent itself with
ntfs_mapping_pairs_decompress(), so it does not need that path.
A validly placed record can trip the check too. The driver puts an
extent record for $MFT's own mapping pairs before the first vcn it
describes, but with clusters smaller than a page, the folio holding it
can still run past the decoded runlist. An unpatched kernel hangs on
that layout as well; with the check the mount fails. The check then
refuses only the folio's tail, so this patch needs "ntfs: do not map an
unmappable runlist fragment as a hole": without it the tail is
zero-filled and the mount serves an all-zero mft record. The mount now
fails instead of hanging:
ntfs: (device vda): ntfs_map_runlist_nolock(): $MFT needs its own
extent records to describe itself; cannot mount.
Tested under qemu with KASAN, PROVE_LOCKING and the hung-task detector
on ntfs-next, with and without the whole series: six crafted images
that hang or crash an unpatched kernel fail to mount with the series,
and nine images that mount without it still mount, three of them with
the same file listing and contents, among them a volume written by
ntfs-3g whose $MFT has its $DATA in three extent records.
Fixes: b041ca562526 ("ntfs: update iomap and address space operations")
Suggested-by: Hyunchul Lee <hyc.lee@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/attrib.c | 11 +++++++++++
fs/ntfs/inode.c | 9 +++++++++
fs/ntfs/volume.h | 3 +++
3 files changed, 23 insertions(+)
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index 91726e4fd3934..f8eecdcf57858 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -103,6 +103,17 @@ int ntfs_map_runlist_nolock(struct ntfs_inode *ni, s64 vcn, struct ntfs_attr_sea
base_ni = ni;
else
base_ni = ni->ext.base_ntfs_ino;
+ /*
+ * ntfs_read_inode_mount() builds $MFT's runlist itself, so nothing
+ * should reach here for $MFT. A crafted image can: the read that
+ * gets here already holds the $MFT folio lock it would wait on.
+ */
+ if (unlikely(NVolMftBootstrap(ni->vol) &&
+ base_ni == NTFS_I(ni->vol->mft_ino))) {
+ ntfs_error(ni->vol->sb,
+ "$MFT needs its own extent records to describe itself; cannot mount.");
+ return -EIO;
+ }
if (!ctx) {
ctx_is_temporary = ctx_needs_reset = true;
m = map_mft_record(base_ni);
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index a6700c5f93791..ca7e2299a8a48 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -2080,6 +2080,11 @@ int ntfs_read_inode_mount(struct inode *vi)
/* Now load all attribute extents. */
a = NULL;
next_vcn = last_vcn = highest_vcn = 0;
+ /*
+ * Reading one of $MFT's own extent records in this loop can re-enter
+ * ntfs_map_runlist_nolock() for $MFT; see the check there.
+ */
+ NVolSetMftBootstrap(vol);
while (!(err = ntfs_attr_lookup(AT_DATA, NULL, 0, 0, next_vcn, NULL, 0,
ctx))) {
struct runlist_element *nrl;
@@ -2162,6 +2167,7 @@ int ntfs_read_inode_mount(struct inode *vi)
err = ntfs_read_locked_inode(vi);
if (err) {
ntfs_error(sb, "ntfs_read_inode() of $MFT failed.\n");
+ NVolClearMftBootstrap(vol);
ntfs_attr_put_search_ctx(ctx);
/* Revert to the safe super operations. */
kfree(m);
@@ -2195,6 +2201,7 @@ int ntfs_read_inode_mount(struct inode *vi)
goto put_err_out;
}
}
+ NVolClearMftBootstrap(vol);
if (err != -ENOENT) {
ntfs_error(sb, "Failed to lookup $MFT/$DATA attribute extent. Run chkdsk.\n");
goto put_err_out;
@@ -2229,6 +2236,8 @@ int ntfs_read_inode_mount(struct inode *vi)
put_err_out:
ntfs_attr_put_search_ctx(ctx);
err_out:
+ /* Also reached from inside the $DATA loop. */
+ NVolClearMftBootstrap(vol);
ntfs_error(sb, "Failed. Marking inode as bad.");
kfree(m);
return -1;
diff --git a/fs/ntfs/volume.h b/fs/ntfs/volume.h
index fdb57279de84c..0473b602084c5 100644
--- a/fs/ntfs/volume.h
+++ b/fs/ntfs/volume.h
@@ -194,6 +194,7 @@ struct ntfs_volume {
* NV_Discard Issue discard/TRIM commands for freed clusters.
* NV_DisableSparse Disable creation of sparse regions.
* NV_NativeSymlinkRel Translate absolute Windows reparse targets (native_symlink=rel).
+ * NV_MftBootstrap Mount is still assembling $MFT's own runlist.
*/
enum {
NV_Errors,
@@ -214,6 +215,7 @@ enum {
NV_DisableSparse,
NV_NativeSymlinkRel,
NV_SymlinkNative,
+ NV_MftBootstrap,
};
/*
@@ -253,6 +255,7 @@ DEFINE_NVOL_BIT_OPS(Discard)
DEFINE_NVOL_BIT_OPS(DisableSparse)
DEFINE_NVOL_BIT_OPS(NativeSymlinkRel)
DEFINE_NVOL_BIT_OPS(SymlinkNative)
+DEFINE_NVOL_BIT_OPS(MftBootstrap)
static inline void ntfs_inc_free_clusters(struct ntfs_volume *vol, s64 nr)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0931/1257] ntfs: do not map a vcn as a hole when its runlist lookup failed
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (929 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0930/1257] ntfs: fail the mount when $MFT needs its own extent records Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0932/1257] ntfs: fail the mount when $MFTs data size exceeds its allocation Greg Kroah-Hartman
` (67 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Goergens, Hyunchul Lee,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
[ Upstream commit e727ea7fc4e36b3d14b7bb304e82918aa6e2024a ]
ntfs_attr_vcn_to_rl() retries ntfs_map_runlist_nolock() for any lcn up
to LCN_RL_NOT_MAPPED, which includes LCN_ENOENT, but turns a failed
retry into an error only for LCN_RL_NOT_MAPPED. For LCN_ENOENT the
error is dropped and the read path maps the range as a hole.
An LCN_ENOENT below allocated_size comes from a base extent with a
highest_vcn of 0, which ntfs_mapping_pairs_decompress() takes to map the
whole attribute, so the runlist ends after its last mapping pair. If
the pairs end early, the retry finds the same extent and fails with
-ENOENT. On a crafted volume with 4 KiB clusters, a 64-cluster file
whose mapping pairs stop after 16 clusters reads 48 clusters of zeros,
with no error.
The same layout gets a crafted $MFT past the check from "ntfs: fail the
mount when $MFT needs its own extent records". With 512-byte clusters
and $MFT's mapping pairs ending at vcn 4, an unpatched kernel hangs on
the folio lock reading records 0-3. With the check alone, the -EIO is
dropped, records 2 and 3 read as zeros and the mount carries on until
check_mft_mirror() finds the zeroed record 2.
Fail the lookup whenever the retry leaves @vcn unmapped below
allocated_size, -ENOENT included. At or beyond allocated_size the end
of the runlist is still returned as it is.
A failed expansion in ntfs_non_resident_attr_expand() or
ntfs_attrlist_repack() truncates the runlist under the runlist lock but
restores allocated_size only after dropping it. A lookup in between
would now fail, so restore allocated_size before dropping the lock in
both, under size_lock, which ntfs_attr_vcn_to_rl() takes to read it.
The crafted file now fails from vcn 16 on with -EIO, and the crafted
volume fails to mount with the check's message.
Fixes: 495e90fa3348 ("ntfs: update attrib operations")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/attrib.c | 30 ++++++++++++++++++++----------
fs/ntfs/attrlist.c | 8 ++++++--
2 files changed, 26 insertions(+), 12 deletions(-)
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index f8eecdcf57858..c5df913d3cbad 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -354,14 +354,16 @@ struct runlist_element *ntfs_attr_vcn_to_rl(struct ntfs_inode *ni, s64 vcn, s64
}
/*
- * The runlist fragment containing @vcn could not be mapped, e.g.
- * because the extent mft record holding it is corrupt. Do not hand
- * LCN_RL_NOT_MAPPED back to callers, which would treat it as a hole.
- * At or beyond the allocated size nothing is mapped, and the runlist
- * ends there with LCN_RL_NOT_MAPPED if only a later extent has been
- * mapped, so return that end as it is.
+ * Neither the runlist nor the retry mapped @vcn, e.g. because the
+ * extent mft record holding it is corrupt or because the mapping
+ * pairs end too soon. ntfs_map_runlist_nolock() reports the latter
+ * as -ENOENT, as @vcn lies past the extent it found. Below the
+ * allocated size, callers would treat LCN_RL_NOT_MAPPED or LCN_ENOENT
+ * as a hole, so fail instead. At or beyond it nothing is mapped: the
+ * runlist ends there with LCN_ENOENT, or with LCN_RL_NOT_MAPPED if
+ * only a later extent has been mapped, so return that end as it is.
*/
- if (*lcn == LCN_RL_NOT_MAPPED) {
+ if (*lcn <= LCN_RL_NOT_MAPPED) {
unsigned long flags;
s64 allocated_size;
@@ -4484,6 +4486,7 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
struct ntfs_inode *base_ni;
struct super_block *sb = ni->vol->sb;
size_t new_rl_count;
+ unsigned long flags;
ntfs_debug("Inode 0x%llx, attr 0x%x, new size %lld old size %lld\n",
(unsigned long long)ni->mft_no, ni->type,
@@ -4714,11 +4717,20 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
if (err2)
ntfs_debug("Leaking clusters");
- /* Now, truncate the runlist itself. */
+ /*
+ * Now, truncate the runlist itself. Restore allocated_size before
+ * dropping the lock: ntfs_attr_vcn_to_rl() fails a lookup below the
+ * allocated size that falls past the end of the runlist.
+ */
if (ni != locked_ni)
down_write(&ni->runlist.lock);
err2 = ntfs_rl_truncate_nolock(vol, &ni->runlist,
ntfs_bytes_to_cluster(vol, org_alloc_size));
+ if (!err2) {
+ write_lock_irqsave(&ni->size_lock, flags);
+ ni->allocated_size = org_alloc_size;
+ write_unlock_irqrestore(&ni->size_lock, flags);
+ }
if (ni != locked_ni)
up_write(&ni->runlist.lock);
if (err2) {
@@ -4730,8 +4742,6 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
ni->runlist.rl = NULL;
ntfs_error(sb, "Couldn't truncate runlist. Rollback failed");
} else {
- /* Prepare to mapping pairs update. */
- ni->allocated_size = org_alloc_size;
/* Restore mapping pairs. */
if (ni != locked_ni)
down_read(&ni->runlist.lock);
diff --git a/fs/ntfs/attrlist.c b/fs/ntfs/attrlist.c
index 1abe0ec2a398a..78e9a1dc79251 100644
--- a/fs/ntfs/attrlist.c
+++ b/fs/ntfs/attrlist.c
@@ -168,14 +168,18 @@ static int ntfs_attrlist_repack(struct inode *attr_vi,
return 0;
restore_old_runlist:
+ /*
+ * Restore allocated_size before dropping the runlist lock:
+ * ntfs_attr_vcn_to_rl() fails a lookup below the allocated size that
+ * falls past the end of the runlist.
+ */
down_write(&attr_ni->runlist.lock);
attr_ni->runlist.rl = old_rl;
attr_ni->runlist.count = old_rl_count;
- up_write(&attr_ni->runlist.lock);
-
write_lock_irqsave(&attr_ni->size_lock, flags);
attr_ni->allocated_size = old_alloc_size;
write_unlock_irqrestore(&attr_ni->size_lock, flags);
+ up_write(&attr_ni->runlist.lock);
restore_err = ntfs_attr_update_mapping_pairs_locked(
attr_ni, 0, locked_ni);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0932/1257] ntfs: fail the mount when $MFTs data size exceeds its allocation
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (930 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0931/1257] ntfs: do not map a vcn as a hole when its runlist lookup failed Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0933/1257] ntfs: hold the runlist lock while expanding a non-resident attribute Greg Kroah-Hartman
` (66 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Goergens, Hyunchul Lee,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
[ Upstream commit 82a5e003ef09113c10b791d687297ef455bb1552 ]
ntfs_read_inode_mount() takes $MFT's i_size from data_size without
checking it against allocated_size, unlike the resident case in
ntfs_read_locked_inode(). mft records between the two are not on disk.
On a crafted volume with 512-byte clusters whose $MFT is cut to 4
clusters while data_size still says 27 records, reading the folio
holding records 0-3 finds the end of the runlist at vcn 4. An unpatched
kernel hangs there on the folio lock, as in "ntfs: fail the mount when
$MFT needs its own extent records". With the previous patch vcn 4-7 are
past the allocation and so read as a hole: records 2 and 3 come back as
zeros and the mount carries on until check_mft_mirror() finds the zeroed
record 2.
Refuse such a $MFT before anything is read through it. The mount now
fails with:
ntfs: (device vda): ntfs_read_inode_mount(): $MFT data size 27648
exceeds its allocated size 2048. $MFT is corrupt. Run chkdsk.
fs/ntfs3 rejects any non-resident attribute whose data_size exceeds its
allocated size. This patch checks only $MFT; the next one covers the
other non-resident attributes.
Fixes: b041ca562526 ("ntfs: update iomap and address space operations")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/inode.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index ca7e2299a8a48..213c4a12b33aa 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -2136,6 +2136,16 @@ int ntfs_read_inode_mount(struct inode *vi)
vi->i_size = le64_to_cpu(a->data.non_resident.data_size);
ni->initialized_size = le64_to_cpu(a->data.non_resident.initialized_size);
ni->allocated_size = le64_to_cpu(a->data.non_resident.allocated_size);
+ /*
+ * Records between allocated_size and data_size are not
+ * on disk, and would be read as zeros.
+ */
+ if (vi->i_size > ni->allocated_size) {
+ ntfs_error(sb,
+ "$MFT data size %lld exceeds its allocated size %lld. $MFT is corrupt. Run chkdsk.",
+ vi->i_size, ni->allocated_size);
+ goto put_err_out;
+ }
/*
* Verify the number of mft records does not exceed
* 2^32 - 1.
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0933/1257] ntfs: hold the runlist lock while expanding a non-resident attribute
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (931 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0932/1257] ntfs: fail the mount when $MFTs data size exceeds its allocation Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0934/1257] ntfs: do not use a stale runlist pointer when undoing $MFT extension Greg Kroah-Hartman
` (65 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Goergens, Baolin Liu,
Hyunchul Lee, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
[ Upstream commit 768c6f5fab58cefa65509dd34b946fdd1071746e ]
ntfs_non_resident_attr_expand() changes ni->runlist.rl while it
allocates clusters: ntfs_attr_map_whole_runlist(), the compressed
branch's ntfs_rl_realloc() and ntfs_runlists_merge() can each kvfree()
the old array. Unless the caller already holds ni->runlist.lock, none
of this happens under it; only the rollback takes it. Callers without
it include the write path, fallocate, ntfs_inode_attr_pwrite() and
ntfs_resident_attr_resize().
Those callers hold mrec_lock, and the write path also inode_lock, but
the iomap read side takes neither: FIEMAP, page faults, readahead and
splice read reach ntfs_read_iomap_begin_non_resident(), which takes only
ni->runlist.lock. A FIEMAP running while write(2) extends the same file
can walk the array that ntfs_runlists_merge() has just freed:
BUG: KASAN: slab-use-after-free in ntfs_attr_vcn_to_rl+0x19b/0x200
A reader that finds a vcn unmapped in the stale array also maps it from
disk into the runlist the writer is changing, which shows up as "Run
lists overlap. Cannot merge!".
Take ni->runlist.lock for writing around the part of the expansion that
changes the runlist and allocated_size, up to and including the mapping
pairs update, as ntfs_non_resident_attr_shrink() does since commit
91709ba5d6d7 ("ntfs: protect runlist updates with the runlist lock"),
and hold it throughout the rollback, where ntfs_cluster_free() requires
it. The lock nests inside mrec_lock, as on the truncate-up path, which
already calls this function with the runlist lock held. Where the
caller says it holds the lock (locked_ni == ni), assert that it holds it
for writing.
For an $ATTRIBUTE_LIST whose lock the caller does not hold, drop the
lock again before the mapping pairs update: that update can resize the
same list through ntfs_attrlist_update_locked(), which returns -ENOSPC
when told that the list's lock is held. Holding it there made punching
holes into a large fragmented file fail with -ENOSPC.
Fixes: 495e90fa3348 ("ntfs: update attrib operations")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/attrib.c | 74 ++++++++++++++++++++++++++++++++++--------------
1 file changed, 53 insertions(+), 21 deletions(-)
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index c5df913d3cbad..1f64680d5c8fe 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -4487,6 +4487,7 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
struct super_block *sb = ni->vol->sb;
size_t new_rl_count;
unsigned long flags;
+ bool runlist_locked = locked_ni == ni;
ntfs_debug("Inode 0x%llx, attr 0x%x, new size %lld old size %lld\n",
(unsigned long long)ni->mft_no, ni->type,
@@ -4528,10 +4529,19 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
* clusters if there is a change.
*/
if (ntfs_bytes_to_cluster(vol, ni->allocated_size) < first_free_vcn) {
+ /*
+ * The runlist array is replaced below. Readers such as the
+ * iomap read path hold only the runlist lock, not mrec_lock.
+ */
+ if (runlist_locked)
+ lockdep_assert_held_write(&ni->runlist.lock);
+ else
+ down_write(&ni->runlist.lock);
+
err = ntfs_attr_map_whole_runlist(ni);
if (err) {
ntfs_error(sb, "ntfs_attr_map_whole_runlist failed");
- return err;
+ goto unlock_runlist;
}
/*
@@ -4556,7 +4566,7 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
last + more_entries + 1);
if (IS_ERR(rl)) {
err = -ENOMEM;
- goto put_err_out;
+ goto unlock_runlist;
}
alloc_size = ni->allocated_size;
@@ -4581,7 +4591,7 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
rl = kmalloc(sizeof(struct runlist_element) * 2, GFP_NOFS);
if (!rl) {
err = -ENOMEM;
- goto put_err_out;
+ goto unlock_runlist;
}
rl[0].vcn = ntfs_bytes_to_cluster(vol, ni->allocated_size);
@@ -4628,7 +4638,8 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
ntfs_debug("Cluster allocation failed (%lld)",
(long long)first_free_vcn -
ntfs_bytes_to_cluster(vol, ni->allocated_size));
- return PTR_ERR(rl);
+ err = PTR_ERR(rl);
+ goto unlock_runlist;
}
/*
* A contiguous ATTRIBUTE_LIST allocation keeps its mapping
@@ -4652,8 +4663,10 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
ni->allocated_size),
lcn_seek_from, DATA_ZONE, false,
false, false);
- if (IS_ERR(rl))
- return PTR_ERR(rl);
+ if (IS_ERR(rl)) {
+ err = PTR_ERR(rl);
+ goto unlock_runlist;
+ }
}
}
@@ -4665,7 +4678,8 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
ntfs_error(sb, "Run list merge failed");
ntfs_cluster_free_from_rl(vol, rl);
kvfree(rl);
- return -EIO;
+ err = -EIO;
+ goto unlock_runlist;
}
ni->runlist.rl = rln;
ni->runlist.count = new_rl_count;
@@ -4673,11 +4687,28 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
/* Prepare to mapping pairs update. */
ni->allocated_size = ntfs_cluster_to_bytes(vol, first_free_vcn);
- err = ntfs_attr_update_mapping_pairs_locked(
- ni, 0, locked_ni);
- if (err) {
- ntfs_debug("Mapping pairs update failed");
- goto rollback;
+ if (ni->type == AT_ATTRIBUTE_LIST && !runlist_locked) {
+ /*
+ * Making room for the list's mapping pairs can resize
+ * this attribute list again through
+ * ntfs_attrlist_update_locked(), which takes its
+ * runlist lock.
+ */
+ up_write(&ni->runlist.lock);
+ err = ntfs_attr_update_mapping_pairs_locked(ni, 0,
+ locked_ni);
+ if (err) {
+ ntfs_debug("Mapping pairs update failed");
+ goto rollback;
+ }
+ } else {
+ err = ntfs_attr_update_mapping_pairs_locked(ni, 0, ni);
+ if (err) {
+ ntfs_debug("Mapping pairs update failed");
+ goto rollback_locked;
+ }
+ if (!runlist_locked)
+ up_write(&ni->runlist.lock);
}
}
@@ -4711,6 +4742,9 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
ntfs_attr_put_search_ctx(ctx);
return 0;
rollback:
+ if (!runlist_locked)
+ down_write(&ni->runlist.lock);
+rollback_locked:
/* Free allocated clusters. */
err2 = ntfs_cluster_free(ni, ntfs_bytes_to_cluster(vol, org_alloc_size),
-1, ctx);
@@ -4722,8 +4756,6 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
* dropping the lock: ntfs_attr_vcn_to_rl() fails a lookup below the
* allocated size that falls past the end of the runlist.
*/
- if (ni != locked_ni)
- down_write(&ni->runlist.lock);
err2 = ntfs_rl_truncate_nolock(vol, &ni->runlist,
ntfs_bytes_to_cluster(vol, org_alloc_size));
if (!err2) {
@@ -4731,8 +4763,6 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
ni->allocated_size = org_alloc_size;
write_unlock_irqrestore(&ni->size_lock, flags);
}
- if (ni != locked_ni)
- up_write(&ni->runlist.lock);
if (err2) {
/*
* Failed to truncate the runlist, so just throw it away, it
@@ -4743,12 +4773,8 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
ntfs_error(sb, "Couldn't truncate runlist. Rollback failed");
} else {
/* Restore mapping pairs. */
- if (ni != locked_ni)
- down_read(&ni->runlist.lock);
- if (__ntfs_attr_update_mapping_pairs(ni, 0, locked_ni, true))
+ if (__ntfs_attr_update_mapping_pairs(ni, 0, ni, true))
ntfs_error(sb, "Failed to restore old mapping pairs");
- if (ni != locked_ni)
- up_read(&ni->runlist.lock);
if (NInoSparse(ni) || NInoCompressed(ni)) {
ni->itype.compressed.size = org_compressed_size;
@@ -4756,6 +4782,8 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
} else
VFS_I(base_ni)->i_blocks = ni->allocated_size >> 9;
}
+ if (!runlist_locked)
+ up_write(&ni->runlist.lock);
if (ctx)
ntfs_attr_put_search_ctx(ctx);
return err;
@@ -4763,6 +4791,10 @@ static int ntfs_non_resident_attr_expand(struct ntfs_inode *ni, const s64 newsiz
if (ctx)
ntfs_attr_put_search_ctx(ctx);
return err;
+unlock_runlist:
+ if (!runlist_locked)
+ up_write(&ni->runlist.lock);
+ return err;
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0934/1257] ntfs: do not use a stale runlist pointer when undoing $MFT extension
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (932 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0933/1257] ntfs: hold the runlist lock while expanding a non-resident attribute Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0935/1257] ntfs: add a runlist merge that leaves the source runlist to the caller Greg Kroah-Hartman
` (64 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baolin Liu, Matthias Goergens,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
[ Upstream commit 258239e79b842e5246fb7f50758d9d15430f4102 ]
When ntfs_mft_data_extend_allocation_nolock() fails after it has
rebuilt the mapping pairs of the last $MFT data extent, undo_alloc
truncates the runlist and then rebuilds the old mapping pairs from rl2,
a pointer into the runlist taken before the truncation.
ntfs_rl_truncate_nolock() can reallocate the runlist, and KASAN then
reports a use-after-free in ntfs_mapping_pairs_build().
Pass the start of the runlist instead, and hold the runlist lock for
reading while the mapping pairs are built from it.
ntfs_mapping_pairs_build() skips to the element containing the first
vcn by itself.
Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
Cc: stable@vger.kernel.org
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/mft.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 8bb8b4085c8b0..892d27db22a3e 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -2023,11 +2023,16 @@ static int ntfs_mft_data_extend_allocation_nolock(struct ntfs_volume *vol)
if (ctx) {
a = ctx->attr;
if (mp_rebuilt && !IS_ERR(ctx->mrec)) {
- if (ntfs_mapping_pairs_build(vol, (u8 *)a + le16_to_cpu(
+ int err;
+
+ down_read(&mft_ni->runlist.lock);
+ err = ntfs_mapping_pairs_build(vol, (u8 *)a + le16_to_cpu(
a->data.non_resident.mapping_pairs_offset),
old_alen - le16_to_cpu(
a->data.non_resident.mapping_pairs_offset),
- rl2, ll, -1, NULL, NULL, NULL)) {
+ mft_ni->runlist.rl, ll, -1, NULL, NULL, NULL);
+ up_read(&mft_ni->runlist.lock);
+ if (err) {
ntfs_error(vol->sb, "Failed to restore mapping pairs array.%s", es);
NVolSetErrors(vol);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0935/1257] ntfs: add a runlist merge that leaves the source runlist to the caller
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (933 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0934/1257] ntfs: do not use a stale runlist pointer when undoing $MFT extension Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0936/1257] ntfs: balance the $MFT runlist lock in data extension error paths Greg Kroah-Hartman
` (63 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Matthias Goergens,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
[ Upstream commit c6ee0986b80715c44d547e9cbdc1a72ad855071c ]
ntfs_runlists_merge() frees the source runlist once its runs are in the
destination. A caller that may have to undo the merge then has to work
out its runs again from the merged runlist, where the first and the
last of them may have been coalesced with neighbouring runs.
Add ntfs_runlists_merge_keep_src(), which neither modifies nor frees
the source runlist. For that, ntfs_rl_append() and ntfs_rl_replace()
now merge the right-hand end into the copied run in the destination
instead of into the last source run before copying it, and the merge
helpers take the source as const, so the compiler checks that none of
them writes to it. The merged runlist is the same as before.
For every caller, a source runlist without any mapped run, which the
merge already warns about, now fails with -EINVAL instead of carrying
on with nothing to insert: with no run copied, the right-hand merge
into the destination would index before the insertion point.
The next patch uses ntfs_runlists_merge_keep_src() to free exactly the
clusters it allocated when it has to undo an $MFT data extension.
Suggested-by: Hyunchul Lee <hyc.lee@gmail.com>
Cc: stable@vger.kernel.org # needed by the next patch
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/runlist.c | 98 ++++++++++++++++++++++++++++++++++++++---------
fs/ntfs/runlist.h | 3 ++
2 files changed, 82 insertions(+), 19 deletions(-)
diff --git a/fs/ntfs/runlist.c b/fs/ntfs/runlist.c
index 3a61f19bcbeef..89e13a452a845 100644
--- a/fs/ntfs/runlist.c
+++ b/fs/ntfs/runlist.c
@@ -47,7 +47,7 @@ static inline void ntfs_rl_mm(struct runlist_element *base, int dst, int src, in
* @srcbase.
*/
static inline void ntfs_rl_mc(struct runlist_element *dstbase, int dst,
- struct runlist_element *srcbase, int src, int size)
+ const struct runlist_element *srcbase, int src, int size)
{
if (likely(size > 0))
memcpy(dstbase + dst, srcbase + src, size * sizeof(*dstbase));
@@ -152,8 +152,8 @@ static inline struct runlist_element *ntfs_rl_realloc_nofail(struct runlist_elem
* Return: true Success, the runlists can be merged.
* false Failure, the runlists cannot be merged.
*/
-static inline bool ntfs_are_rl_mergeable(struct runlist_element *dst,
- struct runlist_element *src)
+static inline bool ntfs_are_rl_mergeable(const struct runlist_element *dst,
+ const struct runlist_element *src)
{
/* We can merge unmapped regions even if they are misaligned. */
if ((dst->lcn == LCN_RL_NOT_MAPPED) && (src->lcn == LCN_RL_NOT_MAPPED))
@@ -186,7 +186,8 @@ static inline bool ntfs_are_rl_mergeable(struct runlist_element *dst,
*
* It is up to the caller to serialize access to the runlists @dst and @src.
*/
-static inline void __ntfs_rl_merge(struct runlist_element *dst, struct runlist_element *src)
+static inline void __ntfs_rl_merge(struct runlist_element *dst,
+ const struct runlist_element *src)
{
dst->length += src->length;
}
@@ -214,10 +215,11 @@ static inline void __ntfs_rl_merge(struct runlist_element *dst, struct runlist_e
* On error, return -errno. Both runlists are left unmodified.
*/
static inline struct runlist_element *ntfs_rl_append(struct runlist_element *dst,
- int dsize, struct runlist_element *src, int ssize, int loc,
+ int dsize, const struct runlist_element *src, int ssize, int loc,
size_t *new_size)
{
bool right = false; /* Right end of @src needs merging. */
+ s64 right_length = 0; /* Length of the run merged at the right. */
int marker; /* End of the inserted runs. */
/* First, check if the right hand end needs merging. */
@@ -235,9 +237,9 @@ static inline struct runlist_element *ntfs_rl_append(struct runlist_element *dst
* original runlists.
*/
- /* First, merge the right hand end, if necessary. */
+ /* Remember the run that the right hand end absorbs, if any. */
if (right)
- __ntfs_rl_merge(src + ssize - 1, dst + loc + 1);
+ right_length = dst[loc + 1].length;
/* First run after the @src runs that have been inserted. */
marker = loc + ssize + 1;
@@ -246,6 +248,9 @@ static inline struct runlist_element *ntfs_rl_append(struct runlist_element *dst
ntfs_rl_mm(dst, marker, loc + 1 + right, dsize - (loc + 1 + right));
ntfs_rl_mc(dst, loc + 1, src, 0, ssize);
+ /* Merge the right hand end into the copy, leaving @src intact. */
+ dst[marker - 1].length += right_length;
+
/* Adjust the size of the preceding hole. */
dst[loc].length = dst[loc + 1].vcn - dst[loc].vcn;
@@ -279,7 +284,7 @@ static inline struct runlist_element *ntfs_rl_append(struct runlist_element *dst
* On error, return -errno. Both runlists are left unmodified.
*/
static inline struct runlist_element *ntfs_rl_insert(struct runlist_element *dst,
- int dsize, struct runlist_element *src, int ssize, int loc,
+ int dsize, const struct runlist_element *src, int ssize, int loc,
size_t *new_size)
{
bool left = false; /* Left end of @src needs merging. */
@@ -374,12 +379,13 @@ static inline struct runlist_element *ntfs_rl_insert(struct runlist_element *dst
* On error, return -errno. Both runlists are left unmodified.
*/
static inline struct runlist_element *ntfs_rl_replace(struct runlist_element *dst,
- int dsize, struct runlist_element *src, int ssize, int loc,
+ int dsize, const struct runlist_element *src, int ssize, int loc,
size_t *new_size)
{
int delta;
bool left = false; /* Left end of @src needs merging. */
bool right = false; /* Right end of @src needs merging. */
+ s64 right_length = 0; /* Length of the run merged at the right. */
int tail; /* Start of tail of @dst. */
int marker; /* End of the inserted runs. */
@@ -405,9 +411,12 @@ static inline struct runlist_element *ntfs_rl_replace(struct runlist_element *ds
* original runlists.
*/
- /* First, merge the left and right ends, if necessary. */
+ /*
+ * Remember the run that the right hand end absorbs, if any, then
+ * merge the left hand end.
+ */
if (right)
- __ntfs_rl_merge(src + ssize - 1, dst + loc + 1);
+ right_length = dst[loc + 1].length;
if (left)
__ntfs_rl_merge(dst + loc - 1, src);
/*
@@ -432,6 +441,13 @@ static inline struct runlist_element *ntfs_rl_replace(struct runlist_element *ds
ntfs_rl_mm(dst, marker, tail, dsize - tail);
ntfs_rl_mc(dst, loc, src, left, ssize - left);
+ /*
+ * Merge the right hand end into the last run of @src, now in @dst at
+ * @marker - 1 (or into @dst[@loc - 1] if that absorbed all of @src),
+ * leaving @src intact.
+ */
+ dst[marker - 1].length += right_length;
+
/* We may have changed the length of the file, so fix the end marker. */
if (dsize - tail > 0 && dst[marker].lcn == LCN_ENOENT)
dst[marker].vcn = dst[marker - 1].vcn + dst[marker - 1].length;
@@ -461,7 +477,7 @@ static inline struct runlist_element *ntfs_rl_replace(struct runlist_element *ds
* On error, return -errno. Both runlists are left unmodified.
*/
static inline struct runlist_element *ntfs_rl_split(struct runlist_element *dst, int dsize,
- struct runlist_element *src, int ssize, int loc,
+ const struct runlist_element *src, int ssize, int loc,
size_t *new_size)
{
/* Space required: @dst size + @src size + one new hole. */
@@ -488,11 +504,12 @@ static inline struct runlist_element *ntfs_rl_split(struct runlist_element *dst,
}
/*
- * ntfs_runlists_merge - merge two runlists into one
+ * __ntfs_runlists_merge - merge two runlists into one
* @d_runlist: destination runlist structure to merge into
* @srl: source runlist to merge from
* @s_rl_count: number of elements in @srl (0 to auto-detect)
* @new_rl_count: on success, set to the new combined runlist size
+ * @keep_srl: leave @srl to the caller instead of deallocating it
*
* First we sanity check the two runlists @srl and @drl to make sure that they
* are sensible and can be merged. The runlist @srl must be either after the
@@ -515,13 +532,14 @@ static inline struct runlist_element *ntfs_rl_split(struct runlist_element *dst,
* On success, return a pointer to the new, combined, runlist. Note, both
* runlists @drl and @srl are deallocated before returning so you cannot use
* the pointers for anything any more. (Strictly speaking the returned runlist
- * may be the same as @dst but this is irrelevant.)
+ * may be the same as @dst but this is irrelevant.) If @keep_srl is true,
+ * @srl is neither modified nor deallocated, and @drl must not be NULL.
*
* On error, return -errno. Both runlists are left unmodified.
*/
-struct runlist_element *ntfs_runlists_merge(struct runlist *d_runlist,
- struct runlist_element *srl, size_t s_rl_count,
- size_t *new_rl_count)
+static struct runlist_element *__ntfs_runlists_merge(struct runlist *d_runlist,
+ struct runlist_element *srl, size_t s_rl_count,
+ size_t *new_rl_count, bool keep_srl)
{
int di, si; /* Current index into @[ds]rl. */
int sstart; /* First index with lcn > LCN_RL_NOT_MAPPED. */
@@ -553,6 +571,8 @@ struct runlist_element *ntfs_runlists_merge(struct runlist *d_runlist,
/* Check for the case where the first mapping is being done now. */
if (unlikely(!drl)) {
+ if (WARN_ON(keep_srl))
+ return ERR_PTR(-EINVAL);
drl = srl;
/* Complete the source runlist if necessary. */
if (unlikely(drl[0].vcn)) {
@@ -582,7 +602,8 @@ struct runlist_element *ntfs_runlists_merge(struct runlist *d_runlist,
si++;
/* Can't have an entirely unmapped source runlist. */
- WARN_ON(!srl[si].length);
+ if (WARN_ON(!srl[si].length))
+ return ERR_PTR(-EINVAL);
/* Record the starting points. */
sstart = si;
@@ -652,7 +673,8 @@ struct runlist_element *ntfs_runlists_merge(struct runlist *d_runlist,
ntfs_error(NULL, "Merge failed.");
return drl;
}
- kvfree(srl);
+ if (!keep_srl)
+ kvfree(srl);
if (marker) {
ntfs_debug("Triggering marker code.");
for (ds = dend; drl[ds].length; ds++)
@@ -714,6 +736,44 @@ struct runlist_element *ntfs_runlists_merge(struct runlist *d_runlist,
return drl;
}
+/*
+ * ntfs_runlists_merge - merge two runlists into one
+ * @d_runlist: destination runlist structure to merge into
+ * @srl: source runlist to merge from, deallocated on success
+ * @s_rl_count: number of elements in @srl (0 to auto-detect)
+ * @new_rl_count: on success, set to the new combined runlist size
+ *
+ * See __ntfs_runlists_merge().
+ */
+struct runlist_element *ntfs_runlists_merge(struct runlist *d_runlist,
+ struct runlist_element *srl, size_t s_rl_count,
+ size_t *new_rl_count)
+{
+ return __ntfs_runlists_merge(d_runlist, srl, s_rl_count, new_rl_count,
+ false);
+}
+
+/*
+ * ntfs_runlists_merge_keep_src - merge two runlists, keeping the source
+ * @d_runlist: destination runlist structure to merge into, not empty
+ * @srl: source runlist to merge from
+ * @s_rl_count: number of elements in @srl (0 to auto-detect)
+ * @new_rl_count: on success, set to the new combined runlist size
+ *
+ * Like ntfs_runlists_merge(), but @srl is neither modified nor deallocated,
+ * on success or on error, and remains the caller's to kvfree(). Even when
+ * runs of @srl are coalesced with runs of @d_runlist, @srl keeps describing
+ * exactly its own runs, e.g. the clusters a caller has to free to undo the
+ * merge.
+ */
+struct runlist_element *ntfs_runlists_merge_keep_src(struct runlist *d_runlist,
+ struct runlist_element *srl, size_t s_rl_count,
+ size_t *new_rl_count)
+{
+ return __ntfs_runlists_merge(d_runlist, srl, s_rl_count, new_rl_count,
+ true);
+}
+
/*
* ntfs_mapping_pairs_decompress - convert mapping pairs array to runlist
* @vol: ntfs volume
diff --git a/fs/ntfs/runlist.h b/fs/ntfs/runlist.h
index cc92e09fbf682..0d4c32b1a338f 100644
--- a/fs/ntfs/runlist.h
+++ b/fs/ntfs/runlist.h
@@ -68,6 +68,9 @@ enum {
struct runlist_element *ntfs_runlists_merge(struct runlist *d_runlist,
struct runlist_element *srl, size_t s_rl_count,
size_t *new_rl_count);
+struct runlist_element *ntfs_runlists_merge_keep_src(struct runlist *d_runlist,
+ struct runlist_element *srl, size_t s_rl_count,
+ size_t *new_rl_count);
struct runlist_element *ntfs_mapping_pairs_decompress(const struct ntfs_volume *vol,
const struct attr_record *attr, struct runlist *old_runlist,
size_t *new_rl_count);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0936/1257] ntfs: balance the $MFT runlist lock in data extension error paths
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (934 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0935/1257] ntfs: add a runlist merge that leaves the source runlist to the caller Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0937/1257] ntfs: fix kunmap_local() of advanced pointers in check_mft_mirror() Greg Kroah-Hartman
` (62 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Goergens, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
[ Upstream commit 69ba74e8a5dfc6fd7ba3588e81d53e965566f3a4 ]
ntfs_mft_data_extend_allocation_nolock() drops the $MFT runlist lock
before allocating clusters, and every path into undo_alloc arrives
without it, except a map_mft_record() failure, which takes it first.
undo_alloc never releases it, so the lock leaks and the next $MFT
extension and $MFT writeback hang. The restore_undo_alloc failure
path, on the other hand, releases the lock without holding it. And
undo_alloc frees the clusters with ntfs_cluster_free() and truncates
the runlist without the lock, although both require it.
Enter undo_alloc without the lock on every path. Merge the new clusters
with ntfs_runlists_merge_keep_src() and keep the runlist that
ntfs_cluster_alloc() returned until the extension is complete. On
failure, undo_alloc truncates $MFT's runlist under the lock and, after
dropping it, frees the clusters from the kept runlist with
ntfs_cluster_free_from_rl(). That keeps lcnbmp_lock outside the runlist
lock, the order given by the comment before the cluster allocation.
Unlike ntfs_cluster_free() on a volume mounted with -o discard, this
does not issue discards for the clusters, which were never written; the
runlist merge failure path already frees them the same way. If the
truncation fails, the runlist may still reference the clusters, so they
stay allocated and the volume is marked for chkdsk; at this call site
the truncation only shrinks the runlist and cannot fail today.
A shorter fix would keep calling ntfs_cluster_free() on the live
runlist without the lock, relying on $MFT's runlist being fully mapped
and changed only by this function under mrec_lock. That breaks
ntfs_cluster_free()'s documented locking rule on an argument about the
rest of the driver, so this patch does not do that.
Fixes: 115380f9a2f9 ("ntfs: update mft operations")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/mft.c | 50 ++++++++++++++++++++++++++++++++++----------------
1 file changed, 34 insertions(+), 16 deletions(-)
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 892d27db22a3e..482a216ade2cb 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1771,7 +1771,7 @@ static int ntfs_mft_data_extend_allocation_nolock(struct ntfs_volume *vol)
s64 min_nr, nr, ll;
unsigned long flags;
struct ntfs_inode *mft_ni;
- struct runlist_element *rl, *rl2;
+ struct runlist_element *rl, *rl2, *alloc_rl;
struct ntfs_attr_search_ctx *ctx = NULL;
struct mft_record *mrec;
struct attr_record *a = NULL;
@@ -1839,15 +1839,15 @@ static int ntfs_mft_data_extend_allocation_nolock(struct ntfs_volume *vol)
up_write(&mft_ni->runlist.lock);
do {
- rl2 = ntfs_cluster_alloc(vol, old_last_vcn, nr, lcn, MFT_ZONE,
- true, false, false);
- if (!IS_ERR(rl2))
+ alloc_rl = ntfs_cluster_alloc(vol, old_last_vcn, nr, lcn,
+ MFT_ZONE, true, false, false);
+ if (!IS_ERR(alloc_rl))
break;
- if (PTR_ERR(rl2) != -ENOSPC || nr == min_nr) {
+ if (PTR_ERR(alloc_rl) != -ENOSPC || nr == min_nr) {
ntfs_error(vol->sb,
"Failed to allocate the minimal number of clusters (%lli) for the mft data attribute.",
nr);
- return PTR_ERR(rl2);
+ return PTR_ERR(alloc_rl);
}
/*
* There is not enough space to do the allocation, but there
@@ -1858,17 +1858,22 @@ static int ntfs_mft_data_extend_allocation_nolock(struct ntfs_volume *vol)
ntfs_debug("Retrying mft data allocation with minimal cluster count %lli.", nr);
} while (1);
+ /*
+ * Keep @alloc_rl until the extension is complete: it describes exactly
+ * the new clusters, which undo_alloc frees if a later step fails.
+ */
down_write(&mft_ni->runlist.lock);
- rl = ntfs_runlists_merge(&mft_ni->runlist, rl2, 0, &new_rl_count);
+ rl = ntfs_runlists_merge_keep_src(&mft_ni->runlist, alloc_rl, 0,
+ &new_rl_count);
if (IS_ERR(rl)) {
up_write(&mft_ni->runlist.lock);
ntfs_error(vol->sb, "Failed to merge runlists for mft data attribute.");
- if (ntfs_cluster_free_from_rl(vol, rl2)) {
+ if (ntfs_cluster_free_from_rl(vol, alloc_rl)) {
ntfs_error(vol->sb,
"Failed to deallocate clusters from the mft data attribute.%s", es);
NVolSetErrors(vol);
}
- kvfree(rl2);
+ kvfree(alloc_rl);
return PTR_ERR(rl);
}
mft_ni->runlist.rl = rl;
@@ -1884,7 +1889,6 @@ static int ntfs_mft_data_extend_allocation_nolock(struct ntfs_volume *vol)
if (IS_ERR(mrec)) {
ntfs_error(vol->sb, "Failed to map mft record.");
ret = PTR_ERR(mrec);
- down_write(&mft_ni->runlist.lock);
goto undo_alloc;
}
ctx = ntfs_attr_get_search_ctx(mft_ni, mrec);
@@ -1982,6 +1986,7 @@ static int ntfs_mft_data_extend_allocation_nolock(struct ntfs_volume *vol)
mark_mft_record_dirty(ctx->ntfs_ino);
ntfs_attr_put_search_ctx(ctx);
unmap_mft_record(mft_ni);
+ kvfree(alloc_rl);
ntfs_debug("Done.");
return 0;
restore_undo_alloc:
@@ -1995,7 +2000,7 @@ static int ntfs_mft_data_extend_allocation_nolock(struct ntfs_volume *vol)
write_unlock_irqrestore(&mft_ni->size_lock, flags);
ntfs_attr_put_search_ctx(ctx);
unmap_mft_record(mft_ni);
- up_write(&mft_ni->runlist.lock);
+ kvfree(alloc_rl);
/*
* The only thing that is now wrong is ->allocated_size of the
* base attribute extent which chkdsk should be able to fix.
@@ -2006,15 +2011,28 @@ static int ntfs_mft_data_extend_allocation_nolock(struct ntfs_volume *vol)
ctx->attr->data.non_resident.highest_vcn =
cpu_to_le64(old_last_vcn - 1);
undo_alloc:
- if (ntfs_cluster_free(mft_ni, old_last_vcn, -1, ctx) < 0) {
- ntfs_error(vol->sb, "Failed to free clusters from mft data attribute.%s", es);
- NVolSetErrors(vol);
- }
-
+ /*
+ * Entered without the runlist lock. Take the new runs off the
+ * runlist under it, and free their clusters from @alloc_rl once it
+ * is dropped, as lcnbmp_lock nests outside it (see above).
+ */
+ down_write(&mft_ni->runlist.lock);
if (ntfs_rl_truncate_nolock(vol, &mft_ni->runlist, old_last_vcn)) {
ntfs_error(vol->sb, "Failed to truncate mft data attribute runlist.%s", es);
NVolSetErrors(vol);
+ /*
+ * The runlist may still reference the clusters, so leave them
+ * allocated until chkdsk.
+ */
+ kvfree(alloc_rl);
+ alloc_rl = NULL;
+ }
+ up_write(&mft_ni->runlist.lock);
+ if (ntfs_cluster_free_from_rl(vol, alloc_rl)) {
+ ntfs_error(vol->sb, "Failed to free clusters from mft data attribute.%s", es);
+ NVolSetErrors(vol);
}
+ kvfree(alloc_rl);
if (mp_extended && ntfs_attr_update_mapping_pairs(mft_ni, 0)) {
ntfs_error(vol->sb, "Failed to restore mapping pairs.%s",
es);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0937/1257] ntfs: fix kunmap_local() of advanced pointers in check_mft_mirror()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (935 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0936/1257] ntfs: balance the $MFT runlist lock in data extension error paths Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0938/1257] ntfs: fix kmap_local leak in ntfs_check_logfile() Greg Kroah-Hartman
` (61 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Hyunchul Lee,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 16fcb1c446f17c11c104bd4e631b841946d180aa ]
check_mft_mirror() compares the mft records of a page with the mirror
records by advancing kmft and kmirr by the record size for every record.
It then passes the advanced pointers to kunmap_local(). After the last
record of a page they point one page past the mapping.
With HIGHMEM kunmap_local() warns that the address does not match the
top of the kmap_local stack. What it does next depends on how the
architecture finds the page table entry:
- 32-bit ARM looks the entry up by that address. It clears the entry of
the neighbouring fixmap slot and leaves the real mapping in place.
The next kmap_local() on that CPU that reaches the slot hits the
BUG_ON(!pte_none()) in __kmap_local_pfn_prot().
- x86-32 takes the entry from the stack index, so the wrong address
does not select a wrong entry. In QEMU the mount carried on after the
warning.
With 4 KiB pages and 1 KiB mft records the four mirror records fill
exactly one page, so every mount whose $MFT and $MFTMirr folios are in
highmem hits it. A fresh mkntfs volume on 32-bit ARM
(multi_v7_defconfig, 256 MiB of highmem) fails on the first mount:
WARNING: mm/highmem.c:623 at kunmap_local_indexed+0x254/0x26c, CPU#1: mount/85
kunmap_local_indexed from ntfs_fill_super+0x224c/0x35a0
ntfs_fill_super from get_tree_bdev_flags+0x1d8/0x2a4
ntfs: volume version 3.1, dev loop0, cluster size 4096
kernel BUG at mm/highmem.c:565!
PC is at __kmap_local_pfn_prot+0x210/0x214
__kmap_local_page_prot from ntfs_check_logfile+0x1fc/0x1210
Found with syzkaller. Kernels without HIGHMEM do not show it.
kmap_local_folio() returns the direct map address there and
kunmap_local() has no mapping to remove.
Keep the addresses returned by kmap_local_folio() and unmap with those.
Fixes: 6251f0b0de7d ("ntfs: update super block operations")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/super.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 6d70352136b0c..0a1faa262c417 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -1132,7 +1132,7 @@ static bool check_mft_mirror(struct ntfs_volume *vol)
struct super_block *sb = vol->sb;
struct ntfs_inode *mirr_ni;
struct folio *mft_folio = NULL, *mirr_folio = NULL;
- u8 *kmft = NULL, *kmirr = NULL;
+ u8 *kmft = NULL, *kmirr = NULL, *kmft_base = NULL, *kmirr_base = NULL;
struct runlist_element *rl, rl2[2];
pgoff_t index;
int mrecs_per_page, i;
@@ -1147,9 +1147,9 @@ static bool check_mft_mirror(struct ntfs_volume *vol)
/* Switch pages if necessary. */
if (!(i % mrecs_per_page)) {
if (index) {
- kunmap_local(kmirr);
+ kunmap_local(kmirr_base);
folio_put(mirr_folio);
- kunmap_local(kmft);
+ kunmap_local(kmft_base);
folio_put(mft_folio);
}
/* Get the $MFT page. */
@@ -1159,7 +1159,8 @@ static bool check_mft_mirror(struct ntfs_volume *vol)
ntfs_error(sb, "Failed to read $MFT.");
return false;
}
- kmft = kmap_local_folio(mft_folio, 0);
+ kmft_base = kmap_local_folio(mft_folio, 0);
+ kmft = kmft_base;
/* Get the $MFTMirr page. */
mirr_folio = read_mapping_folio(vol->mftmirr_ino->i_mapping,
index, NULL);
@@ -1167,7 +1168,8 @@ static bool check_mft_mirror(struct ntfs_volume *vol)
ntfs_error(sb, "Failed to read $MFTMirr.");
goto mft_unmap_out;
}
- kmirr = kmap_local_folio(mirr_folio, 0);
+ kmirr_base = kmap_local_folio(mirr_folio, 0);
+ kmirr = kmirr_base;
++index;
}
@@ -1179,10 +1181,10 @@ static bool check_mft_mirror(struct ntfs_volume *vol)
"Incomplete multi sector transfer detected in mft record %i.",
i);
mm_unmap_out:
- kunmap_local(kmirr);
+ kunmap_local(kmirr_base);
folio_put(mirr_folio);
mft_unmap_out:
- kunmap_local(kmft);
+ kunmap_local(kmft_base);
folio_put(mft_folio);
return false;
}
@@ -1218,9 +1220,9 @@ static bool check_mft_mirror(struct ntfs_volume *vol)
kmirr += vol->mft_record_size;
} while (++i < vol->mftmirr_size);
/* Release the last folios. */
- kunmap_local(kmirr);
+ kunmap_local(kmirr_base);
folio_put(mirr_folio);
- kunmap_local(kmft);
+ kunmap_local(kmft_base);
folio_put(mft_folio);
/* Construct the mft mirror runlist by hand. */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0938/1257] ntfs: fix kmap_local leak in ntfs_check_logfile()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (936 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0937/1257] ntfs: fix kunmap_local() of advanced pointers in check_mft_mirror() Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0939/1257] ntfs: report block device flush failures from fsync Greg Kroah-Hartman
` (60 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Hyunchul Lee,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit a5ec71084996aec76d07e0e530a345cdd202dc1a ]
ntfs_check_logfile() calls kmap_local_folio() on every iteration of its
search loop but kunmap_local() only once per folio. The loop visits
positions 0, 512, 1024, 2048, 4096 and so on. With 4 KiB pages the first
four are in one page, so a mount whose first LogFile folio is in highmem
leaves three entries on the kmap_local stack of the mounting task.
Kernels without HIGHMEM are not affected.
The leaked entries keep migration disabled. nr_pinned of the runqueue
the mount ran on stays raised after the task exits, so taking that CPU
offline blocks forever in balance_hotplug_wait().
The fifth mount in one task reaches KM_MAX_IDX (12 leaked entries plus
4 in the loop) and hits the BUG_ON() in kmap_local_idx_push():
kernel BUG at mm/highmem.c:480!
On x86-32 the generic entry code also warns on return to user space:
DEBUG_LOCKS_WARN_ON(current->kmap_ctrl.idx)
WARNING: include/linux/highmem-internal.h:17 at __do_fast_syscall_32+0x21e/0x550
Map each page once, when it is read, and unmap that address.
Fixes: 5218cd102aec ("ntfs: update misc operations")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/logfile.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/fs/ntfs/logfile.c b/fs/ntfs/logfile.c
index 1404664dacc01..ce38ce87f8fc8 100644
--- a/fs/ntfs/logfile.c
+++ b/fs/ntfs/logfile.c
@@ -457,7 +457,7 @@ bool ntfs_check_logfile(struct inode *log_vi, struct restart_page_header **rp)
struct ntfs_volume *vol = NTFS_SB(log_vi->i_sb);
struct address_space *mapping = log_vi->i_mapping;
struct folio *folio = NULL;
- u8 *kaddr = NULL;
+ u8 *kaddr = NULL, *kbase = NULL;
struct restart_page_header *rstr1_ph = NULL;
struct restart_page_header *rstr2_ph = NULL;
int log_page_size, err;
@@ -511,7 +511,7 @@ bool ntfs_check_logfile(struct inode *log_vi, struct restart_page_header **rp)
if (!folio || folio->index != idx) {
if (folio) {
- kunmap_local(kaddr);
+ kunmap_local(kbase);
folio_put(folio);
}
folio = read_mapping_folio(mapping, idx, NULL);
@@ -520,8 +520,9 @@ bool ntfs_check_logfile(struct inode *log_vi, struct restart_page_header **rp)
idx);
goto err_out;
}
+ kbase = kmap_local_folio(folio, 0);
}
- kaddr = (u8 *)kmap_local_folio(folio, 0) + (pos & ~PAGE_MASK);
+ kaddr = kbase + (pos & ~PAGE_MASK);
/*
* A non-empty block means the logfile is not empty while an
* empty block after a non-empty block has been encountered
@@ -574,7 +575,7 @@ bool ntfs_check_logfile(struct inode *log_vi, struct restart_page_header **rp)
* find a valid one further in the file.
*/
if (err != -EINVAL) {
- kunmap_local(kaddr);
+ kunmap_local(kbase);
folio_put(folio);
goto err_out;
}
@@ -583,7 +584,7 @@ bool ntfs_check_logfile(struct inode *log_vi, struct restart_page_header **rp)
pos = NTFS_BLOCK_SIZE >> 1;
}
if (folio) {
- kunmap_local(kaddr);
+ kunmap_local(kbase);
folio_put(folio);
}
if (logfile_is_empty) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0939/1257] ntfs: report block device flush failures from fsync
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (937 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0938/1257] ntfs: fix kmap_local leak in ntfs_check_logfile() Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0940/1257] ntfs: flush the block device when syncing a directory Greg Kroah-Hartman
` (59 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, DaeMyung Kang, Baolin Liu,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: DaeMyung Kang <charsyam@gmail.com>
[ Upstream commit 9b32a74f4ef52d26d68ceb3f5e492d5eac26f5fc ]
ntfs_file_fsync() calls blkdev_issue_flush() after writeback but discards
its return value. If the device cannot flush its write cache, fsync()
reports success even though the file is not guaranteed to be durable.
Reproduce this with QEMU blkdebug failing flush_to_disk with -EIO.
On ntfs-next at 04fb910da2c8, a kretprobe recorded -EIO from
blkdev_issue_flush() while fsync() returned 0. With this change,
fsync() returns -EIO and logs the failure. The syncfs() path already
reports this error.
Fixes: 9c87959601e8 ("ntfs: update file operations")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/file.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index e290616be07d0..f8f4418cbcda8 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -241,14 +241,14 @@ static int ntfs_file_fsync(struct file *filp, loff_t start, loff_t end,
err = sync_blockdev(vi->i_sb->s_bdev);
if (unlikely(err && !ret))
ret = err;
+ if (!ret)
+ ret = blkdev_issue_flush(vi->i_sb->s_bdev);
if (likely(!ret))
ntfs_debug("Done.");
else
ntfs_warning(vi->i_sb,
"Failed to f%ssync inode 0x%llx. Error %u.",
datasync ? "data" : "", ni->mft_no, -ret);
- if (!ret)
- blkdev_issue_flush(vi->i_sb->s_bdev);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0940/1257] ntfs: flush the block device when syncing a directory
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (938 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0939/1257] ntfs: report block device flush failures from fsync Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0941/1257] ntfs: roll back the ACL xattr commit when the WSL mode update fails Greg Kroah-Hartman
` (58 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, DaeMyung Kang, Baolin Liu,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: DaeMyung Kang <charsyam@gmail.com>
[ Upstream commit 569f514f0ec74c4162241e10b7893bff109f8aca ]
ntfs_dir_fsync() writes directory metadata and calls sync_blockdev(),
but does not flush the block device write cache. A successful fsync()
can therefore leave the directory's metadata in a volatile device cache.
Issue a cache flush after successful writeback and return any flush error.
This matches the regular-file fsync and syncfs paths.
With QEMU blkdebug injecting -EIO for flush_to_disk, fsync() on an NTFS
directory returned 0 before this change while syncfs() returned -EIO.
After this change, both return -EIO. A kretprobe confirmed the flush
error in the directory fsync path.
Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/dir.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
index df60138f9b2d3..09b890b41c4a9 100644
--- a/fs/ntfs/dir.c
+++ b/fs/ntfs/dir.c
@@ -1182,6 +1182,8 @@ static int ntfs_dir_fsync(struct file *filp, loff_t start, loff_t end,
err = sync_blockdev(vi->i_sb->s_bdev);
if (unlikely(err && !ret))
ret = err;
+ if (!ret)
+ ret = blkdev_issue_flush(vi->i_sb->s_bdev);
if (likely(!ret))
ntfs_debug("Done.");
else
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0941/1257] ntfs: roll back the ACL xattr commit when the WSL mode update fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (939 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0940/1257] ntfs: flush the block device when syncing a directory Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0942/1257] ALSA: mtpav: restore negation dropped in guard() conversion Greg Kroah-Hartman
` (57 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunchul Lee, Hongling Zeng,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <zenghongling@kylinos.cn>
[ Upstream commit 89467388e8afc6b55ea7cd38bc1f469df7747db0 ]
ntfs_set_acl_ex() commits the ACL xattr before it rewrites the WSL
mode EA, and removes it again when the rewrite fails. That only
undoes a set that created the xattr: when the update replaced or
removed an existing one, the old ACL is discarded along with the
failed update. No error is recorded when the undo fails, so the
new, typically more permissive, ACL is left on disk while i_mode,
the mode EA and the cached ACL keep the old values. After a
remount, a chmod 0640 -> 0777 that reported failure leaves the file
accessible to the relaxed ACL while stat() still reports 0640.
Save the previous xattr before committing the update, and restore it
when the mode EA rewrite fails. A removed xattr is created again,
since XATTR_REPLACE fails with -ENODATA once the removal dropped the
entry. Remove the new xattr only when there was no previous one, and
skip the undo when the commit changed nothing. A failed rollback is
recorded: NVolSetErrors(), which the next persistence point persists
as VOLUME_IS_DIRTY, and a log message the errors= policy acts on.
The flag cannot be written to disk here directly: the target inode's
mrec_lock is held and the $Volume mrec_lock cannot be nested under
it.
Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations")
Cc: stable@vger.kernel.org
Suggested-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs/ea.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++++----
1 file changed, 63 insertions(+), 4 deletions(-)
diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
index b4fcfbe2da4c9..6ac551fe8ea64 100644
--- a/fs/ntfs/ea.c
+++ b/fs/ntfs/ea.c
@@ -1027,8 +1027,9 @@ static noinline int ntfs_set_acl_ex(struct mnt_idmap *idmap,
{
const char *name;
size_t size, name_len;
- void *value;
- int err;
+ void *value, *old_value = NULL;
+ int err, old_len = -ENODATA;
+ bool acl_committed = false;
int flags;
umode_t mode;
@@ -1072,7 +1073,34 @@ static noinline int ntfs_set_acl_ex(struct mnt_idmap *idmap,
}
mutex_lock(&NTFS_I(inode)->mrec_lock);
+ if (!init_acl) {
+ /* Save the old xattr for rollback. */
+ old_len = ntfs_get_ea(inode, name, name_len, NULL, 0);
+ if (old_len >= 0) {
+ /* kmalloc(0) returns the non-NULL ZERO_SIZE_PTR. */
+ old_value = kmalloc(old_len, GFP_NOFS);
+ if (!old_value) {
+ err = -ENOMEM;
+ goto out_unlock;
+ }
+ err = ntfs_get_ea(inode, name, name_len,
+ old_value, old_len);
+ if (err != old_len) {
+ kfree(old_value);
+ old_value = NULL;
+ if (err >= 0)
+ err = -EIO;
+ goto out_unlock;
+ }
+ } else if (old_len != -ENODATA) {
+ err = old_len;
+ goto out_unlock;
+ }
+ }
err = ntfs_set_ea(inode, name, name_len, value, size, flags, NULL);
+ if (!err)
+ acl_committed = true;
+out_unlock:
mutex_unlock(&NTFS_I(inode)->mrec_lock);
if (err == -ENODATA && !size)
err = 0; /* Removing non existed xattr. */
@@ -1084,8 +1112,38 @@ static noinline int ntfs_set_acl_ex(struct mnt_idmap *idmap,
mutex_lock(&NTFS_I(inode)->mrec_lock);
err = ntfs_ea_set_wsl_inode(inode, 0, &ea_size, NTFS_EA_MODE);
if (err) {
- ntfs_set_ea(inode, name, name_len, NULL, 0,
- XATTR_REPLACE, NULL);
+ if (acl_committed) {
+ int undo_err;
+
+ if (old_len >= 0) {
+ /*
+ * A removed or zero-length xattr must
+ * be recreated without XATTR_REPLACE.
+ */
+ int undo_flags = acl && old_len ?
+ XATTR_REPLACE : 0;
+
+ undo_err = ntfs_set_ea(inode, name,
+ name_len, old_value,
+ old_len, undo_flags,
+ NULL);
+ } else {
+ undo_err = ntfs_set_ea(inode, name,
+ name_len, NULL, 0,
+ XATTR_REPLACE, NULL);
+ }
+ if (undo_err) {
+ /*
+ * Record a failed rollback so the next
+ * persistence point marks the volume
+ * dirty. Run chkdsk.
+ */
+ NVolSetErrors(NTFS_I(inode)->vol);
+ ntfs_error(inode->i_sb,
+ "Failed to undo the ACL xattr: %d",
+ undo_err);
+ }
+ }
mutex_unlock(&NTFS_I(inode)->mrec_lock);
inode->i_mode = old_mode;
goto out;
@@ -1098,6 +1156,7 @@ static noinline int ntfs_set_acl_ex(struct mnt_idmap *idmap,
}
out:
+ kfree(old_value);
kfree(value);
return err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0942/1257] ALSA: mtpav: restore negation dropped in guard() conversion
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (940 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0941/1257] ntfs: roll back the ACL xattr commit when the WSL mode update fails Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0943/1257] ALSA: emux: Stop voices before freeing zones in all cases Greg Kroah-Hartman
` (56 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Yan, Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yan <wangyan01@kylinos.cn>
[ Upstream commit 47c3d5b885a4fcf65238c0cc525dd3c1cc65aa89 ]
commit 316e0074ecdc ("ALSA: mtpav: Use guard() for spin locks")
claims to be "Merely code refactoring, and no behavior change", but
it accidentally dropped the "!" from
if (! (portp->mode & MTPAV_MODE_OUTPUT_TRIGGERED))
in snd_mtpav_output_trigger().
Restore the negation.
Fixes: 316e0074ecdc ("ALSA: mtpav: Use guard() for spin locks")
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261020090959.570101-1-wangyan01@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/drivers/mtpav.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/drivers/mtpav.c b/sound/drivers/mtpav.c
index 1ed6d4f0cb625..288a873a27e61 100644
--- a/sound/drivers/mtpav.c
+++ b/sound/drivers/mtpav.c
@@ -443,7 +443,7 @@ static void snd_mtpav_output_trigger(struct snd_rawmidi_substream *substream, in
scoped_guard(spinlock_irqsave, &mtp_card->spinlock) {
if (up) {
- if ((portp->mode & MTPAV_MODE_OUTPUT_TRIGGERED)) {
+ if (!(portp->mode & MTPAV_MODE_OUTPUT_TRIGGERED)) {
if (mtp_card->istimer++ == 0)
snd_mtpav_add_output_timer(mtp_card);
portp->mode |= MTPAV_MODE_OUTPUT_TRIGGERED;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0943/1257] ALSA: emux: Stop voices before freeing zones in all cases
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (941 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0942/1257] ALSA: mtpav: restore negation dropped in guard() conversion Greg Kroah-Hartman
@ 2026-11-07 13:53 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0944/1257] platform/x86: lenovo-wmi-capdata: Do not stop the AC notifier chain on error Greg Kroah-Hartman
` (55 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 8a5d87c2ba30e8de31cfbe888fd4d95f43c63db9 ]
The emux voice caches the soundfont zone pointer in vp->zone, which
is referred to later, e.g. in snd_emux_send_effect(). For avoiding
dangling pointers, the soundfont code calls the sample_reset callback
to stop all voices before freeing zones. However, in a few cases
(e.g. emu10k1's missing sample_reset or the call path via
remove_info()), the sample reset isn't called properly, leaving the
playing voices.
Fix it by always registering the sample_reset callback, falling back
to snd_emux_terminate_all() when the driver has no own ops, and by
calling sample_reset in remove_info() before freeing the zones.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261020101624.205638-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/synth/emux/emux.c | 10 +++++++---
sound/synth/emux/soundfont.c | 9 +++++++++
2 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c
index 450147b1abed5..2a42d041e1da0 100644
--- a/sound/synth/emux/emux.c
+++ b/sound/synth/emux/emux.c
@@ -71,7 +71,12 @@ static int sf_sample_free(void *private_data, struct snd_sf_sample *sp,
static void sf_sample_reset(void *private_data)
{
struct snd_emux *emu = private_data;
- emu->ops.sample_reset(emu);
+
+ /* stop all voices that might refer to zones and samples to be freed */
+ if (emu->ops.sample_reset)
+ emu->ops.sample_reset(emu);
+ else
+ snd_emux_terminate_all(emu);
}
int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, char *name)
@@ -95,8 +100,7 @@ int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, ch
sf_cb.private_data = emu;
sf_cb.sample_new = sf_sample_new;
sf_cb.sample_free = sf_sample_free;
- if (emu->ops.sample_reset)
- sf_cb.sample_reset = sf_sample_reset;
+ sf_cb.sample_reset = sf_sample_reset;
emu->sflist = snd_sf_new(&sf_cb, emu->memhdr);
if (emu->sflist == NULL)
return -ENOMEM;
diff --git a/sound/synth/emux/soundfont.c b/sound/synth/emux/soundfont.c
index 039357d96e07a..42d1f33fb2b50 100644
--- a/sound/synth/emux/soundfont.c
+++ b/sound/synth/emux/soundfont.c
@@ -443,6 +443,15 @@ remove_info(struct snd_sf_list *sflist, struct snd_soundfont *sf,
struct snd_sf_zone *prev, *next, *p;
int removed = 0;
+ /* stop voices before freeing the zones they might refer to */
+ for (p = sf->zones; p; p = p->next) {
+ if (!p->mapped && p->bank == bank && p->instr == instr) {
+ if (sflist->callback.sample_reset)
+ sflist->callback.sample_reset(sflist->callback.private_data);
+ break;
+ }
+ }
+
prev = NULL;
for (p = sf->zones; p; p = next) {
next = p->next;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0944/1257] platform/x86: lenovo-wmi-capdata: Do not stop the AC notifier chain on error
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (942 preceding siblings ...)
2026-11-07 13:53 ` [PATCH 7.3 0943/1257] ALSA: emux: Stop voices before freeing zones in all cases Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0945/1257] gpiolib: Free chip resources when allocating the label fails Greg Kroah-Hartman
` (54 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Navon John Lukose, Derek J. Clark,
Mark Pearson, Rong Zhang, Ilpo Järvinen, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rong Zhang <i@rong.moe>
[ Upstream commit 3b53e691e907086672b72d0544e4bf27efd4250d ]
Returning NOTIFY_BAD to the AC notifier chain stops it by preventing
later notifier blocks from being called, but our error is non-fatal for
other AC notifier blocks, which should continue to consume the event.
Return NOTIFY_DONE and add a dev_warn() on error, so that the AC
notifier chain continues. This also aligns with hp-wmi.
The function documentation was copied from elsewhere and makes no sense
here, so correct it as well.
Fixes: e1a5fe662b59 ("platform/x86: Add Lenovo Capability Data 01 WMI Driver")
Cc: stable@vger.kernel.org
Tested-by: Navon John Lukose <navonjohnlukose@gmail.com>
Reviewed-by: Derek J. Clark <derekjohn.clark@gmail.com>
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Signed-off-by: Rong Zhang <i@rong.moe>
Link: https://patch.msgid.link/20261019-lwmi-wmi-new-api-v5-2-71557d28d058@rong.moe
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/lenovo/wmi-capdata.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/platform/x86/lenovo/wmi-capdata.c b/drivers/platform/x86/lenovo/wmi-capdata.c
index d5e9615661364..58787da959b4a 100644
--- a/drivers/platform/x86/lenovo/wmi-capdata.c
+++ b/drivers/platform/x86/lenovo/wmi-capdata.c
@@ -774,13 +774,11 @@ static int lwmi_cd_setup(struct lwmi_cd_priv *priv, enum lwmi_cd_type type)
/**
* lwmi_cd01_notifier_call() - Call method for cd01 notifier.
- * block call chain.
- * @nb: The notifier_block registered to lenovo-wmi-events driver.
+ * @nb: The cd01 ACPI notifier_block.
* @action: Unused.
* @data: The ACPI event.
*
- * For LWMI_EVENT_THERMAL_MODE, set current_mode and notify platform_profile
- * of a change.
+ * Refresh cached capdata on AC status change.
*
* Return: notifier_block status.
*/
@@ -799,8 +797,16 @@ static int lwmi_cd01_notifier_call(struct notifier_block *nb, unsigned long acti
switch (event->type) {
case ACPI_AC_NOTIFY_STATUS:
ret = lwmi_cd_cache(priv);
- if (ret)
- return NOTIFY_BAD;
+ if (ret) {
+ dev_warn(&priv->wdev->dev,
+ "failed to refresh capdata on AC change: %d\n", ret);
+
+ /*
+ * Our error is non-fatal for others, and we still want
+ * the other event consumers to process it.
+ */
+ return NOTIFY_DONE;
+ }
return NOTIFY_OK;
default:
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0945/1257] gpiolib: Free chip resources when allocating the label fails
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (943 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0944/1257] platform/x86: lenovo-wmi-capdata: Do not stop the AC notifier chain on error Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0946/1257] ALSA: line6: Handle period elapsed calls outside the locks Greg Kroah-Hartman
` (53 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baek Kyu, Kim, Bartosz Golaszewski,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baek Kyu, Kim <pocj8ur4in@gmail.com>
[ Upstream commit 8381e1f15e27087fcb6f07046a526ac8b9b9b2b9 ]
If desc_set_label() fails after the chip's request callback succeeds,
gpiod_request_commit() clears GPIOD_FLAG_REQUESTED without calling the
free callback. The caller receives an error and has no GPIO to release,
leaving resources acquired by the request callback held.
Call the chip's free callback, if present, before clearing the requested
bit on label allocation failure. Leave request callback errors on the
existing path to avoid freeing a failed request.
Cc: stable@vger.kernel.org
Fixes: 1f2bcb8c8ccd ("gpio: protect the descriptor label with SRCU")
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Link: https://patch.msgid.link/20261018044456.1259250-1-pocj8ur4in@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpiolib.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index c0394c7d6279b..239c0d54843b3 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2627,10 +2627,13 @@ int gpiod_request_commit(struct gpio_desc *desc, const char *label)
ret = desc_set_label(desc, label ? : "?");
if (ret)
- goto out_clear_bit;
+ goto out_free_gpio;
return 0;
+out_free_gpio:
+ if (guard.gc->free)
+ guard.gc->free(guard.gc, offset);
out_clear_bit:
clear_bit(GPIOD_FLAG_REQUESTED, &desc->flags);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0946/1257] ALSA: line6: Handle period elapsed calls outside the locks
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (944 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0945/1257] gpiolib: Free chip resources when allocating the label fails Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0947/1257] gpio: davinci: Clear interrupt status in every bank on suspend Greg Kroah-Hartman
` (52 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Takashi Iwai, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 443ed4edc2678cc51c5a01e7dffc4c890be40051 ]
LINE6 driver may call snd_pcm_period_elapsed() for both playback and
capture substreams at processing the playback substream, and this may
lead to a ABBA deadlock.
Move the actual calls of snd_pcm_period_elapsed() outside the locks
for avoiding it. The capture period notification at submitting the
initial playback URBs (only with the impulse mode) is simply skipped,
as it's done in the lock context; it'll be caught up at the next
period.
Fixes: f56742cc4189 ("ALSA: line6: Add LINE6_CAP_IN_NEEDS_OUT, a void playback stream during capture")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-5a9de389-e6ea-410d-8322-e74e14152603
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261020113118.234689-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/line6/capture.c | 25 ++++++++++++++++---------
sound/usb/line6/capture.h | 2 +-
sound/usb/line6/playback.c | 31 +++++++++++++++++++++----------
3 files changed, 38 insertions(+), 20 deletions(-)
diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c
index 6dbaf30232f97..ceee51eeda0df 100644
--- a/sound/usb/line6/capture.c
+++ b/sound/usb/line6/capture.c
@@ -125,24 +125,21 @@ void line6_capture_copy(struct snd_line6_pcm *line6pcm, char *fbuf, int fsize)
line6pcm->in.pos_done -= runtime->buffer_size;
}
-void line6_capture_check_period(struct snd_line6_pcm *line6pcm, int length)
+/* update the capture position and check whether we need period_elapsed call */
+bool line6_capture_check_period(struct snd_line6_pcm *line6pcm, int length)
{
- struct snd_pcm_substream *substream =
- get_substream(line6pcm, SNDRV_PCM_STREAM_CAPTURE);
-
line6pcm->in.bytes += length;
if (line6pcm->in.bytes >= line6pcm->in.period) {
line6pcm->in.bytes %= line6pcm->in.period;
- spin_unlock(&line6pcm->in.lock);
- snd_pcm_period_elapsed(substream);
- spin_lock(&line6pcm->in.lock);
+ return true;
}
+ return false;
}
/*
* Callback for completed capture URB.
*/
-static void audio_in_callback(struct urb *urb)
+static bool handle_audio_in(struct urb *urb)
{
int i, index, length = 0, shutdown = 0;
struct snd_line6_pcm *line6pcm = (struct snd_line6_pcm *)urb->context;
@@ -207,8 +204,18 @@ static void audio_in_callback(struct urb *urb)
if (!test_bit(LINE6_STREAM_IMPULSE, &line6pcm->in.running) &&
test_bit(LINE6_STREAM_PCM, &line6pcm->in.running))
- line6_capture_check_period(line6pcm, length);
+ return line6_capture_check_period(line6pcm, length);
}
+
+ return false;
+}
+
+static void audio_in_callback(struct urb *urb)
+{
+ struct snd_line6_pcm *line6pcm = (struct snd_line6_pcm *)urb->context;
+
+ if (handle_audio_in(urb))
+ snd_pcm_period_elapsed(get_substream(line6pcm, SNDRV_PCM_STREAM_CAPTURE));
}
/* open capture callback */
diff --git a/sound/usb/line6/capture.h b/sound/usb/line6/capture.h
index 90572dae134ee..628315389efcf 100644
--- a/sound/usb/line6/capture.h
+++ b/sound/usb/line6/capture.h
@@ -17,7 +17,7 @@ extern const struct snd_pcm_ops snd_line6_capture_ops;
extern void line6_capture_copy(struct snd_line6_pcm *line6pcm, char *fbuf,
int fsize);
-extern void line6_capture_check_period(struct snd_line6_pcm *line6pcm,
+extern bool line6_capture_check_period(struct snd_line6_pcm *line6pcm,
int length);
extern int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm);
extern int line6_submit_audio_in_all_urbs(struct snd_line6_pcm *line6pcm);
diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c
index aa6ddf8746a0a..e93a16f6958e3 100644
--- a/sound/usb/line6/playback.c
+++ b/sound/usb/line6/playback.c
@@ -136,6 +136,8 @@ static void add_monitor_signal(struct urb *urb_out, unsigned char *signal,
/*
Find a free URB, prepare audio data, and submit URB.
must be called in line6pcm->out.lock context
+ Returns 1 if snd_pcm_period_elapsed() needs to be called for the
+ capture stream after releasing the lock, 0 if not, or a negative error
*/
static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
{
@@ -151,6 +153,7 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
line6pcm->properties->rates.rats[0].den *
(line6pcm->line6->intervals_per_second / LINE6_ISO_INTERVAL);
struct urb *urb_out;
+ bool capture_period_elapsed = false;
index = find_first_zero_bit(&line6pcm->out.active_urbs,
line6pcm->line6->iso_buffers);
@@ -260,8 +263,9 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
urb_out->transfer_buffer,
urb_out->
transfer_buffer_length);
- line6_capture_check_period(line6pcm,
- urb_out->transfer_buffer_length);
+ capture_period_elapsed =
+ line6_capture_check_period(line6pcm,
+ urb_out->transfer_buffer_length);
}
} else {
if (!(line6pcm->line6->properties->capabilities & LINE6_CAP_HWMON)
@@ -283,24 +287,26 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
dev_err(line6pcm->line6->ifcdev,
"URB out #%d submission failed (%d)\n", index, ret);
- return 0;
+ return capture_period_elapsed;
}
/*
Submit all currently available playback URBs.
must be called in line6pcm->out.lock context
+ The capture period notification is skipped here since we can't call
+ snd_pcm_period_elapsed() in the lock; it'll be caught up at the next one.
*/
int line6_submit_audio_out_all_urbs(struct snd_line6_pcm *line6pcm)
{
- int ret = 0, i;
+ int ret, i;
for (i = 0; i < line6pcm->line6->iso_buffers; ++i) {
ret = submit_audio_out_urb(line6pcm);
if (ret < 0)
- break;
+ return ret;
}
- return ret;
+ return 0;
}
/*
@@ -316,6 +322,8 @@ static void audio_out_callback(struct urb *urb)
const int bytes_per_frame =
line6pcm->properties->bytes_per_channel *
line6pcm->properties->playback_hw.channels_max;
+ bool capture_period_elapsed = false;
+ bool playback_period_elapsed = false;
#if USE_CLEAR_BUFFER_WORKAROUND
memset(urb->transfer_buffer, 0, urb->transfer_buffer_length);
@@ -358,19 +366,22 @@ static void audio_out_callback(struct urb *urb)
shutdown = 1;
if (!shutdown) {
- submit_audio_out_urb(line6pcm);
+ capture_period_elapsed = submit_audio_out_urb(line6pcm) > 0;
if (test_bit(LINE6_STREAM_PCM, &line6pcm->out.running)) {
line6pcm->out.bytes += length;
if (line6pcm->out.bytes >= line6pcm->out.period) {
line6pcm->out.bytes %= line6pcm->out.period;
- spin_unlock(&line6pcm->out.lock);
- snd_pcm_period_elapsed(substream);
- spin_lock(&line6pcm->out.lock);
+ playback_period_elapsed = true;
}
}
}
spin_unlock_irqrestore(&line6pcm->out.lock, flags);
+
+ if (capture_period_elapsed)
+ snd_pcm_period_elapsed(get_substream(line6pcm, SNDRV_PCM_STREAM_CAPTURE));
+ if (playback_period_elapsed)
+ snd_pcm_period_elapsed(substream);
}
/* open playback callback */
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0947/1257] gpio: davinci: Clear interrupt status in every bank on suspend
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (945 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0946/1257] ALSA: line6: Handle period elapsed calls outside the locks Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0948/1257] gpio: pca953x: Preserve wakeup accounting on parent IRQ failure Greg Kroah-Hartman
` (51 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sahaj Chaudhari, Bartosz Golaszewski,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sahaj Chaudhari <sahaj123.sc@gmail.com>
[ Upstream commit 800d7627f552bbf602a1736b638aee0ada3fbf87 ]
davinci_gpio_save_context() saves the registers of each 32-GPIO
register bank, but clears interrupt status only after the loop. At that
point g refers to the last bank, so pending status in all preceding
banks is left uncleared.
Move the interrupt-status write into the per-bank loop so that the
existing suspend-time clearing covers every register bank. Single-bank
controllers retain the same behavior.
Fixes: 0651a730924b ("gpio: davinci: Add support for system suspend/resume PM")
Cc: stable@vger.kernel.org
Signed-off-by: Sahaj Chaudhari <sahaj123.sc@gmail.com>
Link: https://patch.msgid.link/20261018170622.3406158-1-sahaj123.sc@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-davinci.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index cccbaea1dec24..fc2b9bef7efc8 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -611,10 +611,10 @@ static void davinci_gpio_save_context(struct davinci_gpio_controller *chips,
context->set_data = readl_relaxed(&g->set_data);
context->set_rising = readl_relaxed(&g->set_rising);
context->set_falling = readl_relaxed(&g->set_falling);
- }
- /* Clear all interrupt status registers */
- writel_relaxed(GENMASK(31, 0), &g->intstat);
+ /* Clear stale interrupt status for this bank. */
+ writel_relaxed(GENMASK(31, 0), &g->intstat);
+ }
}
static void davinci_gpio_restore_context(struct davinci_gpio_controller *chips,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0948/1257] gpio: pca953x: Preserve wakeup accounting on parent IRQ failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (946 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0947/1257] gpio: davinci: Clear interrupt status in every bank on suspend Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0949/1257] gpio: pca953x: Handle direction register read errors in IRQ paths Greg Kroah-Hartman
` (50 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sahaj Chaudhari, Geert Uytterhoeven,
Bartosz Golaszewski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sahaj Chaudhari <sahaj123.sc@gmail.com>
[ Upstream commit a38bf551726a21c9bcc001b02164f30378b64b64 ]
pca953x_irq_set_wake() updates wakeup_path before asking the parent
IRQ controller to change its wake state. If irq_set_irq_wake() fails,
the IRQ core rolls back its wake state but the driver's counter remains
changed.
A failed enable can therefore leave the expander marked as part of the
wakeup path when no child IRQ has successfully enabled wakeup. A failed
disable can make the driver stop retaining power even though wakeup is
still enabled. The suspend and resume paths use this counter to decide
whether to disable or enable the regulator.
Update wakeup_path only after the parent operation succeeds, leaving it
unchanged on error.
Fixes: f70fbc15bae2 ("gpio: pca953x: Configure wake-up path when wake-up is enabled")
Cc: stable@vger.kernel.org
Signed-off-by: Sahaj Chaudhari <sahaj123.sc@gmail.com>
Fixes: f70fbc15bae2c89f ("gpio: pca953x: Configure wake-up path when wake-up is enabled")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20261018161042.3298045-1-sahaj123.sc@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-pca953x.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index aac9ea7520b60..869ed4264d48a 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -838,13 +838,18 @@ static int pca953x_irq_set_wake(struct irq_data *d, unsigned int on)
{
struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
struct pca953x_chip *chip = gpiochip_get_data(gc);
+ int ret;
+
+ ret = irq_set_irq_wake(chip->client->irq, on);
+ if (ret)
+ return ret;
if (on)
atomic_inc(&chip->wakeup_path);
else
atomic_dec(&chip->wakeup_path);
- return irq_set_irq_wake(chip->client->irq, on);
+ return 0;
}
static void pca953x_irq_bus_lock(struct irq_data *d)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0949/1257] gpio: pca953x: Handle direction register read errors in IRQ paths
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (947 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0948/1257] gpio: pca953x: Preserve wakeup accounting on parent IRQ failure Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0950/1257] blk-mq: clear stale inactive flag on hctx reuse Greg Kroah-Hartman
` (49 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sahaj Chaudhari, Bartosz Golaszewski,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sahaj Chaudhari <sahaj123.sc@gmail.com>
[ Upstream commit a0fe269293509acdd93b9cfb3f46636f7b91b33a ]
Three IRQ paths ignore the result of reading the direction registers
and then use the destination bitmap. pca953x_read_regs() does not populate
that bitmap when regmap_bulk_read() fails, leaving the callers to use
uninitialized stack data.
This can select incorrect GPIOs for direction changes during IRQ bus
synchronization, corrupt the saved input state during IRQ setup, or
produce incorrect pending interrupt decisions.
Check the read result at all three sites. Release irq_lock without
changing GPIO directions on failure, leave the IRQ history untouched
when pending detection fails, and propagate the error from IRQ setup.
The read helper already logs the error.
Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache")
Cc: stable@vger.kernel.org
Signed-off-by: Sahaj Chaudhari <sahaj123.sc@gmail.com>
Link: https://patch.msgid.link/20261018165003.3372368-1-sahaj123.sc@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-pca953x.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index 869ed4264d48a..afec5ec236968 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -867,6 +867,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
DECLARE_BITMAP(irq_mask, MAX_LINE);
DECLARE_BITMAP(reg_direction, MAX_LINE);
int level;
+ int ret;
guard(mutex)(&chip->i2c_lock);
@@ -885,7 +886,9 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
}
/* Switch direction to input if needed */
- pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ if (ret)
+ goto out;
bitmap_or(irq_mask, chip->irq_trig_fall, chip->irq_trig_raise, gc->ngpio);
bitmap_or(irq_mask, irq_mask, chip->irq_trig_level_high, gc->ngpio);
@@ -895,6 +898,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
for_each_andnot_bit(level, irq_mask, reg_direction, gc->ngpio)
pca953x_gpio_direction_input_unlocked(&chip->gpio_chip, level);
+out:
mutex_unlock(&chip->irq_lock);
}
@@ -989,7 +993,9 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
}
/* Remove output pins from the equation */
- pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ if (ret)
+ return false;
bitmap_copy(old_stat, chip->irq_stat, gc->ngpio);
@@ -1089,7 +1095,9 @@ static int pca953x_irq_setup(struct pca953x_chip *chip, int irq_base)
* interrupt. We have to rely on the previous read for
* this purpose.
*/
- pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+ if (ret)
+ return ret;
bitmap_and(chip->irq_stat, irq_stat, reg_direction, gc->ngpio);
mutex_init(&chip->irq_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0950/1257] blk-mq: clear stale inactive flag on hctx reuse
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (948 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0949/1257] gpio: pca953x: Handle direction register read errors in IRQ paths Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0951/1257] selftests/landlock: Fix snprintf truncation checks in test files Greg Kroah-Hartman
` (48 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nirmoy Das, Jens Axboe, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmoy Das <nirmoyd@nvidia.com>
[ Upstream commit afc1de47a7ab607ae6403c4bfda36b0bf3cd342f ]
When the last CPU mapped to an hctx goes offline,
blk_mq_hctx_notify_offline() sets BLK_MQ_S_INACTIVE. Updating the
number of hardware queues exits every hctx and parks it on
q->unused_hctx_list. A later update can reuse a parked hctx through
blk_mq_alloc_and_init_hctx(), at any queue index, and nothing clears
the flag.
If the reused hctx is mapped to an online CPU, blk_mq_get_tag() keeps
returning BLK_MQ_NO_TAG for it. __blk_mq_alloc_requests() sleeps and
retries, expecting CPU hotplug to move the task to another CPU, so a
task that stays on that CPU never gets a tag. Onlining the original CPU
doesn't recover it either, because blk_mq_hctx_notify_online() only
clears the flag on the hctx that CPU now maps to.
Clear BLK_MQ_S_INACTIVE in blk_mq_init_hctx() so a reused hctx starts
like a freshly allocated one. A reused hctx has no cpuhp instances at
that point, so the offline callback can't set the flag again before
blk_mq_add_hw_queues_cpuhp() registers it. Clearing the flag in
blk_mq_exit_hctx() is not enough, because a parked hctx keeps its cpuhp
instances until blk_mq_remove_hw_queues_cpuhp(). Preserve the other
hctx state flags.
Reproduced with null_blk on v7.3 in a four-vCPU arm64 QEMU/KVM guest:
modprobe null_blk nr_devices=0
mkdir /sys/kernel/config/nullb/nullb0
cd /sys/kernel/config/nullb/nullb0
echo 4 > submit_queues; echo 1 > memory_backed; echo 16 > size
echo 1 > power
echo 0 > /sys/devices/system/cpu/cpu3/online
echo 2 > submit_queues
echo 4 > submit_queues
Offlining CPU3 marks hctx3 inactive. After the two updates it comes back
as hctx1 and is mapped to CPU0:
# cat /sys/block/nullb0/mq/1/cpu_list
0
# cat /sys/kernel/debug/block/nullb0/hctx1/state
INACTIVE
A 4K O_DIRECT read pinned to CPU0 hangs in D state, while the same read
on CPU1 and CPU2 completes. Onlining CPU3 again leaves hctx1 inactive
and the CPU0 read still hangs. With this change hctx1 state is empty and
the reads on CPU0, CPU1 and CPU2 complete, before and after onlining
CPU3.
Fixes: bf0beec0607d ("blk-mq: drain I/O when all CPUs in a hctx are offline")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Link: https://patch.msgid.link/20261020125129.430600-1-nirmoyd@nvidia.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index e929f94b25c7f..5a5dc66fc3b15 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4003,6 +4003,7 @@ static int blk_mq_init_hctx(struct request_queue *q,
goto fail;
hctx->queue_num = hctx_idx;
+ clear_bit(BLK_MQ_S_INACTIVE, &hctx->state);
hctx->tags = set->tags[hctx_idx];
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0951/1257] selftests/landlock: Fix snprintf truncation checks in test files
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (949 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0950/1257] blk-mq: clear stale inactive flag on hctx reuse Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0952/1257] f2fs: dont use truncate_inode_pages_final() on live inodes Greg Kroah-Hartman
` (47 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haofeng Li, Wang Yan,
Günther Noack, Mickaël Salaün, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yan <wangyan01@kylinos.cn>
[ Upstream commit 8e4c736cffdd6b133f6498e0d40ba60dc6819d43 ]
Commit b566f7a4f0e4 ("selftests/landlock: Fix snprintf truncation checks
in audit helpers") fixed the truncation detection in audit.h by changing
the comparison from ">" to ">=" to correctly handle the edge case where
snprintf returns a value equal to the buffer size.
However, the same pattern exists in ptrace_test.c, audit_test.c, and
net_test.c and was not fixed. snprintf() returns the number of
characters that would have been written, excluding the terminating NUL
byte. When the output is truncated, this return value equals or exceeds
the buffer size. The existing ">" check therefore fails to detect
truncation when the return value equals the buffer size.
Fix these remaining instances to use ">=" for truncation detection,
matching the fix in audit.h.
Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs")
Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Reviewed-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20260626070016.61049-1-wangyan01@kylinos.cn
Cc: stable@vger.kernel.org
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/landlock/audit_test.c | 2 +-
tools/testing/selftests/landlock/net_test.c | 4 ++--
tools/testing/selftests/landlock/ptrace_test.c | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/landlock/audit_test.c b/tools/testing/selftests/landlock/audit_test.c
index 72b5612375ddb..4bea8c880a4d3 100644
--- a/tools/testing/selftests/landlock/audit_test.c
+++ b/tools/testing/selftests/landlock/audit_test.c
@@ -31,7 +31,7 @@ static int matches_log_signal(struct __test_metadata *const _metadata,
log_match_len =
snprintf(log_match, sizeof(log_match), log_template, opid);
- if (log_match_len > sizeof(log_match))
+ if (log_match_len >= sizeof(log_match))
return -E2BIG;
return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match,
diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
index 16afbfdf06bb2..50b637354b51d 100644
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -2878,7 +2878,7 @@ static int matches_auditlog(const int audit_fd, const char *const blockers,
log_match_len = snprintf(log_match, sizeof(log_match),
log_with_addrport_tmpl, blockers,
dir_addr, addr, dir_port, port);
- if (log_match_len > sizeof(log_match))
+ if (log_match_len >= sizeof(log_match))
return -E2BIG;
return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match,
@@ -3173,7 +3173,7 @@ static int matches_log_connect_bound(int audit_fd, const char *const blockers,
log_match_len = snprintf(log_match, sizeof(log_match), log_template,
blockers, addr, lport, addr, dport);
- if (log_match_len > sizeof(log_match))
+ if (log_match_len >= sizeof(log_match))
return -E2BIG;
return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match,
diff --git a/tools/testing/selftests/landlock/ptrace_test.c b/tools/testing/selftests/landlock/ptrace_test.c
index 2644445a9d020..e0e7f95e889b3 100644
--- a/tools/testing/selftests/landlock/ptrace_test.c
+++ b/tools/testing/selftests/landlock/ptrace_test.c
@@ -305,7 +305,7 @@ static int matches_log_ptrace(struct __test_metadata *const _metadata,
log_match_len =
snprintf(log_match, sizeof(log_match), log_template, opid);
- if (log_match_len > sizeof(log_match))
+ if (log_match_len >= sizeof(log_match))
return -E2BIG;
return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0952/1257] f2fs: dont use truncate_inode_pages_final() on live inodes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (950 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0951/1257] selftests/landlock: Fix snprintf truncation checks in test files Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0953/1257] drm/amdgpu: require _PR3 for BOCO Greg Kroah-Hartman
` (46 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Daeho Jeong, Chao Yu,
Jaegeuk Kim, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <daehojeong@google.com>
[ Upstream commit 74bbd6ada01f91fcad60608e0417bf45a9fa99e6 ]
truncate_inode_pages_final() is meant to be called from ->evict_inode.
It sets AS_EXITING on the mapping, and nothing ever clears it, to tell
the VM that the inode is going away.
f2fs calls it in two places where the inode stays live:
- F2FS_IOC_START_ATOMIC_REPLACE uses it to drop the page cache of the
original inode before setting i_size to 0. The atomic write then
goes on through this inode.
- f2fs_abort_atomic_write() uses it to drop the uncommitted data. It
is called on eviction, but also on the last writer's close in
f2fs_release_file(), from f2fs_file_flush() when the atomic writer
exits, from F2FS_IOC_ABORT_ATOMIC_WRITE and when
F2FS_IOC_COMMIT_ATOMIC_WRITE fails.
Other processes may still have the file open or mapped in all of these
cases. The mapping then stays marked as exiting for as long as the
inode is in memory. This stops reclaim from storing workingset shadow
entries for it and breaks any code that assumes an exiting mapping has
no users left.
All we need in both places is to drop the page cache, so use
truncate_inode_pages(mapping, 0) instead. The eviction path is not
affected, because f2fs_pre_evict_inode() still calls
truncate_inode_pages_final() after f2fs_abort_atomic_write().
Cc: stable@kernel.org
Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
Fixes: 41e8f85a75fc ("f2fs: introduce F2FS_IOC_START_ATOMIC_REPLACE")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 2 +-
fs/f2fs/segment.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index fd72eb4563de2..c477e6d153145 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -2460,7 +2460,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
fi->original_i_size = isize;
if (truncate) {
set_inode_flag(inode, FI_ATOMIC_REPLACE);
- truncate_inode_pages_final(inode->i_mapping);
+ truncate_inode_pages(inode->i_mapping, 0);
f2fs_i_size_write(inode, 0);
isize = 0;
}
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 381b0a9875946..f3a73b6c24c3f 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -194,7 +194,7 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)
return;
if (clean)
- truncate_inode_pages_final(inode->i_mapping);
+ truncate_inode_pages(inode->i_mapping, 0);
release_atomic_write_cnt(inode);
clear_inode_flag(inode, FI_ATOMIC_COMMITTED);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0953/1257] drm/amdgpu: require _PR3 for BOCO
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (951 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0952/1257] f2fs: dont use truncate_inode_pages_final() on live inodes Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0954/1257] drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0 Greg Kroah-Hartman
` (45 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Luigi Lauro,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luigi Lauro <luigi.lauro@gmail.com>
[ Upstream commit 28f3d169f162ca7e803c5a1f7e1bb55bdc915d1c ]
amdgpu_device_supports_boco() returns true for an AMD_IS_PX device on a
system with a hybrid ATPX method even when the device has no ACPI power
resource (_PR3). On an APU mini PC with a discrete GPU attached over
OCuLink, the iGPU's ATPX method reports hybrid graphics, the dGPU is
flagged AMD_IS_PX, and runtime PM in auto mode picks BOCO:
amdgpu: ATPX Hybrid Graphics
amdgpu 0000:c6:00.0: Using BOCO for runtime pm
In BOCO mode the driver leaves powering the device off to the PCI core,
which can only do it through _PR3 on the upstream bridge. No device on
this dGPU's path has _PR3, so when it runtime suspends the card stays
powered, with its fans at about 700 rpm.
Require has_pr3 for BOCO, as the function's description ("dGPU with ACPI
power resources") says. The same card then picks BACO, which powers it
down:
amdgpu 0000:c6:00.0: Using BACO for runtime pm
This only changes systems with a hybrid ATPX method and no _PR3 on the
dGPU's upstream bridge, where BOCO cannot cut the power today. Tested on
one such system only, an RX 9070 XT (Navi 48) over OCuLink with a Ryzen
AI 9 HX 470, with the change backported to 7.2.9: the stock module logs
"Using BOCO", the patched one "Using BACO"; BACO runtime suspend powers
the card off and it resumes cleanly. Not tested on a hybrid laptop or a
Thunderbolt eGPU.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5980
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luigi Lauro <luigi.lauro@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1a039805354a44aab7abb2a6e685212d48b17a5e)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 9269e780feb73..9128b60891c80 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -583,10 +583,8 @@ bool amdgpu_device_supports_boco(struct amdgpu_device *adev)
if (!IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE))
return false;
- if (adev->has_pr3 ||
- ((adev->flags & AMD_IS_PX) && amdgpu_is_atpx_hybrid()))
- return true;
- return false;
+ /* BOCO needs a platform power resource (_PR3) to cut the power */
+ return adev->has_pr3;
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0954/1257] drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (952 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0953/1257] drm/amdgpu: require _PR3 for BOCO Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0955/1257] drm/amdgpu: reset CIK ASIC on Apple boards " Greg Kroah-Hartman
` (44 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Maciej Kucharek,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Kucharek <qchcio@gmail.com>
[ Upstream commit 5b56ede880317bd912f914d5cd38ba1d357677fa ]
On MacBookPros with switchable graphics, the firmware puts VRAM at MC
address 0 when the iGPU is enabled. The EFI stub enables the iGPU on
these machines through apple_set_os(). On a MacBookPro11,5 (Radeon R9
M370X, 1002:6821, subsystem 106b:0149), the driver adopts this layout
at init:
MC_VM_FB_LOCATION=0x007f0000, HDP_NONSURFACE_BASE=0
VRAM at 0x0-0x7fffffff, GART table at 0x1400000
The driver posts the ASIC again on S3 resume and after a GPU reset.
The VBIOS asic_init table then moves VRAM back to the VBIOS default:
MC_VM_FB_LOCATION=0xf47ff400, HDP_NONSURFACE_BASE=0xf4000000
gmc_v6_0 does not reprogram these registers. The GART table is then
no longer in VRAM, and the gfx ring test times out:
amdgpu: ring gfx test failed (-110)
amdgpu: resume of IP block <gfx_v6_0> failed -110
Reset and post the ASIC at driver load on Apple boards with VRAM at 0.
The driver then uses the VBIOS layout (VRAM at 0xf400000000) from the
start, and later posts keep it. After the reset, FB_BASE is not 0, so
a module reload does not reset the ASIC again.
The test is the same one that commit c54e4d105077 ("drm/amdgpu: make
Mac FB workaround generic") uses: an Apple subsystem vendor and VRAM at
0. The VI quirk for the MacBookPro14,3 resets at load for the same
reason:
commit b6b1d9721851 ("drm/amdgpu: reset VI ASIC on MacBookPro14,3")
Other Apple SI boards get the same reset if FB_BASE reads 0 at load.
Tested on a MacBookPro11,5 with 7.2.5 and this patch: the panel comes
up at boot, and 4 of 4 deep S3 cycles resume. Without the patch, S3
resume fails every time. The GPU reset path is not tested.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5978
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Maciej Kucharek <qchcio@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 60dd16ae10f286cb9cce5b6027b2d5ee869637af)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/si.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
index 7100f30ffeffa..a765371ea4bc1 100644
--- a/drivers/gpu/drm/amd/amdgpu/si.c
+++ b/drivers/gpu/drm/amd/amdgpu/si.c
@@ -1512,6 +1512,16 @@ static void si_invalidate_hdp(struct amdgpu_device *adev,
static bool si_need_reset_on_init(struct amdgpu_device *adev)
{
+ /*
+ * MacBookPros with switchable graphics put VRAM at 0 when the iGPU
+ * is enabled. Any later post (S3 resume, GPU reset) moves it back to
+ * the vbios default, so reset and post on load to start with the
+ * vbios layout.
+ */
+ if (adev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+ !(RREG32(mmMC_VM_FB_LOCATION) & MC_VM_FB_LOCATION__FB_BASE_MASK))
+ return true;
+
return false;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0955/1257] drm/amdgpu: reset CIK ASIC on Apple boards with VRAM at 0
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (953 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0954/1257] drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0 Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0956/1257] drm/amdgpu: reset VI " Greg Kroah-Hartman
` (43 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Maciej Kucharek,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Kucharek <qchcio@gmail.com>
[ Upstream commit 095f634ea0aa5b9da19495520b5fc1a155b2c137 ]
On MacBookPros with switchable graphics, the firmware puts VRAM at MC
address 0 when the iGPU is enabled. A later post (S3 resume, GPU
reset) moves VRAM back to the VBIOS default. The SI fix resets and
posts the ASIC at load, so the driver uses the VBIOS layout from the
start:
"drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0"
No MacBookPro has a CIK GPU, and no affected CIK board is known. Add
the same test to cik_need_reset_on_init(), so that SI, CIK and VI
handle this firmware layout in the same way. gmc_v7_0 reads
MC_VM_FB_LOCATION once at init and does not reprogram it. A CIK board
with VRAM at 0 therefore has the same problem as the SI boards.
After the reset, FB_BASE is not 0, so the new test does not fire again
on a module reload.
Only compile-tested.
Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Maciej Kucharek <qchcio@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 6bb4b79d6a6c461b40750fd67cb4e2a070e20b67)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/cik.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
index e037c08c85479..71eeaf42fd33a 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik.c
@@ -1927,6 +1927,16 @@ static bool cik_need_reset_on_init(struct amdgpu_device *adev)
{
u32 clock_cntl, pc;
+ /*
+ * MacBookPros with switchable graphics put VRAM at 0 when the iGPU
+ * is enabled. Any later post (S3 resume, GPU reset) moves it back to
+ * the vbios default, so reset and post on load to start with the
+ * vbios layout.
+ */
+ if (adev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+ !(RREG32(mmMC_VM_FB_LOCATION) & MC_VM_FB_LOCATION__FB_BASE_MASK))
+ return true;
+
if (adev->flags & AMD_IS_APU)
return false;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0956/1257] drm/amdgpu: reset VI ASIC on Apple boards with VRAM at 0
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (954 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0955/1257] drm/amdgpu: reset CIK ASIC on Apple boards " Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0957/1257] drm/amdkfd: fix doorbell allocation race creating duplicate allocations Greg Kroah-Hartman
` (42 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Maciej Kucharek,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Kucharek <qchcio@gmail.com>
[ Upstream commit 92a5184787b81e67f7b831ad860ca9b053505cf8 ]
On MacBookPros with switchable graphics, the firmware puts VRAM at MC
address 0 when the iGPU is enabled. A later post (S3 resume, GPU
reset) moves VRAM back to the VBIOS default. gmc_v8_0 reads
MC_VM_FB_LOCATION once at init and reprograms it only on SR-IOV. On
bare metal, the driver then keeps using the old layout.
vi_reset_quirks[] handles this for the MacBookPro14,3 by PCI ID:
commit b6b1d9721851 ("drm/amdgpu: reset VI ASIC on MacBookPro14,3")
Add the test that SI and CIK use: an Apple subsystem vendor and VRAM at
0. Other Polaris MacBookPros then get the same reset at load, for
example the MacBookPro13,3 if its firmware leaves VRAM at 0. These
boards are not tested.
Keep vi_reset_quirks[]. Its MacBookPro15,1 entries fix a different
failure, a module reload after S3:
commit a5be7ad8f5f0 ("drm/amdgpu: reset VI ASIC on MacBookPro15,1")
VRAM is not at 0 at that point, so the new test may not cover it.
After the reset, FB_BASE is not 0, so the new test does not fire again
on a module reload.
Only compile-tested.
Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Maciej Kucharek <qchcio@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c2335b685b1e1e387f2fea1c67f56b5b8a8b6dc6)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/vi.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index e926d09128e0b..50ba2f140efba 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -1405,6 +1405,16 @@ static bool vi_need_reset_on_init(struct amdgpu_device *adev)
unsigned int i;
u32 clock_cntl, pc;
+ /*
+ * MacBookPros with switchable graphics put VRAM at 0 when the iGPU
+ * is enabled. Any later post (S3 resume, GPU reset) moves it back to
+ * the vbios default, so reset and post on load to start with the
+ * vbios layout.
+ */
+ if (adev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+ !(RREG32(mmMC_VM_FB_LOCATION) & MC_VM_FB_LOCATION__FB_BASE_MASK))
+ return true;
+
for (i = 0; i < ARRAY_SIZE(vi_reset_quirks); i++)
if (adev->pdev->device == vi_reset_quirks[i].device &&
adev->pdev->subsystem_vendor == vi_reset_quirks[i].subsystem_vendor &&
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0957/1257] drm/amdkfd: fix doorbell allocation race creating duplicate allocations
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (955 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0956/1257] drm/amdgpu: reset VI " Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0958/1257] drm/amd/display: dont WARN when removing an unallocated MST payload Greg Kroah-Hartman
` (41 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Henry Martin, Felix Kuehling,
Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <bsdhenrymartin@gmail.com>
[ Upstream commit bebad45050945a3d668d6701fb77ae2571c5d44b ]
The check-and-allocate sequence on pdd->qpd.proc_doorbells is
lockless at every call site of kfd_alloc_process_doorbells():
kfd_get_process_doorbells() (mmap of /dev/kfd),
kfd_ioctl_create_queue() and the CRIU restore path each test the
pointer under different locking (or none), so two racing threads can
both observe NULL and each allocate a doorbell BO and bitmap,
orphaning one allocation and handing the two mappings different
backing pages.
Move the serialization into kfd_alloc_process_doorbells() itself,
using a new per-process-device mutex so all three call sites are
covered regardless of their own locking. The device-global
kfd->doorbell_mutex is not suitable here: it is acquired under
dqm->lock on the kernel-doorbell path (start_cpsch() -> pm_init() ->
kq_initialize() -> kfd_get_kernel_doorbell()), so holding it across
the sleeping allocations above would create a lock-ordering
inversion with dqm->lock via TTM eviction, and it would also
serialize doorbell setup of unrelated processes behind a
device-wide lock for per-process state.
This issue was discovered by Tencent CodeBuddy Security.
v3 (Felix Kuehling):
- Removed unlocked check in kfd_get_process_doorbell flagged as
problematic by Sashiko Bot. Fall back to the locked check inside
kfd_alloc_process_doorbells
- Added missing mutex_destroy
v4 (Felix Kuehling):
- Removed unlocked checks around other kfd_alloc_process_doorbells calls
Fixes: 16f0013157bf ("drm/amdkfd: Allocate doorbells only when needed")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4e27ba5ad5f76932d4f6cbacd25c81c2dd40ec4a)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 18 +++++++-----------
drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c | 23 +++++++++++++++++------
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 +++
drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 ++
4 files changed, 29 insertions(+), 17 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 344da6c0e96ad..3081d9aaf053a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -427,12 +427,10 @@ static int kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
}
}
- if (!pdd->qpd.proc_doorbells) {
- err = kfd_alloc_process_doorbells(dev->kfd, pdd);
- if (err) {
- pr_debug("failed to allocate process doorbells\n");
- goto err_bind_process;
- }
+ err = kfd_alloc_process_doorbells(dev->kfd, pdd);
+ if (err) {
+ pr_debug("failed to allocate process doorbells\n");
+ goto err_bind_process;
}
err = kfd_queue_acquire_buffers(pdd, &q_properties);
@@ -2455,11 +2453,9 @@ static int criu_restore_devices(struct kfd_process *p,
goto exit;
}
- if (!pdd->qpd.proc_doorbells) {
- ret = kfd_alloc_process_doorbells(dev->kfd, pdd);
- if (ret)
- goto exit;
- }
+ ret = kfd_alloc_process_doorbells(dev->kfd, pdd);
+ if (ret)
+ goto exit;
}
/*
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
index fdcf7f2d1b5b4..6af268a031f22 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
@@ -239,11 +239,9 @@ phys_addr_t kfd_get_process_doorbells(struct kfd_process_device *pdd)
struct amdgpu_device *adev = pdd->dev->adev;
uint32_t first_db_index;
- if (!pdd->qpd.proc_doorbells) {
- if (kfd_alloc_process_doorbells(pdd->dev->kfd, pdd))
- /* phys_addr_t 0 is error */
- return 0;
- }
+ if (kfd_alloc_process_doorbells(pdd->dev->kfd, pdd))
+ /* phys_addr_t 0 is error */
+ return 0;
first_db_index = amdgpu_doorbell_index_on_bar(adev,
pdd->qpd.proc_doorbells,
@@ -257,12 +255,21 @@ int kfd_alloc_process_doorbells(struct kfd_dev *kfd, struct kfd_process_device *
int r;
struct qcm_process_device *qpd = &pdd->qpd;
+ mutex_lock(&pdd->doorbell_mutex);
+
+ /* Another thread may have won the check-and-allocate race */
+ if (qpd->proc_doorbells) {
+ mutex_unlock(&pdd->doorbell_mutex);
+ return 0;
+ }
+
/* Allocate bitmap for dynamic doorbell allocation */
qpd->doorbell_bitmap = bitmap_zalloc(KFD_MAX_NUM_OF_QUEUES_PER_PROCESS,
GFP_KERNEL);
if (!qpd->doorbell_bitmap) {
DRM_ERROR("Failed to allocate process doorbell bitmap\n");
- return -ENOMEM;
+ r = -ENOMEM;
+ goto unlock;
}
r = init_doorbell_bitmap(&pdd->qpd, kfd);
@@ -284,11 +291,15 @@ int kfd_alloc_process_doorbells(struct kfd_dev *kfd, struct kfd_process_device *
DRM_ERROR("Failed to allocate process doorbells\n");
goto err;
}
+
+ mutex_unlock(&pdd->doorbell_mutex);
return 0;
err:
bitmap_free(qpd->doorbell_bitmap);
qpd->doorbell_bitmap = NULL;
+unlock:
+ mutex_unlock(&pdd->doorbell_mutex);
return r;
}
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index 435bf26929680..aab7292e2cb12 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -786,6 +786,9 @@ struct kfd_process_device {
/* per-process-per device QCM data structure */
struct qcm_process_device qpd;
+ /* Serializes process doorbell allocation for this device */
+ struct mutex doorbell_mutex;
+
/*Apertures*/
uint64_t lds_base;
uint64_t lds_limit;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
index 0a7c1900da959..dda300786bc4e 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -1231,6 +1231,7 @@ static void kfd_process_destroy_pdds(struct kfd_process *p)
}
atomic_dec(&pdd->dev->kfd->kfd_processes_count);
+ mutex_destroy(&pdd->doorbell_mutex);
kfree(pdd);
p->pdds[i] = NULL;
@@ -1788,6 +1789,7 @@ struct kfd_process_device *kfd_create_process_device_data(struct kfd_node *dev,
pdd->dev = dev;
INIT_LIST_HEAD(&pdd->qpd.queues_list);
INIT_LIST_HEAD(&pdd->qpd.priv_queue_list);
+ mutex_init(&pdd->doorbell_mutex);
pdd->qpd.dqm = dev->dqm;
pdd->qpd.pqm = &p->pqm;
pdd->qpd.evicted = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0958/1257] drm/amd/display: dont WARN when removing an unallocated MST payload
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (956 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0957/1257] drm/amdkfd: fix doorbell allocation race creating duplicate allocations Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0959/1257] drm/amdgpu: reject ANONONLY userptrs that span multiple VMAs Greg Kroah-Hartman
` (40 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wayne Lin, Mario Limonciello, Ray Wu,
Daniel Wheeler, Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit b18a7c6d75bcc883b39497863cc88c9ef4c6c85f ]
[Why]
On an MST teardown that runs through the reset path
(dcn31_reset_hw_ctx_wrap -> link_set_dpms_off -> deallocate_mst_payload),
fill_dc_mst_payload_table_from_drm() is asked to remove a payload whose
vcpi is not present in link->mst_stream_alloc_table and trips:
WARNING: .../amdgpu_dm_helpers.c:275 fill_dc_mst_payload_table_from_drm
This is a legitimate case, not an error: deallocate_mst_payload() can be
called for a stream whose MST payload was never programmed into DC's
HW-maintained table (a new stream created for a modeset whose enable
never completed, as already documented in deallocate_mst_payload()).
There is simply nothing to remove.
[How]
Drop the ASSERT and fall through to the fill loop, which rebuilds the
allocation table from the remaining entries. The table ends up unchanged,
which is correct: the payload being removed was never in it.
Note the loop must not early-return here - the caller passes a zeroed
proposed_table, so returning early would zero the whole link's table and
drop the other MST streams sharing the link.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5875
Reviewed-by: Wayne Lin <wayne.lin@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 88a27f624dc0ebc14a7ab274a84d977ce8513cb6)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
index ced8b3d2d762e..bf6f013fdfc58 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -283,7 +283,7 @@ fill_dc_mst_payload_table_from_drm(struct dc_link *link,
break;
}
}
- ASSERT(i != copy_of_link_table.stream_count);
+ /* Payload absent from HW table when never allocated: nothing to remove. */
}
/* Fill payload info*/
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0959/1257] drm/amdgpu: reject ANONONLY userptrs that span multiple VMAs
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (957 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0958/1257] drm/amd/display: dont WARN when removing an unallocated MST payload Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0960/1257] drm/amd/pm: reapply umd profile state after recovery Greg Kroah-Hartman
` (39 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Philip Yang,
Felix Kuehling, Jesse Zhang, Felix Kuehling, Alex Deucher,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <Jesse.Zhang@amd.com>
[ Upstream commit d577b68a854d0f590f480777249b041507d0708c ]
For AMDGPU_GEM_USERPTR_ANONONLY, amdgpu_ttm_tt_get_user_pages() only
checks the VMA at the start of the range for a backing file, and
amdgpu_hmm_range_get_pages() then faults in the whole range, across any
other VMAs. The check used to reject ranges ending beyond the first VMA
(vma->vm_end < end), which got lost when the code moved to HMM.
An ANONONLY userptr over one page of file-backed memory is rejected
with -EPERM, but one over an anonymous page followed by the same
file-backed page is accepted.
Restore the check and reject ANONONLY userptrs that cross more than one
VMA. The second userptr is now rejected too.
v2: reject ranges spanning multiple VMAs instead of walking every VMA
(Christian)
v3: cast num_pages to u64 to avoid an overflow (Christian)
Fixes: 6826cb3b92a3 ("drm/amdgpu: support userptr cross VMAs case with HMM")
Cc: Christian König <christian.koenig@amd.com>
Cc: Philip Yang <Philip.Yang@amd.com>
Cc: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Acked-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 75d753ed4704d5efc72164d9e546b2a282e42ae2)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 83968886c29a6..364be96c08dfe 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -777,7 +777,8 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo,
goto out_unlock;
}
if (unlikely((gtt->userflags & AMDGPU_GEM_USERPTR_ANONONLY) &&
- vma->vm_file)) {
+ (vma->vm_file ||
+ vma->vm_end < start + (u64)ttm->num_pages * PAGE_SIZE))) {
r = -EPERM;
goto out_unlock;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0960/1257] drm/amd/pm: reapply umd profile state after recovery
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (958 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0959/1257] drm/amdgpu: reject ANONONLY userptrs that span multiple VMAs Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0961/1257] drm/amdkfd: dont drop an SVM CWSR reference that was never taken Greg Kroah-Hartman
` (38 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kevin Wang, Kenneth Feng,
Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Wang <kevin.wang@amd.com>
[ Upstream commit ad6eb088a508d927641c8a76d1ca7911dfb7c80b ]
Resume and full GPU reset retain the selected UMD profile level in
driver state.
The GFX and PMFW state behind it is reinitialized.
Add a generic DPM reapply path after CG and PG restoration.
It restores the UMD GFX state and asks the PM backend to replay the
retained level.
v2:
- Reapply only GFX CG to preserve the profile-owned GFX PG reference.
- Fall back to AUTO when reapply fails without failing device recovery.
- Propagate PowerPlay DPM errors before accepting AUTO fallback.
- Limit workload-profile error reporting to the swSMU reapply path.
This covers:
- PCI runtime resume
- Full GPU reset recovery
- System resume, including S3 and s2idle
Signed-off-by: Kevin Wang <kevin.wang@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit fd0699fc9f4266fc07d6ce6dbb484fac04601106)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 14 ---
.../gpu/drm/amd/include/kgd_pp_interface.h | 2 +
drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 85 ++++++++++++++++++
drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 1 +
.../gpu/drm/amd/pm/powerplay/amd_powerplay.c | 33 +++++--
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 87 +++++++++++++++++--
7 files changed, 201 insertions(+), 27 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 9128b60891c80..e55367ca3e951 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2770,6 +2770,12 @@ static int amdgpu_device_ip_late_init(struct amdgpu_device *adev)
amdgpu_device_set_cg_state(adev, AMD_CG_STATE_GATE);
amdgpu_device_set_pg_state(adev, AMD_PG_STATE_GATE);
+ r = amdgpu_dpm_reapply_umd_profile(adev);
+ if (r) {
+ dev_err(adev->dev, "Failed to restore UMD profile state: %d\n", r);
+ return r;
+ }
+
amdgpu_device_fill_reset_magic(adev);
r = amdgpu_device_enable_mgpu_fan_boost();
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index d9d794a7db964..69278026c9355 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -2929,19 +2929,6 @@ static int amdgpu_pmops_runtime_suspend(struct device *dev)
return 0;
}
-static void amdgpu_restore_umd_profile_pstate_after_runpm(struct amdgpu_device *adev)
-{
- enum amd_dpm_forced_level level;
- uint32_t profile_mode_mask = AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD |
- AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK |
- AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK |
- AMD_DPM_FORCED_LEVEL_PROFILE_PEAK;
-
- level = amdgpu_dpm_get_performance_level(adev);
- if (level & profile_mode_mask)
- amdgpu_asic_update_umd_stable_pstate(adev, true);
-}
-
static int amdgpu_pmops_runtime_resume(struct device *dev)
{
struct pci_dev *pdev = to_pci_dev(dev);
@@ -2987,7 +2974,6 @@ static int amdgpu_pmops_runtime_resume(struct device *dev)
if (adev->pm.rpm_mode == AMDGPU_RUNPM_PX)
drm_dev->switch_power_state = DRM_SWITCH_POWER_ON;
- amdgpu_restore_umd_profile_pstate_after_runpm(adev);
adev->in_runpm = false;
return 0;
}
diff --git a/drivers/gpu/drm/amd/include/kgd_pp_interface.h b/drivers/gpu/drm/amd/include/kgd_pp_interface.h
index 606d481153019..4ec330dd8ead1 100644
--- a/drivers/gpu/drm/amd/include/kgd_pp_interface.h
+++ b/drivers/gpu/drm/amd/include/kgd_pp_interface.h
@@ -433,6 +433,8 @@ struct amd_pm_funcs {
int (*print_clock_levels)(void *handle, enum pp_clock_type type, char *buf);
int (*emit_clock_levels)(void *handle, enum pp_clock_type type, char *buf, int *offset);
int (*force_performance_level)(void *handle, enum amd_dpm_forced_level level);
+ int (*reapply_performance_level)(void *handle,
+ enum amd_dpm_forced_level level);
int (*get_sclk_od)(void *handle);
int (*set_sclk_od)(void *handle, uint32_t value);
int (*get_mclk_od)(void *handle);
diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
index 808be6c425bff..5615af97a3493 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
@@ -1085,6 +1085,91 @@ static void amdgpu_dpm_exit_umd_state(struct amdgpu_device *adev)
AMD_PG_STATE_GATE);
}
+/**
+ * amdgpu_dpm_reapply_umd_profile - Restore the active UMD profile
+ * @adev: amdgpu device
+ *
+ * Resume and reset retain the selected DPM level in software, but the
+ * underlying GFX and PMFW state is lost. Reapply a retained UMD profile
+ * after the common resume path has restored its default CG and PG state.
+ */
+int amdgpu_dpm_reapply_umd_profile(struct amdgpu_device *adev)
+{
+ const struct amd_pm_funcs *pp_funcs = adev->powerplay.pp_funcs;
+ enum amd_dpm_forced_level level;
+ int ret, fallback_ret;
+
+ if (!pp_funcs || !pp_funcs->reapply_performance_level ||
+ !pp_funcs->force_performance_level)
+ return 0;
+
+ /* Serialize the retained level with the GFX and PMFW reprogramming. */
+ mutex_lock(&adev->pm.mutex);
+ if (adev->pm.dpm.thermal_active) {
+ dev_warn(adev->dev,
+ "Cannot restore UMD profile while thermal control is active\n");
+ ret = 0;
+ goto unlock;
+ }
+
+ if (pp_funcs->get_performance_level)
+ level = pp_funcs->get_performance_level(adev->powerplay.pp_handle);
+ else
+ level = adev->pm.dpm.forced_level;
+
+ switch (level) {
+ case AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_PEAK:
+ break;
+ default:
+ ret = 0;
+ goto unlock;
+ }
+
+ /* The active profile already owns the GFX PG reference. */
+ ret = amdgpu_device_ip_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_GFX,
+ AMD_CG_STATE_UNGATE);
+ if (ret)
+ goto fallback_auto;
+
+ ret = amdgpu_asic_update_umd_stable_pstate(adev, true);
+ if (ret)
+ goto fallback_auto;
+
+ ret = pp_funcs->reapply_performance_level(adev->powerplay.pp_handle,
+ level);
+ if (ret)
+ goto fallback_auto;
+
+unlock:
+ mutex_unlock(&adev->pm.mutex);
+
+ return ret;
+
+fallback_auto:
+ dev_warn(adev->dev, "Failed to restore UMD profile state: %d\n", ret);
+
+ /* Restore normal CG before releasing the profile's PG reference. */
+ amdgpu_asic_update_umd_stable_pstate(adev, false);
+ amdgpu_device_ip_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_GFX,
+ AMD_CG_STATE_GATE);
+ mutex_unlock(&adev->pm.mutex);
+
+ mutex_lock(&adev->pm.stable_pstate_ctx_lock);
+ fallback_ret = amdgpu_dpm_force_performance_level(adev,
+ AMD_DPM_FORCED_LEVEL_AUTO);
+ if (fallback_ret)
+ dev_warn(adev->dev, "Failed to fall back to AUTO performance level: %d\n",
+ fallback_ret);
+ else
+ adev->pm.stable_pstate_ctx = NULL;
+ mutex_unlock(&adev->pm.stable_pstate_ctx_lock);
+
+ return 0;
+}
+
int amdgpu_dpm_force_performance_level(struct amdgpu_device *adev,
enum amd_dpm_forced_level level)
{
diff --git a/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h b/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h
index 8e8a052e1d531..3016f0d19f743 100644
--- a/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h
+++ b/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h
@@ -482,6 +482,7 @@ void amdgpu_dpm_set_power_state(struct amdgpu_device *adev,
enum amd_dpm_forced_level amdgpu_dpm_get_performance_level(struct amdgpu_device *adev);
int amdgpu_dpm_force_performance_level(struct amdgpu_device *adev,
enum amd_dpm_forced_level level);
+int amdgpu_dpm_reapply_umd_profile(struct amdgpu_device *adev);
int amdgpu_dpm_get_pp_num_states(struct amdgpu_device *adev,
struct pp_states_info *states);
int amdgpu_dpm_dispatch_task(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
index 7c70e228a5bae..59494959682b2 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
@@ -364,24 +364,46 @@ static void pp_dpm_en_umd_pstate(struct pp_hwmgr *hwmgr,
}
}
-static int pp_dpm_force_performance_level(void *handle,
- enum amd_dpm_forced_level level)
+static int pp_dpm_apply_performance_level(struct pp_hwmgr *hwmgr,
+ enum amd_dpm_forced_level level,
+ bool reapply)
{
- struct pp_hwmgr *hwmgr = handle;
+ int ret;
if (!hwmgr || !hwmgr->pm_en)
return -EINVAL;
- if (level == hwmgr->dpm_level)
+ if (!reapply && level == hwmgr->dpm_level)
return 0;
pp_dpm_en_umd_pstate(hwmgr, &level);
hwmgr->request_dpm_level = level;
- hwmgr_handle_task(hwmgr, AMD_PP_TASK_READJUST_POWER_STATE, NULL);
+ ret = hwmgr_handle_task(hwmgr, AMD_PP_TASK_READJUST_POWER_STATE, NULL);
+ if (ret)
+ return ret;
+
+ ret = phm_force_dpm_levels(hwmgr, level);
+ if (ret)
+ return ret;
+
+ hwmgr->dpm_level = level;
return 0;
}
+static int pp_dpm_force_performance_level(void *handle,
+ enum amd_dpm_forced_level level)
+{
+ return pp_dpm_apply_performance_level(handle, level, false);
+}
+
+static int
+pp_dpm_reapply_performance_level(void *handle,
+ enum amd_dpm_forced_level level)
+{
+ return pp_dpm_apply_performance_level(handle, level, true);
+}
+
static enum amd_dpm_forced_level pp_dpm_get_performance_level(
void *handle)
{
@@ -1542,6 +1564,7 @@ static const struct amd_pm_funcs pp_dpm_funcs = {
.load_firmware = pp_dpm_load_fw,
.wait_for_fw_loading_complete = pp_dpm_fw_loading_complete,
.force_performance_level = pp_dpm_force_performance_level,
+ .reapply_performance_level = pp_dpm_reapply_performance_level,
.get_performance_level = pp_dpm_get_performance_level,
.get_current_power_state = pp_dpm_get_current_power_state,
.dispatch_tasks = pp_dpm_dispatch_tasks,
diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
index cca32f74abf02..9e70a0f3ae305 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -2353,6 +2353,13 @@ static int smu_set_powergating_state(struct amdgpu_ip_block *ip_block,
return 0;
}
+static void smu_enter_umd_pstate(struct smu_context *smu)
+{
+ smu_gpo_control(smu, false);
+ smu_gfx_ulv_control(smu, false);
+ smu_deep_sleep_control(smu, false);
+}
+
static int smu_enable_umd_pstate(void *handle,
enum amd_dpm_forced_level *level)
{
@@ -2371,9 +2378,7 @@ static int smu_enable_umd_pstate(void *handle,
/* enter umd pstate, save current level, disable gfx cg*/
if (*level & profile_mode_mask) {
smu_dpm_ctx->saved_dpm_level = smu_dpm_ctx->dpm_level;
- smu_gpo_control(smu, false);
- smu_gfx_ulv_control(smu, false);
- smu_deep_sleep_control(smu, false);
+ smu_enter_umd_pstate(smu);
amdgpu_asic_update_umd_stable_pstate(smu->adev, true);
}
} else {
@@ -2432,7 +2437,8 @@ static void smu_power_profile_mode_put(struct smu_context *smu,
static int smu_adjust_power_state_dynamic(struct smu_context *smu,
enum amd_dpm_forced_level level,
- bool skip_display_settings)
+ bool skip_display_settings,
+ bool force_performance_level)
{
int ret = 0;
struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm);
@@ -2459,7 +2465,7 @@ static int smu_adjust_power_state_dynamic(struct smu_context *smu,
}
}
- if (smu_dpm_ctx->dpm_level != level) {
+ if (force_performance_level || smu_dpm_ctx->dpm_level != level) {
ret = smu_asic_set_performance_level(smu, level);
if (ret) {
if (ret == -EOPNOTSUPP)
@@ -2482,6 +2488,39 @@ static int smu_adjust_power_state_dynamic(struct smu_context *smu,
return ret;
}
+static int
+smu_reapply_power_state_dynamic(struct smu_context *smu,
+ enum amd_dpm_forced_level level)
+{
+ struct smu_dpm_context *smu_dpm_ctx = &smu->smu_dpm;
+ int ret;
+
+ ret = smu_apply_clocks_adjust_rules(smu);
+ if (ret) {
+ dev_err(smu->adev->dev, "Failed to apply clocks adjust rules!");
+ return ret;
+ }
+
+ ret = smu_asic_set_performance_level(smu, level);
+ if (ret) {
+ if (ret == -EOPNOTSUPP)
+ dev_info(smu->adev->dev, "set performance level %d not supported",
+ level);
+ else
+ dev_err(smu->adev->dev, "Failed to set performance level %d",
+ level);
+ return ret;
+ }
+
+ smu_dpm_ctx->dpm_level = level;
+
+ if (smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_MANUAL ||
+ smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM)
+ return 0;
+
+ return smu_bump_power_profile_mode(smu, NULL, 0);
+}
+
static int smu_handle_task(struct smu_context *smu,
enum amd_dpm_forced_level level,
enum amd_pp_task task_id)
@@ -2496,13 +2535,13 @@ static int smu_handle_task(struct smu_context *smu,
ret = smu_pre_display_config_changed(smu);
if (ret)
return ret;
- ret = smu_adjust_power_state_dynamic(smu, level, false);
+ ret = smu_adjust_power_state_dynamic(smu, level, false, false);
break;
case AMD_PP_TASK_COMPLETE_INIT:
- ret = smu_adjust_power_state_dynamic(smu, level, true);
+ ret = smu_adjust_power_state_dynamic(smu, level, true, false);
break;
case AMD_PP_TASK_READJUST_POWER_STATE:
- ret = smu_adjust_power_state_dynamic(smu, level, true);
+ ret = smu_adjust_power_state_dynamic(smu, level, true, false);
break;
default:
break;
@@ -2631,6 +2670,37 @@ static int smu_force_performance_level(void *handle,
return ret;
}
+static int
+smu_reapply_performance_level(void *handle,
+ enum amd_dpm_forced_level level)
+{
+ struct smu_context *smu = handle;
+ struct smu_dpm_context *smu_dpm_ctx = &smu->smu_dpm;
+
+ if (!smu->pm_enabled || !smu->adev->pm.dpm_enabled)
+ return -EOPNOTSUPP;
+
+ if (!smu->is_apu && !smu_dpm_ctx->dpm_context)
+ return -EINVAL;
+
+ switch (level) {
+ case AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK:
+ case AMD_DPM_FORCED_LEVEL_PROFILE_PEAK:
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ if (smu_dpm_ctx->dpm_level != level)
+ return -EINVAL;
+
+ smu_enter_umd_pstate(smu);
+
+ return smu_reapply_power_state_dynamic(smu, level);
+}
+
static int smu_set_display_count(void *handle, uint32_t count)
{
struct smu_context *smu = handle;
@@ -3988,6 +4058,7 @@ static const struct amd_pm_funcs swsmu_pm_funcs = {
.force_clock_level = smu_force_ppclk_levels,
.emit_clock_levels = smu_emit_ppclk_levels,
.force_performance_level = smu_force_performance_level,
+ .reapply_performance_level = smu_reapply_performance_level,
.read_sensor = smu_read_sensor,
.get_apu_thermal_limit = smu_get_apu_thermal_limit,
.set_apu_thermal_limit = smu_set_apu_thermal_limit,
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0961/1257] drm/amdkfd: dont drop an SVM CWSR reference that was never taken
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (959 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0960/1257] drm/amd/pm: reapply umd profile state after recovery Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0962/1257] drm/amdkfd: fix NULL deref in SDMA HQD debugfs dump on GC 12.1 Greg Kroah-Hartman
` (37 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jesse Zhang, Felix Kuehling,
Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <Jesse.Zhang@amd.com>
[ Upstream commit 030d47cc6720e0f07b502876cdbd266e309f9461 ]
When kfd_queue_acquire_buffers() fails, its error path calls
kfd_queue_release_buffers(), which also drops a queue_refcount on the
SVM range at ctx_save_restore_area_address. The SVM range is the last
buffer acquired, and kfd_queue_buffer_svm_get() takes no reference when
it fails, so on every error path this reference was never taken. If
another queue of the process uses that CWSR range, its reference is
dropped instead, and unmapping the range no longer evicts that queue
while its CWSR area is unmapped from the GPU.
On navi31, with queue A using an SVM CWSR range: munmap() of the range
logs
Freeing queue vital buffer 0x..., queue evicted
but after a CREATE_QUEUE that reuses A's CWSR address with an unmapped
write pointer (-EINVAL), the same munmap() leaves A running without the
message.
Only put the BOs on the acquire error path. The warning and the eviction
are back after the failed CREATE_QUEUE.
Fixes: b049504e211e ("drm/amdkfd: Validate user queue svm memory residency")
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9a08122e6361ef73f4b512d5db9596d561305519)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 23 +++++++++++++++++------
1 file changed, 17 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
index 15eeaaebbbcd7..910d695bb962e 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
@@ -230,6 +230,15 @@ void kfd_queue_buffer_put(struct amdgpu_bo **bo)
amdgpu_bo_unref(bo);
}
+static void kfd_queue_put_bos(struct queue_properties *properties)
+{
+ kfd_queue_buffer_put(&properties->wptr_bo);
+ kfd_queue_buffer_put(&properties->rptr_bo);
+ kfd_queue_buffer_put(&properties->ring_bo);
+ kfd_queue_buffer_put(&properties->eop_buf_bo);
+ kfd_queue_buffer_put(&properties->cwsr_bo);
+}
+
int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_properties *properties)
{
struct kfd_topology_device *topo_dev;
@@ -343,7 +352,13 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
* dropping the VM reservation.
*/
kfd_queue_unref_bo_vas(pdd, properties);
- kfd_queue_release_buffers(pdd, properties);
+ /*
+ * The SVM CWSR range is the last thing acquired and a failed
+ * kfd_queue_buffer_svm_get() takes nothing, so only the BOs are held
+ * here. Dropping the SVM reference would drop the one of another queue
+ * using the same CWSR address.
+ */
+ kfd_queue_put_bos(properties);
return err;
}
@@ -352,11 +367,7 @@ int kfd_queue_release_buffers(struct kfd_process_device *pdd, struct queue_prope
struct kfd_topology_device *topo_dev;
u64 total_cwsr_size;
- kfd_queue_buffer_put(&properties->wptr_bo);
- kfd_queue_buffer_put(&properties->rptr_bo);
- kfd_queue_buffer_put(&properties->ring_bo);
- kfd_queue_buffer_put(&properties->eop_buf_bo);
- kfd_queue_buffer_put(&properties->cwsr_bo);
+ kfd_queue_put_bos(properties);
topo_dev = kfd_topology_device_by_id(pdd->dev->id);
if (!topo_dev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0962/1257] drm/amdkfd: fix NULL deref in SDMA HQD debugfs dump on GC 12.1
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (960 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0961/1257] drm/amdkfd: dont drop an SVM CWSR reference that was never taken Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0963/1257] drm/amdgpu/gmc9: add extra type-2 TLB flush for gfx942/gfx950 Greg Kroah-Hartman
` (36 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harish Kasiviswanathan, Mukul Joshi,
Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
[ Upstream commit 0fe236afa2b9b28540fa1f8c789ef5d499c5d0ee ]
Reading the KFD HQD debugfs node (dqm_debugfs_hqds) on a gc_12_1_0 part
oopses with a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: hqd_sdma_dump_v12_1+0x6a [amdgpu]
Call Trace:
dqm_debugfs_hqds+0x2da/0x360 [amdgpu]
kfd_debugfs_hqds_by_device+0x74/0xa0 [amdgpu]
seq_read ... __x64_sys_read
get_sdma_rlc_reg_offset() assumes an interleaved layout where the second
SDMA per XCC lives in a separate SDMA1_HWIP register aperture. On
gc_12_1_0 that aperture does not exist.
Rewrite get_sdma_rlc_reg_offset() to mirror sdma_v7_1_get_reg_offset():
base the offset on adev->reg_offset[GC_HWIP][xcc_id][0] and add the
per-instance SDMA1 offset for the odd instance.
Fixes: 7bd5d763b8e1 ("drm/amdkfd: Add gfx_v12_1_kfd2kgd interface for GFX12_1")
Signed-off-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Reviewed-by: Mukul Joshi <mukul.joshi@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 94b2c5b06d37adc0e9a23138252758657b64b58a)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/amdgpu/amdgpu_amdkfd_gfx_v12_1.c | 44 +++++++++++--------
.../drm/amd/amdkfd/kfd_device_queue_manager.c | 9 ++++
2 files changed, 34 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v12_1.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v12_1.c
index 070001fd34b0f..7b04258c38931 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v12_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v12_1.c
@@ -77,25 +77,21 @@ static uint32_t get_sdma_rlc_reg_offset(struct amdgpu_device *adev,
unsigned int engine_id,
unsigned int queue_id)
{
- uint32_t sdma_engine_reg_base = 0;
- uint32_t sdma_rlc_reg_offset;
uint32_t dev_inst = GET_INST(SDMA0, engine_id);
+ int xcc_id = adev->sdma.instance[engine_id].xcc_id;
+ int xcc_inst = dev_inst % adev->sdma.num_inst_per_xcc;
+ uint32_t sdma_engine_reg_base;
+ uint32_t sdma_rlc_reg_offset;
- switch (dev_inst % adev->sdma.num_inst_per_xcc) {
- case 0:
- sdma_engine_reg_base = SOC15_REG_OFFSET(SDMA0,
- dev_inst / adev->sdma.num_inst_per_xcc,
- regSDMA0_SDMA_QUEUE0_RB_CNTL) - regSDMA0_SDMA_QUEUE0_RB_CNTL;
- break;
- case 1:
- sdma_engine_reg_base = SOC15_REG_OFFSET(SDMA1,
- dev_inst / adev->sdma.num_inst_per_xcc,
- regSDMA1_SDMA_QUEUE0_RB_CNTL) - regSDMA0_SDMA_QUEUE0_RB_CNTL;
- break;
- default:
- WARN(1, "Invalid SDMA engine id %d\n", engine_id);
- break;
- }
+ /*
+ * On SDMA v7 (gc_12_x) all SDMA queue registers live in the GC_HWIP
+ * aperture. The second SDMA per XCC is reached by adding a fixed
+ * offset (regSDMA1_* - regSDMA0_* == SDMA1_REG_OFFSET
+ */
+ sdma_engine_reg_base = adev->reg_offset[GC_HWIP][xcc_id][0];
+ if (xcc_inst != 0)
+ sdma_engine_reg_base +=
+ regSDMA1_SDMA_QUEUE0_RB_CNTL - regSDMA0_SDMA_QUEUE0_RB_CNTL;
sdma_rlc_reg_offset = sdma_engine_reg_base
+ queue_id * (regSDMA0_SDMA_QUEUE1_RB_CNTL - regSDMA0_SDMA_QUEUE0_RB_CNTL);
@@ -141,8 +137,7 @@ static int hqd_sdma_dump_v12_1(struct amdgpu_device *adev,
uint32_t engine_id, uint32_t queue_id,
uint32_t (**dump)[2], uint32_t *n_regs)
{
- uint32_t sdma_rlc_reg_offset = get_sdma_rlc_reg_offset(adev,
- engine_id, queue_id);
+ uint32_t sdma_rlc_reg_offset;
uint32_t i = 0, reg;
const uint32_t first_reg = regSDMA0_SDMA_QUEUE0_RB_CNTL;
@@ -150,6 +145,17 @@ static int hqd_sdma_dump_v12_1(struct amdgpu_device *adev,
#undef HQD_N_REGS
#define HQD_N_REGS (last_reg - first_reg + 1)
+ /*
+ * dqm_debugfs_hqds() iterates engine_id over
+ * node_id * get_num_all_sdma_engines()..+get_num_all_sdma_engines().
+ * On partitioned devices that range can address a logical SDMA engine
+ * beyond the instances that actually exist on this node; reject it
+ */
+ if (engine_id >= adev->sdma.num_instances)
+ return -EINVAL;
+
+ sdma_rlc_reg_offset = get_sdma_rlc_reg_offset(adev, engine_id, queue_id);
+
*dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL);
if (*dump == NULL)
return -ENOMEM;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 4594824985e1e..dd2c8ac7cb9c4 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -4046,6 +4046,15 @@ int dqm_debugfs_hqds(struct seq_file *m, void *data)
queue++) {
r = dqm->dev->kfd2kgd->hqd_sdma_dump(
dqm->dev->adev, pipe, queue, &dump, &n_regs);
+ if (r == -EINVAL) {
+ /*
+ * SDMA engine not present/mapped on this
+ * device; skip it instead of aborting the
+ * whole dump.
+ */
+ r = 0;
+ break;
+ }
if (r)
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0963/1257] drm/amdgpu/gmc9: add extra type-2 TLB flush for gfx942/gfx950
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (961 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0962/1257] drm/amdkfd: fix NULL deref in SDMA HQD debugfs dump on GC 12.1 Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0964/1257] drm/amd/display: Fix swap in median3() for DSC rate control Greg Kroah-Hartman
` (35 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shahzeb Ahmed, Manjunath Gaonkar,
Elena Sakhnovitch, Apurv Mishra, Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elena Sakhnovitch <Elena.Sakhnovitch@amd.com>
[ Upstream commit 232213c9bd7f703836164f23160b76657094a7db ]
Add extra type-2 TLB flush for GC 9.5.0, similar race condition was
observed as Vega20+XGMI. Add to GC 9.4.3 and 9.4.4 too, as they share
the same multi-XCD TLB topology.
Reported-by: Shahzeb Ahmed <shahzeb.ahmed@amd.com>
Reported-by: Manjunath Gaonkar <Manjunath.Gaonkar@amd.com>
Signed-off-by: Elena Sakhnovitch <Elena.Sakhnovitch@amd.com>
Reviewed-by: Apurv Mishra <apurv.mishra@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 138cfb165ae6aa98c0767b431e718d1a8199db28)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index 1192682735300..bb0d013e1fa12 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -2172,10 +2172,22 @@ static int gmc_v9_0_hw_init(struct amdgpu_ip_block *ip_block)
* (type 2), which flushes both. Due to a race condition with
* concurrent memory accesses using the same TLB cache line, we still
* need a second TLB flush after this.
+ *
+ * GC 9.4.3, 9.4.4 and 9.5.0 hit a similar race.
*/
- adev->gmc.flush_tlb_needs_extra_type_2 =
- amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 4, 0) &&
- adev->gmc.xgmi.num_physical_nodes;
+ switch (amdgpu_ip_version(adev, GC_HWIP, 0)) {
+ case IP_VERSION(9, 4, 0):
+ adev->gmc.flush_tlb_needs_extra_type_2 =
+ adev->gmc.xgmi.num_physical_nodes;
+ break;
+ case IP_VERSION(9, 4, 3):
+ case IP_VERSION(9, 4, 4):
+ case IP_VERSION(9, 5, 0):
+ adev->gmc.flush_tlb_needs_extra_type_2 = true;
+ break;
+ default:
+ break;
+ }
/* The sequence of these two function calls matters.*/
gmc_v9_0_init_golden_registers(adev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0964/1257] drm/amd/display: Fix swap in median3() for DSC rate control
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (962 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0963/1257] drm/amdgpu/gmc9: add extra type-2 TLB flush for gfx942/gfx950 Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0965/1257] drm/amdkfd: wait for a GPU reset before freeing a BO Greg Kroah-Hartman
` (34 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Keita Morisaki, Dan Wheeler,
Roman Li, Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keita Morisaki <kmta1236@gmail.com>
[ Upstream commit 7b23bf82ccbdb4cf0752f2b8686e7319a7ce497f ]
median3() is meant to return the median of three values, but its last
compare-and-swap step swaps b and c instead of a and b. When c is
smaller than both a and b, it returns max(a, b) instead of min(a, b).
For example, median3(2, 3, 1) returns 3 instead of 2.
_do_calc_rc_params() always passes 0 as the first argument, and the
second argument is never below 12. So whenever the third argument is
negative, first_line_bpg_offset (and second_line_bpg_offset for 4:2:0)
is set to the second argument instead of 0.
Fix this by swapping a and b in the last step, as intended.
Note that this change does not affect valid DSC configurations. The
third argument is negative only when bits per pixel exceeds the
uncompressed rate of the colour format:
- 3 * bpc for 4:4:4, 3 * bpc + 2 for RGB
- 2 * bpc for 4:2:2
- 1.5 * bpc for 4:2:0
Fixes: 97bda0322b8a ("drm/amd/display: Add DSC support for Navi (v2)")
Signed-off-by: Keita Morisaki <kmta1236@gmail.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Reviewed-by: Roman Li <roman.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1ddc4bc97a62fc89d9d3681413d9f977e1fa1a83)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c
index b8fc27a5361e8..657173d8081c3 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c
@@ -46,7 +46,7 @@ static int median3(int a, int b, int c)
if (b > c)
swap(b, c);
if (a > b)
- swap(b, c);
+ swap(a, b);
return b;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0965/1257] drm/amdkfd: wait for a GPU reset before freeing a BO
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (963 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0964/1257] drm/amd/display: Fix swap in median3() for DSC rate control Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0966/1257] drm/amdgpu: wait for pending page table updates before switching a VM to CPU updates Greg Kroah-Hartman
` (33 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Kuehling, William Palacek,
Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Palacek <William.Palacek@amd.com>
[ Upstream commit 47d799a718439764432d8ef3a0952af45f025f76 ]
When a GPU reset takes the reset domain, KFD eviction cannot unmap
user queues: execute_queues_cpsch() fails its trylock with -EIO, so
the queues keep running until the ASIC is reset. The TLB flush is also
skipped while the reset is in progress. If the process unmaps and frees
a BO in that window, its pages are released while a queue can still
access them through stale translations.
On MI300X, munmap() then crashes in free_swap_cache() on a small bogus
page pointer in its mmu_gather batch page:
BUG: unable to handle page fault for address: 0000000000002900
RIP: 0010:free_swap_cache+0x5/0xb0
Call Trace:
free_pages_and_swap_cache+0x3a/0x60
tlb_batch_pages_flush+0x43/0x80
tlb_flush_mmu+0x3d/0x110
zap_pte_range+0x80d/0xcd0
...
do_vmi_align_munmap+0x3e8/0x5b0
do_vmi_munmap+0xdf/0x190
__vm_munmap+0xad/0x180
__x64_sys_munmap+0x1b/0x30
In a traced crash the bogus pointer was the read pointer value of an SDMA
queue the process had just destroyed, at the read pointer's page offset:
the queue's writeback landed in its freed rptr page after the page was
reused as the batch page.
commit f0b4440cdc18 ("drm/amdkfd: Fix mode1 reset crash issue") fixed
this race on process exit by waiting for the reset to complete before
freeing the process's BOs. Free through the ioctl has the same race.
Wait for the reset there too, using the same helper.
Fixes: 9c33e5fd4fb6 ("drm/amdgpu: fix locking scope when flushing tlb")
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: William Palacek <William.Palacek@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 06ff8ce77726b15a98fcc285dd6005cb3f48558b)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +++
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 1 +
drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 +-
3 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 3081d9aaf053a..3831451240e97 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1303,6 +1303,9 @@ static int kfd_ioctl_free_memory_of_gpu(struct file *filep,
goto err_unlock;
}
+ /* Queues a reset could not stop may still access the buffer */
+ kfd_process_wait_gpu_reset_complete(p);
+
ret = amdgpu_amdkfd_gpuvm_free_memory_of_gpu(pdd->dev->adev,
(struct kgd_mem *)mem, pdd->drm_priv, &size);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index aab7292e2cb12..f405f476ed182 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -1135,6 +1135,7 @@ void kfd_unref_process(struct kfd_process *p);
int kfd_process_evict_queues(struct kfd_process *p, uint32_t trigger);
int kfd_process_restore_queues(struct kfd_process *p);
void kfd_suspend_all_processes(void);
+void kfd_process_wait_gpu_reset_complete(struct kfd_process *p);
int kfd_resume_all_processes(void);
struct kfd_process_device *kfd_process_device_data_by_id(struct kfd_process *process,
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
index dda300786bc4e..586a6dd53883f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -1292,7 +1292,7 @@ static void kfd_process_remove_sysfs(struct kfd_process *p)
/*
* If any GPU is ongoing reset, wait for reset complete.
*/
-static void kfd_process_wait_gpu_reset_complete(struct kfd_process *p)
+void kfd_process_wait_gpu_reset_complete(struct kfd_process *p)
{
int i;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0966/1257] drm/amdgpu: wait for pending page table updates before switching a VM to CPU updates
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (964 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0965/1257] drm/amdkfd: wait for a GPU reset before freeing a BO Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0967/1257] drm/amd/pm:restate all customized OD features on every table upload for smu 13.0.0/smu 14.0.2 Greg Kroah-Hartman
` (32 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prike Liang, Christian König,
John Fisher, Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fisher <jfisher84@gmail.com>
[ Upstream commit 53d9ef2f518add783bb48a69d77bbc8aea99e911 ]
amdgpu_vm_make_compute() switches a VM from SDMA to CPU page table
updates when a KFD process acquires it. It syncs "with the last SDMA
update/clear" through amdgpu_bo_sync_wait() on the root PD, but that
walks the reservation with DMA_RESV_USAGE_READ, and the clears of the
VM's page tables (the root PD from amdgpu_vm_init(), and the PDs/PTs
the seq64 mapping allocates at the render node's open) are added there
by amdgpu_vm_sdma_commit() with DMA_RESV_USAGE_BOOKKEEP only:
amdgpu_vm_pt_clear() commits them with a NULL fence, so they do not
reach vm->last_update. The CPU path's own waits (amdgpu_vm_cpu_update(),
amdgpu_bo_kmap()) use DMA_RESV_USAGE_KERNEL. None of them waits for a
clear that is still queued.
When one is, the CPU writes the first entries of the new compute VM (the
KFD trap handler's TBA/TMA page at AMDGPU_VA_RESERVED_TRAP_START, mapped
during ACQUIRE_VM) into a page directory the SDMA then clears. The
entries are gone, the handler's page is unmapped, and the first wave
save of any queue of the process faults in the SQC instruction fetch at
the handler's address (GCVM_L2_PROTECTION_FAULT_STATUS 0x008012B1,
PERMISSION_FAULTS 0xb). The MES then fails REMOVE_QUEUE and SUSPEND, and
the device takes a MODE1 reset with VRAM lost on 7.2.9; on 7.3-rc6 the
queue is reset instead.
The window is the time between the render node's open and ACQUIRE_VM.
ROCr spends milliseconds there and is practically never hit; a minimal
KFD client that opens the render node and acquires the VM at once is hit
most of the time. On a Radeon AI PRO R9700 (gfx1201, Resizable BAR, so
vm_update_mode defaults to CPU updates for compute VMs), a wave reading
the trap handler's page right after queue creation found it unmapped in
8 of 12 runs; a 5 ms sleep between the open and ACQUIRE_VM made that 0
of 9, and the same sleep after queue creation instead 3 of 3.
The wait covered these jobs until commit 926c79ad6ecd ("drm/amdgpu:
promote the implicit sync to the dependent read fences") narrowed
amdgpu_sync_resv() from DMA_RESV_USAGE_BOOKKEEP to DMA_RESV_USAGE_READ;
the VM's page table jobs have been added with BOOKKEEP since commit
4247084057cf ("drm/amdgpu: use DMA_RESV_USAGE_BOOKKEEP v2"), so from
v6.16 on the sync in amdgpu_vm_make_compute() waits for nothing of
them.
Record the clears in vm->last_update, as amdgpu_vm_update_pdes() does
with its updates, and wait for it, uninterruptibly, before switching the
update functions. The clears all go through vm->delayed, so the last one
covers the earlier ones; immediate clears are not recorded, as before.
With this, on 7.3-rc6 and on 7.2.9, the same client reads the handler
10 of 10 times, 8 busy queues on the 4 compute slots complete in 5 of 5
runs on 7.3-rc6 and 3 of 3 on 7.2.9 (1 of 6 before), 16 and 32 queues
complete on 7.3-rc6, and two processes with 8 queues each complete
together on both, with no fault.
Fixes: 926c79ad6ecd ("drm/amdgpu: promote the implicit sync to the dependent read fences")
Cc: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: John Fisher <jfisher84@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9ec91b35baba45209c3fcd00f086224a158dd512)
Cc: stable@vger.kernel.org # v6.16+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 5 +----
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 2 +-
2 files changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 4a63b472f68ec..fc3a8d38d5149 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -2725,10 +2725,7 @@ int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm)
if (vm->use_cpu_for_update) {
/* Sync with last SDMA update/clear before switching to CPU */
- r = amdgpu_bo_sync_wait(vm->root.bo,
- AMDGPU_FENCE_OWNER_UNDEFINED, true);
- if (r)
- goto unreserve_bo;
+ dma_fence_wait(vm->last_update, false);
vm->update_funcs = &amdgpu_vm_cpu_funcs;
r = amdgpu_vm_pt_map_tables(adev, vm);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
index e43a60d098082..cef4171b4ad06 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
@@ -422,7 +422,7 @@ int amdgpu_vm_pt_clear(struct amdgpu_device *adev, struct amdgpu_vm *vm,
if (r)
goto exit;
- r = vm->update_funcs->commit(¶ms, NULL);
+ r = vm->update_funcs->commit(¶ms, &vm->last_update);
exit:
drm_dev_exit(idx);
return r;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0967/1257] drm/amd/pm:restate all customized OD features on every table upload for smu 13.0.0/smu 14.0.2
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (965 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0966/1257] drm/amdgpu: wait for pending page table updates before switching a VM to CPU updates Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0968/1257] amdkfd: Fix memory availability double accounting of kfd pinned objects Greg Kroah-Hartman
` (31 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kenneth Feng, Kevin Wang,
Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kenneth Feng <kenneth.feng@amd.com>
[ Upstream commit 44d0d3031e47973ed65fd327669d5e2eaaf6c565 ]
PMFW interprets OverDriveTable.FeatureCtrlMask as the complete set of
overdrive features that are currently overridden, not as a delta
describing the operation at hand. On import it resets every feature
whose bit is clear back to its default value - for the VF curve that
means zeroing VoltageOffsetPerZoneBoundary[] outright.
The driver assumed the opposite. smu_v14_0_2_od_edit_dpm_table() clears
the mask after a successful commit, so a subsequent above-default
power1_cap write goes through smu_v14_0_2_set_ppt_limit() and uploads a
table carrying only PP_OD_FEATURE_PPT_BIT. PMFW then drops the user's
voltage offset and reverts to the stock V/F curve, while the driver's
cached user table still reports the offset through pp_od_clk_voltage.
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5935
Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
Reviewed-by: Kevin Wang <kevin.wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1b63bb397db208a8f84778a9d9cafc93da9373eb)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 2 +
.../drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 35 +++++++----------
.../drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 32 +++++++---------
.../drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 38 +++++++++++--------
4 files changed, 52 insertions(+), 55 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
index 3ec65630ab99c..e354abfef2eba 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
@@ -433,6 +433,8 @@ struct smu_table_context {
void *boot_overdrive_table;
void *user_overdrive_table;
+ uint32_t user_od_feature_mask;
+
struct smu_driver_table driver_tables[SMU_DRIVER_TABLE_COUNT];
};
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
index a29e76b03476b..6ce0195f0a4f1 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
@@ -1569,7 +1569,6 @@ static int smu_v13_0_0_od_edit_dpm_table(struct smu_context *smu,
struct amdgpu_device *adev = smu->adev;
uint32_t offset_of_voltageoffset;
int32_t minimum, maximum;
- uint32_t feature_ctrlmask;
int i, ret = 0;
switch (type) {
@@ -1891,21 +1890,16 @@ static int smu_v13_0_0_od_edit_dpm_table(struct smu_context *smu,
if (ret)
return ret;
} else {
- feature_ctrlmask = od_table->OverDriveTable.FeatureCtrlMask;
memcpy(od_table,
table_context->boot_overdrive_table,
sizeof(OverDriveTableExternal_t));
- od_table->OverDriveTable.FeatureCtrlMask = feature_ctrlmask;
+ od_table->OverDriveTable.FeatureCtrlMask = 0;
+ table_context->user_od_feature_mask = 0;
}
fallthrough;
case PP_OD_COMMIT_DPM_TABLE:
- /*
- * The member below instructs PMFW the settings focused in
- * this single operation.
- * `uint32_t FeatureCtrlMask;`
- * It does not contain actual informations about user's custom
- * settings. Thus we do not cache it.
- */
+ table_context->user_od_feature_mask =
+ od_table->OverDriveTable.FeatureCtrlMask;
offset_of_voltageoffset = offsetof(OverDriveTable_t, VoltageOffsetPerZoneBoundary);
if (memcmp((u8 *)od_table + offset_of_voltageoffset,
table_context->user_overdrive_table + offset_of_voltageoffset,
@@ -1918,7 +1912,6 @@ static int smu_v13_0_0_od_edit_dpm_table(struct smu_context *smu,
return ret;
}
- od_table->OverDriveTable.FeatureCtrlMask = 0;
memcpy(table_context->user_overdrive_table + offset_of_voltageoffset,
(u8 *)od_table + offset_of_voltageoffset,
sizeof(OverDriveTableExternal_t) - offset_of_voltageoffset);
@@ -2201,6 +2194,7 @@ static int smu_v13_0_0_set_default_od_settings(struct smu_context *smu)
boot_od_table,
sizeof(OverDriveTableExternal_t));
smu->user_dpm_profile.user_od = false;
+ smu->smu_table.user_od_feature_mask = 0;
} else if (smu->user_dpm_profile.user_od) {
memcpy(&user_od_table_bak,
user_od_table,
@@ -2250,12 +2244,8 @@ static int smu_v13_0_0_restore_user_od_settings(struct smu_context *smu)
OverDriveTableExternal_t *od_table = table_context->overdrive_table;
OverDriveTableExternal_t *user_od_table = table_context->user_overdrive_table;
int res;
-
- user_od_table->OverDriveTable.FeatureCtrlMask = BIT(PP_OD_FEATURE_GFXCLK_BIT) |
- BIT(PP_OD_FEATURE_UCLK_BIT) |
- BIT(PP_OD_FEATURE_GFX_VF_CURVE_BIT) |
- BIT(PP_OD_FEATURE_FAN_CURVE_BIT) |
- BIT(PP_OD_FEATURE_ZERO_FAN_BIT);
+ user_od_table->OverDriveTable.FeatureCtrlMask =
+ table_context->user_od_feature_mask;
res = smu_v13_0_0_upload_overdrive_table(smu, user_od_table);
user_od_table->OverDriveTable.FeatureCtrlMask = 0;
if (res == 0)
@@ -3069,8 +3059,10 @@ static int smu_v13_0_0_set_ppt_limit(struct smu_context *smu,
if (current_od_table.OverDriveTable.Ppt) {
od_table->OverDriveTable.Ppt = 0;
- od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_PPT_BIT;
-
+ table_context->user_od_feature_mask &=
+ ~(1U << PP_OD_FEATURE_PPT_BIT);
+ od_table->OverDriveTable.FeatureCtrlMask =
+ table_context->user_od_feature_mask;
ret = smu_v13_0_0_upload_overdrive_table(smu, od_table);
if (ret) {
dev_err(smu->adev->dev, "Failed to upload overdrive table!\n");
@@ -3084,8 +3076,9 @@ static int smu_v13_0_0_set_ppt_limit(struct smu_context *smu,
return ret;
od_table->OverDriveTable.Ppt = (limit * 100) / msg_limit - 100;
- od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_PPT_BIT;
-
+ table_context->user_od_feature_mask |= 1U << PP_OD_FEATURE_PPT_BIT;
+ od_table->OverDriveTable.FeatureCtrlMask =
+ table_context->user_od_feature_mask;
ret = smu_v13_0_0_upload_overdrive_table(smu, od_table);
if (ret) {
dev_err(smu->adev->dev, "Failed to upload overdrive table!\n");
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
index 5fe409a237726..51e419e6380c1 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
@@ -1578,7 +1578,6 @@ static int smu_v13_0_7_od_edit_dpm_table(struct smu_context *smu,
struct amdgpu_device *adev = smu->adev;
uint32_t offset_of_voltageoffset;
int32_t minimum, maximum;
- uint32_t feature_ctrlmask;
int i, ret = 0;
switch (type) {
@@ -1900,22 +1899,17 @@ static int smu_v13_0_7_od_edit_dpm_table(struct smu_context *smu,
if (ret)
return ret;
} else {
- feature_ctrlmask = od_table->OverDriveTable.FeatureCtrlMask;
memcpy(od_table,
table_context->boot_overdrive_table,
sizeof(OverDriveTableExternal_t));
- od_table->OverDriveTable.FeatureCtrlMask = feature_ctrlmask;
+ od_table->OverDriveTable.FeatureCtrlMask = 0;
+ table_context->user_od_feature_mask = 0;
}
fallthrough;
case PP_OD_COMMIT_DPM_TABLE:
- /*
- * The member below instructs PMFW the settings focused in
- * this single operation.
- * `uint32_t FeatureCtrlMask;`
- * It does not contain actual informations about user's custom
- * settings. Thus we do not cache it.
- */
+ table_context->user_od_feature_mask =
+ od_table->OverDriveTable.FeatureCtrlMask;
offset_of_voltageoffset = offsetof(OverDriveTable_t, VoltageOffsetPerZoneBoundary);
if (memcmp((u8 *)od_table + offset_of_voltageoffset,
table_context->user_overdrive_table + offset_of_voltageoffset,
@@ -1928,7 +1922,6 @@ static int smu_v13_0_7_od_edit_dpm_table(struct smu_context *smu,
return ret;
}
- od_table->OverDriveTable.FeatureCtrlMask = 0;
memcpy(table_context->user_overdrive_table + offset_of_voltageoffset,
(u8 *)od_table + offset_of_voltageoffset,
sizeof(OverDriveTableExternal_t) - offset_of_voltageoffset);
@@ -2203,6 +2196,7 @@ static int smu_v13_0_7_set_default_od_settings(struct smu_context *smu)
boot_od_table,
sizeof(OverDriveTableExternal_t));
smu->user_dpm_profile.user_od = false;
+ smu->smu_table.user_od_feature_mask = 0;
} else if (smu->user_dpm_profile.user_od) {
memcpy(&user_od_table_bak,
user_od_table,
@@ -2253,11 +2247,8 @@ static int smu_v13_0_7_restore_user_od_settings(struct smu_context *smu)
OverDriveTableExternal_t *user_od_table = table_context->user_overdrive_table;
int res;
- user_od_table->OverDriveTable.FeatureCtrlMask = BIT(PP_OD_FEATURE_GFXCLK_BIT) |
- BIT(PP_OD_FEATURE_UCLK_BIT) |
- BIT(PP_OD_FEATURE_GFX_VF_CURVE_BIT) |
- BIT(PP_OD_FEATURE_FAN_CURVE_BIT) |
- BIT(PP_OD_FEATURE_ZERO_FAN_BIT);
+ user_od_table->OverDriveTable.FeatureCtrlMask =
+ table_context->user_od_feature_mask;
res = smu_v13_0_7_upload_overdrive_table(smu, user_od_table);
user_od_table->OverDriveTable.FeatureCtrlMask = 0;
if (res == 0)
@@ -2689,7 +2680,10 @@ static int smu_v13_0_7_set_ppt_limit(struct smu_context *smu,
if (current_od_table.OverDriveTable.Ppt) {
od_table->OverDriveTable.Ppt = 0;
- od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_PPT_BIT;
+ table_context->user_od_feature_mask &=
+ ~(1U << PP_OD_FEATURE_PPT_BIT);
+ od_table->OverDriveTable.FeatureCtrlMask =
+ table_context->user_od_feature_mask;
ret = smu_v13_0_7_upload_overdrive_table(smu, od_table);
if (ret) {
@@ -2704,7 +2698,9 @@ static int smu_v13_0_7_set_ppt_limit(struct smu_context *smu,
return ret;
od_table->OverDriveTable.Ppt = (limit * 100) / msg_limit - 100;
- od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_PPT_BIT;
+ table_context->user_od_feature_mask |= 1U << PP_OD_FEATURE_PPT_BIT;
+ od_table->OverDriveTable.FeatureCtrlMask =
+ table_context->user_od_feature_mask;
ret = smu_v13_0_7_upload_overdrive_table(smu, od_table);
if (ret) {
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
index 6621e50de9651..566b7f2b00f0e 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
@@ -2385,6 +2385,7 @@ static int smu_v14_0_2_set_default_od_settings(struct smu_context *smu)
boot_od_table,
sizeof(OverDriveTableExternal_t));
smu->user_dpm_profile.user_od = false;
+ smu->smu_table.user_od_feature_mask = 0;
} else if (smu->user_dpm_profile.user_od) {
memcpy(&user_od_table_bak,
user_od_table,
@@ -2433,11 +2434,8 @@ static int smu_v14_0_2_restore_user_od_settings(struct smu_context *smu)
OverDriveTableExternal_t *user_od_table = table_context->user_overdrive_table;
int res;
- user_od_table->OverDriveTable.FeatureCtrlMask = BIT(PP_OD_FEATURE_GFXCLK_BIT) |
- BIT(PP_OD_FEATURE_UCLK_BIT) |
- BIT(PP_OD_FEATURE_GFX_VF_CURVE_BIT) |
- BIT(PP_OD_FEATURE_FAN_CURVE_BIT) |
- BIT(PP_OD_FEATURE_ZERO_FAN_BIT);
+ user_od_table->OverDriveTable.FeatureCtrlMask =
+ table_context->user_od_feature_mask;
res = smu_v14_0_2_upload_overdrive_table(smu, user_od_table);
user_od_table->OverDriveTable.FeatureCtrlMask = 0;
if (res == 0)
@@ -2522,7 +2520,6 @@ static int smu_v14_0_2_od_edit_dpm_table(struct smu_context *smu,
struct amdgpu_device *adev = smu->adev;
uint32_t offset_of_voltageoffset;
int32_t minimum, maximum;
- uint32_t feature_ctrlmask;
int i, ret = 0;
switch (type) {
@@ -2811,21 +2808,26 @@ static int smu_v14_0_2_od_edit_dpm_table(struct smu_context *smu,
if (ret)
return ret;
} else {
- feature_ctrlmask = od_table->OverDriveTable.FeatureCtrlMask;
memcpy(od_table,
table_context->boot_overdrive_table,
sizeof(OverDriveTableExternal_t));
- od_table->OverDriveTable.FeatureCtrlMask = feature_ctrlmask;
+ od_table->OverDriveTable.FeatureCtrlMask = 0;
+ table_context->user_od_feature_mask = 0;
}
fallthrough;
case PP_OD_COMMIT_DPM_TABLE:
/*
- * The member below instructs PMFW the settings focused in
- * this single operation.
- * `uint32_t FeatureCtrlMask;`
- * It does not contain actual informations about user's custom
- * settings. Thus we do not cache it.
+ * PMFW interprets FeatureCtrlMask as the complete set of OD
+ * features that are currently overridden, not as a delta
+ * describing this single operation. Any feature whose bit is
+ * clear gets reset to its default on import. od_table's mask
+ * has accumulated every feature the user touched since the
+ * last full restore, so record it and keep restating it on
+ * subsequent uploads.
*/
+ table_context->user_od_feature_mask =
+ od_table->OverDriveTable.FeatureCtrlMask;
+
offset_of_voltageoffset = offsetof(OverDriveTable_t, VoltageOffsetPerZoneBoundary);
if (memcmp((u8 *)od_table + offset_of_voltageoffset,
table_context->user_overdrive_table + offset_of_voltageoffset,
@@ -2838,7 +2840,6 @@ static int smu_v14_0_2_od_edit_dpm_table(struct smu_context *smu,
return ret;
}
- od_table->OverDriveTable.FeatureCtrlMask = 0;
memcpy(table_context->user_overdrive_table + offset_of_voltageoffset,
(u8 *)od_table + offset_of_voltageoffset,
sizeof(OverDriveTableExternal_t) - offset_of_voltageoffset);
@@ -2882,7 +2883,10 @@ static int smu_v14_0_2_set_ppt_limit(struct smu_context *smu,
if (current_od_table.OverDriveTable.Ppt) {
od_table->OverDriveTable.Ppt = 0;
- od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_PPT_BIT;
+ table_context->user_od_feature_mask &=
+ ~(1U << PP_OD_FEATURE_PPT_BIT);
+ od_table->OverDriveTable.FeatureCtrlMask =
+ table_context->user_od_feature_mask;
ret = smu_v14_0_2_upload_overdrive_table(smu, od_table);
if (ret) {
@@ -2897,7 +2901,9 @@ static int smu_v14_0_2_set_ppt_limit(struct smu_context *smu,
return ret;
od_table->OverDriveTable.Ppt = (limit * 100) / msg_limit - 100;
- od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_PPT_BIT;
+ table_context->user_od_feature_mask |= 1U << PP_OD_FEATURE_PPT_BIT;
+ od_table->OverDriveTable.FeatureCtrlMask =
+ table_context->user_od_feature_mask;
ret = smu_v14_0_2_upload_overdrive_table(smu, od_table);
if (ret) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0968/1257] amdkfd: Fix memory availability double accounting of kfd pinned objects
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (966 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0967/1257] drm/amd/pm:restate all customized OD features on every table upload for smu 13.0.0/smu 14.0.2 Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0969/1257] drm/amdkfd: correct vram_available calculation Greg Kroah-Hartman
` (30 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Phillips, Felix Kuehling,
Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Phillips <daniel.phillips@amd.com>
[ Upstream commit 16df12d7158fb55f20d6e985abd1996cbabab9f8 ]
Pinned objects that are not kfd objects reduce the total vram available
to kfd, so we subtract the total size of pinned objects from kdf vram
availability. However this double counts objects pinned by kfd itself,
because they are counted both as used and pinned. So track the total
size of objects pinned by kfd and add it back to kfd availability to
remove the double accounting.
Signed-off-by: Daniel Phillips <daniel.phillips@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b8257bdb26ca5d9a75f4b81f629422f17afa221b)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 11 +++++++++++
2 files changed, 12 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
index 1b7dc0d3963b8..056dd7375d24f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -106,6 +106,7 @@ struct amdgpu_kfd_dev {
struct kfd_dev *dev;
int64_t vram_used[MAX_XCP];
uint64_t vram_used_aligned[MAX_XCP];
+ atomic64_t vram_pinned;
bool init_complete;
struct work_struct reset_work;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index d66881684ee56..0ac243467422f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -1536,6 +1536,11 @@ static int amdgpu_amdkfd_gpuvm_pin_bo(struct amdgpu_bo *bo, u32 domain)
pr_err("Error in Pinning BO to domain: %d\n", domain);
amdgpu_bo_sync_wait(bo, AMDGPU_FENCE_OWNER_KFD, false);
+
+ if (!ret && bo->tbo.resource->mem_type == TTM_PL_VRAM)
+ atomic64_add(amdgpu_bo_size(bo),
+ &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
+
out:
amdgpu_bo_unreserve(bo);
return ret;
@@ -1558,6 +1563,11 @@ static void amdgpu_amdkfd_gpuvm_unpin_bo(struct amdgpu_bo *bo)
return;
amdgpu_bo_unpin(bo);
+
+ if (bo->tbo.resource->mem_type == TTM_PL_VRAM)
+ atomic64_sub(amdgpu_bo_size(bo),
+ &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
+
amdgpu_bo_unreserve(bo);
}
@@ -1679,6 +1689,7 @@ size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
- adev->kfd.vram_used_aligned[xcp_id]
- atomic64_read(&adev->vram_pin_size)
+ + atomic64_read(&adev->kfd.vram_pinned)
- reserved_for_pt
- reserved_for_ras;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0969/1257] drm/amdkfd: correct vram_available calculation
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (967 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0968/1257] amdkfd: Fix memory availability double accounting of kfd pinned objects Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0970/1257] netdev: Hide the netdev_priv() origin from GCC in netdev_from_priv() Greg Kroah-Hartman
` (29 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philip Yang, Zhen Han, Mukul Joshi,
Lijo Lazar, Alex Deucher, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Han <Zhen.Han@amd.com>
[ Upstream commit 9131cc85d0dedd8ba4cae60dbe5985d081551f30 ]
reserve_mem_limit() computes available VRAM as
vram_size - reserved - vram_pin_size - kfd.vram_used
However, kfd.vram_used already includes BOs that are later pinned.
Pinning does not consume extra VRAM. Subtracting
vram_pin_size counts those bytes twice and causes fake-OOM
while VRAM is still free.
Reuse get_available_memory() in reserve_mem_limit(). Move
ALIGN_DOWN to the ioctl so the userspace ABI is unchanged. The
VRAM counter is a parameter: the ioctl passes vram_used_aligned[],
the gate passes vram_used[] so a 4K BO is not charged 2MB.
kfd.vram_pinned is only updated in gpuvm_pin_bo(). dma-buf pin
calls amdgpu_bo_pin() only, so the counter stays zero. Update it
from amdgpu_bo_pin() through a KFD helper, on first pin and last
unpin, matching vram_pin_size.
Track per-XCP pins in vram_pin_size_xcp[] and kfd.vram_pinned[].
Pins that are not owned by a single partition go to
vram_pin_size_common, which every partition subtracts.
A KFD VRAM BO always carries a partition, so the KFD credit is only
correct for xcp >= 0. Call the helper for both branches and let it
warn once and skip if that ever stops holding: without the credit the
BO would be subtracted through vram_pin_size_common and never added
back, which is the double counting this patch removes, and
kfd.vram_pinned[] would be indexed out of bounds.
Suggested-by: Philip Yang <Philip.Yang@amd.com>
Signed-off-by: Zhen Han <Zhen.Han@amd.com>
Reviewed-by: Mukul Joshi <mukul.joshi@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 894cbb31c50e3cf49657130396bbf6c0475304e4)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 11 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 20 +++-
.../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 94 +++++++++++--------
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 33 +++++++
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 12 ++-
5 files changed, 127 insertions(+), 43 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index a9c6f5d4a6397..a63404adc2d84 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -834,8 +834,17 @@ struct amdgpu_device {
struct mutex mn_lock;
DECLARE_HASHTABLE(mn_hash, 7);
- /* tracking pinned memory */
+ /* tracking pinned memory
+ *
+ * vram_pin_size = sum(vram_pin_size_xcp[]) + vram_pin_size_common
+ *
+ * vram_pin_size total pin size in device
+ * vram_pin_size_xcp[i] pins owned by partition i (bo->xcp_id = i, i >= 0)
+ * vram_pin_size_common pins not owned by any partition, bo->xcp_id = -1
+ */
atomic64_t vram_pin_size;
+ atomic64_t vram_pin_size_xcp[MAX_XCP];
+ atomic64_t vram_pin_size_common;
atomic64_t visible_pin_size;
atomic64_t gart_pin_size;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
index 056dd7375d24f..f462b40220eb2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -42,6 +42,12 @@
extern uint64_t amdgpu_amdkfd_total_mem_size;
+/*
+ * Align VRAM availability to 2MB to avoid fragmentation caused by 4K
+ * allocations in the tail 2MB BO chunk.
+ */
+#define VRAM_AVAILABLITY_ALIGN (1 << 21)
+
enum TLB_FLUSH_TYPE {
TLB_FLUSH_LEGACY = 0,
TLB_FLUSH_LIGHTWEIGHT,
@@ -106,7 +112,7 @@ struct amdgpu_kfd_dev {
struct kfd_dev *dev;
int64_t vram_used[MAX_XCP];
uint64_t vram_used_aligned[MAX_XCP];
- atomic64_t vram_pinned;
+ atomic64_t vram_pinned[MAX_XCP];
bool init_complete;
struct work_struct reset_work;
@@ -391,6 +397,8 @@ void amdgpu_amdkfd_gpuvm_destroy_cb(struct amdgpu_device *adev,
* Allows KFD to release its resources associated with the GEM object.
*/
void amdgpu_amdkfd_release_notify(struct amdgpu_bo *bo);
+void amdgpu_amdkfd_account_vram_pin(struct amdgpu_bo *bo, int xcp_id);
+void amdgpu_amdkfd_account_vram_unpin(struct amdgpu_bo *bo, int xcp_id);
void amdgpu_amdkfd_reserve_system_mem(uint64_t size);
#else
static inline
@@ -408,6 +416,16 @@ static inline
void amdgpu_amdkfd_release_notify(struct amdgpu_bo *bo)
{
}
+
+static inline
+void amdgpu_amdkfd_account_vram_pin(struct amdgpu_bo *bo, int xcp_id)
+{
+}
+
+static inline
+void amdgpu_amdkfd_account_vram_unpin(struct amdgpu_bo *bo, int xcp_id)
+{
+}
#endif
#if IS_ENABLED(CONFIG_HSA_AMD_SVM)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 0ac243467422f..46632a021ce85 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -46,12 +46,6 @@
#define AMDGPU_USERPTR_RESTORE_DELAY_MS 1
#define AMDGPU_RESERVE_MEM_LIMIT (3UL << 29)
-/*
- * Align VRAM availability to 2MB to avoid fragmentation caused by 4K allocations in the tail 2MB
- * BO chunk
- */
-#define VRAM_AVAILABLITY_ALIGN (1 << 21)
-
/* Impose limit on how much memory KFD can use */
static struct {
uint64_t max_system_mem_limit;
@@ -73,6 +67,8 @@ static const char * const domain_bit_to_string[] = {
#define domain_string(domain) domain_bit_to_string[ffs(domain)-1]
static void amdgpu_amdkfd_restore_userptr_worker(struct work_struct *work);
+static size_t __get_available_memory(struct amdgpu_device *adev,
+ uint8_t xcp_id, int64_t vram_used);
static bool kfd_mem_is_attached(struct amdgpu_vm *avm,
struct kgd_mem *mem)
@@ -169,13 +165,8 @@ void amdgpu_amdkfd_reserve_system_mem(uint64_t size)
int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev,
uint64_t size, u32 alloc_flag, int8_t xcp_id)
{
- uint64_t reserved_for_pt =
- ESTIMATE_PT_SIZE(amdgpu_amdkfd_total_mem_size);
- struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
- uint64_t reserved_for_ras = (con ? con->reserved_pages_in_bytes : 0);
size_t system_mem_needed, ttm_mem_needed, vram_needed;
int ret = 0;
- uint64_t vram_size = 0;
system_mem_needed = 0;
ttm_mem_needed = 0;
@@ -196,7 +187,6 @@ int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev,
if (WARN_ONCE(xcp_id < 0, "invalid XCP ID %d", xcp_id))
return -EINVAL;
- vram_size = KFD_XCP_MEMORY_SIZE(adev, xcp_id);
if (adev->apu_prefer_gtt) {
system_mem_needed = size;
ttm_mem_needed = size;
@@ -232,14 +222,11 @@ int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev,
* VRAM check since ttm_mem_limit check already cover this allocation
*/
- if (adev && xcp_id >= 0 && (!adev->apu_prefer_gtt || adev->gmc.is_app_apu)) {
- uint64_t vram_available =
- vram_size - reserved_for_pt - reserved_for_ras -
- atomic64_read(&adev->vram_pin_size);
- if (adev->kfd.vram_used[xcp_id] + vram_needed > vram_available) {
- ret = -ENOMEM;
- goto release;
- }
+ if (adev && xcp_id >= 0 && (!adev->apu_prefer_gtt || adev->gmc.is_app_apu) &&
+ vram_needed > __get_available_memory(adev, xcp_id,
+ adev->kfd.vram_used[xcp_id])) {
+ ret = -ENOMEM;
+ goto release;
}
/* Update memory accounting by decreasing available system
@@ -318,6 +305,30 @@ void amdgpu_amdkfd_release_notify(struct amdgpu_bo *bo)
kfree(bo->kfd_bo);
}
+void amdgpu_amdkfd_account_vram_pin(struct amdgpu_bo *bo, int xcp_id)
+{
+ if (!bo->kfd_bo)
+ return;
+
+ if (WARN_ONCE(xcp_id < 0, "KFD BO pinned in VRAM with no partition"))
+ return;
+
+ atomic64_add(amdgpu_bo_size(bo),
+ &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned[xcp_id]);
+}
+
+void amdgpu_amdkfd_account_vram_unpin(struct amdgpu_bo *bo, int xcp_id)
+{
+ if (!bo->kfd_bo)
+ return;
+
+ if (WARN_ONCE(xcp_id < 0, "KFD BO unpinned in VRAM with no partition"))
+ return;
+
+ atomic64_sub(amdgpu_bo_size(bo),
+ &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned[xcp_id]);
+}
+
/**
* create_dmamap_sg_bo() - Creates a amdgpu_bo object to reflect information
* about USERPTR or DOOREBELL or MMIO BO.
@@ -1537,10 +1548,6 @@ static int amdgpu_amdkfd_gpuvm_pin_bo(struct amdgpu_bo *bo, u32 domain)
amdgpu_bo_sync_wait(bo, AMDGPU_FENCE_OWNER_KFD, false);
- if (!ret && bo->tbo.resource->mem_type == TTM_PL_VRAM)
- atomic64_add(amdgpu_bo_size(bo),
- &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
-
out:
amdgpu_bo_unreserve(bo);
return ret;
@@ -1564,10 +1571,6 @@ static void amdgpu_amdkfd_gpuvm_unpin_bo(struct amdgpu_bo *bo)
amdgpu_bo_unpin(bo);
- if (bo->tbo.resource->mem_type == TTM_PL_VRAM)
- atomic64_sub(amdgpu_bo_size(bo),
- &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
-
amdgpu_bo_unreserve(bo);
}
@@ -1671,8 +1674,9 @@ int amdgpu_amdkfd_criu_resume(void *p)
return ret;
}
-size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
- uint8_t xcp_id)
+/* Caller must hold kfd_mem_limit.mem_limit_lock. */
+static size_t __get_available_memory(struct amdgpu_device *adev,
+ uint8_t xcp_id, int64_t vram_used)
{
uint64_t reserved_for_pt =
ESTIMATE_PT_SIZE(amdgpu_amdkfd_total_mem_size);
@@ -1681,15 +1685,17 @@ size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
ssize_t available;
uint64_t vram_available, system_mem_available, ttm_mem_available;
- spin_lock(&kfd_mem_limit.mem_limit_lock);
+ lockdep_assert_held(&kfd_mem_limit.mem_limit_lock);
+
if (adev->apu_prefer_gtt && !adev->gmc.is_app_apu)
vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
- - adev->kfd.vram_used_aligned[xcp_id];
+ - vram_used;
else
vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
- - adev->kfd.vram_used_aligned[xcp_id]
- - atomic64_read(&adev->vram_pin_size)
- + atomic64_read(&adev->kfd.vram_pinned)
+ - vram_used
+ - atomic64_read(&adev->vram_pin_size_xcp[xcp_id])
+ - atomic64_read(&adev->vram_pin_size_common)
+ + atomic64_read(&adev->kfd.vram_pinned[xcp_id])
- reserved_for_pt
- reserved_for_ras;
@@ -1704,19 +1710,29 @@ size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
available = min3(system_mem_available, ttm_mem_available,
vram_available);
- available = ALIGN_DOWN(available, PAGE_SIZE);
} else {
- available = ALIGN_DOWN(vram_available, VRAM_AVAILABLITY_ALIGN);
+ available = vram_available;
}
- spin_unlock(&kfd_mem_limit.mem_limit_lock);
-
if (available < 0)
available = 0;
return available;
}
+size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
+ uint8_t xcp_id)
+{
+ size_t available;
+
+ spin_lock(&kfd_mem_limit.mem_limit_lock);
+ available = __get_available_memory(adev, xcp_id,
+ adev->kfd.vram_used_aligned[xcp_id]);
+ spin_unlock(&kfd_mem_limit.mem_limit_lock);
+
+ return available;
+}
+
int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
struct amdgpu_device *adev, uint64_t va, uint64_t size,
void *drm_priv, struct kgd_mem **mem,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index 1b6c32a177fb6..ee366d729abfb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -915,6 +915,19 @@ void amdgpu_bo_unref(struct amdgpu_bo **bo)
*bo = NULL;
}
+/* Map a BO onto vram_pin_size_xcp[]. bo->xcp_id < 0 means "any partition":
+ * such pins are not owned by a single partition and go to
+ * vram_pin_size_common, which every partition subtracts.
+ */
+static int amdgpu_bo_get_xcp(struct amdgpu_bo *bo)
+{
+ s8 xcp = bo->xcp_id;
+
+ if (xcp >= 0 && xcp < MAX_XCP)
+ return xcp;
+ return -1;
+}
+
/**
* amdgpu_bo_pin - pin an &amdgpu_bo buffer object
* @bo: &amdgpu_bo buffer object to be pinned
@@ -995,7 +1008,17 @@ int amdgpu_bo_pin(struct amdgpu_bo *bo, u32 domain)
ttm_bo_pin(&bo->tbo);
if (bo->tbo.resource->mem_type == TTM_PL_VRAM) {
+ int xcp = amdgpu_bo_get_xcp(bo);
+
atomic64_add(amdgpu_bo_size(bo), &adev->vram_pin_size);
+ if (xcp >= 0) {
+ atomic64_add(amdgpu_bo_size(bo),
+ &adev->vram_pin_size_xcp[xcp]);
+ } else {
+ atomic64_add(amdgpu_bo_size(bo),
+ &adev->vram_pin_size_common);
+ }
+ amdgpu_amdkfd_account_vram_pin(bo, xcp);
atomic64_add(amdgpu_vram_mgr_bo_visible_size(bo),
&adev->visible_pin_size);
} else if (bo->tbo.resource->mem_type == TTM_PL_TT) {
@@ -1028,7 +1051,17 @@ void amdgpu_bo_unpin(struct amdgpu_bo *bo)
dma_buf_unpin(bo->tbo.base.import_attach);
if (bo->tbo.resource->mem_type == TTM_PL_VRAM) {
+ int xcp = amdgpu_bo_get_xcp(bo);
+
atomic64_sub(amdgpu_bo_size(bo), &adev->vram_pin_size);
+ if (xcp >= 0) {
+ atomic64_sub(amdgpu_bo_size(bo),
+ &adev->vram_pin_size_xcp[xcp]);
+ } else {
+ atomic64_sub(amdgpu_bo_size(bo),
+ &adev->vram_pin_size_common);
+ }
+ amdgpu_amdkfd_account_vram_unpin(bo, xcp);
atomic64_sub(amdgpu_vram_mgr_bo_visible_size(bo),
&adev->visible_pin_size);
} else if (bo->tbo.resource->mem_type == TTM_PL_TT) {
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 3831451240e97..cad60ccdb2166 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1110,11 +1110,19 @@ static int kfd_ioctl_get_available_memory(struct file *filep,
{
struct kfd_ioctl_get_available_memory_args *args = data;
struct kfd_process_device *pdd = kfd_lock_pdd_by_id(p, args->gpu_id);
+ struct amdgpu_device *adev;
+ size_t available;
if (!pdd)
return -EINVAL;
- args->available = amdgpu_amdkfd_get_available_memory(pdd->dev->adev,
- pdd->dev->node_id);
+
+ adev = pdd->dev->adev;
+ available = amdgpu_amdkfd_get_available_memory(adev, pdd->dev->node_id);
+ if (adev->apu_prefer_gtt)
+ args->available = ALIGN_DOWN(available, PAGE_SIZE);
+ else
+ args->available = ALIGN_DOWN(available, VRAM_AVAILABLITY_ALIGN);
+
kfd_unlock_pdd(pdd);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0970/1257] netdev: Hide the netdev_priv() origin from GCC in netdev_from_priv()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (968 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0969/1257] drm/amdkfd: correct vram_available calculation Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0971/1257] ipv6: remove ifaddr from hash during ifdown list cleanup Greg Kroah-Hartman
` (28 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yeswanth Krishna Tellakula,
Kees Cook, Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <kees@kernel.org>
[ Upstream commit 56f8d919739b588e2ad8cb9fb9eff704f32afaab ]
GCC 15.1 and later can compute an object size of 0 for a pointer that
container_of() derives from a pointer into a __counted_by flexible array
member[1]; Clang gets it right. netdev_from_priv() does this with struct
net_device's "priv" array, so when GCC can see that its argument came
from netdev_priv(), FORTIFY_SOURCE sees a zero-sized net_device. Since
commit 9027497a25e3c ("team: use netdev_from_priv()"), adding a port of
another type to a team device can then fail the memcpy() to
"dev->broadcast" in team_setup_by_port(), which GCC sees through after
inlining team_port_add() into team_add_slave():
memcpy: detected buffer overflow: 4 byte write of buffer size 0
...
kernel BUG at lib/string_helpers.c:1044!
...
Call Trace:
<TASK>
team_add_slave.cold+0x88/0x201
do_set_master+0x11c/0x180
do_setlink.isra.0+0x3a4/0x1410
Whether GCC inlines that far depends on the architecture and the
configuration. It does on ppc64le, where this was reported, and on
x86_64 with defconfig plus hardening.config or with Debian's
configuration, but not with allmodconfig.
Hide where "priv" came from with OPTIMIZER_HIDE_VAR(), so GCC sees a
net_device of unknown size whose members have their declared sizes. (An
"unknown" size is considered uncheckable by FORTIFY.) FORTIFY still
bounds writes to members; only the whole-object size becomes unknown,
as it already is for any net_device pointer GCC can't trace to its
allocation. In an extracted PoC, the __builtin_dynamic_object_size()
of "dev->broadcast" for the two types FORTIFY sees, before and after
this patch:
GCC 16.2.0 Clang 22 and 24
before after
plain pointer, whole object unknown unknown 44
container_of(), whole object 0 unknown 44
container_of(), member 0 32 32
In addition to getting the bogus "0" fixed in GCC, I'll be following up
to solve the whole-object visiblity disparity as well.
Build tested with GCC 16.2.0: ARCH=x86_64 defconfig with hardening.config,
CONFIG_NET_TEAM=y, and CONFIG_NET_IPGRE=y; ARCH=arm64 defconfig with
hardening.config, CONFIG_NET_TEAM=y, CONFIG_PPP=y, and CONFIG_NET_AIROHA=m;
and drivers/net/team/, drivers/net/ppp/, and drivers/net/ethernet/airoha/
in ARCH=x86_64 allmodconfig. Under QEMU, the x86_64 kernel hits the BUG
above when adding the GRE fallback device "gre0" as a port of a new team
device without this patch, and adds it with the patch.
Reported-by: Yeswanth Krishna Tellakula <yeswanth@linux.ibm.com>
Closes: https://lore.kernel.org/all/3ad19e86-234c-408f-896e-0d6c774fea49@linux.ibm.com/
Fixes: 9027497a25e3c ("team: use netdev_from_priv()")
Cc: stable@vger.kernel.org
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127875 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
Link: https://patch.msgid.link/20261015165959.i.798-kees@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/netdevice.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3cff2174dc03a..3e64af0b932d7 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2841,6 +2841,13 @@ static inline void *netdev_priv(const struct net_device *dev)
*/
static inline struct net_device *netdev_from_priv(const void *priv)
{
+ /*
+ * When GCC can see that @priv came from netdev_priv(), it can
+ * compute an object size of 0 for the net_device and its members,
+ * which makes FORTIFY_SOURCE fail valid accesses through the result:
+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127875
+ */
+ OPTIMIZER_HIDE_VAR(priv);
return container_of(priv, struct net_device, priv);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0971/1257] ipv6: remove ifaddr from hash during ifdown list cleanup
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (969 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0970/1257] netdev: Hide the netdev_priv() origin from GCC in netdev_from_priv() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0972/1257] ipv6: serialize address publication with device teardown Greg Kroah-Hartman
` (27 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Daehyeon Ko,
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit 6ace56ed7b13a9c6d4cb7ef0d82d3a3d53324a63 ]
addrconf_ifdown() clears the address hash before snapshotting the
per-device address list. A concurrent ipv6_add_addr() can publish an
address after the hash scan and before the list snapshot.
The ifdown path then removes the address from the device list and drops
the list-owned reference while it is still linked in the hash. Once the
remaining references are released, inet6_ifa_finish_destroy() warns, but
a DEAD address continues to kfree_rcu(). The hash therefore points to
freed memory that later RCU walkers can dereference.
This follow-on was found by source review and was not separately
triggered at runtime.
Remove each non-kept address from the hash immediately before removing
it from the per-device list. Keeping it hashed through the delete
notification blocks same-address publication until NETDEV_DOWN has been
delivered. hlist_del_init_rcu() is safe when the earlier hash scan
already removed the address.
This handles a late publisher captured by the list snapshot. The next
change serializes publication with teardown so an add cannot miss both
observations. Both changes are required when backporting the complete fix.
Fixes: 73a8bd74e261 ("ipv6: Revert 'administrative down' address handling changes.")
Cc: stable@vger.kernel.org
Reported-by: Ido Schimmel <idosch@nvidia.com>
Link: https://lore.kernel.org/r/20261004135117.GA206930@shredder
Link: https://lore.kernel.org/r/179161099539.434549.2238120015372268173@kernel.org
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-2-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c90ee6dd7446c..72d7df23f7967 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4019,6 +4019,10 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)
}
if (!keep) {
+ spin_lock_bh(&net->ipv6.addrconf_hash_lock);
+ hlist_del_init_rcu(&ifa->addr_lst);
+ spin_unlock_bh(&net->ipv6.addrconf_hash_lock);
+
write_lock_bh(&idev->lock);
list_del_rcu(&ifa->if_list);
write_unlock_bh(&idev->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0972/1257] ipv6: serialize address publication with device teardown
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (970 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0971/1257] ipv6: remove ifaddr from hash during ifdown list cleanup Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0973/1257] ipv6: initialize temporary ifaddr before publication Greg Kroah-Hartman
` (26 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Daehyeon Ko,
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit 06227034e2d93942119b922cf05f2de9da0ad848 ]
ipv6_add_addr() checks idev state before allocating an ifaddr, but
publishes the object later. addrconf_ifdown() can mark and detach the
idev between the check and publication.
This happens when a non-loopback device MTU falls below IPV6_MIN_MTU. A
forced interleaving published an address on a dead idev, and
ipv6_get_ifaddr() still returned it after teardown. Later device deletion
remained blocked with:
unregister_netdevice: waiting for ac0 to become free. Usage count = 3
Protect the dead indication with idev->lock and keep that lock across
both hash and device-list publication. Recheck dead before publishing;
if teardown wins the lock, reject the unpublished object.
Non-unregister teardown does not set dead. The preceding change covers an
add that misses the initial hash scan but reaches the per-device list
snapshot. Both changes are required when backporting this fix.
Fixes: 8814c4b53381 ("[IPV6] ADDRCONF: Convert addrconf_lock to RCU.")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/179161099408.434549.14449036924552933828@kernel.org
Link: https://lore.kernel.org/r/20261012145306.GB779501@shredder
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-3-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 72d7df23f7967..3bede30d4e989 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1168,14 +1168,18 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
rcu_read_lock();
- err = ipv6_add_addr_hash(idev->dev, ifa);
+ write_lock_bh(&idev->lock);
+
+ if (idev->dead)
+ err = -ENODEV;
+ else
+ err = ipv6_add_addr_hash(idev->dev, ifa);
if (err < 0) {
+ write_unlock_bh(&idev->lock);
rcu_read_unlock();
goto out;
}
- write_lock_bh(&idev->lock);
-
/* Add to inet6_dev unicast addr list. */
ipv6_link_dev_addr(idev, ifa);
@@ -3897,7 +3901,9 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)
* Do not dev_put!
*/
if (unregister) {
+ write_lock_bh(&idev->lock);
WRITE_ONCE(idev->dead, 1);
+ write_unlock_bh(&idev->lock);
/* protected by rtnl_lock */
RCU_INIT_POINTER(dev->ip6_ptr, NULL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0973/1257] ipv6: initialize temporary ifaddr before publication
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (971 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0972/1257] ipv6: serialize address publication with device teardown Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0974/1257] ipv6: do not restart DAD for a dead ifaddr Greg Kroah-Hartman
` (25 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Ido Schimmel, Daehyeon Ko,
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit ed7f278812e540db507f683e5bf9b6d0a1f5bc1e ]
ipv6_create_tempaddr() holds a reference to the public ifaddr, publishes
the new temporary address through ipv6_add_addr(), and only then stores
the reference and final timestamps.
addrconf_ifdown() can remove the temporary address before ifpub is
stored, leaking the public ifaddr reference. Publishing ifpub alone is
insufficient: manage_tempaddrs() can then find the object before cstamp
and tstamp are final, update its lifetimes, and have the constructor
overwrite its timestamp with an older value.
This follow-on was found by source review and was not separately
triggered at runtime.
Pass the public ifaddr and both timestamps in ifa6_config. Initialize all
three fields before adding the temporary address to either the hash or
per-device lists. On success the existing public-ifaddr reference
transfers to the temporary object. On error it remains owned and released
by ipv6_create_tempaddr().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Closes: https://lore.kernel.org/r/179122559913.434549.12720841717630168470@kernel.org
Link: https://lore.kernel.org/r/179161099665.434549.5858601179492551889@kernel.org
Link: https://lore.kernel.org/r/20261007164548.GA1153540@shredder
Link: https://lore.kernel.org/r/20261012145240.GA779501@shredder
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-4-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/addrconf.h | 3 +++
net/ipv6/addrconf.c | 20 +++++++++++++-------
2 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index e6764245995f2..6818057cf7275 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -81,6 +81,9 @@ struct ifa6_config {
u8 ifa_proto;
const struct in6_addr *peer_pfx;
+ struct inet6_ifaddr *ifpub;
+ unsigned long cstamp;
+ unsigned long tstamp;
u32 rt_priority;
u32 ifa_flags;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3bede30d4e989..df56668122619 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1155,10 +1155,19 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
ifa->flags |= IFA_F_TENTATIVE;
ifa->valid_lft = cfg->valid_lft;
ifa->prefered_lft = cfg->preferred_lft;
- ifa->cstamp = ifa->tstamp = jiffies;
ifa->tokenized = false;
ifa->rt = f6i;
+ ifa->ifpub = cfg->ifpub;
+ if (cfg->ifpub) {
+ ifa->cstamp = cfg->cstamp;
+ ifa->tstamp = cfg->tstamp;
+ } else {
+ unsigned long now = jiffies;
+
+ ifa->cstamp = now;
+ ifa->tstamp = now;
+ }
ifa->idev = idev;
in6_dev_hold(idev);
@@ -1491,6 +1500,9 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block)
cfg.pfx = &addr;
cfg.scope = ipv6_addr_scope(cfg.pfx);
+ cfg.ifpub = ifp;
+ cfg.cstamp = now;
+ cfg.tstamp = tmp_tstamp;
ift = ipv6_add_addr(idev, &cfg, block, NULL);
if (IS_ERR(ift)) {
@@ -1501,12 +1513,6 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block)
goto retry;
}
- spin_lock_bh(&ift->lock);
- ift->ifpub = ifp;
- ift->cstamp = now;
- ift->tstamp = tmp_tstamp;
- spin_unlock_bh(&ift->lock);
-
addrconf_dad_start(ift);
in6_ifa_put(ift);
in6_dev_put(idev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0974/1257] ipv6: do not restart DAD for a dead ifaddr
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (972 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0973/1257] ipv6: initialize temporary ifaddr before publication Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0975/1257] fbdev: bitblit: Fix glyph clipping when fbcon pans Greg Kroah-Hartman
` (24 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Daehyeon Ko, Ido Schimmel,
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <4ncienth@gmail.com>
[ Upstream commit ffb668669ce4144347973d8b2fad449e9be0563d ]
addrconf_dad_failure() can create a stable-privacy replacement without
RTNL. After ipv6_add_addr() publishes it, addrconf_ifdown() can mark the
new ifaddr DEAD, clear its route, and unlink it before the recovery path
takes ifp2->lock.
The recovery path then unconditionally changes the state back to PREDAD
and queues delayed DAD work. The MTU teardown path can leave IF_READY
set. For an optimistic address, addrconf_dad_begin() can consequently
pass the cleared NULL route to ip6_ins_rt().
This follow-on was found by source review and was not separately
triggered at runtime.
The new ifaddr is already initialized in PREDAD. Under ifp2->lock, record
the retry and queue DAD only if teardown has not changed the state to
DEAD. If teardown wins after this check, the work observes DEAD and exits
without reviving the address.
This complements the existing lock_errdad check that preserves the original
ifaddr's DEAD state after the same function reacquires its lock.
Fixes: 5f40ef77adb2 ("ipv6: do retries on stable privacy addresses")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Closes: https://lore.kernel.org/r/179161099408.434549.14449036924552933828@kernel.org
Link: https://lore.kernel.org/r/20260513025509.3776405-1-lilinmao@kylinos.cn
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-5-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index df56668122619..a2d3fb187f768 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2198,6 +2198,7 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
ifp->idev->dev->name, &ifp->addr, eth_hdr(skb)->h_source);
if (ifp->flags & IFA_F_STABLE_PRIVACY) {
+ bool start_dad = false;
struct in6_addr new_addr;
struct inet6_ifaddr *ifp2;
int retries = ifp->stable_privacy_retry + 1;
@@ -2236,11 +2237,14 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
goto lock_errdad;
spin_lock_bh(&ifp2->lock);
- ifp2->stable_privacy_retry = retries;
- ifp2->state = INET6_IFADDR_STATE_PREDAD;
+ if (ifp2->state != INET6_IFADDR_STATE_DEAD) {
+ ifp2->stable_privacy_retry = retries;
+ start_dad = true;
+ }
spin_unlock_bh(&ifp2->lock);
- addrconf_mod_dad_work(ifp2, net->ipv6.sysctl.idgen_delay);
+ if (start_dad)
+ addrconf_mod_dad_work(ifp2, net->ipv6.sysctl.idgen_delay);
in6_ifa_put(ifp2);
lock_errdad:
spin_lock_bh(&ifp->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0975/1257] fbdev: bitblit: Fix glyph clipping when fbcon pans
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (973 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0974/1257] ipv6: do not restart DAD for a dead ifaddr Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0976/1257] fbcon: Include font geometry in the rotated font cache Greg Kroah-Hartman
` (23 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Tingjie Zhong,
Helge Deller, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tingjie Zhong <catme0w@live.cn>
[ Upstream commit 06fccf840640d8f6b0e08a1756f8d2f0435b4cbe ]
Commit 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix
vmalloc-out-of-bounds") made bit_putcs() clip glyphs to var.yres. When
fbcon scrolls by panning, it draws text rows up to var.yres_virtual,
so after the first pan most new text is not drawn until the next full
redraw. This affects fbdev drivers that set FBINFO_HWACCEL_YPAN or
FBINFO_HWACCEL_YWRAP, such as vesafb with the ypan option, when
CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y.
Clip to GETVYRES() instead, which fbcon_ud.c and fbcon_ccw.c already
use as the drawing area height. When fbcon does not pan, GETVYRES()
returns var.yres, keeping the existing bound. When fbcon pans, it
returns var.yres_virtual, which the framebuffer memory must cover
anyway for panning to work.
Fixes: 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds")
Reported-by: Thomas Zimmermann <tzimmermann@suse.de>
Closes: https://lore.kernel.org/linux-fbdev/b8b52ffd-ecec-4fba-b432-ba32135c2f99@suse.de/
Tested-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: stable@vger.kernel.org
Signed-off-by: Tingjie Zhong <catme0w@live.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/bitblit.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index 39f44258d793f..323a9e79a684d 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -18,6 +18,7 @@
#include <linux/console.h>
#include <asm/types.h>
#include "fbcon.h"
+#include "fbcon_rotate.h"
/*
* Accelerated handlers.
@@ -150,7 +151,9 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
const unsigned short *s, int count, int yy, int xx,
int fg, int bg)
{
+ struct fbcon_par *par = info->fbcon_par;
struct fb_image image;
+ u32 vyres = GETVYRES(par->p, info);
u32 width = DIV_ROUND_UP(vc->vc_font.width, 8);
u32 cellsize = width * vc->vc_font.height;
u32 maxcnt = info->pixmap.size/cellsize;
@@ -167,10 +170,10 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
image.height = vc->vc_font.height;
image.depth = 1;
- if (image.dy >= info->var.yres)
+ if (image.dy >= vyres)
return;
- image.height = min(image.height, info->var.yres - image.dy);
+ image.height = min(image.height, vyres - image.dy);
if (attribute) {
buf = kmalloc(cellsize, GFP_ATOMIC);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0976/1257] fbcon: Include font geometry in the rotated font cache
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (974 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0975/1257] fbdev: bitblit: Fix glyph clipping when fbcon pans Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0977/1257] fbcon: Rebuild rotated font buffer on font change Greg Kroah-Hartman
` (22 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yao Yiqi, Thomas Zimmermann,
Helge Deller, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao Yiqi <yaoyiqi3@huawei.com>
[ Upstream commit 10463bcd43495fb88ff667b2c5348200860f6bdc ]
fbcon_rotate_font() caches a rotated copy of the console font and
skips the rebuild when the fontdata pointer and the rotation match.
Raw font data carries no geometry, though: width, height and
charcount live in vc->vc_font. fbcon_set_font() deduplicates uploads
by byte equality, so the same bytes re-uploaded with different
dimensions keep the fontdata pointer while the geometry changes, and
the early-out skips the rebuild.
The rotated cell size depends on the geometry (rotation swaps width
and height), so the stale buffer is indexed with the new cell size.
Re-uploading a 4x16 font as 16x8 on a CW-rotated console, for
example, doubles the rotated cell size and reads past the end of the
old buffer.
Record the geometry the buffer was built from and compare it in the
early-out. The pointer-only key used to be backed by an explicit
width check in the deduplication, which commit 1e3c49aa03fb
("lib/fonts: Compare font data for equality with font_data_is_equal()")
dropped.
Fixes: 6cc50e1c5b57 ("[PATCH] fbcon: Console Rotation - Add support to rotate font bitmap")
Cc: stable@vger.kernel.org
Signed-off-by: Yao Yiqi <yaoyiqi3@huawei.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/fbcon.h | 9 ++++++---
drivers/video/fbdev/core/fbcon_rotate.c | 9 ++++++++-
2 files changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h
index 407d207b14f16..bfbd70f8b1cdf 100644
--- a/drivers/video/fbdev/core/fbcon.h
+++ b/drivers/video/fbdev/core/fbcon.h
@@ -89,10 +89,13 @@ struct fbcon_par {
char *cursor_data;
#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION
struct {
- font_data_t *fontdata; /* source font */
- u8 *buf; /* rotated glyphs */
+ font_data_t *fontdata; /* source font */
+ u8 *buf; /* rotated glyphs */
size_t bufsize;
- int buf_rotate; /* rotation of buf */
+ int buf_rotate; /* rotation of buf */
+ unsigned int buf_width; /* geometry of source font */
+ unsigned int buf_height;
+ unsigned int buf_charcount;
} rotated;
#endif
u8 *cursor_src;
diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c
index 6cdbc96eeca6f..660a3fa81baed 100644
--- a/drivers/video/fbdev/core/fbcon_rotate.c
+++ b/drivers/video/fbdev/core/fbcon_rotate.c
@@ -21,11 +21,18 @@ int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc)
unsigned char *buf;
int ret;
- if (par->p->fontdata == par->rotated.fontdata && par->rotate == par->rotated.buf_rotate)
+ if (par->p->fontdata == par->rotated.fontdata &&
+ par->rotate == par->rotated.buf_rotate &&
+ vc->vc_font.width == par->rotated.buf_width &&
+ vc->vc_font.height == par->rotated.buf_height &&
+ vc->vc_font.charcount == par->rotated.buf_charcount)
return 0;
par->rotated.fontdata = par->p->fontdata;
par->rotated.buf_rotate = par->rotate;
+ par->rotated.buf_width = vc->vc_font.width;
+ par->rotated.buf_height = vc->vc_font.height;
+ par->rotated.buf_charcount = vc->vc_font.charcount;
if (info->fbops->fb_sync)
info->fbops->fb_sync(info);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0977/1257] fbcon: Rebuild rotated font buffer on font change
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (975 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0976/1257] fbcon: Include font geometry in the rotated font cache Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0978/1257] fbcon: Retry rotated font allocation after failure Greg Kroah-Hartman
` (21 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yao Yiqi, Thomas Zimmermann,
Helge Deller, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao Yiqi <yaoyiqi3@huawei.com>
[ Upstream commit e4b6b865d45d8dafb6c6f28c8a993a5b4431d25a ]
fbcon_rotate_font() caches a rotated copy of the console font in
par->rotated.buf. The buffer is sized from the font's width, height
and charcount, and is rebuilt in fbcon_init(), fbcon_switch() and
fbcon_modechanged(), but not in fbcon_do_set_font().
When the font is changed through KDFONTOP, the new geometry is
installed and vc_resize() redraws before the buffer is rebuilt. The
rotated putcs/cursor ops then index the old buffer with the new cell
size; KASAN reports a slab-out-of-bounds read in soft_cursor().
Rebuild the buffer for the visible console before the redraw, as the
other callers do: select the console's blitting state with
set_blitting_type() (which also uploads the new font's map on
tile-blitting hardware), then rebuild. Background consoles keep
their rebuild at fbcon_switch() time, as the buffer is shared per
framebuffer and must not be updated for a console that is not being
displayed.
To ensure a correct rollback when the rebuild or the following
vc_resize() fails, save the rotated font state, clear it before
rebuilding, and restore it in the error path of
fbcon_do_set_font().
Fixes: 6cc50e1c5b57 ("[PATCH] fbcon: Console Rotation - Add support to rotate font bitmap")
Cc: stable@vger.kernel.org
Signed-off-by: Yao Yiqi <yaoyiqi3@huawei.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/fbcon.c | 46 ++++++++++++++++++++++++++++++++
drivers/video/fbdev/core/fbcon.h | 22 ++++++++-------
2 files changed, 59 insertions(+), 9 deletions(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 01715873ea49b..9a5d50d69d004 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2414,6 +2414,10 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
font_data_t *old_fontdata = p->fontdata;
const u8 *old_data = vc->vc_font.data;
unsigned short old_hi_font_mask = vc->vc_hi_font_mask;
+#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION
+ struct fbcon_rotated saved_rotated = { };
+ bool rotated_saved = false;
+#endif
font_data_get(data);
@@ -2432,6 +2436,27 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
else if (!vc->vc_hi_font_mask && charcount == 512)
set_vc_hi_font(vc, true);
+ /*
+ * Select the console's blitting state and update par->rotated to
+ * match the new font, so that the rendering below does not use a
+ * cache that was built for the old font. Clear the cached state so
+ * the rebuild allocates a fresh buffer; the old state is kept until
+ * the font change can no longer fail.
+ */
+ if (con_is_visible(vc)) {
+ set_blitting_type(vc, info);
+ if (par->bitops->rotate_font) {
+#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION
+ saved_rotated = par->rotated;
+ memset(&par->rotated, 0, sizeof(par->rotated));
+ rotated_saved = true;
+#endif
+ ret = par->bitops->rotate_font(info, vc);
+ if (ret)
+ goto err_out;
+ }
+ }
+
if (resize) {
int cols, rows;
@@ -2448,12 +2473,26 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
update_screen(vc);
}
+#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION
+ if (rotated_saved)
+ kfree(saved_rotated.buf);
+#endif
if (old_fontdata)
font_data_put(old_fontdata);
return 0;
err_out:
+#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION
+ /*
+ * Drop the buffer built for the new font and restore the saved
+ * state.
+ */
+ if (rotated_saved) {
+ kfree(par->rotated.buf);
+ par->rotated = saved_rotated;
+ }
+#endif
p->fontdata = old_fontdata;
vc->vc_font.data = old_data;
vc->vc_font.width = old_width;
@@ -2466,6 +2505,13 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
else if (!old_hi_font_mask && vc->vc_hi_font_mask)
set_vc_hi_font(vc, false);
+ /*
+ * Re-select the blitting type, which re-uploads the font map on
+ * tile-blitting hardware.
+ */
+ if (con_is_visible(vc))
+ set_blitting_type(vc, info);
+
font_data_put(data);
return ret;
diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h
index bfbd70f8b1cdf..a618adf3c8715 100644
--- a/drivers/video/fbdev/core/fbcon.h
+++ b/drivers/video/fbdev/core/fbcon.h
@@ -72,6 +72,18 @@ struct fbcon_bitops {
int (*rotate_font)(struct fb_info *info, struct vc_data *vc);
};
+#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION
+struct fbcon_rotated {
+ font_data_t *fontdata; /* source font */
+ u8 *buf; /* rotated glyphs */
+ size_t bufsize;
+ int buf_rotate; /* rotation of buf */
+ unsigned int buf_width; /* geometry of source font */
+ unsigned int buf_height;
+ unsigned int buf_charcount;
+};
+#endif
+
struct fbcon_par {
struct fb_var_screeninfo var; /* copy of the current fb_var_screeninfo */
struct delayed_work cursor_work; /* Cursor timer */
@@ -88,15 +100,7 @@ struct fbcon_par {
int rotate;
char *cursor_data;
#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION
- struct {
- font_data_t *fontdata; /* source font */
- u8 *buf; /* rotated glyphs */
- size_t bufsize;
- int buf_rotate; /* rotation of buf */
- unsigned int buf_width; /* geometry of source font */
- unsigned int buf_height;
- unsigned int buf_charcount;
- } rotated;
+ struct fbcon_rotated rotated;
#endif
u8 *cursor_src;
u32 cursor_size;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0978/1257] fbcon: Retry rotated font allocation after failure
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (976 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0977/1257] fbcon: Rebuild rotated font buffer on font change Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0979/1257] PCI: qcom-ep: Deinitialize endpoint on remove Greg Kroah-Hartman
` (20 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yao Yiqi, Thomas Zimmermann,
Helge Deller, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao Yiqi <yaoyiqi3@huawei.com>
[ Upstream commit 7935db1a4a0f83a63590a222500e5016e2f6c85e ]
fbcon_rotate_font() records the font, its geometry and the rotation in
par->rotated before calling font_data_rotate(). If the allocation
fails, the error path clears par->rotated.buf, but the recorded key
already looks up to date, so the next call takes the early-out and
never retries. The rotated putcs/cursor ops keep returning early on
the NULL buffer, and the console stays blank even after memory is
available again.
Also test par->rotated.buf in the early-out, so a failed allocation
is retried on the next call: at the next fbcon_switch(),
fbcon_modechanged() or font change.
Fixes: e4ef723d8975 ("fbcon: Avoid OOB font access if console rotation fails")
Cc: stable@vger.kernel.org
Signed-off-by: Yao Yiqi <yaoyiqi3@huawei.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/fbcon_rotate.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c
index 660a3fa81baed..7afd63dcee7be 100644
--- a/drivers/video/fbdev/core/fbcon_rotate.c
+++ b/drivers/video/fbdev/core/fbcon_rotate.c
@@ -25,7 +25,8 @@ int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc)
par->rotate == par->rotated.buf_rotate &&
vc->vc_font.width == par->rotated.buf_width &&
vc->vc_font.height == par->rotated.buf_height &&
- vc->vc_font.charcount == par->rotated.buf_charcount)
+ vc->vc_font.charcount == par->rotated.buf_charcount &&
+ par->rotated.buf)
return 0;
par->rotated.fontdata = par->p->fontdata;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0979/1257] PCI: qcom-ep: Deinitialize endpoint on remove
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (977 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0978/1257] fbcon: Retry rotated font allocation after failure Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0980/1257] net/rds: ib: dont enable IRQs in rds_ib_conn_free() Greg Kroah-Hartman
` (19 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Manivannan Sadhasivam,
Bjorn Helgaas, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit ed1d71e41c7b2e755e0ef8e9af9cab9b6b185c4b ]
qcom_pcie_ep_probe() initializes the DesignWare PCIe endpoint with
dw_pcie_ep_init(). The probe failure paths call dw_pcie_ep_deinit() to
release the corresponding endpoint resources, but the remove path does
not perform the matching teardown after a successful probe.
As a result, resources initialized by the DesignWare endpoint core can
remain allocated when the endpoint controller is removed.
Notify endpoint functions about EPC deinitialization and call
dw_pcie_ep_deinit() before disabling the controller resources. Keep the
existing early return when the link is already disabled since Qualcomm
endpoint controllers depend on the host refclk for hardware cleanup.
This issue was found by manual code inspection.
Fixes: f55fee56a631 ("PCI: qcom-ep: Add Qualcomm PCIe Endpoint controller driver")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260916090126.2963064-1-lgs201920130244@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom-ep.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c
index 56184e6ca6e69..28949386b0e87 100644
--- a/drivers/pci/controller/dwc/pcie-qcom-ep.c
+++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c
@@ -944,6 +944,8 @@ static void qcom_pcie_ep_remove(struct platform_device *pdev)
if (pcie_ep->link_status == QCOM_PCIE_EP_LINK_DISABLED)
return;
+ pci_epc_deinit_notify(pcie_ep->pci.ep.epc);
+ dw_pcie_ep_deinit(&pcie_ep->pci.ep);
qcom_pcie_disable_resources(pcie_ep);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0980/1257] net/rds: ib: dont enable IRQs in rds_ib_conn_free()
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (978 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0979/1257] PCI: qcom-ep: Deinitialize endpoint on remove Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0981/1257] net: unix: reject negative max_dgram_qlen values Greg Kroah-Hartman
` (18 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c3741bb338b5c6d6a4aa,
Nguyen Ngoc Thang, Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
[ Upstream commit f6fa1d60ec3ceb7e6c26aa91eadfef34f94014e1 ]
__rds_conn_create() calls trans->conn_free() with rds_conn_lock held
and IRQs disabled when it loses the race to insert a connection.
rds_ib_conn_free() takes the device list lock with spin_lock_irq() and
releases it with spin_unlock_irq(), so IRQs are turned on while
rds_conn_lock is still held:
raw_local_irq_restore() called with IRQs enabled
WARNING: kernel/locking/irqflag-debug.c:10 at warn_bogus_irq_restore+0xc/0x20
_raw_spin_unlock_irqrestore+0x67/0x80
__rds_conn_create+0x1de5/0x2290
rds_conn_create_outgoing+0x43/0x60
rds_sendmsg+0xfca/0x20e0
__sys_sendto+0x408/0x5a0
It needs an RDS socket bound to an address on an RDMA device (e.g. rxe)
and two concurrent sendto() calls to the same new destination.
The TCP and loopback ->conn_free() callbacks already use irqsave, so
do the same here.
Fixes: 745cbccac3fe ("RDS: Rewrite connection cleanup, fixing oops on rmmod")
Reported-by: syzbot+c3741bb338b5c6d6a4aa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c3741bb338b5c6d6a4aa
Cc: stable@vger.kernel.org
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/ib_cm.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 6e3110a04ae6b..5c717120eab56 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -1271,6 +1271,7 @@ void rds_ib_conn_free(void *arg)
{
struct rds_ib_connection *ic = arg;
spinlock_t *lock_ptr;
+ unsigned long flags;
rdsdebug("ic %p\n", ic);
@@ -1281,9 +1282,10 @@ void rds_ib_conn_free(void *arg)
*/
lock_ptr = ic->rds_ibdev ? &ic->rds_ibdev->spinlock : &ib_nodev_conns_lock;
- spin_lock_irq(lock_ptr);
+ /* May be called with IRQs already disabled (see __rds_conn_create()) */
+ spin_lock_irqsave(lock_ptr, flags);
list_del(&ic->ib_node);
- spin_unlock_irq(lock_ptr);
+ spin_unlock_irqrestore(lock_ptr, flags);
rds_ib_recv_free_caches(ic);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0981/1257] net: unix: reject negative max_dgram_qlen values
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (979 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0980/1257] net/rds: ib: dont enable IRQs in rds_ib_conn_free() Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0982/1257] mlxsw: Initialize register query payloads Greg Kroah-Hartman
` (17 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yingjie Wang, Kuniyuki Iwashima,
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yingjie Wang <1075151112@qq.com>
[ Upstream commit 1a4e7bc6e3457ad95515a9d2c042452c3161bb2c ]
net.unix.max_dgram_qlen is parsed as a signed int and copied to the u32
sock::sk_max_ack_backlog when an AF_UNIX socket is created. Consequently,
a negative value such as -1 is accepted and converted to UINT_MAX. Since
the receive queue length is also u32, its fullness check cannot become true
for that limit.
max_dgram_qlen has no documented negative sentinel. Its existing signed
interface represents nonnegative values only through INT_MAX; negative bit
patterns are not a supported encoding for the upper half of the u32
consumer range.
Switch to proc_dointvec_minmax and make the established 0..INT_MAX input
range explicit. This rejects negative values without adding new accepted
values or changing the default and zero-value behavior. Very large valid
values can still make the queue limit impractical to reach; this change
corrects the input domain rather than imposing a new resource ceiling.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <1075151112@qq.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/tencent_A643419B56079E9A448D97922763FF069F08@qq.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/networking/ip-sysctl.rst | 3 ++-
net/unix/sysctl_net_unix.c | 4 +++-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index f7af0286341c9..8edd2eb2ac49a 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -3823,5 +3823,6 @@ l3mdev_accept - BOOLEAN
max_dgram_qlen - INTEGER
The maximum length of dgram socket receive queue
- Default: 10
+ Possible values: 0 - INT_MAX
+ Default: 10
diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
index 47660d5726bbd..fa1fbaec3aaf5 100644
--- a/net/unix/sysctl_net_unix.c
+++ b/net/unix/sysctl_net_unix.c
@@ -19,7 +19,9 @@ static const struct ctl_table unix_table[] = {
.data = &init_net.unx.sysctl_max_dgram_qlen,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ .extra2 = SYSCTL_INT_MAX,
},
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0982/1257] mlxsw: Initialize register query payloads
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (980 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0981/1257] net: unix: reject negative max_dgram_qlen values Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0983/1257] exfat: advance valid_size to EOF for append writes Greg Kroah-Hartman
` (16 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Til Kaiser, Ido Schimmel,
Jakub Kicinski, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Til Kaiser <mail@tk154.de>
[ Upstream commit 15b7a86a8888dc6a8fd19e181757e32389de9064 ]
MFGD register queries can exhaust EMAD retries and leave Mellanox
Spectrum switches stuck during boot or shutdown when running OpenWrt
built with GCC 15.
An example failure is shown below with the second line wrapped:
EMAD retries (5/5) (tid=9b544fc100001f35)
EMAD reg access failed (tid=9b544fc100001f35,reg_id=90f0(mfgd),
type=query,status=0(operation performed))
On an SN2100, the failure occurs during driver teardown on reboot.
On an SN3420, it occurs while probing mlxsw_spectrum during boot.
The register query API transmits the supplied payload to the device
before replacing it with the response. Both MFGD callers pass an
uninitialized stack buffer, so the request contains arbitrary register
field values and reserved bits. This makes the request depend on stack
contents and compiler code generation.
Initialize both MFGD query buffers in the firmware fatal event
configuration and reporter test paths. The initialization has been
confirmed to eliminate the boot and shutdown hangs on both switches.
The subsequent read-modify-write still preserves the other fields
returned by the device.
Also initialize the FORE fan fault query and the MOGCR mirroring policer
base query, which pass entirely uninitialized payloads. Restore the MTMP
query initialization in the temperature history reset path, where only
the slot and sensor index fields are set before querying the register.
This follows commit 5b0907407e7f ("mlxsw: core: Zero payload buffers for
couple of registers"), which initialized other query payloads after a
firmware field length bug caused firmware to consume uninitialized data.
Tested with firmware 2020.1148 and with 2016.3900 from linux-firmware.
Fixes: 7d83ee111008 ("mlxsw: core: Introduce fw_fatal health reporter")
Fixes: 2c6a33cd334b ("mlxsw: core: Extend hwmon interface with fan fault attribute")
Fixes: 4039504e6a0c ("mlxsw: spectrum_span: Allow setting policer on a SPAN agent")
Fixes: b890ad418e1f ("mlxsw: core_hwmon: Extend internal structures to support multi hwmon objects")
Cc: stable@vger.kernel.org
Signed-off-by: Til Kaiser <mail@tk154.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261014173117.26305-1-mail@tk154.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlxsw/core.c | 4 ++--
drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c | 4 ++--
drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c | 2 +-
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index 308d8a94865f8..42e9689d7f357 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -2001,7 +2001,7 @@ mlxsw_core_health_fw_fatal_test(struct devlink_health_reporter *reporter,
struct netlink_ext_ack *extack)
{
struct mlxsw_core *mlxsw_core = devlink_health_reporter_priv(reporter);
- char mfgd_pl[MLXSW_REG_MFGD_LEN];
+ char mfgd_pl[MLXSW_REG_MFGD_LEN] = {0};
int err;
/* Read the register first to make sure no other bits are changed. */
@@ -2022,7 +2022,7 @@ mlxsw_core_health_fw_fatal_ops = {
static int mlxsw_core_health_fw_fatal_config(struct mlxsw_core *mlxsw_core,
bool enable)
{
- char mfgd_pl[MLXSW_REG_MFGD_LEN];
+ char mfgd_pl[MLXSW_REG_MFGD_LEN] = {0};
int err;
/* Read the register first to make sure no other bits are changed. */
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
index 30f172ce822cf..a5e7aee730d6a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
@@ -120,7 +120,7 @@ static ssize_t mlxsw_hwmon_temp_rst_store(struct device *dev,
container_of(attr, struct mlxsw_hwmon_attr, dev_attr);
struct mlxsw_hwmon_dev *mlxsw_hwmon_dev = mlxsw_hwmon_attr->mlxsw_hwmon_dev;
struct mlxsw_hwmon *mlxsw_hwmon = mlxsw_hwmon_dev->hwmon;
- char mtmp_pl[MLXSW_REG_MTMP_LEN];
+ char mtmp_pl[MLXSW_REG_MTMP_LEN] = {0};
unsigned long val;
int index;
int err;
@@ -177,7 +177,7 @@ static ssize_t mlxsw_hwmon_fan_fault_show(struct device *dev,
container_of(attr, struct mlxsw_hwmon_attr, dev_attr);
struct mlxsw_hwmon_dev *mlxsw_hwmon_dev = mlxsw_hwmon_attr->mlxsw_hwmon_dev;
struct mlxsw_hwmon *mlxsw_hwmon = mlxsw_hwmon_dev->hwmon;
- char fore_pl[MLXSW_REG_FORE_LEN];
+ char fore_pl[MLXSW_REG_FORE_LEN] = {0};
bool fault;
int err;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
index ae63d549b5429..d54fe5e612963 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
@@ -1720,7 +1720,7 @@ static int mlxsw_sp2_span_init(struct mlxsw_sp *mlxsw_sp)
static int mlxsw_sp2_span_policer_id_base_set(struct mlxsw_sp *mlxsw_sp,
u16 policer_id_base)
{
- char mogcr_pl[MLXSW_REG_MOGCR_LEN];
+ char mogcr_pl[MLXSW_REG_MOGCR_LEN] = {0};
int err;
err = mlxsw_reg_query(mlxsw_sp->core, MLXSW_REG(mogcr), mogcr_pl);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0983/1257] exfat: advance valid_size to EOF for append writes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (981 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0982/1257] mlxsw: Initialize register query payloads Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0984/1257] exfat: hold the invalidate lock while truncating Greg Kroah-Hartman
` (15 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chi Zhiling, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhiling <chizhiling@kylinos.cn>
[ Upstream commit b70ab407503706289163dd59f1ac3e942bacc37d ]
For an append write, the write position is recalculated by
generic_write_checks(). Therefore, the write position must be obtained
after generic_write_checks() returns.
Using the original write position to advance valid_size may cause the
valid_size update to be skipped, potentially exposing stale data.
Also move the truncate_pagecache() check below the recalculated
position, so that pos is never read before it is assigned.
Fixes: 11a347fb6cef ("exfat: change to get file size from DataLength")
Cc: stable@vger.kernel.org
Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/file.c | 18 ++++++++----------
1 file changed, 8 insertions(+), 10 deletions(-)
diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index a2a9ee1a20048..b30aec858da6c 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -854,8 +854,7 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
struct file *file = iocb->ki_filp;
struct inode *inode = file_inode(file);
struct exfat_inode_info *ei = EXFAT_I(inode);
- loff_t pos = iocb->ki_pos;
- loff_t valid_size;
+ loff_t pos, valid_size;
int err;
if (unlikely(exfat_forced_shutdown(inode->i_sb)))
@@ -863,11 +862,6 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
inode_lock(inode);
- if (pos > i_size_read(inode))
- truncate_pagecache(inode, i_size_read(inode));
-
- valid_size = ei->valid_size;
-
ret = generic_write_checks(iocb, iter);
if (ret <= 0)
goto unlock;
@@ -878,6 +872,11 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
goto unlock;
}
+ pos = iocb->ki_pos;
+ if (pos > i_size_read(inode))
+ truncate_pagecache(inode, i_size_read(inode));
+
+ valid_size = ei->valid_size;
if (pos > valid_size) {
ret = exfat_extend_valid_size(inode, pos);
if (ret < 0 && ret != -ENOSPC) {
@@ -887,6 +886,8 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
}
if (ret < 0)
goto unlock;
+
+ pos = valid_size;
}
if (iocb->ki_flags & IOCB_DIRECT)
@@ -899,9 +900,6 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
inode_unlock(inode);
- if (pos > valid_size)
- pos = valid_size;
-
if (iocb->ki_pos > pos) {
ssize_t err = generic_write_sync(iocb, iocb->ki_pos - pos);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0984/1257] exfat: hold the invalidate lock while truncating
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (982 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0983/1257] exfat: advance valid_size to EOF for append writes Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0985/1257] exfat: dirty all new pages when extending valid_size Greg Kroah-Hartman
` (14 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chi Zhiling, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhiling <chizhiling@kylinos.cn>
[ Upstream commit 646df471c37483eb31548d76a1b062775db71d60 ]
truncate_setsize() ends in truncate_inode_pages(), which is documented
as being "Called under (and serialised by) inode->i_rwsem and
mapping->invalidate_lock".
Hold invalidate_lock while executing truncate_setsize() to ensure that
truncate and mmap writes are mutually exclusive. This can simplify the
handling in exfat_page_mkwrite().
Fixes: 82a81a7352bc ("exfat: add iomap buffered I/O support")
Cc: stable@vger.kernel.org
Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/file.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index b30aec858da6c..81eeb76ef94bf 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -413,6 +413,7 @@ int exfat_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
* about to be freed.
*/
inode_dio_wait(inode);
+ filemap_invalidate_lock(inode->i_mapping);
truncate_setsize(inode, attr->ia_size);
/*
@@ -420,6 +421,7 @@ int exfat_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
* is already written by it, so mark_inode_dirty() is unneeded.
*/
exfat_truncate(inode);
+ filemap_invalidate_unlock(inode->i_mapping);
} else
mark_inode_dirty(inode);
@@ -784,8 +786,10 @@ static int exfat_extend_valid_size(struct inode *inode, loff_t new_valid_size)
ret = exfat_zero_new_range(inode, gap_start, new_valid_size);
filemap_invalidate_unlock(inode->i_mapping);
if (ret) {
+ filemap_invalidate_lock(inode->i_mapping);
truncate_setsize(inode, old_valid_size);
exfat_truncate(inode);
+ filemap_invalidate_unlock(inode->i_mapping);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0985/1257] exfat: dirty all new pages when extending valid_size
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (983 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0984/1257] exfat: hold the invalidate lock while truncating Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0986/1257] exfat: make valid_size and zeroed_size atomic Greg Kroah-Hartman
` (13 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chi Zhiling, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhiling <chizhiling@kylinos.cn>
[ Upstream commit 03ac97285b699954fa7bc24f8b6cdc1830c94d28 ]
In the current code, exfat_zero_new_range() does not mark non-uptodate
pages as dirty, which may cause some blocks within a page to not be
written back.
This commit no longer checks each block in a non-uptodate page
individually. Instead, it reads the entire page back into the cache and
then writes it back as a whole. This allows concurrent writes and zeroing
operations to be synchronized using the folio lock.
Fixes: 1135704ed22f ("exfat: fix valid_size extension over a shared writable mapping")
Cc: stable@vger.kernel.org
Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/file.c | 108 ++++++++++++------------------------------------
1 file changed, 26 insertions(+), 82 deletions(-)
diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index 81eeb76ef94bf..8b551bb83676e 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -656,98 +656,42 @@ int exfat_file_fsync(struct file *filp, loff_t start, loff_t end, int datasync)
}
/*
- * exfat_zero_new_range - zero [start, end) without overwriting uptodate blocks
+ * exfat_prepare_valid_range - populate and dirty folios covering [start, end)
*
- * Uptodate blocks may contain data written through a shared mapping beyond
- * valid_size.
+ * Populate missing blocks via the read path, which zero-fills data
+ * beyond the current valid_size and skips uptodate blocks.
+ * Mark entire folios dirty so the newly valid range is written back.
+ *
+ * Call before advancing valid_size.
*/
-static int exfat_zero_new_range(struct inode *inode, loff_t start, loff_t end)
+static int exfat_prepare_valid_range(struct inode *inode, loff_t start,
+ loff_t end)
{
struct address_space *mapping = inode->i_mapping;
- unsigned int blocksize = i_blocksize(inode);
- loff_t pos = start;
- int err;
-
- while (pos < end) {
- loff_t next = min_t(loff_t,
- round_down(pos, PAGE_SIZE) + PAGE_SIZE, end);
- struct folio *folio;
- loff_t bpos;
-
- folio = filemap_get_folio(mapping, pos >> PAGE_SHIFT);
- if (IS_ERR(folio)) {
- err = iomap_zero_range(inode, pos, next - pos, NULL,
- &exfat_iomap_ops, NULL, NULL);
- if (err < 0)
- return err;
- pos = next;
- continue;
- }
+ loff_t next, pos = start;
+ struct folio *folio;
+ pgoff_t index;
- if (folio_test_uptodate(folio)) {
- folio_lock(folio);
- if (folio->mapping == mapping)
- folio_mark_dirty(folio);
- folio_unlock(folio);
- folio_put(folio);
- pos = next;
- continue;
- }
+ if (pos >= end)
+ return 0;
- /*
- * Zero not-uptodate block runs. iomap_zero_range() requires an
- * unlocked folio, so recheck ->mapping after each call.
- */
- folio_lock(folio);
- bpos = pos;
- while (bpos < next) {
- loff_t rstart, rend;
-
- if (folio->mapping != mapping) {
- folio_unlock(folio);
- err = iomap_zero_range(inode, bpos, next - bpos,
- NULL, &exfat_iomap_ops, NULL, NULL);
- if (err < 0) {
- folio_put(folio);
- return err;
- }
- folio_lock(folio);
- break;
- }
-
- if (iomap_is_partially_uptodate(folio,
- offset_in_folio(folio, bpos), blocksize)) {
- bpos += blocksize;
- continue;
- }
+ while (pos < end) {
+ index = pos >> PAGE_SHIFT;
+ next = min(((loff_t)index + 1) << PAGE_SHIFT, end);
- rstart = bpos;
- rend = min_t(loff_t, bpos + blocksize, next);
- while (rend < next &&
- !iomap_is_partially_uptodate(folio,
- offset_in_folio(folio, rend), blocksize))
- rend = min_t(loff_t, rend + blocksize, next);
+ balance_dirty_pages_ratelimited(mapping);
- folio_unlock(folio);
- err = iomap_zero_range(inode, rstart, rend - rstart,
- NULL, &exfat_iomap_ops, NULL, NULL);
- if (err < 0) {
- folio_put(folio);
- return err;
- }
- folio_lock(folio);
- bpos = rend;
- }
+ folio = read_mapping_folio(mapping, index, NULL);
+ if (IS_ERR(folio))
+ return PTR_ERR(folio);
- /*
- * Dirty only a fully uptodate folio. Dirtying a partial folio could
- * write uninitialised cache contents over valid on-disk blocks.
- */
- if (folio->mapping == mapping && folio_test_uptodate(folio))
+ folio_lock(folio);
+ if (folio->mapping == mapping) {
folio_mark_dirty(folio);
+ pos = next;
+ }
folio_unlock(folio);
folio_put(folio);
- pos = next;
}
return 0;
@@ -783,7 +727,7 @@ static int exfat_extend_valid_size(struct inode *inode, loff_t new_valid_size)
if (gap_start < new_valid_size)
unmap_mapping_range(inode->i_mapping, gap_start,
new_valid_size - gap_start, 0);
- ret = exfat_zero_new_range(inode, gap_start, new_valid_size);
+ ret = exfat_prepare_valid_range(inode, gap_start, new_valid_size);
filemap_invalidate_unlock(inode->i_mapping);
if (ret) {
filemap_invalidate_lock(inode->i_mapping);
@@ -965,7 +909,7 @@ static vm_fault_t exfat_page_mkwrite(struct vm_fault *vmf)
* fault populated its folio and iomap_page_mkwrite()
* will dirty it.
*/
- err = exfat_zero_new_range(inode, ei->zeroed_size,
+ err = exfat_prepare_valid_range(inode, ei->zeroed_size,
fault_page_start);
if (err < 0) {
inode_unlock(inode);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0986/1257] exfat: make valid_size and zeroed_size atomic
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (984 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0985/1257] exfat: dirty all new pages when extending valid_size Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0987/1257] exfat: drain in-flight DIO before buffered writes Greg Kroah-Hartman
` (12 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chi Zhiling, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhiling <chizhiling@kylinos.cn>
[ Upstream commit 6bb112f5d90a78461648e3bd89093ea299196be5 ]
ei->valid_size and ei->zeroed_size are 64-bit fields read from bio
completion context (exfat_iomap_read_end_io()) and from ->iomap_begin
without i_rwsem, while writers update them under i_rwsem. On 32-bit
these loads can tear, and the "if (x < new) x = new" read-modify-write
can lose an update or regress the value when two writers race.
Convert both to atomic64_t and funnel updates through a cmpxchg-based
monotonic advance helper so the value only moves forward; plain reads use
exfat_get_*(), and the few shrink/init paths (truncate, inode fill,
create) use exfat_set_*(). This is a prerequisite for taking
exfat_page_mkwrite() out from under i_rwsem.
Fixes: 82a81a7352bc ("exfat: add iomap buffered I/O support")
Cc: stable@vger.kernel.org
Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/exfat_fs.h | 60 +++++++++++++++++++++++++++++++++++++++++++--
fs/exfat/file.c | 32 +++++++++++++-----------
fs/exfat/inode.c | 16 ++++++------
fs/exfat/iomap.c | 20 +++++++--------
fs/exfat/namei.c | 4 +--
5 files changed, 96 insertions(+), 36 deletions(-)
diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h
index a9131fe03302e..249aa59288631 100644
--- a/fs/exfat/exfat_fs.h
+++ b/fs/exfat/exfat_fs.h
@@ -7,6 +7,7 @@
#define _EXFAT_FS_H
#include <linux/fs.h>
+#include <linux/atomic.h>
#include <linux/ratelimit.h>
#include <linux/nls.h>
#include <linux/blkdev.h>
@@ -293,9 +294,16 @@ struct exfat_inode_info {
/* on-disk position of directory entry or 0 */
loff_t i_pos;
- loff_t valid_size;
+ /*
+ * valid_size and zeroed_size are updated from multiple contexts that
+ * are not serialised against each other (page_mkwrite runs without
+ * i_rwsem, while buffered/DIO writes advance them under i_rwsem). Keep
+ * them atomic and only ever advance them with a cmpxchg loop so a
+ * concurrent update can never regress the value or tear on 32-bit.
+ */
+ atomic64_t valid_size;
/* block-aligned size zeroed in the page cache (>= valid_size) */
- loff_t zeroed_size;
+ atomic64_t zeroed_size;
/* hash by i_location */
struct hlist_node i_hash_fat;
struct inode vfs_inode;
@@ -313,6 +321,54 @@ static inline struct exfat_inode_info *EXFAT_I(struct inode *inode)
return container_of(inode, struct exfat_inode_info, vfs_inode);
}
+static inline loff_t exfat_get_valid_size(struct exfat_inode_info *ei)
+{
+ return atomic64_read(&ei->valid_size);
+}
+
+static inline loff_t exfat_get_zeroed_size(struct exfat_inode_info *ei)
+{
+ return atomic64_read(&ei->zeroed_size);
+}
+
+static inline void exfat_set_valid_size(struct exfat_inode_info *ei, loff_t v)
+{
+ atomic64_set(&ei->valid_size, v);
+}
+
+static inline void exfat_set_zeroed_size(struct exfat_inode_info *ei, loff_t v)
+{
+ atomic64_set(&ei->zeroed_size, v);
+}
+
+/*
+ * Monotonically advance @v to at least @new. Returns true if the value was
+ * actually raised, so callers can decide whether to mark the inode dirty.
+ */
+static inline bool exfat_size_advance(atomic64_t *v, loff_t new)
+{
+ loff_t old = atomic64_read(v);
+
+ do {
+ if (old >= new)
+ return false;
+ } while (!atomic64_try_cmpxchg(v, &old, new));
+
+ return true;
+}
+
+static inline bool exfat_advance_valid_size(struct exfat_inode_info *ei,
+ loff_t new)
+{
+ return exfat_size_advance(&ei->valid_size, new);
+}
+
+static inline bool exfat_advance_zeroed_size(struct exfat_inode_info *ei,
+ loff_t new)
+{
+ return exfat_size_advance(&ei->zeroed_size, new);
+}
+
static inline int exfat_forced_shutdown(struct super_block *sb)
{
return test_bit(EXFAT_FLAGS_SHUTDOWN, &EXFAT_SB(sb)->s_exfat_flags);
diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index 8b551bb83676e..89e2fdebcc2c1 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -247,8 +247,10 @@ int __exfat_truncate(struct inode *inode)
ei->start_clu = EXFAT_EOF_CLUSTER;
}
- if (i_size_read(inode) < ei->valid_size)
- ei->valid_size = ei->zeroed_size = i_size_read(inode);
+ if (i_size_read(inode) < exfat_get_valid_size(ei)) {
+ exfat_set_valid_size(ei, i_size_read(inode));
+ exfat_set_zeroed_size(ei, i_size_read(inode));
+ }
if (ei->type == TYPE_FILE)
ei->attr |= EXFAT_ATTR_ARCHIVE;
@@ -700,12 +702,12 @@ static int exfat_prepare_valid_range(struct inode *inode, loff_t start,
static int exfat_extend_valid_size(struct inode *inode, loff_t new_valid_size)
{
struct exfat_inode_info *ei = EXFAT_I(inode);
- loff_t old_valid_size = ei->valid_size;
+ loff_t old_valid_size = exfat_get_valid_size(ei);
int ret = 0;
if (old_valid_size < new_valid_size) {
/* Do not re-zero blocks already covered by zeroed_size. */
- loff_t gap_start = max(old_valid_size, ei->zeroed_size);
+ loff_t gap_start = max(old_valid_size, exfat_get_zeroed_size(ei));
if (i_size_read(inode) < new_valid_size) {
/*
@@ -737,9 +739,9 @@ static int exfat_extend_valid_size(struct inode *inode, loff_t new_valid_size)
return ret;
}
- ei->valid_size = new_valid_size;
- if (ei->zeroed_size < round_up(new_valid_size, i_blocksize(inode)))
- ei->zeroed_size = round_up(new_valid_size, i_blocksize(inode));
+ exfat_set_valid_size(ei, new_valid_size);
+ exfat_advance_zeroed_size(ei,
+ round_up(new_valid_size, i_blocksize(inode)));
mark_inode_dirty(inode);
}
@@ -824,7 +826,7 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
if (pos > i_size_read(inode))
truncate_pagecache(inode, i_size_read(inode));
- valid_size = ei->valid_size;
+ valid_size = exfat_get_valid_size(ei);
if (pos > valid_size) {
ret = exfat_extend_valid_size(inode, pos);
if (ret < 0 && ret != -ENOSPC) {
@@ -900,8 +902,10 @@ static vm_fault_t exfat_page_mkwrite(struct vm_fault *vmf)
fault_page_start = ((loff_t)vmf->pgoff) << PAGE_SHIFT;
new_valid_size = min(mmap_valid_size, i_size_read(inode));
- if (ei->valid_size < new_valid_size) {
- if (ei->zeroed_size < fault_page_start) {
+ if (exfat_get_valid_size(ei) < new_valid_size) {
+ loff_t zeroed_size = exfat_get_zeroed_size(ei);
+
+ if (zeroed_size < fault_page_start) {
int err;
/*
@@ -909,7 +913,7 @@ static vm_fault_t exfat_page_mkwrite(struct vm_fault *vmf)
* fault populated its folio and iomap_page_mkwrite()
* will dirty it.
*/
- err = exfat_prepare_valid_range(inode, ei->zeroed_size,
+ err = exfat_prepare_valid_range(inode, zeroed_size,
fault_page_start);
if (err < 0) {
inode_unlock(inode);
@@ -922,9 +926,9 @@ static vm_fault_t exfat_page_mkwrite(struct vm_fault *vmf)
* at i_size recording blocks wholly beyond it could skip a
* later required zeroing.
*/
- if (ei->zeroed_size < round_up(new_valid_size, i_blocksize(inode)))
- ei->zeroed_size = round_up(new_valid_size, i_blocksize(inode));
- ei->valid_size = new_valid_size;
+ exfat_advance_zeroed_size(ei,
+ round_up(new_valid_size, i_blocksize(inode)));
+ exfat_set_valid_size(ei, new_valid_size);
mark_inode_dirty(inode);
}
diff --git a/fs/exfat/inode.c b/fs/exfat/inode.c
index ccd13630187e1..5129df1e79b44 100644
--- a/fs/exfat/inode.c
+++ b/fs/exfat/inode.c
@@ -29,6 +29,7 @@ int __exfat_write_inode(struct inode *inode, int sync)
struct exfat_sb_info *sbi = EXFAT_SB(sb);
struct exfat_inode_info *ei = EXFAT_I(inode);
bool is_dir = (ei->type == TYPE_DIR);
+ loff_t valid_size = exfat_get_valid_size(ei);
struct timespec64 ts;
if (inode->i_ino == EXFAT_ROOT_INO)
@@ -81,7 +82,7 @@ int __exfat_write_inode(struct inode *inode, int sync)
* preventing fsck from reporting "more clusters are allocated".
*/
on_disk_size = max_t(unsigned long long, i_size_read(inode),
- ei->valid_size);
+ valid_size);
if (ei->start_clu == EXFAT_EOF_CLUSTER)
on_disk_size = 0;
@@ -89,7 +90,7 @@ int __exfat_write_inode(struct inode *inode, int sync)
* valid_size on disk must reflect only confirmed data (up to i_size)
* and must not exceed on_disk_size.
*/
- on_disk_valid_size = min_t(unsigned long long, ei->valid_size,
+ on_disk_valid_size = min_t(unsigned long long, valid_size,
i_size_read(inode));
if (ei->start_clu == EXFAT_EOF_CLUSTER)
on_disk_valid_size = 0;
@@ -258,15 +259,16 @@ static void exfat_readahead(struct readahead_control *rac)
struct inode *inode = mapping->host;
struct exfat_inode_info *ei = EXFAT_I(inode);
loff_t pos = readahead_pos(rac);
+ loff_t valid_size = exfat_get_valid_size(ei);
struct iomap_read_folio_ctx ctx = {
.ops = &exfat_iomap_bio_read_ops,
.rac = rac,
};
/* Range cross valid_size, read it page by page. */
- if (ei->valid_size < i_size_read(inode) &&
- pos <= ei->valid_size &&
- ei->valid_size < pos + readahead_length(rac))
+ if (valid_size < i_size_read(inode) &&
+ pos <= valid_size &&
+ valid_size < pos + readahead_length(rac))
return;
iomap_readahead(&exfat_iomap_ops, &ctx, NULL);
@@ -371,8 +373,8 @@ static int exfat_fill_inode(struct inode *inode, struct exfat_dir_entry *info)
ei->start_clu = info->start_clu;
ei->flags = info->flags;
ei->type = info->type;
- ei->valid_size = info->valid_size;
- ei->zeroed_size = info->valid_size;
+ exfat_set_valid_size(ei, info->valid_size);
+ exfat_set_zeroed_size(ei, info->valid_size);
ei->version = 0;
ei->hint_stat.eidx = 0;
diff --git a/fs/exfat/iomap.c b/fs/exfat/iomap.c
index 8911aa84a730e..faa9b116e5528 100644
--- a/fs/exfat/iomap.c
+++ b/fs/exfat/iomap.c
@@ -46,6 +46,7 @@ static int __exfat_iomap_begin(struct inode *inode, loff_t offset, loff_t length
struct exfat_inode_info *ei = EXFAT_I(inode);
unsigned int cluster, num_clusters;
loff_t cluster_offset, cluster_length;
+ loff_t valid_size = exfat_get_valid_size(ei);
int err;
bool balloc = false;
@@ -88,7 +89,7 @@ static int __exfat_iomap_begin(struct inode *inode, loff_t offset, loff_t length
if (may_alloc || flags & IOMAP_ZERO) {
if (balloc)
iomap->flags |= IOMAP_F_NEW;
- else if (iomap->offset + iomap->length >= ei->valid_size) {
+ else if (iomap->offset + iomap->length >= valid_size) {
/*
* This is a write that starts at or extends beyond
* the current valid_size. The region between the old
@@ -114,10 +115,10 @@ static int __exfat_iomap_begin(struct inode *inode, loff_t offset, loff_t length
* return IOMAP_UNWRITTEN so the write path can
* distinguish it from a real hole.
*/
- if (offset >= ei->valid_size) {
+ if (offset >= valid_size) {
iomap->type = flags & IOMAP_REPORT ?
IOMAP_HOLE : IOMAP_UNWRITTEN;
- } else if (offset + iomap->length > ei->valid_size) {
+ } else if (offset + iomap->length > valid_size) {
if (flags & IOMAP_REPORT) {
/*
* For SEEK_HOLE/SEEK_DATA, clip the length
@@ -125,9 +126,9 @@ static int __exfat_iomap_begin(struct inode *inode, loff_t offset, loff_t length
* This ensures the caller gets the precise
* hole position in byte units.
*/
- iomap->length = ei->valid_size - iomap->offset;
+ iomap->length = valid_size - iomap->offset;
} else
- iomap->length = round_up(ei->valid_size,
+ iomap->length = round_up(valid_size,
i_blocksize(inode)) -
iomap->offset;
}
@@ -175,10 +176,8 @@ static int exfat_write_iomap_end(struct inode *inode, loff_t pos, loff_t length,
end = pos + written;
- if (ei->valid_size < end) {
- ei->valid_size = end;
+ if (exfat_advance_valid_size(ei, end))
dirtied = true;
- }
/*
* IOMAP_F_ZERO_TAIL zeroes the remainder of the last block. Track that
@@ -186,8 +185,7 @@ static int exfat_write_iomap_end(struct inode *inode, loff_t pos, loff_t length,
*/
if (iomap->flags & IOMAP_F_ZERO_TAIL)
end = round_up(end, i_blocksize(inode));
- if (ei->zeroed_size < end)
- ei->zeroed_size = end;
+ exfat_advance_zeroed_size(ei, end);
if (dirtied || iomap->flags & IOMAP_F_SIZE_CHANGED)
mark_inode_dirty(inode);
@@ -250,7 +248,7 @@ static void exfat_iomap_read_end_io(struct bio *bio)
s64 valid_size;
loff_t pos = folio_pos(folio);
- valid_size = ei->valid_size;
+ valid_size = exfat_get_valid_size(ei);
if (pos + iter.offset < valid_size &&
pos + iter.offset + iter.length > valid_size)
folio_zero_segment(folio, offset_in_folio(folio, valid_size),
diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
index a4dc83b5949c4..1ab26833ba91d 100644
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -380,7 +380,7 @@ int exfat_find_empty_entry(struct inode *inode,
/* directory inode should be updated in here */
i_size_write(inode, size);
- ei->valid_size += sbi->cluster_size;
+ atomic64_add(sbi->cluster_size, &ei->valid_size);
ei->flags = p_dir->flags;
inode->i_blocks += sbi->cluster_size >> 9;
}
@@ -1248,7 +1248,7 @@ static int __exfat_rename(struct inode *old_parent_inode,
}
i_size_write(new_inode, 0);
- new_ei->valid_size = 0;
+ exfat_set_valid_size(new_ei, 0);
new_ei->start_clu = EXFAT_EOF_CLUSTER;
new_ei->flags = ALLOC_NO_FAT_CHAIN;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0987/1257] exfat: drain in-flight DIO before buffered writes
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (985 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0986/1257] exfat: make valid_size and zeroed_size atomic Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0988/1257] exfat: zero invalid tail on partial overwrites Greg Kroah-Hartman
` (11 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiale Yao, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <yaojiale02@163.com>
[ Upstream commit acea17f0f4c7742118375e96d3f876be34e449a5 ]
An asynchronous direct write can remain in flight after the inode lock is
released. If a buffered operation dirties page cache while the direct
write is still pending, the direct write's post-I/O invalidation can find
the dirty pages, report a page cache invalidation failure, and record -EIO
in the mapping error sequence. A later fsync() therefore returns -EIO.
Commit 15cdefd0c0522f9d5e12d947fa04f4c11649b699 ("ext4: drain
in-flight DIO before buffered write fallback") fixed the same race in
ext4. ExFAT does not drain in-flight DIO before a regular buffered write,
the buffered fallback after iomap_dio_rw() returns -ENOTBLK or a short
write, or the page-cache operations used to extend valid_size.
Wait for in-flight DIO before these paths can dirty page cache.
A reproducer using concurrent AIO direct writes and buffered fallback
triggered the following warning and made a subsequent fsync() return
-EIO:
Page cache invalidation failure on direct I/O. Possible data corruption
due to collision with buffered I/O!
Fixes: 867b9c96dc83 ("exfat: add iomap direct I/O support")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20260629113827.4074335-3-libaokun@linux.alibaba.com
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/file.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index 89e2fdebcc2c1..d24f0650bfc88 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -706,6 +706,8 @@ static int exfat_extend_valid_size(struct inode *inode, loff_t new_valid_size)
int ret = 0;
if (old_valid_size < new_valid_size) {
+ inode_dio_wait(inode);
+
/* Do not re-zero blocks already covered by zeroed_size. */
loff_t gap_start = max(old_valid_size, exfat_get_zeroed_size(ei));
@@ -757,6 +759,8 @@ static ssize_t exfat_fallback_buffered_write(struct kiocb *iocb,
iocb->ki_flags &= ~IOCB_DIRECT;
+ inode_dio_wait(file_inode(iocb->ki_filp));
+
written = iomap_file_buffered_write(iocb, from, &exfat_write_iomap_ops,
NULL, NULL);
if (written < 0)
@@ -840,11 +844,17 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
pos = valid_size;
}
- if (iocb->ki_flags & IOCB_DIRECT)
+ if (iocb->ki_flags & IOCB_DIRECT) {
ret = exfat_dio_write_iter(iocb, iter);
- else
+ } else {
+ /*
+ * Prevent concurrent direct I/O and buffered I/O to the same file
+ * range. Wait for in-flight DIO to finish before dirtying pages.
+ */
+ inode_dio_wait(inode);
ret = iomap_file_buffered_write(iocb, iter,
&exfat_write_iomap_ops, NULL, NULL);
+ }
if (ret < 0)
goto unlock;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0988/1257] exfat: zero invalid tail on partial overwrites
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (986 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0987/1257] exfat: drain in-flight DIO before buffered writes Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0989/1257] exfat: fix a large buffered write failing when the volume is nearly full Greg Kroah-Hartman
` (10 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
[ Upstream commit 748ad4ba13cd14163ed7262c6ac304c380804167 ]
Buffered overwrite that ends before valid_size in the same filesystem
block reads the entire block without IOMAP_F_ZERO_TAIL. If an existing
cluster contains stale bytes beyond valid_size, the synchronous read
loads them into the page cache and marks the block uptodate. Subsequent
buffered reads can return these bytes while i_size exceeds valid_size.
For example, with 512-byte blocks, valid_size of 1000 and i_size of 2048,
a cold-cache overwrite of [900, 950) exposes stale data in [1000, 1024).
Setting ZERO_TAIL for this write would also erase valid data in
[950, 1000).
Use iomap_truncate_page() to zero only the invalid tail at valid_size
before preparing such buffered overwrites. Call it after dropping s_lock
and before iomap locks the write folio. The inode lock held by buffered
writes serializes valid_size against truncation and page_mkwrite.
Skip direct I/O, fault mappings and new allocations. Writes that reach
valid_size continue to use IOMAP_F_ZERO_TAIL.
Fixes: 82a81a7352bc ("exfat: add iomap buffered I/O support")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/iomap.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/fs/exfat/iomap.c b/fs/exfat/iomap.c
index faa9b116e5528..bcb7a9214f92b 100644
--- a/fs/exfat/iomap.c
+++ b/fs/exfat/iomap.c
@@ -149,7 +149,27 @@ static int exfat_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
static int exfat_write_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
unsigned int flags, struct iomap *iomap, struct iomap *srcmap)
{
- return __exfat_iomap_begin(inode, offset, length, flags, iomap, true);
+ struct exfat_inode_info *ei = EXFAT_I(inode);
+ loff_t valid_size = exfat_get_valid_size(ei);
+ loff_t end;
+ int err;
+
+ err = __exfat_iomap_begin(inode, offset, length, flags, iomap, true);
+ if (err || flags & (IOMAP_DIRECT | IOMAP_FAULT) ||
+ iomap->flags & IOMAP_F_NEW)
+ return err;
+
+ end = iomap->offset + iomap->length;
+ if (end >= valid_size ||
+ round_up(end, i_blocksize(inode)) <= valid_size)
+ return 0;
+
+ /*
+ * Zero the invalid bytes from valid_size to the end of the block
+ * to prevent stale data from being exposed through the page cache.
+ */
+ return iomap_truncate_page(inode, valid_size, NULL, &exfat_iomap_ops,
+ NULL, NULL);
}
static DEFINE_IOMAP_ITER_NEXT(exfat_iomap_next, exfat_iomap_begin);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0989/1257] exfat: fix a large buffered write failing when the volume is nearly full
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (987 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0988/1257] exfat: zero invalid tail on partial overwrites Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0990/1257] exfat: mark straddling folio RO and zero the post-EOF range Greg Kroah-Hartman
` (9 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hengyu Liang, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengyu Liang <hengyul@cs.unc.edu>
[ Upstream commit 73cababf93cb371e2e9d06da5261ca6ddd2404b6 ]
Commit 82a81a7352bc ("exfat: add iomap buffered I/O support") made a
buffered write map the whole range of the write in one step, so the
clusters for all of it are allocated at once.
However, exfat_alloc_cluster() returns -ENOSPC when fewer clusters are
free than it is asked for. As of now, a write() that is larger than the
free space writes nothing and fails with ENOSPC, while it used to write
as much as fits and return a short count.
The issue can be reproduced with a 16M image made by mkfs.exfat that is
filled except for 256K:
mount -o loop /img /mnt
dd if=/dev/zero of=/mnt/hole bs=256k count=1
dd if=/dev/zero of=/mnt/fill bs=4k
rm /mnt/hole
dd if=/dev/zero of=/mnt/f bs=1M count=1
wc -c < /mnt/f
Before commit 82a81a7352bc ("exfat: add iomap buffered I/O support"),
the result is:
262144
After that commit, the result is:
0
This patch will map a single cluster when the clusters for the whole
range cannot be allocated, so that the write goes on until the volume is
full. Direct I/O is not changed, it still fails without writing as it
did before that commit.
Fixes: 82a81a7352bc ("exfat: add iomap buffered I/O support")
Cc: stable@vger.kernel.org
Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/iomap.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/exfat/iomap.c b/fs/exfat/iomap.c
index bcb7a9214f92b..f734d13d3fce5 100644
--- a/fs/exfat/iomap.c
+++ b/fs/exfat/iomap.c
@@ -75,6 +75,17 @@ static int __exfat_iomap_begin(struct inode *inode, loff_t offset, loff_t length
err = exfat_map_cluster(inode, exfat_bytes_to_cluster(sbi, offset),
&cluster, &num_clusters, may_alloc, &balloc);
+ if (err == -ENOSPC && !(flags & IOMAP_DIRECT)) {
+ /*
+ * There are not enough free clusters for the whole range. A
+ * buffered write can be short, so map what still fits.
+ */
+ num_clusters = 1;
+ err = exfat_map_cluster(inode,
+ exfat_bytes_to_cluster(sbi, offset),
+ &cluster, &num_clusters, may_alloc,
+ &balloc);
+ }
if (err)
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0990/1257] exfat: mark straddling folio RO and zero the post-EOF range
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (988 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0989/1257] exfat: fix a large buffered write failing when the volume is nearly full Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0991/1257] exfat: free clusters beyond EOF when a write fails or is short Greg Kroah-Hartman
` (8 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuezhang Mo, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <Yuezhang.Mo@sony.com>
[ Upstream commit 1043264c3cfa43b0668f7472a749868c1e21749b ]
When extending a file across a non-page-aligned EOF, the folio
containing the old EOF must be marked RO so that subsequent mmap
writes trigger ->page_mkwrite() and update valid_size.
The straddling folio remains mapped to the same filesystem block
after the file is extended. As a result, the existing writable PTE
may remain in place, allowing mmap writes to bypass ->page_mkwrite()
and leave valid_size unchanged.
Furthermore, writes to the post-EOF range may occur between
truncate_pagecache() and locking the folio. So the post-EOF range
should be zeroed after marking the straddling folio RO, and using
truncate_pagecache() to zero out the post-EOF range is redundant.
Introduce exfat_pagecache_isize_extended() to mark the straddling
folio RO and zero the post-EOF range after clearing writable mapping.
This ensures that data written beyond the old EOF before the extension
is not exposed as valid file data, and that subsequent mmap writes
trigger ->page_mkwrite() to update valid_size.
Fixes: 82a81a7352bc ("exfat: add iomap buffered I/O support")
Cc: stable@vger.kernel.org
Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/file.c | 72 ++++++++++++++++++++++++++++++++++++++++++-------
1 file changed, 63 insertions(+), 9 deletions(-)
diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index d24f0650bfc88..f106db945d8dd 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -17,11 +17,70 @@
#include <linux/fileattr.h>
#include <linux/iomap.h>
#include <linux/pagemap.h>
+#include <linux/rmap.h>
#include "exfat_raw.h"
#include "exfat_fs.h"
#include "iomap.h"
+/*
+ * Unlike pagecache_isize_extended(), this function updates i_size while
+ * holding the straddling folio lock, and does not skip the straddling
+ * folio when the filesystem block size is >= PAGE_SIZE or when 'from'
+ * and 'to' fall within the same filesystem block.
+ *
+ * This ensures that the folio is marked RO and the post-EOF range is
+ * zeroed before readers or writeback can observe the updated i_size.
+ */
+static void exfat_pagecache_isize_extended(struct inode *inode, loff_t from,
+ loff_t to)
+{
+ struct folio *folio;
+
+ if (!(from & (PAGE_SIZE - 1))) {
+ i_size_write(inode, to);
+ return;
+ }
+
+ folio = filemap_lock_folio(inode->i_mapping, from >> PAGE_SHIFT);
+
+ /* Folio not cached? Nothing to do */
+ if (IS_ERR(folio)) {
+ i_size_write(inode, to);
+ return;
+ }
+
+ /*
+ * See folio_clear_dirty_for_io() for details why folio_mark_dirty()
+ * is needed.
+ */
+ if (folio_mkclean(folio))
+ folio_mark_dirty(folio);
+
+ /*
+ * Zero the post-EOF range before publishing the new size. Writeback
+ * normally does this, but the extension would expose the tail to
+ * readers before writeback gets a chance to zero it.
+ */
+ if (folio_test_dirty(folio)) {
+ loff_t offset, end;
+
+ offset = from - folio_pos(folio);
+ end = min_t(loff_t, to - folio_pos(folio),
+ folio_size(folio));
+ folio_zero_segment(folio, offset, end);
+ }
+
+ /*
+ * Publish the new size after zeroing the tail. Uptodate folios can
+ * be read without taking the folio lock.
+ */
+ i_size_write(inode, to);
+
+ folio_unlock(folio);
+ folio_put(folio);
+}
+
static int exfat_cont_expand(struct inode *inode, loff_t size)
{
int ret;
@@ -32,8 +91,6 @@ static int exfat_cont_expand(struct inode *inode, loff_t size)
struct exfat_chain clu;
loff_t oldsize = i_size_read(inode);
- truncate_pagecache(inode, oldsize);
-
ret = inode_newsize_ok(inode, size);
if (ret)
return ret;
@@ -81,15 +138,12 @@ static int exfat_cont_expand(struct inode *inode, loff_t size)
out:
inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
- /* Expanded range not zeroed, do not update valid_size */
- i_size_write(inode, size);
/*
- * When extending file size, call truncate_pagecache() first,
- * then update i_size, and call pagecache_isize_extended()
- * to ensures the straddling folio is properly marked RO so
- * page_mkwrite() is called and post-EOF area is zeroed.
+ * When extending file size, call exfat_pagecache_isize_extended()
+ * to update i_size and ensure the straddling folio is properly
+ * marked RO so page_mkwrite() is called and post-EOF area is zeroed.
*/
- pagecache_isize_extended(inode, oldsize, inode->i_size);
+ exfat_pagecache_isize_extended(inode, oldsize, size);
inode->i_blocks = round_up(size, sbi->cluster_size) >> 9;
mark_inode_dirty(inode);
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0991/1257] exfat: free clusters beyond EOF when a write fails or is short
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (989 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0990/1257] exfat: mark straddling folio RO and zero the post-EOF range Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0992/1257] exfat: fix reading a directory whose FAT chain is longer than its size Greg Kroah-Hartman
` (7 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hengyu Liang, Namjae Jeon,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengyu Liang <hengyul@cs.unc.edu>
[ Upstream commit b4c282c0d82e8715ea9ed0b35813a3f365e3f952 ]
Commit 82a81a7352bc ("exfat: add iomap buffered I/O support") and commit
867b9c96dc83 ("exfat: add iomap direct I/O support") made a write
allocate the clusters for its whole range in one step. They also dropped
exfat_write_failed(), which freed the clusters beyond the end of the
file after a failed or short write.
However, a write can stop early, for example when the process is killed
or when a part of the buffer cannot be read. As of now, the clusters for
the part that was not written stay allocated beyond the end of the file.
exfat_cont_expand() does not expect them, so a later write or truncate
that extends the file fails with ENOSPC. The directory entry records
only the size of the file, so the space can be lost for good once the
volume is unmounted.
The issue can be reproduced on a 64M volume made by mkfs.exfat and
mounted on /mnt, with a write of 1M from a buffer that has only its
first 4K mapped:
#include <fcntl.h>
#include <stdio.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <unistd.h>
int main(void)
{
char *p = mmap(NULL, 8192, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
int fd = open("/mnt/f", O_CREAT | O_WRONLY, 0644);
struct stat st;
munmap(p + 4096, 4096);
printf("write: %zd\n", write(fd, p, 1 << 20));
fstat(fd, &st);
printf("blocks: %ld\n", (long)st.st_blocks);
printf("ftruncate: %d\n", ftruncate(fd, 1 << 16));
return 0;
}
Before commit 82a81a7352bc ("exfat: add iomap buffered I/O support"),
the result is:
write: 4096
blocks: 8
ftruncate: 0
After that commit, the result is:
write: 4096
blocks: 2048
ftruncate: -1
This patch will bring back exfat_write_failed() and call it when a write
ends before the end of its range, so that the clusters beyond the end of
the file are freed again. It waits for direct I/O in flight first, as
exfat_setattr() does before it frees clusters.
Fixes: 82a81a7352bc ("exfat: add iomap buffered I/O support")
Fixes: 867b9c96dc83 ("exfat: add iomap direct I/O support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/file.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index f106db945d8dd..dc57d2c2f0f0f 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -804,6 +804,19 @@ static int exfat_extend_valid_size(struct inode *inode, loff_t new_valid_size)
return ret;
}
+/*
+ * The clusters for a write are allocated before the data is copied. Free the
+ * ones that a failed or short write has left beyond the end of the file.
+ */
+static void exfat_write_failed(struct inode *inode)
+{
+ inode_dio_wait(inode);
+ filemap_invalidate_lock(inode->i_mapping);
+ truncate_pagecache(inode, i_size_read(inode));
+ exfat_truncate(inode);
+ filemap_invalidate_unlock(inode->i_mapping);
+}
+
static ssize_t exfat_fallback_buffered_write(struct kiocb *iocb,
struct iov_iter *from)
{
@@ -862,7 +875,7 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
struct file *file = iocb->ki_filp;
struct inode *inode = file_inode(file);
struct exfat_inode_info *ei = EXFAT_I(inode);
- loff_t pos, valid_size;
+ loff_t pos, valid_size, end;
int err;
if (unlikely(exfat_forced_shutdown(inode->i_sb)))
@@ -881,6 +894,7 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
}
pos = iocb->ki_pos;
+ end = pos + iov_iter_count(iter);
if (pos > i_size_read(inode))
truncate_pagecache(inode, i_size_read(inode));
@@ -909,6 +923,8 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
ret = iomap_file_buffered_write(iocb, iter,
&exfat_write_iomap_ops, NULL, NULL);
}
+ if (ret != -EIOCBQUEUED && end > i_size_read(inode))
+ exfat_write_failed(inode);
if (ret < 0)
goto unlock;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0992/1257] exfat: fix reading a directory whose FAT chain is longer than its size
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (990 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0991/1257] exfat: free clusters beyond EOF when a write fails or is short Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0993/1257] net/smc: queue the copied chunk when smc_tx_sendmsg() faults Greg Kroah-Hartman
` (6 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hengyu Liang, Chi Zhiling,
Namjae Jeon, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengyu Liang <hengyul@cs.unc.edu>
[ Upstream commit 8534eb11ac056dc2ca08007cf76d3ae7cbe42684 ]
Commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper") made the
directory code walk the clusters of a directory with
exfat_chain_advance().
However, exfat_chain_advance() returns -EIO once it has walked as many
clusters as the size of the directory says. The FAT chain of a directory
can be longer than that, because some cameras stop updating the size,
see commit 1e5654de0f51 ("exfat: handle wrong stream entry size in
exfat_readdir()"). As of now, opening such a directory fails with EIO as
soon as the chain is two clusters longer than the size. Reading a
directory that has a FAT chain after a seek past its end fails with EIO
too.
The issue can be reproduced with an image in which the size of a
directory with 200 files and 7 clusters is lowered to 2 clusters:
mount -o loop exfat.img /mnt
ls /mnt/d | wc -l
Before commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper"),
the result is:
200
After that commit, ls fails with "Input/output error" and the result is:
0
This patch will make exfat_chain_advance() follow the FAT to its end
when the directory has a FAT chain, as the code did before, and keep the
size check for a directory without one.
Fixes: 08cf4a8181b4 ("exfat: use exfat_chain_advance helper")
Cc: stable@vger.kernel.org
Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
Reviewed-by: Chi Zhiling <chizhiling@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/exfat_fs.h | 28 +++++++++++++++++++---------
1 file changed, 19 insertions(+), 9 deletions(-)
diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h
index 249aa59288631..dd6734632bb23 100644
--- a/fs/exfat/exfat_fs.h
+++ b/fs/exfat/exfat_fs.h
@@ -679,19 +679,29 @@ static inline int exfat_chain_advance(struct super_block *sb,
struct exfat_chain *chain, unsigned int step)
{
unsigned int clu = chain->dir;
+ unsigned int i;
- if (unlikely(chain->size < step))
- return -EIO;
+ if (chain->flags == ALLOC_NO_FAT_CHAIN) {
+ if (unlikely(chain->size < step))
+ return -EIO;
- if (exfat_cluster_walk(sb, &clu, step, chain->flags))
- return -EIO;
+ chain->size -= step;
+ chain->dir = chain->size ? clu + step : EXFAT_EOF_CLUSTER;
+ return 0;
+ }
- chain->size -= step;
+ /*
+ * Only the FAT tells where a chain of this kind ends. The size can be
+ * smaller than the chain, see commit 1e5654de0f51 ("exfat: handle
+ * wrong stream entry size in exfat_readdir()").
+ */
+ for (i = 0; i < step && clu != EXFAT_EOF_CLUSTER; i++) {
+ if (exfat_get_next_cluster(sb, &clu))
+ return -EIO;
+ }
- if (chain->size == 0 && chain->flags == ALLOC_NO_FAT_CHAIN)
- chain->dir = EXFAT_EOF_CLUSTER;
- else
- chain->dir = clu;
+ chain->size -= min(chain->size, step);
+ chain->dir = clu;
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0993/1257] net/smc: queue the copied chunk when smc_tx_sendmsg() faults
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (991 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0992/1257] exfat: fix reading a directory whose FAT chain is longer than its size Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0994/1257] alpha: determine tininess after rounding in the FP emulation Greg Kroah-Hartman
` (5 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Jakub Kicinski,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
[ Upstream commit c0703534b223a5c6993e0f000fd1c3abe621fb65 ]
When a send wraps the end of the send buffer, smc_tx_sendmsg() copies
the data in two chunks. If memcpy_from_msg() faults on the second one,
smc_tx_sendmsg() returns send_done, which already counts the first
chunk, but leaves tx_curs_prep and sndbuf_space as they were. send()
reports bytes the peer never receives, and the next send() overwrites
them. Any caller can hit this on its own stream with a buffer whose
tail is unreadable.
On a fault in the second chunk, queue the first one. The next pass
retries the rest and returns send_done if it faults again, so send()
reports only what it queued, as TCP does.
Fixes: e6727f39004b ("smc: send data (through RDMA)")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20261013-b4-disp-872a3689-v1-1-2a4c63b04761@proton.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_tx.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index 3144b4b1fe290..495fb1354728c 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -249,6 +249,13 @@ int smc_tx_sendmsg(struct smc_sock *smc, struct msghdr *msg, size_t len)
rc = memcpy_from_msg(sndbuf_base + chunk_off,
msg, chunk_len);
if (rc) {
+ if (chunk) {
+ /* send_done counts the first chunk:
+ * queue it and retry the rest
+ */
+ copylen -= chunk_len;
+ break;
+ }
smc_sndbuf_sync_sg_for_device(conn);
if (send_done)
return send_done;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0994/1257] alpha: determine tininess after rounding in the FP emulation
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (992 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0993/1257] net/smc: queue the copied chunk when smc_tx_sendmsg() faults Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0995/1257] ocfs2: reserve metadata for a new xattr block and its value tree Greg Kroah-Hartman
` (4 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Magnus Lindholm, Matt Turner,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
[ Upstream commit b74843b38da8f1186fd7d447646c835b47096a15 ]
IEEE 754 lets an architecture determine tininess of a floating-point
result either before or after rounding, but requires the same choice for
every operation. Alpha determines it after rounding, and stdlib's
tst-tininess confirms the hardware does so for the results it produces
itself.
The soft-fp emulation has no notion of the distinction and always
determines tininess before rounding, so a result that the hardware would
not consider tiny is reported as underflowing whenever the instruction
happens to trap for software completion. The two paths then disagree on
the same machine. A multiply of the largest subnormal double by
1 + 2^-52 rounds up to the smallest normal and raises no underflow when
the operands are normal, but raises it when an operand is subnormal and
the instruction traps:
glibc math testsuite, test-float32x-float64-mul:
Failure: mul_double (0x3.ffffffffffffcp-1024, 0x1.0000000000001p+0):
Exception "Underflow" set
Add _FP_TININESS_AFTER_ROUNDING, as glibc's copy of soft-fp has, and set
it for alpha. It determines tininess by rounding a copy of the result as
if the exponent range were unbounded, which is what the definition asks
for. A plain check of whether the rounded result came out normal is not
equivalent: it differs for values that are still tiny once rounded with
an unbounded exponent range but reach the smallest normal on the coarser
subnormal grid. That plain check is what the hardware itself does (it
decides tininess from the delivered result), and it is why a divide such
as -0x4p-128 / 0x1.000002p+0 in FE_DOWNWARD delivers -0x1p-126 and raises
nothing although the result is tiny after rounding. Such cases do not
trap, so the emulation never sees them; where it does get control, it
follows the definition rather than reproducing that deviation, which is
what glibc's soft-fp does as well.
The macro defaults to zero, so powerpc, sh and sparc keep determining
tininess before rounding as they do now.
Cc: stable@vger.kernel.org # 5.15+
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260803-alpha-fp-exceptions-v1-3-c99d75608e60@gmail.com
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/asm/sfp-machine.h | 4 ++++
include/math-emu/op-common.h | 23 +++++++++++++++++++++--
include/math-emu/soft-fp.h | 8 ++++++++
3 files changed, 33 insertions(+), 2 deletions(-)
diff --git a/arch/alpha/include/asm/sfp-machine.h b/arch/alpha/include/asm/sfp-machine.h
index 5fe63afbd474f..bff1ad963c689 100644
--- a/arch/alpha/include/asm/sfp-machine.h
+++ b/arch/alpha/include/asm/sfp-machine.h
@@ -59,6 +59,10 @@
R##_c = FP_CLS_NAN; \
} while (0)
+/* Alpha determines tininess after rounding, so the emulation must do the
+ same as the hardware does for the results it produces itself. */
+#define _FP_TININESS_AFTER_ROUNDING 1
+
/* Obtain the current rounding mode. */
#define FP_ROUNDMODE mode
#define FP_RND_NEAREST (FPCR_DYN_NORMAL >> FPCR_DYN_SHIFT)
diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
index 8ce066c035cfa..1d1ce5c08efcf 100644
--- a/include/math-emu/op-common.h
+++ b/include/math-emu/op-common.h
@@ -135,6 +135,24 @@ do { \
else \
{ \
/* we've got a denormalized number */ \
+ int _FP_PACK_CANONICAL_is_tiny = 1; \
+ if (_FP_TININESS_AFTER_ROUNDING && X##_e == 0) \
+ { \
+ /* Architectures that detect tininess after rounding \
+ only signal underflow if the result is still \
+ subnormal once rounded as if the exponent range \
+ were unbounded. Round a copy to find out. */ \
+ FP_DECL_##fs(_FP_PACK_CANONICAL_T); \
+ /* The class field is not used by the rounding below, \
+ and is unused entirely where this block is dead. */ \
+ (void)_FP_PACK_CANONICAL_T##_c; \
+ _FP_FRAC_COPY_##wc(_FP_PACK_CANONICAL_T, X); \
+ _FP_PACK_CANONICAL_T##_s = X##_s; \
+ _FP_PACK_CANONICAL_T##_e = X##_e; \
+ _FP_ROUND(wc, _FP_PACK_CANONICAL_T); \
+ if (_FP_FRAC_OVERP_##wc(fs, _FP_PACK_CANONICAL_T)) \
+ _FP_PACK_CANONICAL_is_tiny = 0; \
+ } \
X##_e = -X##_e + 1; \
if (X##_e <= _FP_WFRACBITS_##fs) \
{ \
@@ -161,8 +179,9 @@ do { \
_FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
} \
} \
- if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \
- (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW)) \
+ if (_FP_PACK_CANONICAL_is_tiny \
+ && ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \
+ (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW))) \
FP_SET_EXCEPTION(FP_EX_UNDERFLOW); \
} \
else \
diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h
index 5650c16283830..02ada0a9fca16 100644
--- a/include/math-emu/soft-fp.h
+++ b/include/math-emu/soft-fp.h
@@ -31,6 +31,14 @@
#include <endian.h>
#endif
+/* Whether the architecture determines tininess of a floating-point
+ result after rounding rather than before it. IEEE 754 permits either
+ but requires the same choice for every operation, so this has to agree
+ with what the hardware does for the results it produces itself. */
+#ifndef _FP_TININESS_AFTER_ROUNDING
+#define _FP_TININESS_AFTER_ROUNDING 0
+#endif
+
#define _FP_WORKBITS 3
#define _FP_WORK_LSB ((_FP_W_TYPE)1 << 3)
#define _FP_WORK_ROUND ((_FP_W_TYPE)1 << 2)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0995/1257] ocfs2: reserve metadata for a new xattr block and its value tree
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (993 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0994/1257] alpha: determine tininess after rounding in the FP emulation Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0996/1257] ocfs2: reserve value tree metadata when moving an xattr into the inode Greg Kroah-Hartman
` (3 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Mark Fasheh, Joel Becker, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 8ad5fa0c11246d260d7b12c9672e604b1f431b2e ]
Patch series "ocfs2: fix metadata reservation for xattr value trees".
ocfs2_calc_xattr_set_need() reserves too little metadata for a new xattr
value's extent tree on three paths. The reservation cannot be topped up
once the transaction has started, so ocfs2_add_clusters_in_btree() gives
up with RESTART_META when the value root fills and nothing is left.
ocfs2_xattr_extend_allocation() turns that into -ENOSPC, after
ocfs2_xa_cleanup_value_truncate() has dropped the entry and leaked the
clusters already handed out; before commit 0cdc7dde00ec ("ocfs2: fix
missing metadata reservation for large xattrs") it was a BUG_ON() instead.
It takes a fragmented cluster allocator to get there, since the first
extent always fits in the root.
Patch 1 fixes the create side of meta_guess: commit 3ed2be719eb9 ("ocfs2:
allow for more than one data extent when creating xattr") replaced the
block reserved for the new xattr block with the two the value tree needs
instead of adding them together.
Patch 2 fixes the arm that moves an xattr back into the inode, which
charges credits for a value tree but no metadata for one.
Patch 3 drops a second copy of the same reservation on the path that falls
through to meta_guess. That one is cleanup rather than a fix and is not
for stable, and it must not be backported without patch 1: the duplicate
it removes is what currently covers the shortfall patch 1 fixes.
This patch (of 3):
The create side of meta_guess in ocfs2_calc_xattr_set_need() reserves
metadata for the new value's extent tree and nothing for the xattr block
that will hold it:
} else {
credits += OCFS2_XATTR_BLOCK_CREATE_CREDITS;
if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
struct ocfs2_extent_list *el = &def_xv.xv.xr_list;
meta_add += ocfs2_extend_meta_needed(el);
...
Commit 3ed2be719eb9 ("ocfs2: allow for more than one data extent when
creating xattr") meant to add that tree on top of the meta_add += 1 the
branch already had, but it moved the 1 into the else arm instead, so the
external-value case lost it. The 1 is not optional: it is what
ocfs2_create_xattr_block() takes from meta_ac through
ocfs2_claim_metadata(), and it is spent before the value tree exists.
ocfs2_extend_meta_needed() on the empty def_xv list returns 2, so the
branch reserves 2 where 3 are needed. The xattr block consumes one, and
when the cluster allocator is fragmented enough that the value needs more
than one extent, ocfs2_add_clusters_in_btree() comes back around with a
full value root and ocfs2_alloc_context_bits_left() of 1 against a
threshold of 2. It answers RESTART_META, which
ocfs2_xattr_extend_allocation() turns into a BUG_ON(). Commit
0cdc7dde00ec ("ocfs2: fix missing metadata reservation for large xattrs")
downgraded that to -ENOSPC, at the cost of leaking the clusters already
handed out: ocfs2_xa_cleanup_value_truncate() takes its !orig_clusters
arm, drops the entry and leaves the clusters for fsck.ocfs2 to reclaim.
Reserve for the block and the tree separately.
Link: https://lore.kernel.org/20261010113454.1420939-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20261010113454.1420939-2-joseph.qi@linux.alibaba.com
Fixes: 3ed2be719eb9 ("ocfs2: allow for more than one data extent when creating xattr")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/xattr.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 8933d0f301199..b133489282a4d 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -3481,7 +3481,13 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
credits += OCFS2_XATTR_BLOCK_CREATE_CREDITS;
if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
struct ocfs2_extent_list *el = &def_xv.xv.xr_list;
- meta_add += ocfs2_extend_meta_needed(el);
+ /*
+ * One block for the xattr block we may have to
+ * allocate, the rest for growing the value tree it
+ * would hold. If ocfs2_xattr_ibody_set() succeeds
+ * instead, that first block goes unused.
+ */
+ meta_add += 1 + ocfs2_extend_meta_needed(el);
credits += ocfs2_calc_extend_credits(inode->i_sb,
el);
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0996/1257] ocfs2: reserve value tree metadata when moving an xattr into the inode
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (994 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0995/1257] ocfs2: reserve metadata for a new xattr block and its value tree Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0997/1257] lib/cmdline: fix get_options() count and overflow with large ranges Greg Kroah-Hartman
` (2 subsequent siblings)
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Mark Fasheh, Joel Becker, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit f5aee8ae5f85f8dfa78160e5c4963494319cdd64 ]
ocfs2_calc_xattr_set_need() charges no metadata for the case where an
xattr living in an xattr block or bucket moves back into the inode:
if (old_in_xb) {
if (ocfs2_xattr_can_be_in_inode(inode, xi, xis)) {
clusters_add += new_clusters;
credits += ...;
if (!ocfs2_xattr_is_local(xe))
credits += ocfs2_calc_extend_credits(...);
goto out;
}
}
The credits for extending a value tree are there but the matching blocks
are not, so meta_add stays 0, ocfs2_init_xattr_set_ctxt() skips
ocfs2_reserve_new_metadata_blocks() and ctxt->meta_ac is left NULL.
This is the shape commit 0cdc7dde00ec ("ocfs2: fix missing metadata
reservation for large xattrs") fixed for the xattr block case, and it is
reached the same way: namevalue_size() charges a value larger than
OCFS2_XATTR_INLINE_SIZE as only OCFS2_XATTR_ROOT_SIZE, so
ocfs2_xattr_can_be_in_inode() accepts a new value that will be stored
outside. ocfs2_xa_prepare_entry() installs a value root from def_xv and
grows it, and once the cluster allocator is fragmented enough to need a
second extent ocfs2_add_clusters_in_btree() finds the root full with no
meta_ac at all and answers RESTART_META. ocfs2_xattr_extend_allocation()
turns that into -ENOSPC, or into a BUG_ON() without that commit, and
ocfs2_xa_cleanup_value_truncate() takes its !orig_clusters arm, dropping
the entry and leaking the clusters already handed out until fsck.ocfs2
reclaims them.
Reserve for the value tree here too. The entry moves back into the inode
rather than into a new xattr block, so unlike the create side of
meta_guess this needs no block of its own.
Link: https://lore.kernel.org/20261010113454.1420939-3-joseph.qi@linux.alibaba.com
Fixes: 78f30c314a74 ("ocfs2/xattr: Reserve meta/data at the beginning of ocfs2_xattr_set.")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/xattr.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index b133489282a4d..1beb4937fd19c 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -3381,6 +3381,14 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
credits += ocfs2_calc_extend_credits(
inode->i_sb,
&def_xv.xv.xr_list);
+ /*
+ * A value too big to stay inline is only charged as
+ * OCFS2_XATTR_ROOT_SIZE above, so it can still need a
+ * value tree of its own. No xattr block is allocated
+ * on this path, so the tree is all we reserve for.
+ */
+ if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE)
+ meta_add += ocfs2_extend_meta_needed(&def_xv.xv.xr_list);
goto out;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0997/1257] lib/cmdline: fix get_options() count and overflow with large ranges
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (995 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0996/1257] ocfs2: reserve value tree metadata when moving an xattr into the inode Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0998/1257] ocfs2: deal with legacy signed dir index name hash values Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0999/1257] ocfs2: use the stored hash when checking xattr bucket collision Greg Kroah-Hartman
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Armaan Sandhu, Andrew Morton,
Leizhen Zhang, Andy Shevchenko, Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armaan Sandhu <armaan.sandhu0504@gmail.com>
[ Upstream commit 5d72266218b1c4dd2917f1df2b86f3b0e0a605c9 ]
get_range() stops writing once the array is full, but get_options() still
advances its index by the whole range. So "1-100" parsed into four ints
reports 99 numbers, and a range like "0-2147483647" wraps the index
negative and writes outside the array.
Stop once a range fills the array, bail out in validation mode before the
count overflows, and saturate the range length in get_range(). Add KUnit
cases; without the fix "0-2147483647" panics the test kernel.
Only root can supply this input, so this is a robustness fix.
[akpm@linux-foundation.org: add additional test case from Leizhen]
Link: https://lore.kernel.org/20261005213945.359905-1-armaan.sandhu0504@gmail.com
Fixes: 22f2e2801799 ("[PATCH] get_options to allow a hypenated range for isolcpus")
Signed-off-by: Armaan Sandhu <armaan.sandhu0504@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Leizhen Zhang <lzsx618@gmail.com>
Reviewed-by: Leizhen Zhang <lzsx618@gmail.com>
Cc: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/cmdline.c | 13 ++++++++++++-
lib/tests/cmdline_kunit.c | 39 +++++++++++++++++++++++++++++++++++++++
2 files changed, 51 insertions(+), 1 deletion(-)
diff --git a/lib/cmdline.c b/lib/cmdline.c
index 16cce6621cec1..40b98d943a9ae 100644
--- a/lib/cmdline.c
+++ b/lib/cmdline.c
@@ -11,6 +11,7 @@
#include <linux/export.h>
#include <linux/kernel.h>
+#include <linux/overflow.h>
#include <linux/string.h>
#include <linux/ctype.h>
@@ -26,7 +27,9 @@ static int get_range(char **str, int *pint, int n)
(*str)++;
upper_range = simple_strtol((*str), NULL, 0);
- inc_counter = upper_range - *pint;
+ /* Keep the sign of the result when the difference doesn't fit */
+ if (check_sub_overflow(upper_range, *pint, &inc_counter))
+ inc_counter = upper_range < *pint ? -1 : INT_MAX;
for (x = *pint; n && x < upper_range; x++, n--)
*pint++ = x;
return inc_counter;
@@ -122,6 +125,14 @@ char *get_options(const char *str, int nints, int *ints)
range_nums = get_range((char **)&str, pint, n);
if (range_nums < 0)
break;
+ /* The range didn't fit, so the array is full */
+ if (!validate && range_nums > n) {
+ i = nints;
+ break;
+ }
+ /* Leave room for the upper number of the range */
+ if (range_nums >= INT_MAX - i)
+ break;
/*
* Decrement the result by one to leave out the
* last number in the range. The next iteration
diff --git a/lib/tests/cmdline_kunit.c b/lib/tests/cmdline_kunit.c
index 3f61ff8d31782..12b85f255b651 100644
--- a/lib/tests/cmdline_kunit.c
+++ b/lib/tests/cmdline_kunit.c
@@ -140,6 +140,44 @@ static void cmdline_test_range(struct kunit *test)
} while (++i < ARRAY_SIZE(cmdline_test_range_strings));
}
+static const struct {
+ const char *in;
+ int parsed[4];
+ int validated;
+} cmdline_test_range_overflow_cases[] = {
+ { "1-100", { 3, 1, 2, 3, }, 100, },
+ { "1,5-100,7", { 3, 1, 5, 6, }, 98, },
+ { "1-2147483646", { 3, 1, 2, 3, }, 2147483646, },
+ { "0-2147483647", { 3, 0, 1, 2, }, 0, },
+ { "-5-2147483647", { 3, -5, -4, -3, }, 0, },
+ { "2147483647--5", { 0, 2147483647, }, 0, },
+ { "1,0-2147483647", { 3, 1, 0, 1, }, 1, },
+};
+
+static void cmdline_test_range_overflow(struct kunit *test)
+{
+ unsigned int i, j;
+
+ for (i = 0; i < ARRAY_SIZE(cmdline_test_range_overflow_cases); i++) {
+ const char *in = cmdline_test_range_overflow_cases[i].in;
+ const int *e = cmdline_test_range_overflow_cases[i].parsed;
+ /* Two guard elements past the array handed to get_options() */
+ int r[ARRAY_SIZE(cmdline_test_range_overflow_cases[0].parsed) + 2];
+ int n;
+
+ memset(r, 0, sizeof(r));
+ get_options(in, ARRAY_SIZE(r) - 2, r);
+ for (j = 0; j < ARRAY_SIZE(r) - 2; j++)
+ KUNIT_EXPECT_EQ_MSG(test, r[j], e[j], "Pattern: %s at %u", in, j);
+ for (; j < ARRAY_SIZE(r); j++)
+ KUNIT_EXPECT_EQ_MSG(test, r[j], 0, "Pattern: %s out of bound at %u", in, j);
+
+ get_options(in, 0, &n);
+ KUNIT_EXPECT_EQ_MSG(test, n, cmdline_test_range_overflow_cases[i].validated,
+ "Pattern: %s (validated)", in);
+ }
+}
+
static void cmdline_test_next_arg_quoted_value(struct kunit *test)
{
char in[] = "foo=\"bar baz\" qux=1";
@@ -258,6 +296,7 @@ static struct kunit_case cmdline_test_cases[] = {
KUNIT_CASE(cmdline_test_lead_int),
KUNIT_CASE(cmdline_test_tail_int),
KUNIT_CASE(cmdline_test_range),
+ KUNIT_CASE(cmdline_test_range_overflow),
KUNIT_CASE(cmdline_test_next_arg_quoted_value),
KUNIT_CASE(cmdline_test_next_arg_bare_quote_regression),
KUNIT_CASE(cmdline_test_next_arg_mixed_tokens),
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0998/1257] ocfs2: deal with legacy signed dir index name hash values
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (996 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0997/1257] lib/cmdline: fix get_options() count and overflow with large ranges Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0999/1257] ocfs2: use the stored hash when checking xattr bucket collision Greg Kroah-Hartman
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Anderson Ferneda, Heming Zhao, Mark Fasheh, Joel Becker,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit d1b49d5ea1bf43cce2b0e249a7f7a30dde133907 ]
Patch series "ocfs2: deal with legacy signed name hash values", v2.
Commit 3bc753c06dd0 ("kbuild: treat char as always unsigned") turned on
-funsigned-char globally, which changed the result of two naked 'char'
loads in ocfs2 hashing code:
str2hashbuf() val = msg[i] + (val << 8);
ocfs2_xattr_name_hash() hash = (hash << 5) ^ (hash >> 27) ^ *name++;
A name byte >= 0x80 used to sign-extend and now zero-extends. Both
results are written to disk, the first into the dx leaf when a directory
entry is indexed and the second into xe_name_hash when an xattr is
stored, so anything written by a pre-6.2 kernel is looked up under a
different hash and is no longer found. readdir and listxattr still list
those names because neither of them hashes, which makes this look like
the filesystem losing entries rather than like a lookup bug. Anderson
Ferneda reported it that way for directories with non-ASCII names [1].
Patches 1 and 3 do what ext4 did in commit f3bbac32475b2 ("ext4: deal
with legacy signed xattr name hash values"): look up with the current
unsigned hash, retry with the legacy signed one on a miss, and always
store new entries under the unsigned hash. The retry is skipped when the
two hashes come out equal, so an ASCII name does not walk the index
twice. Both hash functions now spell out the signedness instead of
leaving it to -funsigned-char, as commit 854f0912f813 ("ext4: make xattr
char unsignedness in hash explicit") did, so a backport to a kernel
without the flag still computes both variants correctly.
Patch 2 is a separate fix, placed before patch 3 so that every commit in
the series is correct on its own. ocfs2_check_xattr_bucket_collision()
recomputes the hash of the name to decide whether splitting a full bucket
can make room for the entry being set. That is right for a new entry and
wrong for one that already exists, since an update leaves xe_name_hash
alone. Against a bucket holding legacy hashes the comparison does not
match, so the split goes ahead and cannot help: a bucket whose entries
all share one hash has no divide position. How that ends depends on
where the unsigned hash sorts. Below the legacy ones, the set fails with
-ENOSPC after growing the tree for nothing. Above them, it lands in the
empty bucket the split just appended and stores a second copy of the
entry there while the original stays behind, so listxattr reports the
name twice. Using the stored hash closes both.
Nothing retires a legacy hash at runtime. Deleting or updating an entry
does not rewrite it, and the only code that rehashes existing dirents is
ocfs2_expand_inline_dir() on the inline to extent conversion, so the
retry stays for as long as the legacy entries do. Rebuilding the index
offline is what removes it for good.
This patch (of 3):
Commit 3bc753c06dd0 ("kbuild: treat char as always unsigned") set
-funsigned-char globally, which changed the result of the naked 'char'
load in str2hashbuf():
val = msg[i] + (val << 8);
A name byte >= 0x80 used to sign-extend and now zero-extends, so
ocfs2_dx_dir_name_hash() computes a different hash pair for every name
containing one. The pair is written into the dx leaf when the entry is
created, so an index built by an older kernel no longer matches and
ocfs2_dx_dir_search() returns -ENOENT for a name that readdir still
lists.
Search with the current unsigned hash and, on a miss, retry with the
legacy signed one, as ext4 does in commit f3bbac32475b2 ("ext4: deal
with legacy signed xattr name hash values"). New entries are always
indexed under the unsigned hash. Skip the retry when the two hashes
are equal, so that a miss on an ASCII name does not walk the index
twice.
The retry costs a second walk of the dx tree, so a negative lookup of a
name containing a byte >= 0x80 does twice the work. That is bounded and
worth it, and directories whose dx root is still inline pay nothing
extra, since there the retry only rescans the root block that is already
loaded. Nothing retires it at runtime: a legacy entry keeps its legacy
hash, because neither deleting nor updating an entry rewrites the dx
hash, and the only code that rehashes existing dirents is
ocfs2_expand_inline_dir() on the inline to extent conversion.
Rebuilding the index offline is what removes the cost for good.
Also spell out the signedness in str2hashbuf() instead of leaving the
current hash to -funsigned-char, as commit 854f0912f813 ("ext4: make
xattr char unsignedness in hash explicit") did, so that both variants
stay correct if this is backported to a kernel without the flag.
Link: https://lore.kernel.org/20261009083002.2621201-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20261009083002.2621201-2-joseph.qi@linux.alibaba.com
Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Anderson Ferneda <anderson.ferneda@braza.com.br>
Closes: https://lore.kernel.org/ocfs2-devel/CP5P284MB2780AC2C3C2AB2CF2B6CB7AFBE942@CP5P284MB2780.BRAP284.PROD.OUTLOOK.COM/
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org> # 6.2+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/dir.c | 76 ++++++++++++++++++++++++++++++++++++++++++--------
1 file changed, 65 insertions(+), 11 deletions(-)
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index 0075e1624310e..b358b58a121dc 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -221,7 +221,8 @@ static void TEA_transform(__u32 buf[4], __u32 const in[])
buf[1] += b1;
}
-static void str2hashbuf(const char *msg, int len, __u32 *buf, int num)
+static void str2hashbuf(const char *msg, int len, __u32 *buf, int num,
+ bool legacy_signed)
{
__u32 pad, val;
int i;
@@ -235,7 +236,10 @@ static void str2hashbuf(const char *msg, int len, __u32 *buf, int num)
for (i = 0; i < len; i++) {
if ((i % 4) == 0)
val = pad;
- val = msg[i] + (val << 8);
+ if (legacy_signed)
+ val = (signed char)msg[i] + (val << 8);
+ else
+ val = (unsigned char)msg[i] + (val << 8);
if ((i % 4) == 3) {
*buf++ = val;
val = pad;
@@ -248,8 +252,9 @@ static void str2hashbuf(const char *msg, int len, __u32 *buf, int num)
*buf++ = pad;
}
-static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
- struct ocfs2_dx_hinfo *hinfo)
+static void __ocfs2_dx_dir_name_hash(struct inode *dir, const char *name,
+ int len, struct ocfs2_dx_hinfo *hinfo,
+ bool legacy_signed)
{
struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
const char *p;
@@ -279,7 +284,7 @@ static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
p = name;
while (len > 0) {
- str2hashbuf(p, len, in, 4);
+ str2hashbuf(p, len, in, 4, legacy_signed);
TEA_transform(buf, in);
len -= 16;
p += 16;
@@ -290,6 +295,19 @@ static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
hinfo->minor_hash = buf[1];
}
+static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
+ struct ocfs2_dx_hinfo *hinfo)
+{
+ __ocfs2_dx_dir_name_hash(dir, name, len, hinfo, false);
+}
+
+static void ocfs2_dx_dir_name_hash_signed(struct inode *dir, const char *name,
+ int len,
+ struct ocfs2_dx_hinfo *hinfo)
+{
+ __ocfs2_dx_dir_name_hash(dir, name, len, hinfo, true);
+}
+
/*
* bh passed here can be an inode block or a dir data block, depending
* on the inode inline data flag.
@@ -966,10 +984,10 @@ static int ocfs2_dx_dir_lookup(struct inode *inode,
return ret;
}
-static int ocfs2_dx_dir_search(const char *name, int namelen,
- struct inode *dir,
- struct ocfs2_dx_root_block *dx_root,
- struct ocfs2_dir_lookup_result *res)
+static int __ocfs2_dx_dir_search(const char *name, int namelen,
+ struct inode *dir,
+ struct ocfs2_dx_root_block *dx_root,
+ struct ocfs2_dir_lookup_result *res)
{
int ret, i, found;
u64 phys;
@@ -982,8 +1000,6 @@ static int ocfs2_dx_dir_search(const char *name, int namelen,
struct ocfs2_extent_list *dr_el;
struct ocfs2_dx_entry_list *entry_list;
- ocfs2_dx_dir_name_hash(dir, name, namelen, &res->dl_hinfo);
-
if (ocfs2_dx_root_inline(dx_root)) {
entry_list = &dx_root->dr_entries;
goto search;
@@ -1080,6 +1096,44 @@ static int ocfs2_dx_dir_search(const char *name, int namelen,
return ret;
}
+static int ocfs2_dx_dir_search(const char *name, int namelen,
+ struct inode *dir,
+ struct ocfs2_dx_root_block *dx_root,
+ struct ocfs2_dir_lookup_result *res)
+{
+ struct ocfs2_dx_hinfo legacy;
+ int ret;
+
+ ocfs2_dx_dir_name_hash(dir, name, namelen, &res->dl_hinfo);
+
+ ret = __ocfs2_dx_dir_search(name, namelen, dir, dx_root, res);
+ if (ret != -ENOENT)
+ return ret;
+
+ /*
+ * Nothing under the current hash. The entry may have been indexed by
+ * an older kernel, which sign-extended the name bytes when hashing.
+ * New entries are always indexed under the unsigned hash, so only fall
+ * back to the legacy signed one when it can actually differ: an ASCII
+ * name hashes the same either way, and a genuine miss on one should
+ * not have to walk the index twice.
+ */
+ ocfs2_dx_dir_name_hash_signed(dir, name, namelen, &legacy);
+ if (legacy.major_hash == res->dl_hinfo.major_hash &&
+ legacy.minor_hash == res->dl_hinfo.minor_hash)
+ return ret;
+
+ res->dl_hinfo = legacy;
+
+ ret = __ocfs2_dx_dir_search(name, namelen, dir, dx_root, res);
+ if (ret)
+ return ret;
+
+ pr_warn_once("ocfs2: directory index with signed name hash\n");
+
+ return 0;
+}
+
static int ocfs2_find_entry_dx(const char *name, int namelen,
struct inode *dir,
struct ocfs2_dir_lookup_result *lookup)
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
* [PATCH 7.3 0999/1257] ocfs2: use the stored hash when checking xattr bucket collision
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
` (997 preceding siblings ...)
2026-11-07 13:54 ` [PATCH 7.3 0998/1257] ocfs2: deal with legacy signed dir index name hash values Greg Kroah-Hartman
@ 2026-11-07 13:54 ` Greg Kroah-Hartman
998 siblings, 0 replies; 1281+ messages in thread
From: Greg Kroah-Hartman @ 2026-11-07 13:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Andrew Morton,
Heming Zhao, Anderson Ferneda, Mark Fasheh, Joel Becker,
Sasha Levin
7.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit e39baff18b85cf8956aee138d7944b6581e8ba36 ]
ocfs2_check_xattr_bucket_collision() decides whether splitting a full
bucket can make room for the entry being set by recomputing the hash of
the name:
u32 name_hash = ocfs2_xattr_name_hash(inode, name, strlen(name));
if (name_hash != le32_to_cpu(xh->xh_entries[0].xe_name_hash))
return 0;
For a new entry that is the hash it will be stored under, so comparing it
is correct. An existing entry keeps the hash it already has: an update
never rewrites xe_name_hash, since ocfs2_xa_add_entry() is the only
writer of that field for a real entry and ocfs2_xa_prepare_entry() calls
it only when loc->xl_entry is NULL.
An entry stored by a kernel that sign-extended the name bytes when
hashing can still be updated, because ocfs2_xattr_find_entry() searches
a non-indexed xattr block by memcmp on the name and never looks at
xe_name_hash. Growing it past the space left in the block converts the
block into a tree, ocfs2_cp_xattr_block_to_bucket() fills the bucket in
stored hash order, and the update runs out of room in the bucket too.
The collision check then compares the unsigned hash against the legacy
hashes in the bucket and reports no collision.
ocfs2_xattr_set_entry_index_block() goes on to allocate a bucket that
ocfs2_divide_xattr_bucket() cannot fill: a bucket whose entries all share
one hash has no divide position, so all it does is append an empty bucket
with a sentinel hash one above the last entry's.
The re-search that follows depends on where the unsigned hash sorts.
Below the legacy ones, it comes back to the full bucket and the set fails
with -ENOSPC, having grown the tree for nothing. Above them, it lands on
the new empty bucket, which ocfs2_xattr_bucket_find() handles explicitly
and ocfs2_find_xe_in_bucket() scans zero times, so the set stores a second
copy of the entry under the unsigned hash and returns success. The
original stays in the full bucket, listxattr reports the name twice and
getxattr returns the new copy.
Pass the hash the entry is stored under instead: the stored one for an
existing entry, the unsigned one for a new entry. A tree whose entries
are all stored under the unsigned hash sees no change, since there the
two are the same value.
Link: https://lore.kernel.org/20261009083002.2621201-3-joseph.qi@linux.alibaba.com
Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Anderson Ferneda <anderson.ferneda@braza.com.br>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org> # 6.2+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/xattr.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 1beb4937fd19c..84a47bf30ed5b 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -5769,16 +5769,14 @@ static int ocfs2_rm_xattr_cluster(struct inode *inode,
/*
* check whether the xattr bucket is filled up with the same hash value.
- * If we want to insert the xattr with the same hash, return -ENOSPC.
- * If we want to insert a xattr with different hash value, go ahead
- * and ocfs2_divide_xattr_bucket will handle this.
+ * If the entry being set carries that same hash, return -ENOSPC, since
+ * ocfs2_divide_xattr_bucket() has no divide position to work with.
+ * Otherwise go ahead and ocfs2_divide_xattr_bucket() will handle this.
*/
-static int ocfs2_check_xattr_bucket_collision(struct inode *inode,
- struct ocfs2_xattr_bucket *bucket,
- const char *name)
+static int ocfs2_check_xattr_bucket_collision(struct ocfs2_xattr_bucket *bucket,
+ u32 name_hash)
{
struct ocfs2_xattr_header *xh = bucket_xh(bucket);
- u32 name_hash = ocfs2_xattr_name_hash(inode, name, strlen(name));
if (name_hash != le32_to_cpu(xh->xh_entries[0].xe_name_hash))
return 0;
@@ -5847,6 +5845,7 @@ static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
struct ocfs2_xattr_search *xs,
struct ocfs2_xattr_set_ctxt *ctxt)
{
+ u32 name_hash;
int ret;
trace_ocfs2_xattr_set_entry_index_block(xi->xi_name);
@@ -5866,10 +5865,18 @@ static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
* the maximum number of collisions we will allow for then is
* one bucket's worth, so check it here whether we need to
* add a new bucket for the insert.
+ *
+ * An existing entry keeps the hash it was stored under, and that is
+ * the hash a split has to work with. A new entry is stored under the
+ * unsigned one, which is what ocfs2_xa_add_entry() will write.
*/
- ret = ocfs2_check_xattr_bucket_collision(inode,
- xs->bucket,
- xi->xi_name);
+ if (xs->not_found)
+ name_hash = ocfs2_xattr_name_hash(inode, xi->xi_name,
+ xi->xi_name_len);
+ else
+ name_hash = le32_to_cpu(xs->here->xe_name_hash);
+
+ ret = ocfs2_check_xattr_bucket_collision(xs->bucket, name_hash);
if (ret) {
mlog_errno(ret);
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1281+ messages in thread
end of thread, other threads:[~2026-11-07 15:27 UTC | newest]
Thread overview: 1281+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-07 13:38 [PATCH 7.3 0000/1257] 7.3.4-rc1 review Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0001/1257] drm/xe: Implement Wa_22016122933 Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0002/1257] media: cx88: Specify rc type at rc_allocate_type() Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0003/1257] media: saa7134: " Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0004/1257] mptcp: fix MP_CAPABLE token migration when cloning reqsk Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0005/1257] x86/mm/pat: Use pr_warn() for early W^X warnings Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0006/1257] inet: reject unhashed sockets during established lookups Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0007/1257] rust: irq: declare cfi_encoding for irqreturn Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0008/1257] rust: hrtimer: declare cfi_encoding for hrtimer_restart Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0009/1257] rust: dma: declare cfi_encoding for dma_data_direction Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0010/1257] media: rc: Replace open coded krealloc() for keymap Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0011/1257] media: rc: Add missing locking " Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0012/1257] alpha: honor force_successful_syscall_return() again Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0013/1257] drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0014/1257] drm/nouveau: reject zero-size notifier object allocation Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0015/1257] drm/nouveau/svm: drain fault handler before freeing svmm Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0016/1257] drm/nouveau/pci: use config-space MSI rearm on MCP79/MCP7A (NVAC) Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0017/1257] drm/nouveau: disable the fence uevent work instead of just cancelling it Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0018/1257] drm/nouveau: cancel the DP IRQ work before freeing the connector Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0019/1257] drm/nouveau: dont dereference outp before checking it in nouveau_dp_irq Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0020/1257] drm/amdgpu: recompute the dw estimate after allocating a new VM update job Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0021/1257] drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0022/1257] iio: adc: ti-ads1100: Fix incorrect reading when datarate changed in single mode Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0023/1257] iio: light: ltr501: Power down chip if request irq fails Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0024/1257] cpufreq: airoha: fix probe failure with correct error check Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0025/1257] media: streamzap: Add missing rc_unregister_device() Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0026/1257] media: redrat3: Ensure we dont read beyond the end of the packet Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0027/1257] media: redrat3: Ensure all urbs are suspended Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0028/1257] media: redrat3: Error path leaves device in transmitting state Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0029/1257] media: sunxi-cir: Ensure no more interrupts can occur before free Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0030/1257] media: meson-ir-tx: Ensure clock is disabled on unbind Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0031/1257] media: meson-ir-tx: Ensure rc_free_device() is called " Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0032/1257] media: meson-ir-tx: Ensure probe error is propagated Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0033/1257] media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0034/1257] media: imx-jpeg: finish the job on device_run() error paths Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0035/1257] microblaze: Fix MB_MANAGER build with older binutils Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0036/1257] devtmpfs: restore mount option reconfiguration on get_tree Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0037/1257] udf: Make sure theres enough space for LVID implementation use field Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0038/1257] aio: prevent eventfd/epoll recursion on poll Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0039/1257] ipc/mqueue: release notification resources during inode eviction Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0040/1257] kho: do not reserve scratch memory in the kdump kernel Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0041/1257] remoteproc: elf_loader: Bound the section header table Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0042/1257] soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison Greg Kroah-Hartman
2026-11-07 13:38 ` [PATCH 7.3 0043/1257] soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0044/1257] soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0045/1257] soc: qcom: geni-se: Fix write to read-only firmware buffer Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0046/1257] soc: qcom: pmic_glink: Fix device access from worker during suspend Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0047/1257] PCI: qcom: Only check bridge nodes for PERST# GPIOs Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0048/1257] udf: validate the device specification EA before using it Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0049/1257] microblaze: reserve the ABI argument-home area in the signal frame Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0050/1257] microblaze: dont clobber r3/r4 restored by rt_sigreturn Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0051/1257] microblaze: restore the ABI argument home area below pt_regs (PTO) Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0052/1257] microblaze: preserve the MSR carry flags across signals Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0053/1257] PCI: aspeed: Fix clk and PHY leak in aspeed_pcie_port_init() error paths Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0054/1257] memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0055/1257] memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0056/1257] memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0057/1257] wifi: rtw88: fix out-of-bounds CAM write when key table is full Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0058/1257] wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0059/1257] wifi: rtw89: cap firmware section_num before parsing Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0060/1257] platform/x86: int3472: Fix uninitialised variable warning Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0061/1257] platform/x86: int3472: Increase handshake GPIO delay to 200 ms Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0062/1257] clk: mstar: msc313-mpll: fix off-by-one in clock array allocation Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0063/1257] ARM: imx: Fix suspend/resume crash with Clang CFI Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0064/1257] bpf: Fix queue/stack map u32 index overflow Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0065/1257] hte: tegra194: Initialize slice locks before registering chip Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0066/1257] media: i2c: cvs: Add sensor node in bound callback Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0067/1257] arm64: dts: qcom: sdm845-google: Set i2c3 frequency to 400 kHz Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0068/1257] clk: mediatek: Add missing depend for COMMON_CLK_MT8173 Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0069/1257] wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup() Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0070/1257] media: i2c: ov8856 : remove ACPI node bypass mechanism Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0071/1257] media: i2c: ov8856: fix debug message to report actual CSI-2 lane count Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0072/1257] PCI: rcar-gen4: Limit Max_Read_Request_Size to 256 Bytes Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0073/1257] mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0074/1257] mtd: spi-nor: sfdp: check the length of the SCCR map Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0075/1257] mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0076/1257] fs_pin: publish pins with RCU list helpers Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0077/1257] fs: make sure to call fsnotify_inoderemove() only once when inode is dead Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0078/1257] arm64: dts: ti: k3-am62-verdin: Set MMC clock pins as OUTPUT Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0079/1257] thermal: intel: powerclamp: Reject invalid window_size values Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0080/1257] thermal: intel: int340x: Fix temperature selection around 0 C Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0081/1257] mtd: rawnand: ndfc: use devm_platform_ioremap_resource() Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0082/1257] riscv: dts: spacemit: k3: fix IMSIC num-guest-ids Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0083/1257] isofs: fix Rock Ridge CE extent validation on multisession media Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0084/1257] arm64: dts: mediatek: mt7986: correct timer frequency Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0085/1257] media: hws: report measured colorimetry Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0086/1257] media: hws: Wait for IRQ handler before returning buffers Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0087/1257] media: pci: hws: only init channels the device actually has Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0088/1257] media: cx231xx-audio: drain wq_trigger before audio fini Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0089/1257] media: cx231xx: Fix cleanup path on failure Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0090/1257] firewire: core: fix source bus ID detection for AT context in big-endian systems Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0091/1257] media: au0828: Free URBs when starting DVB streaming fails Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0092/1257] media: i2c: tc358743: add missing color-space strings Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0093/1257] media: go7007: bound EZ-USB I2C transfers to the usb_buf size Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0094/1257] media: saa7146: Initialize interrupt lock before requesting IRQ Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0095/1257] media: vim2m: keep transaction buffer count stable while streaming Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0096/1257] media: vimc: sensor: fix pixel_rate type to resolve do_div() warning Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0097/1257] media: vicodec: fix out-of-bounds write on under-rounded coded dimensions Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0098/1257] media: vicodec: make encoder CAPTURE dimensions read-only Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0099/1257] media: vidtv: fix frontend reference leak on unbind Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0100/1257] media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0101/1257] media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0102/1257] staging: media: av7110: fix corrupted BER reporting in sp8870 Greg Kroah-Hartman
2026-11-07 13:39 ` [PATCH 7.3 0103/1257] staging: media: av7110: fix sp8870 initialization failure state Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0104/1257] media: m2m-deinterlace: fix default capture field Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0105/1257] wifi: mac80211: queue frames while off-channel Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0106/1257] ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+ Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0107/1257] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0108/1257] media: microchip-isc: fix awb_mutex and lock lifecycle Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0109/1257] media: microchip-isc: synchronize the IRQ before disabling clocks on stop Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0110/1257] media: microchip-isc: disable histogram and flush AWB work on teardown Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0111/1257] media: microchip-isc: do not touch WB registers when not streaming Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0112/1257] media: microchip-isc: fix PM runtime leak in AWB work handler Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0113/1257] media: microchip-isc: dont sleep in the clk .is_enabled callback Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0114/1257] media: stm32: csi: correct remote pad retrieval Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0115/1257] media: stm32: csi: unregister async notifier on cleanup Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0116/1257] mtd: rawnand: sunxi: reject ECC maximization on small pages Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0117/1257] mtd: rawnand: sunxi: fix free OOB section offsets Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0118/1257] pinctrl: renesas: rzt2h: Fix used_irqs indexing in clear path Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0119/1257] media: adv7604: avoid negative array index in log_status when cp_read fails Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0120/1257] media: stv090x: bound DiSEqC reply length to msg[] size Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0121/1257] media: stv0900: " Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0122/1257] media: synopsys: hdmirx: use request_any_context_irq() for 5V detection IRQ Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0123/1257] media: nuvoton: npcm-video: quiesce VCD IRQ before teardown Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0124/1257] media: v4l2-ctrls: default HEVC SPS chroma format to 4:2:0 Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0125/1257] media: require two-byte Cypress type 04 records Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0126/1257] drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0127/1257] dmaengine: altera-msgdma: initialize state before requesting IRQ Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0128/1257] ACPI: pfr_update: zero-initialize capability query result Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0129/1257] hte: tegra194-test: shut down timer before GPIO release Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0130/1257] power: supply: qcom_smbx: include base when petting watchdog Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0131/1257] power: supply: qcom_smbx: test battery health status bits Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0132/1257] power: supply: qcom_smbx: fix float voltage selector Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0133/1257] power: supply: qcom_smbx: validate battery float voltage Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0134/1257] power: supply: qcom_smbx: notify battery overvoltage recovery Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0135/1257] power: supply: bq27xxx: synchronize work cancellation on suspend Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0136/1257] power: supply: bq27xxx: Ensure poll work is cancelled on remove Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0137/1257] iio: imu: inv_icm42600: fix odr change not caught in certain cases Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0138/1257] sched/fair: Reset NUMA fault locality after scan period update Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0139/1257] PCI: rzg3s: Disable refclk on probe failure Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0140/1257] PCI: rzg3s: Propagate platform_get_irq_byname() errors Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0141/1257] PCI: rzg3s: Fix IRQ domain initialization error handling Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0142/1257] media: vivid: round the height down to the vertical subsampling factor Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0143/1257] media: cx231xx: preserve I2C transfer length Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0144/1257] media: vivid: cancel svid ctrl work on release Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0145/1257] media: vicodec: zero-initialize stateful decoder heap buffers Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0146/1257] crypto: atmel-tdes - zero-initialize device state Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0147/1257] crypto: atmel-aes - fix AADLENR for standalone GHASH Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0148/1257] lib/842: reject output overflows from index and short data Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0149/1257] lib/842: require a complete history block for repeat templates Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0150/1257] crypto: ccp - Initialize DBC ioctl mutex before registering device Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0151/1257] gfs2: reject invalid inode sizes Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0152/1257] PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier() Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0153/1257] iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0154/1257] PCI: endpoint: pci-epf-vntb: Manage virtual NTB and PCI bus lifetime Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0155/1257] iio: light: isl29028: fix runtime PM reference leak on error paths Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0156/1257] iio: adc: max14001: add missing MODULE_DEVICE_TABLE macro Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0157/1257] affs: validate blocks before freeing them Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0158/1257] dm vdo indexer: prevent delta list overflow on load Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0159/1257] dm vdo indexer: validate record page numbers better Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0160/1257] f2fs: drop pending discard commands before reserving device alias Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0161/1257] f2fs: force out-place update for all writes on compressed file Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0162/1257] f2fs: compress: fix to handle race between truncate and writeback Greg Kroah-Hartman
2026-11-07 13:40 ` [PATCH 7.3 0163/1257] ACPI: SBS: Fix NULL pointer dereference on allocation failure Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0164/1257] ata: sata_inic162x: remove dangerous broken driver Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0165/1257] pinctrl: renesas: rzt2h: Restore correct pin mode on IRQ free Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0166/1257] pinctrl: renesas: rzt2h: Setup IRQ in .irq_{request,release}_resources() Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0167/1257] pinctrl: renesas: rzt2h: Fix reading pin value in IRQ function Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0168/1257] ata: ahci_st: Do not ignore errors when getting the reset controls Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0169/1257] ata: ahci_st: Assert the power down reset in the probe() error path Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0170/1257] ata: libahci: Free the IRQs when activating a multi-IRQ host fails Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0171/1257] ata: libata: Do not leave ata_host_stop() registered when activation fails Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0172/1257] media: i2c: alvium-csi2: balance runtime PM usage count on remove Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0173/1257] media: i2c: og01a1b: power off sensor " Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0174/1257] media: i2c: ov2735: fix power cleanup " Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0175/1257] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str() Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0176/1257] ntfs3: reject empty iomap before reading its LCN Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0177/1257] ntfs3: bound index head insertions by buffer capacity Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0178/1257] crypto: atmel-tdes - sync output bounce buffer before DMA Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0179/1257] usb: fotg210: validate endpoint index in ep0 handlers Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0180/1257] ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe() Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0181/1257] ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id() Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0182/1257] iio: accel: kxcjk-1013: Disable autosuspend on remove Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0183/1257] iio: accel: mma9551: disable " Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0184/1257] iio: accel: mma9553: " Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0185/1257] iio: adc: at91-sama5d2: " Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0186/1257] md/raid5: track disks array size to fix extra_page leak on error paths Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0187/1257] md/raid5: fix NULL pointer dereference in raid5_free_percpu Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0188/1257] md/raid5: validate payload size before calculating payload_len Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0189/1257] drm/panic: Do not use un-escaped URL as format string Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0190/1257] drm/panic: Test address from kmap op for NULL Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0191/1257] media: i2c: cvs: Get the wake IRQ without claiming the GPIO Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0192/1257] media: imx219: Account rate_factor in setting upper exposure limit Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0193/1257] media: imx219: Account for rate_factor in control steps Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0194/1257] media: imx219: The horizontal blanking step is 8 Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0195/1257] spi: spi-qpic-snand: publish the ECC context to snandc->qspi Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0196/1257] cpufreq: conservative: Restrict deferred downscaling to low load Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0197/1257] nilfs2: force clear dirty state when restoring from the shadow map Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0198/1257] regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling() Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0199/1257] regulator: core: Fix rdev reference leak in regulator_resolve_supply() Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0200/1257] PCI: Skip Target Speed quirk on clamped ports with no link Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0201/1257] crypto: zynqmp-sha - fix NULL pointer dereference in init_tfm Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0202/1257] crypto: xilinx - clear AES key buffer before freeing it Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0203/1257] crypto: omap-des - fix crypto engine cleanup Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0204/1257] crypto: omap-sham " Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0205/1257] ACPI: CPPC: Propagate errors from cross-CPU FFH calls Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0206/1257] cpufreq: CPPC: Create the FIE worker before enabling PCC callbacks Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0207/1257] ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect() Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0208/1257] fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0209/1257] regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable() Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0210/1257] iio: dac: mcp47feb02: initialize dac_data field in channel data struct at probe Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0211/1257] iio: dac: mcp47feb02: Fix gain field initialization for active channels Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0212/1257] iio: dac: mcp47feb02: Return len when disabling EEPROM store Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0213/1257] iio: dac: mcp47feb02: Increase EEPROM Programming Write Cycle Time Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0214/1257] iio: accel: adis16201: fix channel order for buffer mode Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0215/1257] iio: imu: inv_icm42600: force accel odr change when switching power mode Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0216/1257] iio: light: apds9306: fix default sampling frequency definition Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0217/1257] ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0 Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0218/1257] PCI: pciehp: Make pciehp_poll_mode parameter read-only Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0219/1257] i3c: master: Fix out-of-bounds read in DMA bounce buffer setup Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0220/1257] i3c: mipi-i3c-hci: Bounce short reads irrespective of the IOMMU Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0221/1257] i3c: mipi-i3c-hci-pci: Set drvdata before creating LTR sysfs attribute Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0222/1257] signalfd: dont dequeue the forced fatal signals Greg Kroah-Hartman
2026-11-07 13:41 ` [PATCH 7.3 0223/1257] seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0224/1257] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0225/1257] leds: ktd2692: Pass context to regulator cleanup Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0226/1257] media: ene_ir: Ensure teardown is done in the correct order Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0227/1257] media: serial_ir: Fix race condition where timer can be re-armed Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0228/1257] media: ir_toy: Validate the maximum tx carrier Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0229/1257] media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse() Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0230/1257] ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv() Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0231/1257] arm64: dts: ti: k3-am62a: Fix MMC0_CLK register address Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0232/1257] arm64: dts: ti: k3-am62a7-sk: Set eMMC clock pin as OUTPUT Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0233/1257] arm64: dts: ti: k3-am62a7-sk: Set SD " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0234/1257] arm64: dts: ti: k3-am62a-phycore-som: Set eMMC " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0235/1257] arm64: dts: ti: k3-am62-lp-sk: Set eMMC clock pins " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0236/1257] arm64: dts: ti: k3-am62-pocketbeagle2: Set SD clock pin " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0237/1257] arm64: dts: ti: k3-am625-beagleplay: Set MMC clock pins " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0238/1257] arm64: dts: ti: k3-am62x-sk-common: Set SD clock pin " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0239/1257] arm64: dts: ti: k3-am625-sk-common: Set eMMC " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0240/1257] arm64: dts: ti: k3-am62-phycore-som: " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0241/1257] arm64: dts: ti: k3-am625-tqma62xx: Set MMC clock pins " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0242/1257] arm64: dts: ti: k3-am625-var-som-symphony: Set SD " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0243/1257] arm64: dts: ti: k3-am625-var-som: Set MMC " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0244/1257] arm64: dts: ti: k3-am62x-phyboard-lyra: Set SD clock pin " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0245/1257] arm64: dts: ti: k3-am62p5-verdin: build zinnia dtbs Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0246/1257] drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable() Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0247/1257] cpufreq/amd-pstate: Skip auto_sel write when it already matches the mode Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0248/1257] nilfs2: fix checkpoint root lifetime on sysfs errors Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0249/1257] EDAC/i10nm: Fix mdev reference leak in i10nm_get_ddr_munits() Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0250/1257] md: validate bblog_size when loading v1.x badblocks metadata Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0251/1257] crypto: qat - fix error source for QAT GEN6 transmit interface faults Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0252/1257] crypto: amlogic - Fix IRQ handler return value and fallthrough logic Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0253/1257] crypto: hisilicon/hpre - fix pointer dereference before length check Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0254/1257] crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0255/1257] crypto: hisilicon/hpre - fix ECDH destination DMA mapping Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0256/1257] crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0257/1257] crypto: qat - zero the VF migration state buffer on save Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0258/1257] media: cec: extron: clear response tail before dispatch Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0259/1257] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0260/1257] media: adv748x: Fix endpoint reference leaks on probe failure Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0261/1257] media: marvell: manage the MMP camera clock provider Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0262/1257] media: go7007: unregister the I2C adapter on USB probe failure Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0263/1257] media: cx18: Disable PCI device on " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0264/1257] media: tw68: balance PCI enable on cleanup Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0265/1257] media: adv7180: Initialize mutex before ancillary clients Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0266/1257] media: au0828: Fix media device leak in au0828_usb_probe() Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0267/1257] media: vpif_capture: Fix i2c adapter reference leak in vpif_probe() Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0268/1257] media: vpif_display: " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0269/1257] media: synopsys: hdmirx: fetch colordepth before calculating pixelclock Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0270/1257] media: i2c: ov5647: fix power cleanup on remove Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0271/1257] media: atmel-isi: release unregistered video device " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0272/1257] ASoC: fsl_xcvr: free IRQ before canceling reset work Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0273/1257] memory: stm32_omm: fix child clock leak on set_amcr() error path Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0274/1257] arm64: dts: freescale: imx8mm-verdin-ivy: fix DIGI_1/DIGI_2 gpio-line-names Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0275/1257] arm64: dts: freescale: imx8mp-verdin-ivy: " Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0276/1257] arm64: dts: freescale: imx95-aquila: fix gpio-line-names padding Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0277/1257] arm64: dts: freescale: imx8mp-toradex-smarc: fix SMARC_SLEEP# gpio-line-names typo Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0278/1257] arm64: dts: freescale: imx8mp-verdin-yavia: fix external GPIOs Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0279/1257] arm64: dts: freescale: imx95-toradex-smarc: enable Wi-Fi SD interface Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0280/1257] clk: qcom: gcc-ipq5018: mark gpll0_main clock as critical Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0281/1257] drm/panel: ebbg-ft8719: Set prepare_prev_first Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0282/1257] mfd: da903x: Cancel IRQ work during teardown Greg Kroah-Hartman
2026-11-07 13:42 ` [PATCH 7.3 0283/1257] mfd: Fix MAX77705 dependency on regmap Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0284/1257] mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set" Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0285/1257] mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0286/1257] mfd: twl-core: Unregister the auxiliary platform device on unbind Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0287/1257] hwmon: (k10temp) Stop matching Hygon devices Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0288/1257] perf loongarch: Fix discarded const qualifier in _get_field() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0289/1257] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0290/1257] kobject: fix out-of-bounds access in kobject_action_type() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0291/1257] ASoC: Intel: atom: Fix platform device leak on probe failure Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0292/1257] ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0293/1257] clk: mvebu: ap-cpu-clk: Assign .num before accessing .hws Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0294/1257] KVM: arm64: ptdump: Check the page tables arent freed when accessing Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0295/1257] KVM: arm64: ptdump: Fix shadow ptdump sleep-in-atomic-context problem Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0296/1257] regulator: core: Fix coupled regulators reference leak on removal Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0297/1257] hwmon: (lm95245) Fix negative temperature conversion Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0298/1257] hwmon: (lm70) Fix rounding of negative temperatures Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0299/1257] fuse: dont shorten the folio descriptor at LLONG_MAX Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0300/1257] fuse: dont drop destination page cache on a zero byte copy reply Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0301/1257] platform/x86/intel/pmt: Block mmap when callback is present Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0302/1257] mtd: rawnand: nuvoton: fix clock cleanup on probe failure Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0303/1257] mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0304/1257] mtd: maps: pci: balance PCI enable on cleanup Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0305/1257] mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0306/1257] mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0307/1257] mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0308/1257] mtd: maps: l440gx: Fix double put of the PM device " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0309/1257] mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0310/1257] mtd: Call get_wunit() on the master partition Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0311/1257] hwmon: (coretemp) Refresh the temperature on the first read Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0312/1257] dcache: report a Tasks-RCU quiescent state in dentry_kill() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0313/1257] ASoC: sdw_utils: clear stale RT711 device reference on exit Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0314/1257] ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0315/1257] peci: aspeed: Initialize state before requesting IRQ Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0316/1257] peci: npcm: " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0317/1257] hwmon: (tmp102) Fix jiffies wraparound in conversion-ready check Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0318/1257] hwmon: (tmp108) " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0319/1257] MIPS: mm: align hugetlb mappings in arch_get_unmapped_area() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0320/1257] MIPS: mm: do not write a huge TLB entry when the probe misses Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0321/1257] netfilter: ctnetlink: fix inverted IPv6 address match in dump filter Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0322/1257] arm64: dts: qcom: sdm845-xiaomi-beryllium: Extend the xbl_mem region Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0323/1257] arm64: dts: qcom: sdm845-xiaomi-polaris: " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0324/1257] arm64: dts: qcom: ipq9574: Wire up USB3 PHY PIPE clock to GCC Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0325/1257] iommu/vt-d: Avoid out-of-range shift in qi_desc_dev_iotlb_pasid() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0326/1257] fuse: fix GCC 8 build with CONFIG_PROFILE_ALL_BRANCHES Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0327/1257] ALSA: mpu401: shut down timer before freeing MPU Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0328/1257] ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status() Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0329/1257] iio: adc: ad4080: enable address ascension for chip identification Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0330/1257] iio: amplifiers: ad8366: reject devices without match data Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0331/1257] iio: dac: ad5755: validate SPI " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0332/1257] iio: dac: mcp4821: reject devices without " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0333/1257] iio: frequency: adf4377: " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0334/1257] iio: imu: adis16400: validate SPI " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0335/1257] iio: potentiometer: x9250: reject devices without " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0336/1257] iio: pressure: bmp280: validate SPI " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0337/1257] iio: adc: ad7192: reject devices without " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0338/1257] iio: adc: ad7606: " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0339/1257] iio: adc: ad7768-1: " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0340/1257] iio: adc: max11205: " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0341/1257] iio: adc: mcp3911: " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0342/1257] iio: adc: ti-adc128s052: validate SPI " Greg Kroah-Hartman
2026-11-07 13:43 ` [PATCH 7.3 0343/1257] iio: adc: ti-ads1018: reject devices without " Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0344/1257] iio: adc: ti-ads131m02: " Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0345/1257] iio: adc: ti-ads7950: validate SPI " Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0346/1257] iio: accel: adxl313: reject devices without " Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0347/1257] iio: accel: adxl372: " Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0348/1257] iio: accel: adxl380: " Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0349/1257] iio: accel: sca3000: " Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0350/1257] iio: dac: mcp47feb02: Avoid unjustified probe error on missing label Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0351/1257] iio: adc: stm32: fix minimum sampling time values Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0352/1257] iio: pressure: dps310: fix CFG_REG bit definitions Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0353/1257] spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup() Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0354/1257] fs/ntfs3: fix integer overflow in find_log_rec() causing OOB read Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0355/1257] fs/ntfs3: reject an oversized resident attribute on the inline iomap path Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0356/1257] cxl/acpi: Check ACPI companion before use Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0357/1257] ALSA: timer: Handle userspace-driven timer ioctls from 32-bit tasks Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0358/1257] media: qcom: camss: vfe-17x: Fix write master buffer done being dropped Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0359/1257] media: qcom: camss: vfe-17x: Fix write master selection for RDI lines Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0360/1257] media: qcom: camss: vfe: Fix VFE reset while another line is streaming Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0361/1257] media: qcom: camss: Add "gcc_axi_hf" to 8775p VFE lite clock lists Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0362/1257] media: venus: Fix iova allocation from restrict region Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0363/1257] media: iris: reset AHB bridge before enabling HW mode Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0364/1257] media: iris: avoid bit depth validation for capture formats Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0365/1257] media: iris: Fix iova allocation from restrict region Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0366/1257] media: iris: Fix bus_info prefix in VIDIOC_QUERYCAP Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0367/1257] media: iris: Fix power-off ordering to disable power domain after clocks Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0368/1257] media: iris: Fix frame interval enumeration for non-divisor framerates Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0369/1257] ALSA: sgio2audio: Only free successfully requested IRQs Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0370/1257] m68k: dmasound: Keep the Q40 IRQ handler registered Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0371/1257] ALSA: core: Check shutdown flag at D0 power-state, too Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0372/1257] clk: starfive: jh7110-isp: fix refcount leak in jh7110_ispcrg_probe() Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0373/1257] powerpc64/bpf: fix percpu private stack leak on JIT failure Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0374/1257] powerpc/bpf: fix buffer overflow in JIT for large BPF programs Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0375/1257] powerpc/bpf: fix alignment of long branch trampoline address Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0376/1257] pseries/plpks: fix error handling in plpks_read_var() Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0377/1257] pseries/plpks: fix error code for wrapping key reads Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0378/1257] pseries/plpks: validate input to plpks_signed_update_var() Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0379/1257] pseries/plpks: clear sensitive PLPKS buffers Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0380/1257] pseries/plpks: clear sensitive buffers in wrapping operations Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0381/1257] pseries/plpks: clear signed update authentication buffer Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0382/1257] pseries/plpks: clear SED key data after use Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0383/1257] pseries/plpks: fix self-reference in plpks_var initializer Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0384/1257] pseries/plpks: hide wrapping_features when unsupported Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0385/1257] powerpc/pseries/iommu: Add TCEs for 16GB pages when RAM is pre-mapped Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0386/1257] ASoC: pcm6240: do not free an unrequested IRQ Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0387/1257] nilfs2: clear dirty flag on bdev buffers on log write failure Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0388/1257] clk: tenstorrent: Assign .num before accessing .hws Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0389/1257] clk: tenstorrent: Fix refcount leak on shared gate clk enable failure Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0390/1257] vfio/pci: Restore 8-byte ioeventfd support Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0391/1257] nilfs2: ignore non-fatal signals during synchronous log write wait Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0392/1257] pwm: tiehrpwm: Clear period on disable to allow reconfiguration Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0393/1257] IB/hfi1: Shutdown self-rearming timers before freeing Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0394/1257] arm64: dts: freescale: imx95-aquila: Enable I2C_3_DSI1 on Clover board Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0395/1257] i3c: master: adi: free the IRQ before unregistering the master Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0396/1257] drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0397/1257] drm/msm/hdmi: Handle msm_hdmi_power_on() errors during .atomic_pre_enable() Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0398/1257] drm/msm/hdmi_bridge: Correct poweroff/audio cleanup order in post_disable Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0399/1257] drm/msm/dsi: Fix VM leak in dsi_tx_buf_alloc_6g() Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0400/1257] staging: greybus: uart: fix racy TIOCMIWAIT implementation Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0401/1257] staging: rtl8723bs: fix RX buffer OOB write from device-reported length Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0402/1257] media: mali-c55: add padding to mali_c55_params_ccm structure Greg Kroah-Hartman
2026-11-07 13:44 ` [PATCH 7.3 0403/1257] media: renesas: rzv2h-ivc: manage runtime PM with devres Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0404/1257] media: v4l2-isp: reject zero-sized parameter blocks Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0405/1257] media: mali-c55: fail power-on when safe stop times out Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0406/1257] media: mali-c55: Free the ISP control handler on unregister Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0407/1257] media: mali-c55: Check the parameters buffer address before copying Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0408/1257] media: mali-c55: Check the statistics buffer address before filling Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0409/1257] media: mali-c55: Ignore disconnected queues when checking readiness Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0410/1257] media: tw686x: fix V4L2 device lifetime on probe failure Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0411/1257] media: pvrusb2: Fix USB parent device leak in class_dev_create() Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0412/1257] media: rtl28xxu: fix SDR platform device leak Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0413/1257] media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0414/1257] media: em28xx: fix double free in em28xx_alloc_urbs Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0415/1257] media: em28xx: fix inverted tuner capability check for VBI device Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0416/1257] dm: fix a bug in dm_accept_partial_bio Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0417/1257] dm-writecache: report I/O error if flush failed Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0418/1257] dm-writecache: fix a quirk in statistics Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0419/1257] dm-writecache: fix a crash if we attempt to use non-dax device Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0420/1257] dm-writecache: fix uncommitted_blocks underflow Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0421/1257] dm-writecache: fix REQ_FUA processing Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0422/1257] KVM: arm64: Fix MMFR0 TGRAN advertisement for pVMs Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0423/1257] pps: generators: stop the generator on unregister Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0424/1257] block: drop the cached plug time when blk_add_rq_to_plug() flushes Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0425/1257] block: amiflop: synchronize flush timer before track flush Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0426/1257] arm64: dts: qcom: shikra: Remove cdsp compute-cb@9 Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0427/1257] PCI: Disable MSI for ULi M1575 EHCI controller Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0428/1257] media: uvcvideo: Fix NULL deref on events for uninitialized controls Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0429/1257] crypto: sa2ul - Fix HMAC key preparation Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0430/1257] crypto: caam - fix double-free in caam_rsa_set_priv_key_form() Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0431/1257] hwrng: amd - report partial reads in non-blocking mode Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0432/1257] hwrng: ba431 - fix reported byte count Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0433/1257] hwrng: core - reject unknown RNG names Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0434/1257] crypto: nx - validate ignore before subtracting in decompress Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0435/1257] crypto: ecc - Handle exceptional points in Shamir multiplication Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0436/1257] drm/panel: simple: Add Raystar RFF500F-AWH-DNN enable delay Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0437/1257] KVM: arm64: Validate the host vCPUs VM before reading it under pKVM Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0438/1257] KVM: arm64: Pin the host vCPU before adjusting its PC " Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0439/1257] x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n mitigation reporting Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0440/1257] KVM: arm64: vgic-v3: Undo assignment on iodev registration failure Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0441/1257] soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0442/1257] phy: apple: atc: Support DUMMY PIPEHANDLER state in configure_pipehandler Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0443/1257] KVM: arm64: vgic-v3: Roll back assignments from the new region Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0444/1257] media: imagination: Fix value clamping in calculate_qp_tables Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0445/1257] media: v4l2-common: Fix P010 format info Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0446/1257] media: sti: delta: use unaligned accessors for MJPEG SOF fields Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0447/1257] media: rockchip: rga: quiesce IRQ before releasing m2m state Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0448/1257] media: chips-media: wave5: Handle polling IRQ thread failure Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0449/1257] media: chips-media: wave5: Balance runtime PM on encoder close errors Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0450/1257] media: chips-media: wave5: Check decoder qbuf runtime resume Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0451/1257] media: meson: vdec: size capture planes from the aligned canvas Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0452/1257] media: rockchip: rga: fix rotation on rev0 hardware Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0453/1257] media: amphion: drain message work before releasing core state Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0454/1257] media: amphion: prevent unbind while video instances are open Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0455/1257] media: mediatek: vpu: free IRQ before destroying watchdog workqueue Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0456/1257] media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init() Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0457/1257] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker() Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0458/1257] media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker() Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0459/1257] media: rkvdec: do not destroy borrowed SRAM pool Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0460/1257] media: mediatek: vcodec: destroy core workqueue on remove Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0461/1257] media: mediatek: vpu: release reserved memory " Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0462/1257] media: mediatek: jpeg: Avoid context access after job finish Greg Kroah-Hartman
2026-11-07 13:45 ` [PATCH 7.3 0463/1257] media: verisilicon: rockchip: Fix leaks in init Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0464/1257] media: mediatek: jpeg: retry HW selection after successful wait Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0465/1257] media: vicodec: fix NULL deref on oversized frame Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0466/1257] media: hantro: Harden MPEG-2 control access against NULL Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0467/1257] media: hantro: release runtime resources when device_run fails Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0468/1257] media: amphion: fix runtime PM imbalance on probe failure Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0469/1257] media: hantro: disable runtime PM before hardware teardown Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0470/1257] power: supply: core: Honor supplied-from with CONFIG_OF=y Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0471/1257] power: supply: ltc2941: Fix of_node reference leak in ltc294x_i2c_probe() Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0472/1257] fsverity: hoist statx reporting of fs-verity flag Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0473/1257] ALSA: aloop: Dont constrain playback params in notify mode Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0474/1257] power: supply: ab8500_fg: Accept status from supplied power Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0475/1257] power: supply: ab8500_fg: Report sub-percent charge changes Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0476/1257] spi: atmel-quadspi: balance runtime PM and pclk across system sleep Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0477/1257] perf: xgene: initialize lock before requesting IRQ Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0478/1257] svcrdma: Grant credits from the clamped sc_max_requests Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0479/1257] xfarray: dont crash when sorting if array element crosses a folio Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0480/1257] ASoC: stm: stm32_i2s: request IRQ after regmap initialization Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0481/1257] ASoC: codecs: rt5682s: disable jack detection work on shutdown Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0482/1257] dmaengine: loongson2-apb-cmc: fix descriptor leak in prep_slave_sg() Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0483/1257] floppy: dont store a stack buffer in timeout_message Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0484/1257] floppy: return the drive state flags from the 32-bit FDGETDRVSTAT Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0485/1257] dmaengine: sh: rz-dmac: Fix off-by-one in residue lmdesc lookup Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0486/1257] dlm: fix send buffer backpressure handling Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0487/1257] PCI/DOE: Fix double free of a duplicate features sysfs name Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0488/1257] PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0489/1257] xfs: cross-reference the primary superblock Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0490/1257] wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0491/1257] mm/ksm: mark migration stores with WRITE_ONCE() Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0492/1257] mm/memcontrol: fix data-race on reading jiffies_64 Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0493/1257] mm/page_isolation: fix UBSAN shift-out-of-bounds warning Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0494/1257] mm/page_isolation: guard compound_order() against racing Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0495/1257] zram: fix idle age_sec underflow in idle_store() Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0496/1257] mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0497/1257] mm/mempolicy: take a cpuset cookie for the interleave node count Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0498/1257] mm/huge_memory: skip zone device folios in madvise_free_huge_pmd() Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0499/1257] mm/madvise: skip zone device folios in cold/pageout PMD range Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0500/1257] mm/mempolicy: skip zone device folios when queueing folios Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0501/1257] mm: memcontrol: raise MEMCG_MAX for charges that fail without reclaiming Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0502/1257] mm/huge_memory: do not touch frozen folios in deferred_split_isolate() Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0503/1257] mm/page_table_check: skip zero pages Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0504/1257] mm/damon/core: skip applying scheme if region split for quota fails Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0505/1257] mm/damon/paddr: respect folio end for DAMOS_STAT Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0506/1257] mm/damon/paddr: respect folio end for DAMOS actions except STAT Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0507/1257] mm/damon/vaddr: respect folio end for DAMOS_STAT Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0508/1257] mm/damon/vaddr: respect folio end for DAMOS_MIGRATE_{HOT,COLD} Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0509/1257] mm/damon/core: handle extreme memory state in damon_get_node_mem_bp() Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0510/1257] mm/damon/core: handle extreme memory state in get_node_memcg_used_bp() Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0511/1257] mm/damon/core: handle extreme memory state in get_in_active_mem_bp() Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0512/1257] mm/list_lru: dont copy stale shrinker id from non-memcg-aware shrinkers Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0513/1257] mm/damon/tests/core-kunit: test committing psi goal to psi goal Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0514/1257] mm/damon/core: handle uninitialized damos_quota_goal->last_psi_total Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0515/1257] mm/damon/core: keep the temporal tuner quota over an unmeasured PSI round Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0516/1257] mm/damon/core: copy nid for eligible_mem_bp damos quota goal commit Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0517/1257] mm/damon/sysfs: set next refresh jiffies per sysfs context Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0518/1257] mm: hugetlb: return -ENOSPC on memcg charge failure Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0519/1257] mm: hugetlb: drop refcount before freeing " Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0520/1257] resource: fix lost wakeup when waiting for a muxed region Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0521/1257] fat: fix fat_ent_write() for reverting the value Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0522/1257] fault-inject: fix dentry leak Greg Kroah-Hartman
2026-11-07 13:46 ` [PATCH 7.3 0523/1257] USB: gadgetfs: do not WARN about excessively large memory allocations Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0524/1257] init: fix early boot crash with bare hostname parameter Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0525/1257] ocfs2: exit recovery thread on mount error path Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0526/1257] ocfs2: free replay slots in ocfs2_recovery_exit() Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0527/1257] selftests/core: fix unshare_test with large fs.nr_open Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0528/1257] xor: add missing vzeroupper to AVX code Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0529/1257] raid6: add missing vzeroupper to AVX2 code Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0530/1257] raid6: add missing vzeroupper to AVX-512 code Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0531/1257] fork: honor task_structs declared alignment Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0532/1257] ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to system inodes Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0533/1257] ocfs2: skip uninitialized lockres in ocfs2_mark_lockres_freeing() Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0534/1257] KVM: arm64: timers: Compute an offset-applied CVAL from the current count Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0535/1257] wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0536/1257] wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0537/1257] wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0538/1257] wifi: mt76: fix memory leak in USB TX path Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0539/1257] wifi: mt76: mt7615: restore DBDC state after ext PHY failure Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0540/1257] wifi: mt76: take rcu_read_lock in the USB/SDIO tx completion path Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0541/1257] wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0542/1257] wifi: mt76: move the channel survey when the channel changes Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0543/1257] wifi: mt76: mt7615: cancel reset work during unregister Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0544/1257] wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits() Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0545/1257] wifi: mt76: mt792x: fix negative errno truncation in offload capability Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0546/1257] wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2() Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0547/1257] clocksource/drivers/fttmr010: Fix clk reference leak in error paths Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0548/1257] clocksource/drivers/digicolor: Fix clk reference leak on request_irq failure Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0549/1257] spi: stm32: fix double free of SRAM buffer on MDMA fallback Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0550/1257] aoe: pull in the headers each received packet type reads Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0551/1257] PCI/sysfs: Pass the device name length in UTF-16 code units Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0552/1257] wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0553/1257] wifi: rtw89: usb: shorten the RX aggregation hold on RTL8922AU over USB 3 Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0554/1257] ALSA: hda/realtek: Fix silent speakers on Lenovo Legion S7 15IMH05 Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0555/1257] crypto: algif_skcipher - rewind rounded output bytes Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0556/1257] ALSA: hda/hdmi: clamp num_cvts against cvt_nids[] in hdmi_read_pin_conn Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0557/1257] ALSA: hda/hdmi: clamp sad_count in ELD proc write handler Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0558/1257] fanotify: report names longer than NAME_MAX Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0559/1257] ext4: only update tune mount options when requested Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0560/1257] ext4: fix fast commit replay failing on a read-only mount Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0561/1257] ext4: reject delalloc to nodelalloc before applying remount options Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0562/1257] jbd2: dont advance j_fc_off before the buffer is recorded Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0563/1257] ext4: skip extra isize expansion while unmounting Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0564/1257] ext4: dont report delalloc data as a hole on indirect-mapped inodes Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0565/1257] ext4: fix ABBA deadlock in ext4_rmdir() Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0566/1257] ext4: fix out-of-bounds read in ext4_get_group_info() Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0567/1257] nilfs2: validate directory position after llseek in readdir Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0568/1257] riscv: cfi: Bounds check restore token before swap Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0569/1257] riscv: cfi: Only write envcfg CSR when task is current Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0570/1257] md: dont hand out the array before md_alloc() has added mddev->kobj Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0571/1257] mm/hugetlb: charge folios to the target mms memcg Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0572/1257] mm/memory: constrain generic_access_phys() to page boundary Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0573/1257] mm: memcg: redirect stats updates of dying memcgs for all hierarchies Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0574/1257] mm: workingset: use lruvec_page_state_local() to count lru pages Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0575/1257] mm: memcg: skip the RCU lock when the memcg is not dying Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0576/1257] mm: memcg: reparent non-hierarchical lruvec stats on cgroup v2 Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0577/1257] mm/execmem: free ROX cache chunks only when they span an entire vm area Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0578/1257] mm/nommu: reject wrapping ranges in access_remote_vm() Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0579/1257] mm/hugetlb: fix subpool minimum reservation rollback Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0580/1257] mm/zswap: publish the initial pool with list_add_rcu() Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0581/1257] mm/memcg: clear folio memcg after changing per memcg stats Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0582/1257] mm/page_counter: avoid integer overflow in effective_protection() Greg Kroah-Hartman
2026-11-07 13:47 ` [PATCH 7.3 0583/1257] mm/mglru: fix ineffective memory protection for non-kswapd reclaim Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0584/1257] mm/zswap: enable zswap_ever_enabled in zswap_pool_create() Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0585/1257] mm/mempolicy: use vm_normal_folio_pmd() in queue_folios_pmd() Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0586/1257] mm/madvise: use vm_normal_folio_pmd() in cold/pageout PMD range Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0587/1257] clk: imx: Fix clock reference leak in imx_get_clk_hw_by_name() Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0588/1257] clk: imx: Fix clock reference leak in imx_obtain_fixed_clock_hw() Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0589/1257] xen/gntdev: prevent private mappings from becoming writable Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0590/1257] soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms() Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0591/1257] soc: fsl: dpio: Fix cleanup on IRQ registration failure Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0592/1257] soc: fsl: dpio: Free the IRQ before releasing the I/O object Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0593/1257] xen/privcmd: Only claim ioreqs matching an ioeventfd Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0594/1257] xen/gntdev: Fix gntdev_dmabuf ref leak in dmabuf_exp_wait_released() Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0595/1257] xen/pcifront: check that an AER callback exists before calling it Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0596/1257] xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf() Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0597/1257] iommu/dma: Catch scatterlist length overflows Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0598/1257] drm/ttm: return an error when kmapping a BO without pages Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0599/1257] ALSA: usb-audio: Add mic resolution quirk for Logitech Webcam C200 Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0600/1257] wifi: ath12k: validate MAC/PHY capability count before saving Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0601/1257] USB: cdc-acm: fix urb leak on disconnect Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0602/1257] USB: serial: option: add Rolling Wireless RN947R Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0603/1257] USB: serial: option: add support for ASR 1286:4e3c modem Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0604/1257] USB: serial: usb_wwan: fix urb leak on disconnect Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0605/1257] misc: fastrpc: fix double-free in fastrpc_map_attach() error path Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0606/1257] misc: fastrpc: Allocate entire reserved memory for Audio PD in probe Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0607/1257] nvmem: rockchip-otp: Serialize reads Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0608/1257] slimbus: messaging: fix leaked PM vote on tid allocation failure Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0609/1257] xen-blkfront: Fix IO race during unplug Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0610/1257] RISC-V: KVM: Fix IPI delivery for out-of-order vcpu_id Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0611/1257] vfio/mlx5: Fix boundary check in set_report_output() Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0612/1257] cxl/port: Clear cached dport pointers when a dport is removed Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0613/1257] cxl/pci: Use the Device GPF DVSEC for restricted endpoints Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0614/1257] cxl/pci: Program the Port GPF timeouts before caching the DVSEC Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0615/1257] cxl/port: Convert PCIe link latency to nanoseconds Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0616/1257] cxl: Account for link width in latency calculation Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0617/1257] cxl/acpi: Convert QTG _DSM latencies to picoseconds Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0618/1257] ALSA: hda/realtek: Enable all four speaker amps on Lenovo ThinkBook X G2 IAH Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0619/1257] KVM: arm64: Prevent 64-bit overflow when computing hyp clock rate Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0620/1257] lib/plist: fix plist_requeue() corrupting order in the last bucket Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0621/1257] usb: core: dont set drvdata to NULL in usb_unbind_interface() Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0622/1257] usb: octeon-hcd: release the USB block when initialization fails Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0623/1257] usb: octeon-hcd: keep SOF interrupts while a pipe needs them Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0624/1257] USB: cdc-acm: add VeriFone VX820 device ID Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0625/1257] USB: quirks: add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for GameSir G7 SE Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0626/1257] usb: typec: ucsi: Skip CAM query when partner has no alt modes Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0627/1257] usb: typec: ucsi: ccg: Validate altmode index in GET_CURRENT_CAM response Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0628/1257] usb: xhci: Fix bounce buffer overflow Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0629/1257] xhci: Prevent invalid vdev dereference during sideband unregister Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0630/1257] usb: xhci-pci: Add AMD 600 series to xhci-pci-prom21 Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0631/1257] usb: typec: ucsi_ccg: Add retry mechanism in ccg_read Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0632/1257] mailbox: altera: shut down RX polling timer on channel teardown Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0633/1257] mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0634/1257] mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush() Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0635/1257] mailbox: qcom-ipcc: Guard against NULL con_priv in send_data() Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0636/1257] m68k: Fix seccomp filtering on ColdFire and 68000 Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0637/1257] USB: serial: sierra: fix urb leak on write completion Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0638/1257] selftests/filesystems: Fix idmapped_tmpfile layer dir ownership Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0639/1257] dm-snapshot: fix crash if dm_io_client_create fails Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0640/1257] ALSA: hda: cs35l41: Fix ACPI device reference leak on probe failure Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0641/1257] ACPI: APEI: accumulate the queued flag across error sections Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0642/1257] arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO Greg Kroah-Hartman
2026-11-07 13:48 ` [PATCH 7.3 0643/1257] btrfs: zoned: fix block group reference leak in btrfs_repair_one_zone() Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0644/1257] btrfs: return -ENOTTY for unknown ioctls on the control device Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0645/1257] mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read() Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0646/1257] mtd: parsers: qcom: fix offset/size overflow on large partitions Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0647/1257] xprtrdma: prevent disconnect feedback during endpoint teardown Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0648/1257] xprtrdma: trim head iovec when the payload arrives via a Write chunk Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0649/1257] PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream ports Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0650/1257] PCI: vmd: Flush DMA writes before handling MSI on Meteor Lake Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0651/1257] PCI: vmd: Flush DMA writes before handling MSI on Arrow Lake Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0652/1257] mm/damon/sysfs-schemes: read sysfs_filter->addr_range only once Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0653/1257] mm/damon/core: return an error from damos_commit_filter_arg() Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0654/1257] mm/damon/core-kunit: extend damos_commit_filter_for() for wrong input Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0655/1257] mm/damon/core-kunit: test invalid damos filter commits Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0656/1257] proc/task_mmu: handle special PMDs in clear_refs and pagemap Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0657/1257] mm/madvise: reclaim isolated folios if PTE restart fails Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0658/1257] mm/madvise: use folio_trylock() in the cold/pageout PMD split Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0659/1257] mm/page_alloc: do not boost watermarks in kdump capture kernels Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0660/1257] mm/hugetlb_cgroup: move per-node usage on cross node migration Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0661/1257] mm/hugetlb_cgroup: move per-node usage on cgroup reparenting Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0662/1257] mm/shmem: report RCU-tasks quiescent states while undoing a range Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0663/1257] mm/alloc_tag: account for reserved tag ids in the kernel tag check Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0664/1257] mm/shmem: dont release a swapin-error marker as a swap entry Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0665/1257] mm/damon/core: charge only the part of a region the filter left Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0666/1257] mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0667/1257] platform/x86/amd/pmf: Add AMDI0112 ACPI ID Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0668/1257] platform/x86/amd/pmf: Validate the APTS state index Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0669/1257] platform/x86/amd: Stop counting intermediate cycles with metrics table Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0670/1257] platform/x86: asus-wmi: fix unclear usage of bd->props.power Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0671/1257] platform/x86: asus-wmi: fix screenpad power state detection Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0672/1257] platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0673/1257] platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query() Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0674/1257] platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop() Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0675/1257] platform/x86: asus-wmi: Serialize WMI method evaluations with a mutex Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0676/1257] platform/x86: oxpec: Fix Apex charge limit control Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0677/1257] platform/x86: simatic-ipc: fix platform device leak on registration failure Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0678/1257] platform/x86/amd: hfi: Fix out-of-bounds reads when parsing ranking data Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0679/1257] platform/x86/intel-uncore-freq: Continue restoring limits on resume Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0680/1257] platform/x86/intel/vsec: Fix inverted walk_header() test in get_features() Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0681/1257] fbdev: sh_mobile_lcdcfb: Restore the per-overlay sysfs attributes Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0682/1257] fbdev: core: Initialize modelist in framebuffer_alloc() Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0683/1257] fbdev: ssd1307fb: check for fb_deferred_io_init() error Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0684/1257] fbdev: xen-fbfront: " Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0685/1257] fbdev: udlfb: " Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0686/1257] fbdev: smscufx: " Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0687/1257] fbdev: sh_mobile_lcdc: " Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0688/1257] fbdev: kyro: Release WC setup on registration failure Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0689/1257] fbdev: nvidia: Release write-combining handle on probe failure Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0690/1257] arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0691/1257] tools/dma: fix building from the top level with O= Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0692/1257] serial: sc16is7xx: fix data corruption due to unexpected xon/xoff Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0693/1257] serial: sc16is7xx: declare MCR and IER as volatile registers Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0694/1257] serial: 8250_exar: store the GPIO platform device in struct exar8250 Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0695/1257] dm-bufio: fix non-working memory limit Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0696/1257] dm-bufio: fix a race leading to an unsigned integer underflow Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0697/1257] misc: issei: Fix issei architecture deps Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0698/1257] misc: tifm: dont clear dev->driver in tifm_device_remove() Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0699/1257] mei: vsc: Fix packet CRC computed over pointer size Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0700/1257] speakup: Fix NULL pointer dereference on VT switch + selection Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0701/1257] clk: qcom: ipq-cmn-pll: Assign .num before accessing .hws Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0702/1257] clk: qcom: ipq5018: add 24MHz rate for USB UTMI clock Greg Kroah-Hartman
2026-11-07 13:49 ` [PATCH 7.3 0703/1257] clk: qcom: ipq5332: " Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0704/1257] clk: qcom: ipq5210: " Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0705/1257] iomap: dont lose a fiemap iteration error when emitting the last extent Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0706/1257] iomap: dont lose a failed direct I/O bios error when zeroing the tail Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0707/1257] nvme-rdma: dont complete a request after a bogus remote invalidation Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0708/1257] nvmet: fix preempt of another registrant by the reservation holder Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0709/1257] nvme-auth: fail when the controller does not authenticate itself Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0710/1257] nvmet: free the bvec on file namespace range errors Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0711/1257] nvmet: require authentication before property set Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0712/1257] nvme: bound FDP config log reads to the received buffer Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0713/1257] nvmet: zns: dont leak stale memory in zone management receive Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0714/1257] f2fs: convert inline quota files when turning quota on Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0715/1257] PCI: rockchip-ep: Do not attempt 5.0 GT/s retraining Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0716/1257] PCI: rockchip-host: " Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0717/1257] PCI: rockchip: Drive at 2.5 GT/s, error other speeds Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0718/1257] sh: intc: Sort the prio and sense lists after filling them Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0719/1257] accel/qaic: Cancel Sahara read data work on removal Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0720/1257] f2fs: remove mappedtodisk flag usage in mmap write path Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0721/1257] f2fs: allow pinning empty compressed files Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0722/1257] f2fs: read i_size once in f2fs_vm_page_mkwrite Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0723/1257] f2fs: check every cur_*_segno[] entry on readonly images Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0724/1257] f2fs: allow empty strings for journaled quota options Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0725/1257] f2fs: fix defragment writeback range truncation on 32-bit Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0726/1257] f2fs: disallow mmap write and data-modifying fallocate on atomic files Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0727/1257] f2fs: fix to use bio_in_atomic() in f2fs_read_end_io() Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0728/1257] spi: ljca: validate the response length before copying the data Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0729/1257] pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank() Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0730/1257] lib/decompress_bunzip2: fix off-by-one in run-length bounds check Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0731/1257] panic: fix redirect CPU race in panic_try_force_cpu() Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0732/1257] panic: flatten nmi_panic control flow Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0733/1257] panic: fix va_list reuse in panic_try_force_cpu() Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0734/1257] panic: restore variable arguments to nmi_panic() Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0735/1257] panic: allow force_cpu redirect from an NMI Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0736/1257] panic: kill the "buffer unavailable" redirect fallback Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0737/1257] lib: decompress_bunzip2: fix integer overflow in run-length decoding Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0738/1257] ocfs2: update xattr count before moving bucket entries Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0739/1257] ocfs2: fix array out of bound access in __ocfs2_find_path() Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0740/1257] tmpfs: fix unicode_map leaks in casefold option handling Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0741/1257] ALSA: hda/tas2781: Assign total_sz at the end of the function Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0742/1257] ALSA: hda/tas2781: Skip invalid TAS2563 UEFI calibration data Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0743/1257] ALSA: hda/realtek: keep headset mic on Acer SSID 0x1640 Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0744/1257] PCI: imx6: Avoid dereferencing a NULL clock name Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0745/1257] platform/x86/tuxedo: Fix keyboard LED map ordering Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0746/1257] ALSA: cs46xx: fix unit mismatch in DSP code area bounds check Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0747/1257] platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer() Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0748/1257] platform/x86: hp-bioscfg: fix non-ASCII truncation " Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0749/1257] platform/x86: hp-bioscfg: return -E2BIG from validate_password_input() Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0750/1257] platform/x86: hp-bioscfg: allow clearing current_password Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0751/1257] platform/x86: hp-bioscfg: NUL-terminate the SPM auth token Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0752/1257] serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit() Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0753/1257] serial: 8250_omap: set priv->line before enabling the IRQ Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0754/1257] Revert "serial: 8250_port: Drop duplicate NULL check" Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0755/1257] serial: amba-pl011: honour delay_rts_before_send for every write Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0756/1257] serial: amba-pl011: keep transmitter enabled when disabling RS485 Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0757/1257] serial: pmac_zilog: push received data to the port that received it Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0758/1257] iommu/amd: Program device table when kdump reuse fails Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0759/1257] iommu/amd: Dont allocate kdump device table from DMA32 Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0760/1257] nvme: make the DH-HMAC-CHAP secret attributes readable by root only Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0761/1257] mfd: ab8500: Fix child device leaks on probe failure Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0762/1257] spi: cadence-xspi: reject SDMA transfers larger than the requested length Greg Kroah-Hartman
2026-11-07 13:50 ` [PATCH 7.3 0763/1257] spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0764/1257] ARM: 9488/1: smp: set current pointer in assembly before jumping into C Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0765/1257] ARM: 9491/1: alignment: restore uaccess state on emulation fault Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0766/1257] ARM: 9520/1: cacheinfo: avoid out-of-bounds write in populate_cache_leaves() Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0767/1257] ARM: 9521/1: cacheinfo: count external caches in early_cache_level() Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0768/1257] ARM: 9522/1: cacheinfo: guard the CLIDR read in populate_cache_leaves() Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0769/1257] ARM: 9523/1: topology: allocate the cacheinfo early on the boot CPU Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0770/1257] PCI: Set supported_speeds in set_pcie_port_type() Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0771/1257] Input: xpad - add GameSir Nova Lite support Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0772/1257] Bluetooth: btusb: Add device ID for Realtek RTL8761BUE (StarTech AV53C1) Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0773/1257] Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0774/1257] Bluetooth: hci_debugfs: Pin module for debugfs file operations Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0775/1257] Bluetooth: selftest: Pin module for selftest " Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0776/1257] Bluetooth: L2CAP: Reject mode changes on connected channels Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0777/1257] Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0778/1257] Bluetooth: L2CAP: Use default TxWindow for zero socket option Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0779/1257] cpufreq: schedutil: Serialize sugov_start() against rate limit updates Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0780/1257] PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain() Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0781/1257] kbuild: AutoFDO: Update split machine function argument for upstream rename Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0782/1257] iommufd: Keep dmabuf PFNs MMIO when filling another domain Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0783/1257] iommufd: Reject a zero-length dirty bitmap request Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0784/1257] ALSA: hda/realtek: Fix quirk for HP Laptop 15-fc0xxx Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0785/1257] crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev() Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0786/1257] crypto: qat - fix use of destroyed vf2pf_lock on VF restart Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0787/1257] irqchip/gic-v3-its: Dont clamp nvecs to zero when id_bits is 32 Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0788/1257] irqchip/imx-intmux: Fix runtime PM teardown on remove Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0789/1257] irqchip/mchp-eic: Fix clock reference leak in mchp_eic_probe() Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0790/1257] irqchip/atmel-aic[5]: Disable interrupts in the irq_pm_shutdown() callbacks Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0791/1257] irqchip/jcore-aic: Fix lost IPIs on SMP Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0792/1257] irqchip/renesas-rzv2h: Preserve TIEN state in rzv2h_tint_set_type() Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0793/1257] ALSA: ump: Correct return size of fill_rpn() Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0794/1257] gfs2: fix the escaped block copy in gfs2_before_commit() Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0795/1257] spi: jcore: fix divide-by-zero when speed_hz is zero Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0796/1257] efi/libstub: arm64: Dont use the platform register x18 Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0797/1257] efi/libstub: Dont replace an existing LINUX_EFI_MEMRESERVE table Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0798/1257] KVM: arm64: nv: Move L2->L1 switch on interrupt early Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0799/1257] KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0800/1257] KVM: arm64: Move IN_GUEST_MODE ahead of state being loaded Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0801/1257] KVM: arm64: Turn vcpu->arch.pause into a counter Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0802/1257] spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0803/1257] mfd: bq257xx: Mark self-modifying BQ25792 registers volatile Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0804/1257] cxl/events: Test CME counter expiry with equality, not bitwise AND Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0805/1257] mfd: tps65217: Fix NULL pointer dereference on IRQ init failure Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0806/1257] mfd: tps65217: Check return value when masking interrupt sources Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0807/1257] mfd: tps65217: Use devres for IRQ domain and wake teardown Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0808/1257] ASoC: qcom: q6apm-dai: wrap the position of a full ring to 0 Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0809/1257] ASoC: qcom: q6apm: reset the hw pointer with the fragment queue Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0810/1257] ASoC: qcom: q6asm-dai: wrap the position of a full ring to 0 Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0811/1257] iommupt: Do not allow PTEs to be split when dirty logging Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0812/1257] spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0813/1257] PCI/PM: Restore BARs after powering up during enumeration Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0814/1257] spi: amd: fix len==0 underflow and FIFO overflow Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0815/1257] erofs: use on-disk blkszbits for lz4 max pcluster bound Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0816/1257] ring-buffer: Take cpus_read_lock() when changing the subbuf order Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0817/1257] dax: Return errors from dax_core_init() Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0818/1257] dax: fix dax_range_compare_iter() to use correct size and address offset Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0819/1257] net: erspan: set lltx to avoid sch_direct_xmit deadlock Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0820/1257] ublk: keep a canceled FETCH round canceling until the server is gone Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0821/1257] ublk: mark the io command cancelable before publishing it Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0822/1257] ublk: mark the batch fetch command cancelable before linking it Greg Kroah-Hartman
2026-11-07 13:51 ` [PATCH 7.3 0823/1257] ublk: reset the FETCH round in release also without a disk Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0824/1257] ublk: reset the FETCH round under ub->mutex Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0825/1257] ublk: let STOP_DEV cancel the servers commands before its release Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0826/1257] net: skbuff: dont BUG() on a bad csum_start in skb_copy_and_csum_dev() Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0827/1257] rds: fix out-of-bounds conn_path walks via handshake exthdrs Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0828/1257] ipv6: defrag: orphan skb before queuing Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0829/1257] sctp: hold transport reference across connect wait Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0830/1257] RDS/IB: validate receive fragment completions Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0831/1257] net: bgmac: enable interrupts only after NAPI is ready Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0832/1257] cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64 Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0833/1257] cpufreq: loongson3: Adjust the width of id and val in smc_message Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0834/1257] cpufreq: loongson3: Replace per-package mutex with per-node Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0835/1257] cpufreq: loongson3: Use global physical CPU ID in get/target callbacks Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0836/1257] cpufreq: loongson3: Replace IOCSR read/write with MMIO ones Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0837/1257] fuse: dont launder folios of a bad inode Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0838/1257] virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0839/1257] virtiofs: validate fixed-output response length Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0840/1257] ASoC: amd: acp-config: force SoundWire probe on Dell 14S DS14265 Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0841/1257] fuse: fix copy_file_range reply handling race Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0842/1257] ublk: pin module while release work is pending Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0843/1257] ipc, msg: Account msg_msg allocations with GFP_KERNEL_ACCOUNT again Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0844/1257] mptcp: reset msk state on early connect failure Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0845/1257] mptcp: fix subflow bitfield misuse Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0846/1257] ALSA: seq: oss: Skip events until fully initialized Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0847/1257] ALSA: hda/realtek: Enable mute LEDs on HP OmniBook X Flip 14-fm0xxx Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0848/1257] ALSA: hda/realtek: Fix internal speakers on Acer Aspire AL16-31P Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0849/1257] KVM: arm64: vgic-its: Dont map an LPI from more than one event Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0850/1257] perf python: Free the parse error entries when parsing fails Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0851/1257] sched_ext: Dont leave balance callbacks queued across a pick retry Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0852/1257] power: supply: qcom_smbx: set the charge enable after software control Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0853/1257] power: supply: cros_charge-control: restore EC state on resume Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0854/1257] power: supply: generic-adc-battery: fix status with no supplier Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0855/1257] power: supply: qcom_battmgr: Notify charger supplies of online changes Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0856/1257] sched_ext: Dont queue balance callbacks from a core-sched pick Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0857/1257] alpha: handle VM_FAULT_HWPOISON in do_page_fault() Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0858/1257] alpha: load the MMU context when switch_mm() switches the current task Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0859/1257] alpha: run check_mmu_context() from finish_arch_post_lock_switch() Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0860/1257] alpha: only use a targeted tbi() when the target mm is really current Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0861/1257] alpha: invalidate the local context in flush_tlb_page() Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0862/1257] alpha: fix the local TLB invalidate " Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0863/1257] alpha: fix the local TLB invalidate in the UP flush_tlb_page() Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0864/1257] alpha: invalidate the local context in flush_tlb_mm() Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0865/1257] alpha: invalidate the local context in flush_icache_user_page() Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0866/1257] alpha: do not clear remote MMU contexts in migrate_flush_tlb_page() Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0867/1257] alpha: do not skip TLB shootdown IPIs for kthread-borrowed mms Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0868/1257] ALSA: hda/via: Apply runtime PM workaround for ASUS X55A Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0869/1257] RDMA/uverbs: Fix uobject leak in DMABUF release Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0870/1257] spi: ch341: handle transfers without a TX or RX buffer Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0871/1257] hwmon: (sht4x) Fix jiffies wraparound in heater-ready check Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0872/1257] hwmon: (coretemp) Return -ENODATA for invalid temperature readings Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0873/1257] hwmon: (sht4x) Reject incomplete heater command transfers Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0874/1257] hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0875/1257] lib/buildid: reject file offsets that do not fit in pgoff_t Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0876/1257] gpiolib: cdev: dont set GPIOD_FLAG_IS_OUT Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0877/1257] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3402VA Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0878/1257] ALSA: usb-audio: Fix missing sample-rate control for PreSonus AudioBox USB Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0879/1257] netfilter: nf_reject: initialize IPCB at inet ingress Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0880/1257] hwmon: (coretemp) Fix handling of isolated SMT siblings Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0881/1257] hwmon: (gigabyte_waterforce) reject short input reports Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0882/1257] bnxt_en: dont leave an XDP program installed when the open fails Greg Kroah-Hartman
2026-11-07 13:52 ` [PATCH 7.3 0883/1257] f2fs: flush SIT journal during filesystem resize Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0884/1257] f2fs: fix submit accounting for IPU writeback Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0885/1257] dax: fix wrong error code returned from dax_dedupe_file_range_compare() Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0886/1257] rtc: cmos: Disable ACPI RTC event before handling it Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0887/1257] rtc: cmos: Honor explicit use_acpi_alarm parameter value Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0888/1257] platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc() Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0889/1257] rtc: pcf8563: pass the driver data to the alarm interrupt handler Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0890/1257] hwmon: (mcp9982) Update the interval cache only after successful writes Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0891/1257] hwmon: (sht3x) Return the consumed count for heater writes Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0892/1257] hwmon: (acpi_power_meter) Fix 18.45 TW bug Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0893/1257] Input: always accept EV_SYN in input_event() Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0894/1257] Revert "Input: matrix_keypad - force switch rows to input mode" Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0895/1257] sched_ext: Reset runnable_at when a task leaves its scheduler Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0896/1257] cgroup: fix cgroup.kill for exited thread group leader Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0897/1257] netdevsim: reject cls_bpf programs bound to another device Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0898/1257] net: gro: dont chain linear parts larger than gso_size into frag_list Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0899/1257] ALSA: usb-audio: Skip sample-rate read-back on PreSonus AudioBox USB Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0900/1257] ALSA: compress: fix buffer leak on failed SET_PARAMS Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0901/1257] ALSA: compress: reject buffer geometry change on gapless next_track Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0902/1257] ALSA: compress: add missing OPEN-state gate to SET_METADATA Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0903/1257] ALSA: compress: reject restarting an ACTIVE task via origin_seqno Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0904/1257] l2tp: snapshot sequencing state when building transmit headers Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0905/1257] ntfs: read MFT writeback bounds under size_lock Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0906/1257] ntfs: validate the MFT I/O geometry Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0907/1257] ntfs: write MFT mirror data in mapped I/O units Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0908/1257] ntfs: serialize raw MFT updates against folio writeback Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0909/1257] ntfs: track direct MFT writes until BIO completion Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0910/1257] ntfs: write MFT folios through mapped I/O units Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0911/1257] ntfs: write MFT records through containing " Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0912/1257] ntfs: use sync flag for direct MFT writes Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0913/1257] ntfs: trigger page_mkwrite for native 4Kn size extension Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0914/1257] ntfs: wait for attribute folio writeback before update Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0915/1257] ntfs: NULL vol->vol_ino in the load_system_files() error teardown Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0916/1257] ntfs: use fatal_signal_pending() for fallocate interruption checks Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0917/1257] ntfs: avoid truncate and writeback deadlock Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0918/1257] ntfs: fix volume flag update races Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0919/1257] ntfs: set the volume dirty bit unconditionally on metadata changes Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0920/1257] ntfs: sync the volume dirty bit with the recorded error state Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0921/1257] ntfs: persist the dirty state after the final put_super() commits Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0922/1257] ntfs: do not clear the volume dirty bit during sync Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0923/1257] ntfs: check the dirty-state commit on remount and unmount Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0924/1257] ntfs: fail remount on sync errors and keep the dirty bit on SB_FORCE Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0925/1257] ntfs: include the final partial cluster in sync writes Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0926/1257] ntfs: mount hibernated volumes read-only regardless of errors= Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0927/1257] ntfs: validate attribute-list sizes before allocation Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0928/1257] ntfs: do not map an unmappable runlist fragment as a hole Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0929/1257] ntfs: do not turn an unmappable runlist fragment into delalloc on write Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0930/1257] ntfs: fail the mount when $MFT needs its own extent records Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0931/1257] ntfs: do not map a vcn as a hole when its runlist lookup failed Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0932/1257] ntfs: fail the mount when $MFTs data size exceeds its allocation Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0933/1257] ntfs: hold the runlist lock while expanding a non-resident attribute Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0934/1257] ntfs: do not use a stale runlist pointer when undoing $MFT extension Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0935/1257] ntfs: add a runlist merge that leaves the source runlist to the caller Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0936/1257] ntfs: balance the $MFT runlist lock in data extension error paths Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0937/1257] ntfs: fix kunmap_local() of advanced pointers in check_mft_mirror() Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0938/1257] ntfs: fix kmap_local leak in ntfs_check_logfile() Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0939/1257] ntfs: report block device flush failures from fsync Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0940/1257] ntfs: flush the block device when syncing a directory Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0941/1257] ntfs: roll back the ACL xattr commit when the WSL mode update fails Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0942/1257] ALSA: mtpav: restore negation dropped in guard() conversion Greg Kroah-Hartman
2026-11-07 13:53 ` [PATCH 7.3 0943/1257] ALSA: emux: Stop voices before freeing zones in all cases Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0944/1257] platform/x86: lenovo-wmi-capdata: Do not stop the AC notifier chain on error Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0945/1257] gpiolib: Free chip resources when allocating the label fails Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0946/1257] ALSA: line6: Handle period elapsed calls outside the locks Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0947/1257] gpio: davinci: Clear interrupt status in every bank on suspend Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0948/1257] gpio: pca953x: Preserve wakeup accounting on parent IRQ failure Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0949/1257] gpio: pca953x: Handle direction register read errors in IRQ paths Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0950/1257] blk-mq: clear stale inactive flag on hctx reuse Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0951/1257] selftests/landlock: Fix snprintf truncation checks in test files Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0952/1257] f2fs: dont use truncate_inode_pages_final() on live inodes Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0953/1257] drm/amdgpu: require _PR3 for BOCO Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0954/1257] drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0 Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0955/1257] drm/amdgpu: reset CIK ASIC on Apple boards " Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0956/1257] drm/amdgpu: reset VI " Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0957/1257] drm/amdkfd: fix doorbell allocation race creating duplicate allocations Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0958/1257] drm/amd/display: dont WARN when removing an unallocated MST payload Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0959/1257] drm/amdgpu: reject ANONONLY userptrs that span multiple VMAs Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0960/1257] drm/amd/pm: reapply umd profile state after recovery Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0961/1257] drm/amdkfd: dont drop an SVM CWSR reference that was never taken Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0962/1257] drm/amdkfd: fix NULL deref in SDMA HQD debugfs dump on GC 12.1 Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0963/1257] drm/amdgpu/gmc9: add extra type-2 TLB flush for gfx942/gfx950 Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0964/1257] drm/amd/display: Fix swap in median3() for DSC rate control Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0965/1257] drm/amdkfd: wait for a GPU reset before freeing a BO Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0966/1257] drm/amdgpu: wait for pending page table updates before switching a VM to CPU updates Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0967/1257] drm/amd/pm:restate all customized OD features on every table upload for smu 13.0.0/smu 14.0.2 Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0968/1257] amdkfd: Fix memory availability double accounting of kfd pinned objects Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0969/1257] drm/amdkfd: correct vram_available calculation Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0970/1257] netdev: Hide the netdev_priv() origin from GCC in netdev_from_priv() Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0971/1257] ipv6: remove ifaddr from hash during ifdown list cleanup Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0972/1257] ipv6: serialize address publication with device teardown Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0973/1257] ipv6: initialize temporary ifaddr before publication Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0974/1257] ipv6: do not restart DAD for a dead ifaddr Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0975/1257] fbdev: bitblit: Fix glyph clipping when fbcon pans Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0976/1257] fbcon: Include font geometry in the rotated font cache Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0977/1257] fbcon: Rebuild rotated font buffer on font change Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0978/1257] fbcon: Retry rotated font allocation after failure Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0979/1257] PCI: qcom-ep: Deinitialize endpoint on remove Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0980/1257] net/rds: ib: dont enable IRQs in rds_ib_conn_free() Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0981/1257] net: unix: reject negative max_dgram_qlen values Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0982/1257] mlxsw: Initialize register query payloads Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0983/1257] exfat: advance valid_size to EOF for append writes Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0984/1257] exfat: hold the invalidate lock while truncating Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0985/1257] exfat: dirty all new pages when extending valid_size Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0986/1257] exfat: make valid_size and zeroed_size atomic Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0987/1257] exfat: drain in-flight DIO before buffered writes Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0988/1257] exfat: zero invalid tail on partial overwrites Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0989/1257] exfat: fix a large buffered write failing when the volume is nearly full Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0990/1257] exfat: mark straddling folio RO and zero the post-EOF range Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0991/1257] exfat: free clusters beyond EOF when a write fails or is short Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0992/1257] exfat: fix reading a directory whose FAT chain is longer than its size Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0993/1257] net/smc: queue the copied chunk when smc_tx_sendmsg() faults Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0994/1257] alpha: determine tininess after rounding in the FP emulation Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0995/1257] ocfs2: reserve metadata for a new xattr block and its value tree Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0996/1257] ocfs2: reserve value tree metadata when moving an xattr into the inode Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0997/1257] lib/cmdline: fix get_options() count and overflow with large ranges Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0998/1257] ocfs2: deal with legacy signed dir index name hash values Greg Kroah-Hartman
2026-11-07 13:54 ` [PATCH 7.3 0999/1257] ocfs2: use the stored hash when checking xattr bucket collision Greg Kroah-Hartman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox