+ mm-fix-the-inaccurate-memory-statistics-issue-for-users.patch added to mm-hotfixes-unstable branch
by Andrew Morton
The patch titled
Subject: mm: fix the inaccurate memory statistics issue for users
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-fix-the-inaccurate-memory-statistics-issue-for-users.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Baolin Wang <baolin.wang(a)linux.alibaba.com>
Subject: mm: fix the inaccurate memory statistics issue for users
Date: Sat, 24 May 2025 09:59:53 +0800
On some large machines with a high number of CPUs running a 64K pagesize
kernel, we found that the 'RES' field is always 0 displayed by the top
command for some processes, which will cause a lot of confusion for users.
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
875525 root 20 0 12480 0 0 R 0.3 0.0 0:00.08 top
1 root 20 0 172800 0 0 S 0.0 0.0 0:04.52 systemd
The main reason is that the batch size of the percpu counter is quite
large on these machines, caching a significant percpu value, since
converting mm's rss stats into percpu_counter by commit f1a7941243c1 ("mm:
convert mm's rss stats into percpu_counter"). Intuitively, the batch
number should be optimized, but on some paths, performance may take
precedence over statistical accuracy. Therefore, introducing a new
interface to add the percpu statistical count and display it to users,
which can remove the confusion. In addition, this change is not expected
to be on a performance-critical path, so the modification should be
acceptable.
Link: https://lkml.kernel.org/r/4f0fd51eb4f48c1a34226456b7a8b4ebff11bf72.17480518…
Fixes: f1a7941243c1 ("mm: convert mm's rss stats into percpu_counter")
Signed-off-by: Baolin Wang <baolin.wang(a)linux.alibaba.com>
Tested-by Donet Tom <donettom(a)linux.ibm.com>
Reviewed-by: Aboorva Devarajan <aboorvad(a)linux.ibm.com>
Tested-by: Aboorva Devarajan <aboorvad(a)linux.ibm.com>
Acked-by: Shakeel Butt <shakeel.butt(a)linux.dev>
Acked-by: SeongJae Park <sj(a)kernel.org>
Cc: David Hildenbrand <david(a)redhat.com>
Cc: Liam Howlett <liam.howlett(a)oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Mike Rapoport <rppt(a)kernel.org>
Cc: Suren Baghdasaryan <surenb(a)google.com>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/proc/task_mmu.c | 14 +++++++-------
include/linux/mm.h | 5 +++++
2 files changed, 12 insertions(+), 7 deletions(-)
--- a/fs/proc/task_mmu.c~mm-fix-the-inaccurate-memory-statistics-issue-for-users
+++ a/fs/proc/task_mmu.c
@@ -36,9 +36,9 @@ void task_mem(struct seq_file *m, struct
unsigned long text, lib, swap, anon, file, shmem;
unsigned long hiwater_vm, total_vm, hiwater_rss, total_rss;
- anon = get_mm_counter(mm, MM_ANONPAGES);
- file = get_mm_counter(mm, MM_FILEPAGES);
- shmem = get_mm_counter(mm, MM_SHMEMPAGES);
+ anon = get_mm_counter_sum(mm, MM_ANONPAGES);
+ file = get_mm_counter_sum(mm, MM_FILEPAGES);
+ shmem = get_mm_counter_sum(mm, MM_SHMEMPAGES);
/*
* Note: to minimize their overhead, mm maintains hiwater_vm and
@@ -59,7 +59,7 @@ void task_mem(struct seq_file *m, struct
text = min(text, mm->exec_vm << PAGE_SHIFT);
lib = (mm->exec_vm << PAGE_SHIFT) - text;
- swap = get_mm_counter(mm, MM_SWAPENTS);
+ swap = get_mm_counter_sum(mm, MM_SWAPENTS);
SEQ_PUT_DEC("VmPeak:\t", hiwater_vm);
SEQ_PUT_DEC(" kB\nVmSize:\t", total_vm);
SEQ_PUT_DEC(" kB\nVmLck:\t", mm->locked_vm);
@@ -92,12 +92,12 @@ unsigned long task_statm(struct mm_struc
unsigned long *shared, unsigned long *text,
unsigned long *data, unsigned long *resident)
{
- *shared = get_mm_counter(mm, MM_FILEPAGES) +
- get_mm_counter(mm, MM_SHMEMPAGES);
+ *shared = get_mm_counter_sum(mm, MM_FILEPAGES) +
+ get_mm_counter_sum(mm, MM_SHMEMPAGES);
*text = (PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK))
>> PAGE_SHIFT;
*data = mm->data_vm + mm->stack_vm;
- *resident = *shared + get_mm_counter(mm, MM_ANONPAGES);
+ *resident = *shared + get_mm_counter_sum(mm, MM_ANONPAGES);
return mm->total_vm;
}
--- a/include/linux/mm.h~mm-fix-the-inaccurate-memory-statistics-issue-for-users
+++ a/include/linux/mm.h
@@ -2708,6 +2708,11 @@ static inline unsigned long get_mm_count
return percpu_counter_read_positive(&mm->rss_stat[member]);
}
+static inline unsigned long get_mm_counter_sum(struct mm_struct *mm, int member)
+{
+ return percpu_counter_sum_positive(&mm->rss_stat[member]);
+}
+
void mm_trace_rss_stat(struct mm_struct *mm, int member);
static inline void add_mm_counter(struct mm_struct *mm, int member, long value)
_
Patches currently in -mm which might be from baolin.wang(a)linux.alibaba.com are
mm-fix-the-inaccurate-memory-statistics-issue-for-users.patch
7 months, 1 week
- 1
- 0
Re: [PATCH v2 1/1] netfilter: load nf_log_syslog on enabling nf_conntrack_log_invalid
by Lance Yang
Cc: stable
On 2025/5/28 19:42, Lance Yang wrote:
>
> Thanks for taking the time to review!
>
> On 2025/5/28 19:05, Florian Westphal wrote:
>> Lance Yang <ioworker0(a)gmail.com> wrote:
>>> From: Lance Yang <lance.yang(a)linux.dev>
>>>
>>> When no logger is registered, nf_conntrack_log_invalid fails to log
>>> invalid
>>> packets, leaving users unaware of actual invalid traffic. Improve
>>> this by
>>> loading nf_log_syslog, similar to how 'iptables -I FORWARD 1 -m
>>> conntrack
>>> --ctstate INVALID -j LOG' triggers it.
>>
>> Acked-by: Florian Westphal <fw(a)strlen.de>
>
> Hmm... should this patch be backported to stable kernels? Without it,
> nf_conntrack_log_invalid won't log invalid packets when no logger is
> registered, causing unnecessary debugging effort ;)
>
> Back then, I actually thought my machine wasn't seeing any invalid
> packets... turns out they just weren't logged in dmesg :(
>
> Thanks,
> Lance
7 months, 1 week
- 1
- 0
KASAN: slab-out-of-bounds Read in steelseries_remove in linux6.12-6.15
by Jianzhou Zhao
Hello, I found a potential bug titled " KASAN: slab-out-of-bounds Read in steelseries_remove " with modified syzkaller in the Linux6.12 - 6.15.
This bug was verified to exist in 6.12.24,6.12.28 and 6.15.
During the execution of poc, for the same hdev device, in the function steelseries_probe, the sd of hdev is first set to the steelseries_device type. If sd->quriks=0x1, Then execute steelseries_srws1_probe to reset the sd of hdev to the type steelseries_srws1_data. However, when the device is removed and the steelseries_remove command is executed, the sd obtained through hdev will first be forcibly converted to the steelseries_device type, but the value of sd->quirks may not be 0x1, but rather become some pointer. For example, sd->quirks=0xffff888022167000, then steelseries_srws1_remove (hdev) cannot be executed. This will lead to type errors in subsequent access to sd (wrongly treating sd of type steelseries_srws1_data as of type steelseries_device), and an out-of-bounds access error occurs when accessing sd->lock.
However, I still don't understand why the sd-> quirks of the same hdev in the detection phase and the deletion phase are completely inconsistent (even Pointers appear).
static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id *id)
{
struct steelseries_device *sd;
int ret;
sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL);
.......
hid_set_drvdata(hdev, sd); [1] Set hdev->dev->driver_data to the type of steelseries_device ( hdev->dev->driver_data = sd )
sd->hdev = hdev;
sd->quirks = id->driver_data; //Here, sd->quirks is assigned a value of 0x1
if (sd->quirks & STEELSERIES_SRWS1) { //Passed the inspection successfully
#if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
(IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
return steelseries_srws1_probe(hdev, id); [2] Set hdev->dev->driver_data to the type of steelseries_srws1_data
#else
return -ENODEV;
#endif
}
......
}
static int steelseries_srws1_probe(struct hid_device *hdev,
const struct hid_device_id *id)
{
int ret, i;
struct led_classdev *led;
size_t name_sz;
char *name;
struct steelseries_srws1_data *drv_data = kzalloc(sizeof(*drv_data), GFP_KERNEL);
if (drv_data == NULL) {
hid_err(hdev, "can't alloc SRW-S1 memory\n");
return -ENOMEM;
}
hid_set_drvdata(hdev, drv_data); [3] Set hdev->dev->driver_data to the type of steelseries_srws1_data
}
static void steelseries_remove(struct hid_device *hdev)
{
struct steelseries_device *sd = hid_get_drvdata(hdev); [4] The default sd is of the steelseries_device type
unsigned long flags;
if (sd->quirks & STEELSERIES_SRWS1) { [5]sd->quriks is not 0x1 but equal to the value of a pointer, such as 0xffff888022167000. Therefore, the inspection cannot be passed and steelseries_srws1_remove cannot be executed
#if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
(IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
steelseries_srws1_remove(hdev);
#endif
return;
}
spin_lock_irqsave(&sd->lock, flags); [6] The correct type of sd is steelseries_srws1_data. However, here, sd is treated as the type of steelseries_srws1_data to access sd->quirks, resulting in out-of-bounds access
......
}
The commit of the kernel is : ef4999852d307d38cfdecd91ed6892cc03beb9b8
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=55f8591b98dd132
compiler: gcc version 11.4.0
If you fix this issue, please add the following tag to the commit:
Reported-by: Jianzhou Zhao <luckd0g(a)163.com>
Reported-by: Penglei Jiang <superman.xpt(a)gmail.com>
I put the reproduction program of this bug at the end of the email.
------------[ cut here ]-----------------------------------------
TITLE: KASAN: slab-out-of-bounds Read in steelseries_remove
------------[ cut here ]------------
==================================================================
BUG: KASAN: slab-out-of-bounds in __lock_acquire+0x31b5/0x3f40 kernel/locking/lockdep.c:5065
Read of size 8 at addr ffff8880285a64d0 by task kworker/0:11/12464
CPU: 0 UID: 0 PID: 12464 Comm: kworker/0:11 Not tainted 6.12.28 #29
Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc6/0x620 mm/kasan/report.c:488
kasan_report+0xd8/0x110 mm/kasan/report.c:601
__lock_acquire+0x31b5/0x3f40 kernel/locking/lockdep.c:5065
lock_acquire.part.0+0x11f/0x380 kernel/locking/lockdep.c:5825
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
steelseries_remove+0x8c/0x1f0 drivers/hid/hid-steelseries.c:564
hid_device_remove+0xce/0x260 drivers/hid/hid-core.c:2758
device_remove+0xc8/0x170 drivers/base/dd.c:567
__device_release_driver drivers/base/dd.c:1272 [inline]
device_release_driver_internal+0x44b/0x620 drivers/base/dd.c:1295
bus_remove_device+0x22f/0x420 drivers/base/bus.c:576
device_del+0x377/0x9c0 drivers/base/core.c:3881
hid_remove_device drivers/hid/hid-core.c:2942 [inline]
hid_destroy_device+0xe5/0x150 drivers/hid/hid-core.c:2962
usbhid_disconnect+0xa0/0xe0 drivers/hid/usbhid/hid-core.c:1459
usb_unbind_interface+0x1e8/0x960 drivers/usb/core/driver.c:461
device_remove drivers/base/dd.c:569 [inline]
device_remove+0x122/0x170 drivers/base/dd.c:561
__device_release_driver drivers/base/dd.c:1272 [inline]
device_release_driver_internal+0x44b/0x620 drivers/base/dd.c:1295
bus_remove_device+0x22f/0x420 drivers/base/bus.c:576
device_del+0x377/0x9c0 drivers/base/core.c:3881
usb_disable_device+0x35f/0x7c0 drivers/usb/core/message.c:1418
usb_disconnect+0x2e0/0x920 drivers/usb/core/hub.c:2315
hub_port_connect drivers/usb/core/hub.c:5373 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5673 [inline]
port_event drivers/usb/core/hub.c:5833 [inline]
hub_event+0x1da4/0x4e20 drivers/usb/core/hub.c:5915
process_one_work+0x9c3/0x1b70 kernel/workqueue.c:3229
process_scheduled_works kernel/workqueue.c:3310 [inline]
worker_thread+0x61e/0xe40 kernel/workqueue.c:3391
kthread+0x2ab/0x390 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 2285:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
steelseries_srws1_probe drivers/hid/hid-steelseries.c:253 [inline]
steelseries_probe+0x69d/0xf60 drivers/hid/hid-steelseries.c:528
__hid_device_probe drivers/hid/hid-core.c:2702 [inline]
hid_device_probe+0x2f5/0x4f0 drivers/hid/hid-core.c:2739
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23a/0xa80 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:459
__device_attach+0x1e5/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:534
device_add+0x1143/0x1a80 drivers/base/core.c:3692
hid_add_device+0x377/0xa60 drivers/hid/hid-core.c:2885
usbhid_probe+0xd41/0x1400 drivers/hid/usbhid/hid-core.c:1432
usb_probe_interface+0x309/0x9d0 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23a/0xa80 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:459
__device_attach+0x1e5/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:534
device_add+0x1143/0x1a80 drivers/base/core.c:3692
usb_set_configuration+0x120e/0x1e10 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:254
usb_probe_device+0xec/0x3e0 drivers/usb/core/driver.c:294
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23a/0xa80 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:459
__device_attach+0x1e5/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:534
device_add+0x1143/0x1a80 drivers/base/core.c:3692
usb_new_device+0xd04/0x19d0 drivers/usb/core/hub.c:2662
hub_port_connect drivers/usb/core/hub.c:5533 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5673 [inline]
port_event drivers/usb/core/hub.c:5833 [inline]
hub_event+0x2d92/0x4e20 drivers/usb/core/hub.c:5915
process_one_work+0x9c3/0x1b70 kernel/workqueue.c:3229
process_scheduled_works kernel/workqueue.c:3310 [inline]
worker_thread+0x61e/0xe40 kernel/workqueue.c:3391
kthread+0x2ab/0x390 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff8880285a6400
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 72 bytes to the right of
allocated 136-byte region [ffff8880285a6400, ffff8880285a6488)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x285a6
ksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801b0413c0 ffffea0000875540 dead000000000003
raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 9743, tgid 9743 (syz-executor), ts 61586032132, free_ts 61073188909
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2f0/0x350 mm/page_alloc.c:1558
prep_new_page mm/page_alloc.c:1566 [inline]
get_page_from_freelist+0x7d6/0x3660 mm/page_alloc.c:3476
__alloc_pages_noprof+0x229/0x2670 mm/page_alloc.c:4754
alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269
alloc_slab_page mm/slub.c:2425 [inline]
allocate_slab mm/slub.c:2595 [inline]
new_slab+0x2df/0x410 mm/slub.c:2649
___slab_alloc+0xe2f/0x19a0 mm/slub.c:3837
__slab_alloc.isra.0+0x56/0xb0 mm/slub.c:3927
__slab_alloc_node mm/slub.c:3980 [inline]
slab_alloc_node mm/slub.c:4141 [inline]
__kmalloc_cache_noprof+0x2b4/0x300 mm/slub.c:4309
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
call_usermodehelper_setup+0xaf/0x360 kernel/umh.c:363
kobject_uevent_env+0x15fe/0x1860 lib/kobject_uevent.c:628
rx_queue_add_kobject net/core/net-sysfs.c:1124 [inline]
net_rx_queue_update_kobjects+0x17c/0x5f0 net/core/net-sysfs.c:1164
register_queue_kobjects net/core/net-sysfs.c:1898 [inline]
netdev_register_kobject+0x269/0x3a0 net/core/net-sysfs.c:2143
register_netdevice+0x1312/0x1db0 net/core/dev.c:10557
veth_newlink+0x354/0x9e0 drivers/net/veth.c:1830
rtnl_newlink_create net/core/rtnetlink.c:3542 [inline]
__rtnl_newlink+0x1187/0x1910 net/core/rtnetlink.c:3762
rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3775
page last free pid 9715 tgid 9715 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]
free_unref_page+0x6d7/0x1080 mm/page_alloc.c:2659
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x54/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4104 [inline]
slab_alloc_node mm/slub.c:4153 [inline]
__kmalloc_cache_noprof+0x11e/0x300 mm/slub.c:4309
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
kobject_uevent_env+0x265/0x1860 lib/kobject_uevent.c:540
__kobject_del+0x168/0x1f0 lib/kobject.c:601
kobject_cleanup lib/kobject.c:680 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x327/0x5a0 lib/kobject.c:737
net_rx_queue_update_kobjects+0x476/0x5f0 net/core/net-sysfs.c:1178
netif_set_real_num_rx_queues+0x169/0x210 net/core/dev.c:3055
veth_init_queues+0x151/0x190 drivers/net/veth.c:1761
veth_newlink+0x530/0x9e0 drivers/net/veth.c:1873
rtnl_newlink_create net/core/rtnetlink.c:3542 [inline]
__rtnl_newlink+0x1187/0x1910 net/core/rtnetlink.c:3762
rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3775
rtnetlink_rcv_msg+0x3c7/0xea0 net/core/rtnetlink.c:6678
netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2537
Memory state around the buggy address:
ffff8880285a6380: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
ffff8880285a6400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880285a6480: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff8880285a6500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880285a6580: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
==================================================================
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <linux/usb/ch9.h>
static unsigned long long procid;
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
#define MAX_FDS 30
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static struct usb_device_index* lookup_usb_index(int fd)
{
for (int i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd)
return &usb_devices[i].index;
}
return NULL;
}
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
if (!parse_usb_descriptor(dev, dev_len, &usb_devices[i].index))
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
struct usb_qualifier_descriptor* qual,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_data = (char*)qual;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
struct vusb_descriptor {
uint8_t req_type;
uint8_t desc_type;
uint32_t len;
char data[0];
} __attribute__((packed));
struct vusb_descriptors {
uint32_t len;
struct vusb_descriptor* generic;
struct vusb_descriptor* descs[0];
} __attribute__((packed));
struct vusb_response {
uint8_t type;
uint8_t req;
uint32_t len;
char data[0];
} __attribute__((packed));
struct vusb_responses {
uint32_t len;
struct vusb_response* generic;
struct vusb_response* resps[0];
} __attribute__((packed));
static bool lookup_control_response(const struct vusb_descriptors* descs, const struct vusb_responses* resps,
struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length)
{
int descs_num = 0;
int resps_num = 0;
if (descs)
descs_num = (descs->len - offsetof(struct vusb_descriptors, descs)) / sizeof(descs->descs[0]);
if (resps)
resps_num = (resps->len - offsetof(struct vusb_responses, resps)) / sizeof(resps->resps[0]);
uint8_t req = ctrl->bRequest;
uint8_t req_type = ctrl->bRequestType & USB_TYPE_MASK;
uint8_t desc_type = ctrl->wValue >> 8;
if (req == USB_REQ_GET_DESCRIPTOR) {
int i;
for (i = 0; i < descs_num; i++) {
struct vusb_descriptor* desc = descs->descs[i];
if (!desc)
continue;
if (desc->req_type == req_type && desc->desc_type == desc_type) {
*response_length = desc->len;
if (*response_length != 0)
*response_data = &desc->data[0];
else
*response_data = NULL;
return true;
}
}
if (descs && descs->generic) {
*response_data = &descs->generic->data[0];
*response_length = descs->generic->len;
return true;
}
} else {
int i;
for (i = 0; i < resps_num; i++) {
struct vusb_response* resp = resps->resps[i];
if (!resp)
continue;
if (resp->type == req_type && resp->req == req) {
*response_length = resp->len;
if (*response_length != 0)
*response_data = &resp->data[0];
else
*response_data = NULL;
return true;
}
}
if (resps && resps->generic) {
*response_data = &resps->generic->data[0];
*response_length = resps->generic->len;
return true;
}
}
return false;
}
#define UDC_NAME_LENGTH_MAX 128
struct usb_raw_init {
__u8 driver_name[UDC_NAME_LENGTH_MAX];
__u8 device_name[UDC_NAME_LENGTH_MAX];
__u8 speed;
};
enum usb_raw_event_type {
USB_RAW_EVENT_INVALID = 0,
USB_RAW_EVENT_CONNECT = 1,
USB_RAW_EVENT_CONTROL = 2,
};
struct usb_raw_event {
__u32 type;
__u32 length;
__u8 data[0];
};
struct usb_raw_ep_io {
__u16 ep;
__u16 flags;
__u32 length;
__u8 data[0];
};
#define USB_RAW_EPS_NUM_MAX 30
#define USB_RAW_EP_NAME_MAX 16
#define USB_RAW_EP_ADDR_ANY 0xff
struct usb_raw_ep_caps {
__u32 type_control : 1;
__u32 type_iso : 1;
__u32 type_bulk : 1;
__u32 type_int : 1;
__u32 dir_in : 1;
__u32 dir_out : 1;
};
struct usb_raw_ep_limits {
__u16 maxpacket_limit;
__u16 max_streams;
__u32 reserved;
};
struct usb_raw_ep_info {
__u8 name[USB_RAW_EP_NAME_MAX];
__u32 addr;
struct usb_raw_ep_caps caps;
struct usb_raw_ep_limits limits;
};
struct usb_raw_eps_info {
struct usb_raw_ep_info eps[USB_RAW_EPS_NUM_MAX];
};
#define USB_RAW_IOCTL_INIT _IOW('U', 0, struct usb_raw_init)
#define USB_RAW_IOCTL_RUN _IO('U', 1)
#define USB_RAW_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_raw_event)
#define USB_RAW_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP0_READ _IOWR('U', 4, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
#define USB_RAW_IOCTL_EP_DISABLE _IOW('U', 6, __u32)
#define USB_RAW_IOCTL_EP_WRITE _IOW('U', 7, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_READ _IOWR('U', 8, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_CONFIGURE _IO('U', 9)
#define USB_RAW_IOCTL_VBUS_DRAW _IOW('U', 10, __u32)
#define USB_RAW_IOCTL_EPS_INFO _IOR('U', 11, struct usb_raw_eps_info)
#define USB_RAW_IOCTL_EP0_STALL _IO('U', 12)
#define USB_RAW_IOCTL_EP_SET_HALT _IOW('U', 13, __u32)
#define USB_RAW_IOCTL_EP_CLEAR_HALT _IOW('U', 14, __u32)
#define USB_RAW_IOCTL_EP_SET_WEDGE _IOW('U', 15, __u32)
static int usb_raw_open()
{
return open("/dev/raw-gadget", O_RDWR);
}
static int usb_raw_init(int fd, uint32_t speed, const char* driver, const char* device)
{
struct usb_raw_init arg;
strncpy((char*)&arg.driver_name[0], driver, sizeof(arg.driver_name));
strncpy((char*)&arg.device_name[0], device, sizeof(arg.device_name));
arg.speed = speed;
return ioctl(fd, USB_RAW_IOCTL_INIT, &arg);
}
static int usb_raw_run(int fd)
{
return ioctl(fd, USB_RAW_IOCTL_RUN, 0);
}
static int usb_raw_configure(int fd)
{
return ioctl(fd, USB_RAW_IOCTL_CONFIGURE, 0);
}
static int usb_raw_vbus_draw(int fd, uint32_t power)
{
return ioctl(fd, USB_RAW_IOCTL_VBUS_DRAW, power);
}
static int usb_raw_ep0_write(int fd, struct usb_raw_ep_io* io)
{
return ioctl(fd, USB_RAW_IOCTL_EP0_WRITE, io);
}
static int usb_raw_ep0_read(int fd, struct usb_raw_ep_io* io)
{
return ioctl(fd, USB_RAW_IOCTL_EP0_READ, io);
}
static int usb_raw_event_fetch(int fd, struct usb_raw_event* event)
{
return ioctl(fd, USB_RAW_IOCTL_EVENT_FETCH, event);
}
static int usb_raw_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
{
return ioctl(fd, USB_RAW_IOCTL_EP_ENABLE, desc);
}
static int usb_raw_ep_disable(int fd, int ep)
{
return ioctl(fd, USB_RAW_IOCTL_EP_DISABLE, ep);
}
static int usb_raw_ep0_stall(int fd)
{
return ioctl(fd, USB_RAW_IOCTL_EP0_STALL, 0);
}
static int lookup_interface(int fd, uint8_t bInterfaceNumber, uint8_t bAlternateSetting)
{
struct usb_device_index* index = lookup_usb_index(fd);
if (!index)
return -1;
for (int i = 0; i < index->ifaces_num; i++) {
if (index->ifaces[i].bInterfaceNumber == bInterfaceNumber &&
index->ifaces[i].bAlternateSetting == bAlternateSetting)
return i;
}
return -1;
}
#define USB_MAX_PACKET_SIZE 4096
struct usb_raw_control_event {
struct usb_raw_event inner;
struct usb_ctrlrequest ctrl;
char data[USB_MAX_PACKET_SIZE];
};
struct usb_raw_ep_io_data {
struct usb_raw_ep_io inner;
char data[USB_MAX_PACKET_SIZE];
};
static void set_interface(int fd, int n)
{
struct usb_device_index* index = lookup_usb_index(fd);
if (!index)
return;
if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) {
for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) {
int rv = usb_raw_ep_disable(fd, index->ifaces[index->iface_cur].eps[ep].handle);
if (rv < 0) {
} else {
}
}
}
if (n >= 0 && n < index->ifaces_num) {
for (int ep = 0; ep < index->ifaces[n].eps_num; ep++) {
int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc);
if (rv < 0) {
} else {
index->ifaces[n].eps[ep].handle = rv;
}
}
index->iface_cur = n;
}
}
static int configure_device(int fd)
{
struct usb_device_index* index = lookup_usb_index(fd);
if (!index)
return -1;
int rv = usb_raw_vbus_draw(fd, index->bMaxPower);
if (rv < 0) {
return rv;
}
rv = usb_raw_configure(fd);
if (rv < 0) {
return rv;
}
set_interface(fd, 0);
return 0;
}
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev,
const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
if (!dev) {
return -1;
}
int fd = usb_raw_open();
if (fd < 0) {
return fd;
}
if (fd >= MAX_FDS) {
close(fd);
return -1;
}
struct usb_device_index* index = add_usb_index(fd, dev, dev_len);
if (!index) {
return -1;
}
char device[32];
sprintf(&device[0], "dummy_udc.%llu", procid);
int rv = usb_raw_init(fd, speed, "dummy_udc", &device[0]);
if (rv < 0) {
return rv;
}
rv = usb_raw_run(fd);
if (rv < 0) {
return rv;
}
bool done = false;
while (!done) {
struct usb_raw_control_event event;
event.inner.type = 0;
event.inner.length = sizeof(event.ctrl);
rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
if (rv < 0) {
return rv;
}
if (event.inner.type != USB_RAW_EVENT_CONTROL)
continue;
char* response_data = NULL;
uint32_t response_length = 0;
struct usb_qualifier_descriptor qual;
if (event.ctrl.bRequestType & USB_DIR_IN) {
if (!lookup_connect_response_in(fd, descs, &event.ctrl, &qual, &response_data, &response_length)) {
usb_raw_ep0_stall(fd);
continue;
}
} else {
if (!lookup_connect_response_out(fd, descs, &event.ctrl, &done)) {
usb_raw_ep0_stall(fd);
continue;
}
response_data = NULL;
response_length = event.ctrl.wLength;
}
if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
event.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
rv = configure_device(fd);
if (rv < 0) {
return rv;
}
}
struct usb_raw_ep_io_data response;
response.inner.ep = 0;
response.inner.flags = 0;
if (response_length > sizeof(response.data))
response_length = 0;
if (event.ctrl.wLength < response_length)
response_length = event.ctrl.wLength;
response.inner.length = response_length;
if (response_data)
memcpy(&response.data[0], response_data, response_length);
else
memset(&response.data[0], 0, response_length);
if (event.ctrl.bRequestType & USB_DIR_IN) {
rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
} else {
rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
}
if (rv < 0) {
return rv;
}
}
sleep_ms(200);
return fd;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic);
}
static volatile long syz_usb_control_io(volatile long a0, volatile long a1, volatile long a2)
{
int fd = a0;
const struct vusb_descriptors* descs = (const struct vusb_descriptors*)a1;
const struct vusb_responses* resps = (const struct vusb_responses*)a2;
struct usb_raw_control_event event;
event.inner.type = 0;
event.inner.length = USB_MAX_PACKET_SIZE;
int rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
if (rv < 0) {
return rv;
}
if (event.inner.type != USB_RAW_EVENT_CONTROL) {
return -1;
}
char* response_data = NULL;
uint32_t response_length = 0;
if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) {
if (!lookup_control_response(descs, resps, &event.ctrl, &response_data, &response_length)) {
usb_raw_ep0_stall(fd);
return -1;
}
} else {
if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD ||
event.ctrl.bRequest == USB_REQ_SET_INTERFACE) {
int iface_num = event.ctrl.wIndex;
int alt_set = event.ctrl.wValue;
int iface_index = lookup_interface(fd, iface_num, alt_set);
if (iface_index < 0) {
} else {
set_interface(fd, iface_index);
}
}
response_length = event.ctrl.wLength;
}
struct usb_raw_ep_io_data response;
response.inner.ep = 0;
response.inner.flags = 0;
if (response_length > sizeof(response.data))
response_length = 0;
if (event.ctrl.wLength < response_length)
response_length = event.ctrl.wLength;
if ((event.ctrl.bRequestType & USB_DIR_IN) && !event.ctrl.wLength) {
response_length = USB_MAX_PACKET_SIZE;
}
response.inner.length = response_length;
if (response_data)
memcpy(&response.data[0], response_data, response_length);
else
memset(&response.data[0], 0, response_length);
if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) {
rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
} else {
rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
}
if (rv < 0) {
return rv;
}
sleep_ms(200);
return 0;
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
write_file("/proc/self/oom_score_adj", "1000");
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
int iter = 0;
for (;; iter++) {
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
sleep_ms(10);
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
}
}
uint64_t r[1] = {0xffffffffffffffff};
void execute_one(void)
{
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
*(uint8_t*)0x200000000040 = 0x12;
*(uint8_t*)0x200000000041 = 1;
*(uint16_t*)0x200000000042 = 0x200;
*(uint8_t*)0x200000000044 = 0;
*(uint8_t*)0x200000000045 = 0;
*(uint8_t*)0x200000000046 = 0;
*(uint8_t*)0x200000000047 = 8;
*(uint16_t*)0x200000000048 = 0x1038;
*(uint16_t*)0x20000000004a = 0x1410;
*(uint16_t*)0x20000000004c = 0;
*(uint8_t*)0x20000000004e = 0;
*(uint8_t*)0x20000000004f = 0;
*(uint8_t*)0x200000000050 = 0;
*(uint8_t*)0x200000000051 = 1;
*(uint8_t*)0x200000000052 = 9;
*(uint8_t*)0x200000000053 = 2;
*(uint16_t*)0x200000000054 = 0x24;
*(uint8_t*)0x200000000056 = 1;
*(uint8_t*)0x200000000057 = 0;
*(uint8_t*)0x200000000058 = 0;
*(uint8_t*)0x200000000059 = 0;
*(uint8_t*)0x20000000005a = 2;
*(uint8_t*)0x20000000005b = 9;
*(uint8_t*)0x20000000005c = 4;
*(uint8_t*)0x20000000005d = 0;
*(uint8_t*)0x20000000005e = 0;
*(uint8_t*)0x20000000005f = 1;
*(uint8_t*)0x200000000060 = 3;
*(uint8_t*)0x200000000061 = 0;
*(uint8_t*)0x200000000062 = 1;
*(uint8_t*)0x200000000063 = 0;
*(uint8_t*)0x200000000064 = 9;
*(uint8_t*)0x200000000065 = 0x21;
*(uint16_t*)0x200000000066 = 8;
*(uint8_t*)0x200000000068 = 0xfd;
*(uint8_t*)0x200000000069 = 1;
*(uint8_t*)0x20000000006a = 0x22;
*(uint16_t*)0x20000000006b = 0x29;
*(uint8_t*)0x20000000006d = 9;
*(uint8_t*)0x20000000006e = 5;
*(uint8_t*)0x20000000006f = 0x81;
*(uint8_t*)0x200000000070 = 3;
*(uint16_t*)0x200000000071 = 0;
*(uint8_t*)0x200000000073 = 0;
*(uint8_t*)0x200000000074 = 0;
*(uint8_t*)0x200000000075 = 0;
res = -1;
res = syz_usb_connect(/*speed=*/0, /*dev_len=*/0x36, /*dev=*/0x200000000040, /*conn_descs=*/0);
if (res != -1)
r[0] = res;
syz_usb_control_io(/*fd=*/r[0], /*descs=*/0, /*resps=*/0);
syscall(__NR_prctl, /*option=*/0x26ul, /*arg=*/1ul, 0, 0, 0);
*(uint32_t*)0x200000000000 = 0x2c;
*(uint64_t*)0x200000000004 = 0x2000000000c0;
memcpy((void*)0x2000000000c0, "\x40\x0c\x2a\x00\x00\x00\x2a\x22\x5f\xab\xe9\x36\x24\xdb\xb2\x2d\x8b\x5a\xc8\x50\x1c\x70\x40\xb2\xad\xcf\x1f\xb3\xab\x7e\xd1\x6b\xbb\xbf\xa2\xa0\x80\x2a\x9e\x3f\x78\x95\xe5\x90\x2e\xdd\xcb\x54", 48);
*(uint64_t*)0x20000000000c = 0;
*(uint64_t*)0x200000000014 = 0;
*(uint64_t*)0x20000000001c = 0;
*(uint64_t*)0x200000000024 = 0;
syz_usb_control_io(/*fd=*/r[0], /*descs=*/0x200000000000, /*resps=*/0);
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
loop();
return 0;
}
I hope it helps.
Best regards
Jianzhou Zhao
Penglei Jiang
7 months, 1 week
- 1
- 0
Qualcomm Supply Chain - Sinldo Technology
by Alan Ye
[Sinldo Technology]
Company Profile
Hong Kong Sinldo Technology Co., Ltd. was established in 2009 and focuses on the supply chain of Qualcomm chips. As a leading supplier in the industry,
We have established solid cooperative relationships with many internationally renowned manufacturers and are committed to providing customers with high-quality and reliable chip products.
Business Scope：
Import and distribution of Qualcomm chips
Management and bidding for excess electronic components
Provide high-quality customer service and technical support
Mission
Stable supply
Vision
Mutual benefit and Triumph
Value
Reduce Fees and increase efficiency
Environment
The company is located in the core business district, with convenient transportation, elegant environment and complete surrounding supporting facilities, which facilitates the travel and business exchanges of employees and customers.
Milestones
2025
2020
2015
2009
It is expected to complete the upgrade strategic planning, further increase market share, and strive for sustainable development
The company implemented a digital management system and began to actively develop online Deals channels
The company has added multiple 4G Qualcomm chips and established partnerships with more OEM customers。
The company was formally established in Shenzhen and initially established cooperative relationships with global suppliers
Company Environment
Coastal Huanqing
Building
Office Area
storehouse
[Qualcomm]Company Spot
[ WIFI6 - IPQ5018 Kits ]
IPQ5018-0-MRQFN232-MT-01-0
QCN6102-0-DRQFN116-TR-01-0
QCA8337-AL3C
Snapdragon SDM-450-B Kits
SDM-450-B-792NSP-TR-01-0-AA
WTR-2965-0-59F0WNSP-TR-07-1
PMI-8952-0-144WLNSP-TR-02-0-00
WCN-3680B-0-79BWLNSP-TR-05-1
PM-8953-0-187F0WNSP-TR-01-1
MDM9x07 Kits
MDM-9607-0-328PSP-TR-00-0
MDM-9207-0-328PSP-TR-00-0
WTR-2965-0-59F0WNSP-TR-07-1
PMD-9607-0-94WLNSP-TR-04-2
[Sinldo Technology Co., Ltd.]
Email：yesunjian888(a)gmail.com
Skype：625285556(a)qq.com
Address：Room 2305, Hai'an Huanqing Building,
Futian Road, Futian District, Shenzhen
Wechat
Hit subscribe now to receive regular updates and our product’s latest features! Subscribe
If you don't want to receive our emails, you can easily unsubscribe here.
Alan Ye
Purchasing Manager
：+86 136 0651 6680
QUALCOMM
Supply chain : yesunjian888(a)gmail.com
7 months, 1 week
- 1
- 0
FAILED: patch "[PATCH] smb: client: Fix use-after-free in cifs_fill_dirent" failed to apply to 5.4-stable tree
by gregkh＠linuxfoundation.org
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x a7a8fe56e932a36f43e031b398aef92341bf5ea0
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2025052437-platform-elastic-f5d2@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a7a8fe56e932a36f43e031b398aef92341bf5ea0 Mon Sep 17 00:00:00 2001
From: Wang Zhaolong <wangzhaolong1(a)huawei.com>
Date: Fri, 16 May 2025 17:12:55 +0800
Subject: [PATCH] smb: client: Fix use-after-free in cifs_fill_dirent
There is a race condition in the readdir concurrency process, which may
access the rsp buffer after it has been released, triggering the
following KASAN warning.
==================================================================
BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]
Read of size 4 at addr ffff8880099b819c by task a.out/342975
CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
print_report+0xce/0x640
kasan_report+0xb8/0xf0
cifs_fill_dirent+0xb03/0xb60 [cifs]
cifs_readdir+0x12cb/0x3190 [cifs]
iterate_dir+0x1a1/0x520
__x64_sys_getdents+0x134/0x220
do_syscall_64+0x4b/0x110
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f996f64b9f9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89
f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
f0 ff ff 0d f7 c3 0c 00 f7 d8 64 89 8
RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88
R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000
</TASK>
Allocated by task 408:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
__kasan_slab_alloc+0x6e/0x70
kmem_cache_alloc_noprof+0x117/0x3d0
mempool_alloc_noprof+0xf2/0x2c0
cifs_buf_get+0x36/0x80 [cifs]
allocate_buffers+0x1d2/0x330 [cifs]
cifs_demultiplex_thread+0x22b/0x2690 [cifs]
kthread+0x394/0x720
ret_from_fork+0x34/0x70
ret_from_fork_asm+0x1a/0x30
Freed by task 342979:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x37/0x50
kmem_cache_free+0x2b8/0x500
cifs_buf_release+0x3c/0x70 [cifs]
cifs_readdir+0x1c97/0x3190 [cifs]
iterate_dir+0x1a1/0x520
__x64_sys_getdents64+0x134/0x220
do_syscall_64+0x4b/0x110
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The buggy address belongs to the object at ffff8880099b8000
which belongs to the cache cifs_request of size 16588
The buggy address is located 412 bytes inside of
freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0x80000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001
head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
POC is available in the link [1].
The problem triggering process is as follows:
Process 1 Process 2
-----------------------------------------------------------------
cifs_readdir
/* file->private_data == NULL */
initiate_cifs_search
cifsFile = kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
smb2_query_dir_first ->query_dir_first()
SMB2_query_directory
SMB2_query_directory_init
cifs_send_recv
smb2_parse_query_directory
srch_inf->ntwrk_buf_start = (char *)rsp;
srch_inf->srch_entries_start = (char *)rsp + ...
srch_inf->last_entry = (char *)rsp + ...
srch_inf->smallBuf = true;
find_cifs_entry
/* if (cfile->srch_inf.ntwrk_buf_start) */
cifs_small_buf_release(cfile->srch_inf // free
cifs_readdir ->iterate_shared()
/* file->private_data != NULL */
find_cifs_entry
/* in while (...) loop */
smb2_query_dir_next ->query_dir_next()
SMB2_query_directory
SMB2_query_directory_init
cifs_send_recv
compound_send_recv
smb_send_rqst
__smb_send_rqst
rc = -ERESTARTSYS;
/* if (fatal_signal_pending()) */
goto out;
return rc
/* if (cfile->srch_inf.last_entry) */
cifs_save_resume_key()
cifs_fill_dirent // UAF
/* if (rc) */
return -ENOENT;
Fix this by ensuring the return code is checked before using pointers
from the srch_inf.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220131 [1]
Fixes: a364bc0b37f1 ("[CIFS] fix saving of resume key before CIFSFindNext")
Cc: stable(a)vger.kernel.org
Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com>
Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c
index 50f96259d9ad..67d7dd64b5e2 100644
--- a/fs/smb/client/readdir.c
+++ b/fs/smb/client/readdir.c
@@ -756,11 +756,11 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos,
rc = server->ops->query_dir_next(xid, tcon, &cfile->fid,
search_flags,
&cfile->srch_inf);
+ if (rc)
+ return -ENOENT;
/* FindFirst/Next set last_entry to NULL on malformed reply */
if (cfile->srch_inf.last_entry)
cifs_save_resume_key(cfile->srch_inf.last_entry, cfile);
- if (rc)
- return -ENOENT;
}
if (index_to_find < cfile->srch_inf.index_of_last_entry) {
/* we found the buffer that contains the entry */
7 months, 1 week
- 2
- 2
FAILED: patch "[PATCH] smb: client: Fix use-after-free in cifs_fill_dirent" failed to apply to 5.10-stable tree
by gregkh＠linuxfoundation.org
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x a7a8fe56e932a36f43e031b398aef92341bf5ea0
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2025052435-guts-tinfoil-42a7@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a7a8fe56e932a36f43e031b398aef92341bf5ea0 Mon Sep 17 00:00:00 2001
From: Wang Zhaolong <wangzhaolong1(a)huawei.com>
Date: Fri, 16 May 2025 17:12:55 +0800
Subject: [PATCH] smb: client: Fix use-after-free in cifs_fill_dirent
There is a race condition in the readdir concurrency process, which may
access the rsp buffer after it has been released, triggering the
following KASAN warning.
==================================================================
BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]
Read of size 4 at addr ffff8880099b819c by task a.out/342975
CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
print_report+0xce/0x640
kasan_report+0xb8/0xf0
cifs_fill_dirent+0xb03/0xb60 [cifs]
cifs_readdir+0x12cb/0x3190 [cifs]
iterate_dir+0x1a1/0x520
__x64_sys_getdents+0x134/0x220
do_syscall_64+0x4b/0x110
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f996f64b9f9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89
f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
f0 ff ff 0d f7 c3 0c 00 f7 d8 64 89 8
RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88
R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000
</TASK>
Allocated by task 408:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
__kasan_slab_alloc+0x6e/0x70
kmem_cache_alloc_noprof+0x117/0x3d0
mempool_alloc_noprof+0xf2/0x2c0
cifs_buf_get+0x36/0x80 [cifs]
allocate_buffers+0x1d2/0x330 [cifs]
cifs_demultiplex_thread+0x22b/0x2690 [cifs]
kthread+0x394/0x720
ret_from_fork+0x34/0x70
ret_from_fork_asm+0x1a/0x30
Freed by task 342979:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x37/0x50
kmem_cache_free+0x2b8/0x500
cifs_buf_release+0x3c/0x70 [cifs]
cifs_readdir+0x1c97/0x3190 [cifs]
iterate_dir+0x1a1/0x520
__x64_sys_getdents64+0x134/0x220
do_syscall_64+0x4b/0x110
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The buggy address belongs to the object at ffff8880099b8000
which belongs to the cache cifs_request of size 16588
The buggy address is located 412 bytes inside of
freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0x80000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001
head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
POC is available in the link [1].
The problem triggering process is as follows:
Process 1 Process 2
-----------------------------------------------------------------
cifs_readdir
/* file->private_data == NULL */
initiate_cifs_search
cifsFile = kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
smb2_query_dir_first ->query_dir_first()
SMB2_query_directory
SMB2_query_directory_init
cifs_send_recv
smb2_parse_query_directory
srch_inf->ntwrk_buf_start = (char *)rsp;
srch_inf->srch_entries_start = (char *)rsp + ...
srch_inf->last_entry = (char *)rsp + ...
srch_inf->smallBuf = true;
find_cifs_entry
/* if (cfile->srch_inf.ntwrk_buf_start) */
cifs_small_buf_release(cfile->srch_inf // free
cifs_readdir ->iterate_shared()
/* file->private_data != NULL */
find_cifs_entry
/* in while (...) loop */
smb2_query_dir_next ->query_dir_next()
SMB2_query_directory
SMB2_query_directory_init
cifs_send_recv
compound_send_recv
smb_send_rqst
__smb_send_rqst
rc = -ERESTARTSYS;
/* if (fatal_signal_pending()) */
goto out;
return rc
/* if (cfile->srch_inf.last_entry) */
cifs_save_resume_key()
cifs_fill_dirent // UAF
/* if (rc) */
return -ENOENT;
Fix this by ensuring the return code is checked before using pointers
from the srch_inf.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220131 [1]
Fixes: a364bc0b37f1 ("[CIFS] fix saving of resume key before CIFSFindNext")
Cc: stable(a)vger.kernel.org
Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com>
Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c
index 50f96259d9ad..67d7dd64b5e2 100644
--- a/fs/smb/client/readdir.c
+++ b/fs/smb/client/readdir.c
@@ -756,11 +756,11 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos,
rc = server->ops->query_dir_next(xid, tcon, &cfile->fid,
search_flags,
&cfile->srch_inf);
+ if (rc)
+ return -ENOENT;
/* FindFirst/Next set last_entry to NULL on malformed reply */
if (cfile->srch_inf.last_entry)
cifs_save_resume_key(cfile->srch_inf.last_entry, cfile);
- if (rc)
- return -ENOENT;
}
if (index_to_find < cfile->srch_inf.index_of_last_entry) {
/* we found the buffer that contains the entry */
7 months, 1 week
- 2
- 2
FAILED: patch "[PATCH] smb: client: Fix use-after-free in cifs_fill_dirent" failed to apply to 5.15-stable tree
by gregkh＠linuxfoundation.org
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x a7a8fe56e932a36f43e031b398aef92341bf5ea0
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2025052432-deafening-parted-13e0@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a7a8fe56e932a36f43e031b398aef92341bf5ea0 Mon Sep 17 00:00:00 2001
From: Wang Zhaolong <wangzhaolong1(a)huawei.com>
Date: Fri, 16 May 2025 17:12:55 +0800
Subject: [PATCH] smb: client: Fix use-after-free in cifs_fill_dirent
There is a race condition in the readdir concurrency process, which may
access the rsp buffer after it has been released, triggering the
following KASAN warning.
==================================================================
BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]
Read of size 4 at addr ffff8880099b819c by task a.out/342975
CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
print_report+0xce/0x640
kasan_report+0xb8/0xf0
cifs_fill_dirent+0xb03/0xb60 [cifs]
cifs_readdir+0x12cb/0x3190 [cifs]
iterate_dir+0x1a1/0x520
__x64_sys_getdents+0x134/0x220
do_syscall_64+0x4b/0x110
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f996f64b9f9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89
f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
f0 ff ff 0d f7 c3 0c 00 f7 d8 64 89 8
RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88
R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000
</TASK>
Allocated by task 408:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
__kasan_slab_alloc+0x6e/0x70
kmem_cache_alloc_noprof+0x117/0x3d0
mempool_alloc_noprof+0xf2/0x2c0
cifs_buf_get+0x36/0x80 [cifs]
allocate_buffers+0x1d2/0x330 [cifs]
cifs_demultiplex_thread+0x22b/0x2690 [cifs]
kthread+0x394/0x720
ret_from_fork+0x34/0x70
ret_from_fork_asm+0x1a/0x30
Freed by task 342979:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x37/0x50
kmem_cache_free+0x2b8/0x500
cifs_buf_release+0x3c/0x70 [cifs]
cifs_readdir+0x1c97/0x3190 [cifs]
iterate_dir+0x1a1/0x520
__x64_sys_getdents64+0x134/0x220
do_syscall_64+0x4b/0x110
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The buggy address belongs to the object at ffff8880099b8000
which belongs to the cache cifs_request of size 16588
The buggy address is located 412 bytes inside of
freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0x80000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001
head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
POC is available in the link [1].
The problem triggering process is as follows:
Process 1 Process 2
-----------------------------------------------------------------
cifs_readdir
/* file->private_data == NULL */
initiate_cifs_search
cifsFile = kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
smb2_query_dir_first ->query_dir_first()
SMB2_query_directory
SMB2_query_directory_init
cifs_send_recv
smb2_parse_query_directory
srch_inf->ntwrk_buf_start = (char *)rsp;
srch_inf->srch_entries_start = (char *)rsp + ...
srch_inf->last_entry = (char *)rsp + ...
srch_inf->smallBuf = true;
find_cifs_entry
/* if (cfile->srch_inf.ntwrk_buf_start) */
cifs_small_buf_release(cfile->srch_inf // free
cifs_readdir ->iterate_shared()
/* file->private_data != NULL */
find_cifs_entry
/* in while (...) loop */
smb2_query_dir_next ->query_dir_next()
SMB2_query_directory
SMB2_query_directory_init
cifs_send_recv
compound_send_recv
smb_send_rqst
__smb_send_rqst
rc = -ERESTARTSYS;
/* if (fatal_signal_pending()) */
goto out;
return rc
/* if (cfile->srch_inf.last_entry) */
cifs_save_resume_key()
cifs_fill_dirent // UAF
/* if (rc) */
return -ENOENT;
Fix this by ensuring the return code is checked before using pointers
from the srch_inf.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220131 [1]
Fixes: a364bc0b37f1 ("[CIFS] fix saving of resume key before CIFSFindNext")
Cc: stable(a)vger.kernel.org
Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com>
Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c
index 50f96259d9ad..67d7dd64b5e2 100644
--- a/fs/smb/client/readdir.c
+++ b/fs/smb/client/readdir.c
@@ -756,11 +756,11 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos,
rc = server->ops->query_dir_next(xid, tcon, &cfile->fid,
search_flags,
&cfile->srch_inf);
+ if (rc)
+ return -ENOENT;
/* FindFirst/Next set last_entry to NULL on malformed reply */
if (cfile->srch_inf.last_entry)
cifs_save_resume_key(cfile->srch_inf.last_entry, cfile);
- if (rc)
- return -ENOENT;
}
if (index_to_find < cfile->srch_inf.index_of_last_entry) {
/* we found the buffer that contains the entry */
7 months, 1 week
- 2
- 4
6.12.30: black screen after waking up from hibernate; bisected
by Rainer Fiebig
With kernel 6.12.30 waking up from hibernate fails in a Ryzen 3 5600G
system with the latest BIOS. At the end of the wake-up procedure the
screen goes black instead of showing the log-in screen and the system
becomes unresponsive. A hard reset is necessary.
Seeing messages like the following in the system log, I suspected an
amdgpu problem:
May 23 19:09:30 LUX kernel: [16885.524496] amdgpu 0000:30:00.0: [drm]
*ERROR* flip_done timed out
May 23 19:09:30 LUX kernel: [16885.524501] amdgpu 0000:30:00.0: [drm]
*ERROR* [CRTC:73:crtc-0] commit wait timed out
I don't know whether those messages and the problem are really related
but I bisected in 'drivers/gpu/drm/amd' anyway and the result was:
> git bisect bad
25e07c8403f4daad35cffc18d96e32a80a2a3222 is the first bad commit
commit 25e07c8403f4daad35cffc18d96e32a80a2a3222 (HEAD)
Author: Alex Deucher <alexander.deucher(a)amd.com>
Date: Thu May 1 13:46:46 2025 -0400
drm/amdgpu: fix pm notifier handling
commit 4aaffc85751da5722e858e4333e8cf0aa4b6c78f upstream.
Set the s3/s0ix and s4 flags in the pm notifier so that we can skip
the resource evictions properly in pm prepare based on whether
we are suspending or hibernating. Drop the eviction as processes
are not frozen at this time, we we can end up getting stuck trying
to evict VRAM while applications continue to submit work which
causes the buffers to get pulled back into VRAM.
HTH. Thanks.
Rainer
--
The truth always turns out to be simpler than you thought.
Richard Feynman
7 months, 1 week
- 3
- 5
[PATCH] rtc: pcf2127: add missing semicolon after statement
by Hugo Villeneuve
From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Replace comma with semicolon at the end of the statement when setting
config.max_register.
Fixes: fd28ceb4603f ("rtc: pcf2127: add variant-specific configuration structure")
Cc: stable(a)vger.kernel.org
Cc: Elena Popa <elena.popa(a)nxp.com>
Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
---
drivers/rtc/rtc-pcf2127.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
index 31c7dca8f469..2bfebe3eba0c 100644
--- a/drivers/rtc/rtc-pcf2127.c
+++ b/drivers/rtc/rtc-pcf2127.c
@@ -1538,7 +1538,7 @@ static int pcf2127_spi_probe(struct spi_device *spi)
variant = &pcf21xx_cfg[type];
}
- config.max_register = variant->max_register,
+ config.max_register = variant->max_register;
regmap = devm_regmap_init_spi(spi, &config);
if (IS_ERR(regmap)) {
base-commit: c7622a4e44d9d008e0e5edcc46c71854c50cf4a8
--
2.39.5
7 months, 1 week
- 1
- 0
+ mm-fix-uprobe-pte-be-overwritten-when-expanding-vma.patch added to mm-unstable branch
by Andrew Morton
The patch titled
Subject: mm: fix uprobe pte be overwritten when expanding vma
has been added to the -mm mm-unstable branch. Its filename is
mm-fix-uprobe-pte-be-overwritten-when-expanding-vma.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Pu Lehui <pulehui(a)huawei.com>
Subject: mm: fix uprobe pte be overwritten when expanding vma
Date: Thu, 29 May 2025 15:56:47 +0000
Patch series "Fix uprobe pte be overwritten when expanding vma".
This patch (of 4):
We encountered a BUG alert triggered by Syzkaller as follows:
BUG: Bad rss-counter state mm:00000000b4a60fca type:MM_ANONPAGES val:1
And we can reproduce it with the following steps:
1. register uprobe on file at zero offset
2. mmap the file at zero offset:
addr1 = mmap(NULL, 2 * 4096, PROT_NONE, MAP_PRIVATE, fd, 0);
3. mremap part of vma1 to new vma2:
addr2 = mremap(addr1, 4096, 2 * 4096, MREMAP_MAYMOVE);
4. mremap back to orig addr1:
mremap(addr2, 4096, 4096, MREMAP_MAYMOVE | MREMAP_FIXED, addr1);
In step 3, the vma1 range [addr1, addr1 + 4096] will be remap to new vma2
with range [addr2, addr2 + 8192], and remap uprobe anon page from the vma1
to vma2, then unmap the vma1 range [addr1, addr1 + 4096].
In step 4, the vma2 range [addr2, addr2 + 4096] will be remap back to the
addr range [addr1, addr1 + 4096]. Since the addr range [addr1 + 4096,
addr1 + 8192] still maps the file, it will take vma_merge_new_range to
expand the range, and then do uprobe_mmap in vma_complete. Since the
merged vma pgoff is also zero offset, it will install uprobe anon page to
the merged vma. However, the upcomming move_page_tables step, which use
set_pte_at to remap the vma2 uprobe pte to the merged vma, will overwrite
the newly uprobe pte in the merged vma, and lead that pte to be orphan.
Since the uprobe pte will be remapped to the merged vma, we can remove the
unnecessary uprobe_mmap upon merged vma.
This problem was first found in linux-6.6.y and also exists in the
community syzkaller:
https://lore.kernel.org/all/000000000000ada39605a5e71711@google.com/T/
Link: https://lkml.kernel.org/r/20250529155650.4017699-1-pulehui@huaweicloud.com
Link: https://lkml.kernel.org/r/20250529155650.4017699-2-pulehui@huaweicloud.com
Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints")
Signed-off-by: Pu Lehui <pulehui(a)huawei.com>
Suggested-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com>
Cc: Jann Horn <jannh(a)google.com>
Cc: Liam Howlett <liam.howlett(a)oracle.com>
Cc: "Masami Hiramatsu (Google)" <mhiramat(a)kernel.org>
Cc: Oleg Nesterov <oleg(a)redhat.com>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/vma.c | 20 +++++++++++++++++---
mm/vma.h | 7 +++++++
2 files changed, 24 insertions(+), 3 deletions(-)
--- a/mm/vma.c~mm-fix-uprobe-pte-be-overwritten-when-expanding-vma
+++ a/mm/vma.c
@@ -169,6 +169,9 @@ static void init_multi_vma_prep(struct v
vp->file = vma->vm_file;
if (vp->file)
vp->mapping = vma->vm_file->f_mapping;
+
+ if (vmg && vmg->skip_vma_uprobe)
+ vp->skip_vma_uprobe = true;
}
/*
@@ -358,10 +361,13 @@ static void vma_complete(struct vma_prep
if (vp->file) {
i_mmap_unlock_write(vp->mapping);
- uprobe_mmap(vp->vma);
- if (vp->adj_next)
- uprobe_mmap(vp->adj_next);
+ if (!vp->skip_vma_uprobe) {
+ uprobe_mmap(vp->vma);
+
+ if (vp->adj_next)
+ uprobe_mmap(vp->adj_next);
+ }
}
if (vp->remove) {
@@ -1830,6 +1836,14 @@ struct vm_area_struct *copy_vma(struct v
faulted_in_anon_vma = false;
}
+ /*
+ * If the VMA we are copying might contain a uprobe PTE, ensure
+ * that we do not establish one upon merge. Otherwise, when mremap()
+ * moves page tables, it will orphan the newly created PTE.
+ */
+ if (vma->vm_file)
+ vmg.skip_vma_uprobe = true;
+
new_vma = find_vma_prev(mm, addr, &vmg.prev);
if (new_vma && new_vma->vm_start < addr + len)
return NULL; /* should never get here */
--- a/mm/vma.h~mm-fix-uprobe-pte-be-overwritten-when-expanding-vma
+++ a/mm/vma.h
@@ -19,6 +19,8 @@ struct vma_prepare {
struct vm_area_struct *insert;
struct vm_area_struct *remove;
struct vm_area_struct *remove2;
+
+ bool skip_vma_uprobe :1;
};
struct unlink_vma_file_batch {
@@ -120,6 +122,11 @@ struct vma_merge_struct {
*/
bool give_up_on_oom :1;
+ /*
+ * If set, skip uprobe_mmap upon merged vma.
+ */
+ bool skip_vma_uprobe :1;
+
/* Internal flags set during merge process: */
/*
_
Patches currently in -mm which might be from pulehui(a)huawei.com are
mm-fix-uprobe-pte-be-overwritten-when-expanding-vma.patch
mm-expose-abnormal-new_pte-during-move_ptes.patch
selftests-mm-extract-read_sysfs-and-write_sysfs-into-vm_util.patch
selftests-mm-add-test-about-uprobe-pte-be-orphan-during-vma-merge.patch
7 months, 1 week
- 1
- 0
[PATCH] x86/mm: Fix paging-structure cache flush on kernel table freeing
by Jann Horn
There are several issues in pud_free_pmd_page() and pmd_free_pte_page(),
which are used by vmalloc:
1. flush_tlb_kernel_range() does not flush paging-structure caches for
inactive PCIDs, but we're using it when freeing kernel page tables.
2. flush_tlb_kernel_range() only flushes paging-structure cache entries
that intersect with the flush range, and pud_free_pmd_page() passes in
the first PAGE_SIZE bytes of the area covered by the PMD table; but
pud_free_pmd_page() is actually designed to also remove PTE tables that
were installed in the PMD table, so we need to also flush those.
3. [theoretical issue] invlpgb_kernel_range_flush() expects an exclusive
range, it does: `nr = (info->end - addr) >> PAGE_SHIFT;`
But pmd_free_pte_page() and pud_free_pmd_page() provide inclusive
ranges (`addr, addr + PAGE_SIZE-1`).
To fix it:
1. Add a new helper flush_tlb_kernel_pgtable_range() for flushing paging
structure caches for kernel page tables, and use that.
2. Flush PUD_SIZE instead of PAGE_SIZE in pud_free_pmd_page().
3. Remove `-1` in end address calculations.
Note that since I'm not touching invlpgb_kernel_range_flush() or
invlpgb_flush_addr_nosync() in this patch, the flush on PMD table deletion
with INVLPGB might be a bit slow due to using PTE_STRIDE instead of
PMD_STRIDE. I don't think that matters.
Backport notes:
Kernels before 6.16 don't have invlpgb_kernel_range_flush(); for them,
kernel_tlb_flush_pgtable() should just unconditionally call
flush_tlb_all().
I am marking this as fixing commit 28ee90fe6048 ("x86/mm: implement free
pmd/pte page interfaces"); that is technically incorrect, since back then
no paging-structure cache invalidations were performed at all, but probably
makes the most sense here.
Cc: stable(a)vger.kernel.org
Fixes: 28ee90fe6048 ("x86/mm: implement free pmd/pte page interfaces")
Signed-off-by: Jann Horn <jannh(a)google.com>
---
arch/x86/include/asm/tlb.h | 4 ++++
arch/x86/include/asm/tlbflush.h | 1 +
arch/x86/mm/pgtable.c | 13 +++++++++----
arch/x86/mm/tlb.c | 37 +++++++++++++++++++++++++++++++++++++
4 files changed, 51 insertions(+), 4 deletions(-)
diff --git a/arch/x86/include/asm/tlb.h b/arch/x86/include/asm/tlb.h
index 866ea78ba156..56a4b93a0742 100644
--- a/arch/x86/include/asm/tlb.h
+++ b/arch/x86/include/asm/tlb.h
@@ -153,6 +153,10 @@ static inline void invlpgb_flush_all(void)
/* Flush addr, including globals, for all PCIDs. */
static inline void invlpgb_flush_addr_nosync(unsigned long addr, u16 nr)
{
+ /*
+ * Don't set INVLPGB_FLAG_FINAL_ONLY here without adjusting
+ * kernel_tlb_flush_pgtable().
+ */
__invlpgb(0, 0, addr, nr, PTE_STRIDE, INVLPGB_FLAG_INCLUDE_GLOBAL);
}
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index e9b81876ebe4..06a4a2b7a9f5 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -318,6 +318,7 @@ extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
unsigned long end, unsigned int stride_shift,
bool freed_tables);
extern void flush_tlb_kernel_range(unsigned long start, unsigned long end);
+void flush_tlb_kernel_pgtable_range(unsigned long start, unsigned long end);
static inline void flush_tlb_page(struct vm_area_struct *vma, unsigned long a)
{
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 62777ba4de1a..0779ed02226c 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -745,8 +745,13 @@ int pud_free_pmd_page(pud_t *pud, unsigned long addr)
pud_clear(pud);
- /* INVLPG to clear all paging-structure caches */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE-1);
+ /*
+ * Clear paging-structure caches.
+ * Note that since this function can remove a PMD table together with the
+ * PTE tables it points to, we can't just flush the first PAGE_SIZE, we
+ * must flush PUD_SIZE!
+ */
+ flush_tlb_kernel_pgtable_range(addr, addr + PUD_SIZE);
for (i = 0; i < PTRS_PER_PMD; i++) {
if (!pmd_none(pmd_sv[i])) {
@@ -778,8 +783,8 @@ int pmd_free_pte_page(pmd_t *pmd, unsigned long addr)
pte = (pte_t *)pmd_page_vaddr(*pmd);
pmd_clear(pmd);
- /* INVLPG to clear all paging-structure caches */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE-1);
+ /* clear paging-structure caches */
+ flush_tlb_kernel_pgtable_range(addr, addr + PAGE_SIZE);
free_page((unsigned long)pte);
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 39f80111e6f1..26b78451a7ed 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -1525,6 +1525,22 @@ static void kernel_tlb_flush_range(struct flush_tlb_info *info)
on_each_cpu(do_kernel_range_flush, info, 1);
}
+static void kernel_tlb_flush_pgtable(struct flush_tlb_info *info)
+{
+ /*
+ * The special thing about removing kernel page tables is that we can't
+ * use a flush that just removes global TLB entries; we need one that
+ * flushes paging structure caches across all PCIDs.
+ * With INVLPGB, that's explicitly supported.
+ * Otherwise, there's no good way (INVLPG and INVPCID can't specifically
+ * target one address across all PCIDs), just throw everything away.
+ */
+ if (cpu_feature_enabled(X86_FEATURE_INVLPGB))
+ invlpgb_kernel_range_flush(info);
+ else
+ flush_tlb_all();
+}
+
void flush_tlb_kernel_range(unsigned long start, unsigned long end)
{
struct flush_tlb_info *info;
@@ -1542,6 +1558,27 @@ void flush_tlb_kernel_range(unsigned long start, unsigned long end)
put_flush_tlb_info();
}
+/*
+ * Flush paging-structure cache entries for page tables covering the specified
+ * range and synchronize with concurrent hardware page table walks, in
+ * preparation for freeing page tables in the region.
+ * This must not be used for flushing translations to data pages.
+ */
+void flush_tlb_kernel_pgtable_range(unsigned long start, unsigned long end)
+{
+ struct flush_tlb_info *info;
+
+ /* We don't synchronize against GUP-fast. */
+ VM_WARN_ON(start < TASK_SIZE_MAX);
+
+ guard(preempt)();
+
+ info = get_flush_tlb_info(NULL, start, end, PMD_SHIFT, true,
+ TLB_GENERATION_INVALID);
+ kernel_tlb_flush_pgtable(info);
+ put_flush_tlb_info();
+}
+
/*
* This can be used from process context to figure out what the value of
* CR3 is without needing to do a (slow) __read_cr3().
---
base-commit: b1456f6dc167f7f101746e495bede2bac3d0e19f
change-id: 20250528-x86-fix-vmap-pt-del-flush-f9fa4f287c93
--
Jann Horn <jannh(a)google.com>
7 months, 1 week
- 2
- 1
[PATCH v6.6 00/26] af_unix: Align with upstream to avoid a potential UAF
by Lee Jones
From: Lee Jones <joneslee(a)google.com>
This is the second attempt at achieving the same goal. This time, the
submission avoids forking the current code base, ensuring it remains
easier to maintain over time.
The set has been tested using the SCM_RIGHTS test suite [1] using QEMU
and has been seen to successfully mitigate a UAF on on a top tier
handset.
RESULTS:
TAP version 13
1..20
# Starting 20 tests from 5 test cases.
# RUN scm_rights.dgram.self_ref ...
# OK scm_rights.dgram.self_ref
ok 1 scm_rights.dgram.self_ref
# RUN scm_rights.dgram.triangle ...
# OK scm_rights.dgram.triangle
ok 2 scm_rights.dgram.triangle
# RUN scm_rights.dgram.cross_edge ...
# OK scm_rights.dgram.cross_edge
ok 3 scm_rights.dgram.cross_edge
# RUN scm_rights.dgram.backtrack_from_scc ...
# OK scm_rights.dgram.backtrack_from_scc
ok 4 scm_rights.dgram.backtrack_from_scc
# RUN scm_rights.stream.self_ref ...
# OK scm_rights.stream.self_ref
ok 5 scm_rights.stream.self_ref
# RUN scm_rights.stream.triangle ...
# OK scm_rights.stream.triangle
ok 6 scm_rights.stream.triangle
# RUN scm_rights.stream.cross_edge ...
# OK scm_rights.stream.cross_edge
ok 7 scm_rights.stream.cross_edge
# RUN scm_rights.stream.backtrack_from_scc ...
# OK scm_rights.stream.backtrack_from_scc
ok 8 scm_rights.stream.backtrack_from_scc
# RUN scm_rights.stream_oob.self_ref ...
# OK scm_rights.stream_oob.self_ref
ok 9 scm_rights.stream_oob.self_ref
# RUN scm_rights.stream_oob.triangle ...
# OK scm_rights.stream_oob.triangle
ok 10 scm_rights.stream_oob.triangle
# RUN scm_rights.stream_oob.cross_edge ...
# OK scm_rights.stream_oob.cross_edge
ok 11 scm_rights.stream_oob.cross_edge
# RUN scm_rights.stream_oob.backtrack_from_scc ...
# OK scm_rights.stream_oob.backtrack_from_scc
ok 12 scm_rights.stream_oob.backtrack_from_scc
# RUN scm_rights.stream_listener.self_ref ...
# OK scm_rights.stream_listener.self_ref
ok 13 scm_rights.stream_listener.self_ref
# RUN scm_rights.stream_listener.triangle ...
# OK scm_rights.stream_listener.triangle
ok 14 scm_rights.stream_listener.triangle
# RUN scm_rights.stream_listener.cross_edge ...
# OK scm_rights.stream_listener.cross_edge
ok 15 scm_rights.stream_listener.cross_edge
# RUN scm_rights.stream_listener.backtrack_from_scc ...
# OK scm_rights.stream_listener.backtrack_from_scc
ok 16 scm_rights.stream_listener.backtrack_from_scc
# RUN scm_rights.stream_listener_oob.self_ref ...
# OK scm_rights.stream_listener_oob.self_ref
ok 17 scm_rights.stream_listener_oob.self_ref
# RUN scm_rights.stream_listener_oob.triangle ...
# OK scm_rights.stream_listener_oob.triangle
ok 18 scm_rights.stream_listener_oob.triangle
# RUN scm_rights.stream_listener_oob.cross_edge ...
# OK scm_rights.stream_listener_oob.cross_edge
ok 19 scm_rights.stream_listener_oob.cross_edge
# RUN scm_rights.stream_listener_oob.backtrack_from_scc ...
# OK scm_rights.stream_listener_oob.backtrack_from_scc
ok 20 scm_rights.stream_listener_oob.backtrack_from_scc
# PASSED: 20 / 20 tests passed.
# Totals: pass:20 fail:0 xfail:0 xpass:0 skip:0 error:0
[0] https://lore.kernel.org/all/20250304030149.82265-1-kuniyu@amazon.com/
[1] https://lore.kernel.org/all/20240325202425.60930-16-kuniyu@amazon.com/
Kuniyuki Iwashima (24):
af_unix: Return struct unix_sock from unix_get_socket().
af_unix: Run GC on only one CPU.
af_unix: Try to run GC async.
af_unix: Replace BUG_ON() with WARN_ON_ONCE().
af_unix: Remove io_uring code for GC.
af_unix: Remove CONFIG_UNIX_SCM.
af_unix: Allocate struct unix_vertex for each inflight AF_UNIX fd.
af_unix: Allocate struct unix_edge for each inflight AF_UNIX fd.
af_unix: Link struct unix_edge when queuing skb.
af_unix: Bulk update unix_tot_inflight/unix_inflight when queuing skb.
af_unix: Iterate all vertices by DFS.
af_unix: Detect Strongly Connected Components.
af_unix: Save listener for embryo socket.
af_unix: Fix up unix_edge.successor for embryo socket.
af_unix: Save O(n) setup of Tarjan's algo.
af_unix: Skip GC if no cycle exists.
af_unix: Avoid Tarjan's algorithm if unnecessary.
af_unix: Assign a unique index to SCC.
af_unix: Detect dead SCC.
af_unix: Replace garbage collection algorithm.
af_unix: Remove lock dance in unix_peek_fds().
af_unix: Try not to hold unix_gc_lock during accept().
af_unix: Don't access successor in unix_del_edges() during GC.
af_unix: Add dead flag to struct scm_fp_list.
Michal Luczaj (1):
af_unix: Fix garbage collection of embryos carrying OOB with
SCM_RIGHTS
Shigeru Yoshida (1):
af_unix: Fix uninit-value in __unix_walk_scc()
include/net/af_unix.h | 49 ++-
include/net/scm.h | 11 +
net/Makefile | 2 +-
net/core/scm.c | 17 ++
net/unix/Kconfig | 5 -
net/unix/Makefile | 2 -
net/unix/af_unix.c | 120 +++++---
net/unix/garbage.c | 691 +++++++++++++++++++++++++++++-------------
net/unix/scm.c | 161 ----------
net/unix/scm.h | 10 -
10 files changed, 617 insertions(+), 451 deletions(-)
delete mode 100644 net/unix/scm.c
delete mode 100644 net/unix/scm.h
--
2.49.0.1112.g889b7c5bd8-goog
7 months, 2 weeks
- 3
- 53
Backports of 2e43ae7dd71cd9bb0d1bce1d3306bf77523feb81 for 5.15 and older
by Nathan Chancellor
Hi Greg and Sasha,
Please find attached backports of commit 2e43ae7dd71c ("drm/i915/gvt:
fix unterminated-string-initialization warning") to address an instance
of -Wunterminated-string-initialization that appears in the i915 driver
with GCC 15 and Clang 21 due to its use of -Wextra. Please let me know
if there are any issues.
Cheers,
Nathan
7 months, 2 weeks
- 2
- 1
[PATCH 6.1.y] selftests/vm: fix split huge page tests
by wndgwang4
From: Zi Yan <ziy(a)nvidia.com>
[ upstream commit dd63bd7df41a8f9393a2e3ff9157a441c08eb996 ]
Fix two inputs to check_anon_huge() and one if condition, so the tests
work as expected.
Steps to reproduce the issue.
make headers
make -C tools/testing/selftests/vm
Before patching:test fails with a non-zero exit code
~/linux$ sudo tools/testing/selftests/vm/split_huge_page_test | echo 0
2
~/linux$ sudo tools/testing/selftests/vm/split_huge_page_test
No THP is allocated
After patching:
~/linux$ sudo tools/testing/selftests/vm/split_huge_page_test | echo 0
0
~/linux$ sudo tools/testing/selftests/vm/split_huge_page_test
Split huge pages successful
...
Link: https://lkml.kernel.org/r/20230306160907.16804-1-zi.yan@sent.com
Fixes: c07c343cda8e ("selftests/vm: dedup THP helpers")
Cc: stable(a)vger.kernel.org
Signed-off-by: Zi Yan <ziy(a)nvidia.com>
Reviewed-by: Zach O'Keefe <zokeefe(a)google.com>
Tested-by: Zach O'Keefe <zokeefe(a)google.com>
Acked-by: David Hildenbrand <david(a)redhat.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: wndgwang4 <guangming.wang(a)windriver.com>
---
tools/testing/selftests/vm/split_huge_page_test.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/vm/split_huge_page_test.c b/tools/testing/selftests/vm/split_huge_page_test.c
index 76e1c36dd..b8558c7f1 100644
--- a/tools/testing/selftests/vm/split_huge_page_test.c
+++ b/tools/testing/selftests/vm/split_huge_page_test.c
@@ -106,7 +106,7 @@ void split_pmd_thp(void)
for (i = 0; i < len; i++)
one_page[i] = (char)i;
- if (!check_huge_anon(one_page, 1, pmd_pagesize)) {
+ if (!check_huge_anon(one_page, 4, pmd_pagesize)) {
printf("No THP is allocated\n");
exit(EXIT_FAILURE);
}
@@ -122,7 +122,7 @@ void split_pmd_thp(void)
}
- if (check_huge_anon(one_page, 0, pmd_pagesize)) {
+ if (!check_huge_anon(one_page, 0, pmd_pagesize)) {
printf("Still AnonHugePages not split\n");
exit(EXIT_FAILURE);
}
@@ -169,7 +169,7 @@ void split_pte_mapped_thp(void)
for (i = 0; i < len; i++)
one_page[i] = (char)i;
- if (!check_huge_anon(one_page, 1, pmd_pagesize)) {
+ if (!check_huge_anon(one_page, 4, pmd_pagesize)) {
printf("No THP is allocated\n");
exit(EXIT_FAILURE);
}
--
2.34.1
7 months, 2 weeks
- 2
- 1
[PATCH net] can: kvaser_pciefd: refine error prone echo_skb_max handling logic
by Marc Kleine-Budde
From: Fedor Pchelkin <pchelkin(a)ispras.ru>
echo_skb_max should define the supported upper limit of echo_skb[]
allocated inside the netdevice's priv. The corresponding size value
provided by this driver to alloc_candev() is KVASER_PCIEFD_CAN_TX_MAX_COUNT
which is 17.
But later echo_skb_max is rounded up to the nearest power of two (for the
max case, that would be 32) and the tx/ack indices calculated further
during tx/rx may exceed the upper array boundary. Kasan reported this for
the ack case inside kvaser_pciefd_handle_ack_packet(), though the xmit
function has actually caught the same thing earlier.
BUG: KASAN: slab-out-of-bounds in kvaser_pciefd_handle_ack_packet+0x2d7/0x92a drivers/net/can/kvaser_pciefd.c:1528
Read of size 8 at addr ffff888105e4f078 by task swapper/4/0
CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 6.15.0 #12 PREEMPT(voluntary)
Call Trace:
<IRQ>
dump_stack_lvl lib/dump_stack.c:122
print_report mm/kasan/report.c:521
kasan_report mm/kasan/report.c:634
kvaser_pciefd_handle_ack_packet drivers/net/can/kvaser_pciefd.c:1528
kvaser_pciefd_read_packet drivers/net/can/kvaser_pciefd.c:1605
kvaser_pciefd_read_buffer drivers/net/can/kvaser_pciefd.c:1656
kvaser_pciefd_receive_irq drivers/net/can/kvaser_pciefd.c:1684
kvaser_pciefd_irq_handler drivers/net/can/kvaser_pciefd.c:1733
__handle_irq_event_percpu kernel/irq/handle.c:158
handle_irq_event kernel/irq/handle.c:210
handle_edge_irq kernel/irq/chip.c:833
__common_interrupt arch/x86/kernel/irq.c:296
common_interrupt arch/x86/kernel/irq.c:286
</IRQ>
Tx max count definitely matters for kvaser_pciefd_tx_avail(), but for seq
numbers' generation that's not the case - we're free to calculate them as
would be more convenient, not taking tx max count into account. The only
downside is that the size of echo_skb[] should correspond to the max seq
number (not tx max count), so in some situations a bit more memory would
be consumed than could be.
Thus make the size of the underlying echo_skb[] sufficient for the rounded
max tx value.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 8256e0ca6010 ("can: kvaser_pciefd: Fix echo_skb race")
Cc: stable(a)vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru>
Link: https://patch.msgid.link/20250528192713.63894-1-pchelkin@ispras.ru
Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de>
---
drivers/net/can/kvaser_pciefd.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c
index 7d3066691d5d..52301511ed1b 100644
--- a/drivers/net/can/kvaser_pciefd.c
+++ b/drivers/net/can/kvaser_pciefd.c
@@ -966,7 +966,7 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie)
u32 status, tx_nr_packets_max;
netdev = alloc_candev(sizeof(struct kvaser_pciefd_can),
- KVASER_PCIEFD_CAN_TX_MAX_COUNT);
+ roundup_pow_of_two(KVASER_PCIEFD_CAN_TX_MAX_COUNT));
if (!netdev)
return -ENOMEM;
@@ -995,7 +995,6 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie)
can->tx_max_count = min(KVASER_PCIEFD_CAN_TX_MAX_COUNT, tx_nr_packets_max - 1);
can->can.clock.freq = pcie->freq;
- can->can.echo_skb_max = roundup_pow_of_two(can->tx_max_count);
spin_lock_init(&can->lock);
can->can.bittiming_const = &kvaser_pciefd_bittiming_const;
base-commit: 271683bb2cf32e5126c592b5d5e6a756fa374fd9
--
2.47.2
7 months, 2 weeks
- 2
- 1
[PATCH] driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
by Macpaul Lin
From: Yanqing Wang <ot_yanqing.wang(a)mediatek.com>
Identify the cause of the suspend/resume hang: netif_carrier_off()
is called during link state changes and becomes stuck while
executing linkwatch_work().
To resolve this issue, call netif_device_detach() during the Ethernet
suspend process to temporarily detach the network device from the
kernel and prevent the suspend/resume hang.
Fixes: 8c7bd5a454ff ("net: ethernet: mtk-star-emac: new driver")
Signed-off-by: Yanqing Wang <ot_yanqing.wang(a)mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin(a)mediatek.com>
Signed-off-by: Biao Huang <biao.huang(a)mediatek.com>
---
drivers/net/ethernet/mediatek/mtk_star_emac.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/mediatek/mtk_star_emac.c b/drivers/net/ethernet/mediatek/mtk_star_emac.c
index b175119a6a7d..b83886a41121 100644
--- a/drivers/net/ethernet/mediatek/mtk_star_emac.c
+++ b/drivers/net/ethernet/mediatek/mtk_star_emac.c
@@ -1463,6 +1463,8 @@ static __maybe_unused int mtk_star_suspend(struct device *dev)
if (netif_running(ndev))
mtk_star_disable(ndev);
+ netif_device_detach(ndev);
+
clk_bulk_disable_unprepare(MTK_STAR_NCLKS, priv->clks);
return 0;
@@ -1487,6 +1489,8 @@ static __maybe_unused int mtk_star_resume(struct device *dev)
clk_bulk_disable_unprepare(MTK_STAR_NCLKS, priv->clks);
}
+ netif_device_attach(ndev);
+
return ret;
}
--
2.45.2
7 months, 2 weeks
- 3
- 2
Re: [PATCH v3] virtio_blk: Fix disk deletion hang on device surprise removal
by Michael S. Tsirkin
On Thu, May 29, 2025 at 06:19:31AM +0000, Parav Pandit wrote:
> When the PCI device is surprise removed, requests may not complete
> the device as the VQ is marked as broken. Due to this, the disk
> deletion hangs.
>
> Fix it by aborting the requests when the VQ is broken.
>
> With this fix now fio completes swiftly.
> An alternative of IO timeout has been considered, however
> when the driver knows about unresponsive block device, swiftly clearing
> them enables users and upper layers to react quickly.
>
> Verified with multiple device unplug iterations with pending requests in
> virtio used ring and some pending with the device.
>
> Fixes: 43bb40c5b926 ("virtio_pci: Support surprise removal of virtio pci device")
> Cc: stable(a)vger.kernel.org
> Reported-by: Li RongQing <lirongqing(a)baidu.com>
> Closes: https://lore.kernel.org/virtualization/c45dd68698cd47238c55fb73ca9b4741@bai…
> Reviewed-by: Max Gurtovoy <mgurtovoy(a)nvidia.com>
> Reviewed-by: Israel Rukshin <israelr(a)nvidia.com>
> Signed-off-by: Parav Pandit <parav(a)nvidia.com>
>
> ---
> v2->v3:
> - Addressed comments from Michael
> - updated comment for synchronizing with callbacks
>
> v1->v2:
> - Addressed comments from Stephan
> - fixed spelling to 'waiting'
> - Addressed comments from Michael
> - Dropped checking broken vq from queue_rq() and queue_rqs()
> because it is checked in lower layer routines in virtio core
>
> v0->v1:
> - Fixed comments from Stefan to rename a cleanup function
> - Improved logic for handling any outstanding requests
> in bio layer
> - improved cancel callback to sync with ongoing done()
Thanks!
Something else small to improve.
> ---
> drivers/block/virtio_blk.c | 82 ++++++++++++++++++++++++++++++++++++++
> 1 file changed, 82 insertions(+)
>
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index 7cffea01d868..d37df878f4e9 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -1554,6 +1554,86 @@ static int virtblk_probe(struct virtio_device *vdev)
> return err;
> }
>
> +static bool virtblk_request_cancel(struct request *rq, void *data)
it is more
virtblk_request_complete_broken_with_ioerr
and maybe a comment?
/*
* If the vq is broken, device will not complete requests.
* So we do it for the device.
*/
> +{
> + struct virtblk_req *vbr = blk_mq_rq_to_pdu(rq);
> + struct virtio_blk *vblk = data;
> + struct virtio_blk_vq *vq;
> + unsigned long flags;
> +
> + vq = &vblk->vqs[rq->mq_hctx->queue_num];
> +
> + spin_lock_irqsave(&vq->lock, flags);
> +
> + vbr->in_hdr.status = VIRTIO_BLK_S_IOERR;
> + if (blk_mq_request_started(rq) && !blk_mq_request_completed(rq))
> + blk_mq_complete_request(rq);
> +
> + spin_unlock_irqrestore(&vq->lock, flags);
> + return true;
> +}
> +
> +static void virtblk_broken_device_cleanup(struct virtio_blk *vblk)
and one goes okay what does it do exactly? cleanup device in
a broken way? turns out no, it cleans up a broken device.
And an overview would be good. Maybe, a small comment will help:
/*
* if the device is broken, it will not use any buffers and waiting
* for that to happen is pointless. We'll do it in the driver,
* completing all requests for the device.
*/
> +{
> + struct request_queue *q = vblk->disk->queue;
> +
> + if (!virtqueue_is_broken(vblk->vqs[0].vq))
> + return;
so one has to read it, and understand that we did not need to call
it in the 1st place on a non broken device.
Moving it to the caller would be cleaner.
> +
> + /* Start freezing the queue, so that new requests keeps waiting at the
wrong style of comment for blk.
/* this is
* net style
*/
/*
* this is
* rest of the linux style
*/
> + * door of bio_queue_enter(). We cannot fully freeze the queue because
> + * freezed queue is an empty queue and there are pending requests, so
a frozen queue
> + * only start freezing it.
> + */
> + blk_freeze_queue_start(q);
> +
> + /* When quiescing completes, all ongoing dispatches have completed
> + * and no new dispatch will happen towards the driver.
> + * This ensures that later when cancel is attempted, then are not
they are not?
> + * getting processed by the queue_rq() or queue_rqs() handlers.
> + */
> + blk_mq_quiesce_queue(q);
> +
> + /*
> + * Synchronize with any ongoing VQ callbacks that may have started
> + * before the VQs were marked as broken. Any outstanding requests
> + * will be completed by virtblk_request_cancel().
> + */
> + virtio_synchronize_cbs(vblk->vdev);
> +
> + /* At this point, no new requests can enter the queue_rq() and
> + * completion routine will not complete any new requests either for the
> + * broken vq. Hence, it is safe to cancel all requests which are
> + * started.
> + */
> + blk_mq_tagset_busy_iter(&vblk->tag_set, virtblk_request_cancel, vblk);
> + blk_mq_tagset_wait_completed_request(&vblk->tag_set);
> +
> + /* All pending requests are cleaned up. Time to resume so that disk
> + * deletion can be smooth. Start the HW queues so that when queue is
> + * unquiesced requests can again enter the driver.
> + */
> + blk_mq_start_stopped_hw_queues(q, true);
> +
> + /* Unquiescing will trigger dispatching any pending requests to the
> + * driver which has crossed bio_queue_enter() to the driver.
> + */
> + blk_mq_unquiesce_queue(q);
> +
> + /* Wait for all pending dispatches to terminate which may have been
> + * initiated after unquiescing.
> + */
> + blk_mq_freeze_queue_wait(q);
> +
> + /* Mark the disk dead so that once queue unfreeze, the requests
... once we unfreeze the queue
> + * waiting at the door of bio_queue_enter() can be aborted right away.
> + */
> + blk_mark_disk_dead(vblk->disk);
> +
> + /* Unfreeze the queue so that any waiting requests will be aborted. */
> + blk_mq_unfreeze_queue_nomemrestore(q);
> +}
> +
> static void virtblk_remove(struct virtio_device *vdev)
> {
> struct virtio_blk *vblk = vdev->priv;
> @@ -1561,6 +1641,8 @@ static void virtblk_remove(struct virtio_device *vdev)
> /* Make sure no work handler is accessing the device. */
> flush_work(&vblk->config_work);
>
I prefer simply moving the test here:
if (virtqueue_is_broken(vblk->vqs[0].vq))
virtblk_broken_device_cleanup(vblk);
makes it much clearer what is going on, imho.
> del_gendisk(vblk->disk);
> blk_mq_free_tag_set(&vblk->tag_set);
>
> --
> 2.34.1
7 months, 2 weeks
- 2
- 2
Linux 6.14.9
by Greg Kroah-Hartman
I'm announcing the release of the 6.14.9 kernel.
All users of the 6.14 kernel series must upgrade.
The updated 6.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/admin-guide/kernel-parameters.txt | 2
Documentation/driver-api/pps.rst | 3
Documentation/driver-api/serial/driver.rst | 2
Documentation/hwmon/dell-smm-hwmon.rst | 14
Documentation/networking/net_cachelines/snmp.rst | 1
Makefile | 6
arch/arm/boot/dts/nvidia/tegra114.dtsi | 2
arch/arm/mach-at91/pm.c | 21
arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts | 38
arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts | 14
arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi | 22
arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 8
arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 2
arch/arm64/boot/dts/nvidia/tegra234-p3740-0002+p3701-0008.dts | 10
arch/arm64/boot/dts/xilinx/zynqmp-clk-ccf.dtsi | 15
arch/arm64/include/asm/cputype.h | 2
arch/arm64/include/asm/pgtable.h | 27
arch/arm64/kernel/proton-pack.c | 1
arch/arm64/net/bpf_jit_comp.c | 6
arch/loongarch/kernel/Makefile | 8
arch/loongarch/kvm/Makefile | 2
arch/mips/include/asm/ftrace.h | 16
arch/mips/kernel/pm-cps.c | 30
arch/powerpc/include/asm/mmzone.h | 1
arch/powerpc/kernel/prom_init.c | 4
arch/powerpc/mm/book3s64/radix_pgtable.c | 3
arch/powerpc/mm/numa.c | 2
arch/powerpc/perf/core-book3s.c | 20
arch/powerpc/perf/isa207-common.c | 4
arch/powerpc/platforms/pseries/iommu.c | 139 ++-
arch/riscv/include/asm/cpufeature.h | 3
arch/riscv/include/asm/page.h | 12
arch/riscv/include/asm/pgtable.h | 2
arch/riscv/kernel/Makefile | 4
arch/riscv/kernel/cpufeature.c | 60 -
arch/riscv/mm/tlbflush.c | 37
arch/s390/hypfs/hypfs_diag_fs.c | 2
arch/s390/include/asm/tlb.h | 2
arch/um/kernel/mem.c | 1
arch/x86/Kconfig | 3
arch/x86/boot/boot.h | 4
arch/x86/boot/genimage.sh | 5
arch/x86/entry/entry.S | 2
arch/x86/entry/vdso/extable.h | 2
arch/x86/events/amd/ibs.c | 20
arch/x86/events/intel/ds.c | 9
arch/x86/include/asm/alternative.h | 6
arch/x86/include/asm/asm.h | 10
arch/x86/include/asm/boot.h | 2
arch/x86/include/asm/bug.h | 5
arch/x86/include/asm/cfi.h | 11
arch/x86/include/asm/cpufeature.h | 4
arch/x86/include/asm/cpumask.h | 4
arch/x86/include/asm/current.h | 4
arch/x86/include/asm/desc_defs.h | 4
arch/x86/include/asm/dwarf2.h | 2
arch/x86/include/asm/fixmap.h | 4
arch/x86/include/asm/frame.h | 10
arch/x86/include/asm/fred.h | 4
arch/x86/include/asm/fsgsbase.h | 4
arch/x86/include/asm/ftrace.h | 8
arch/x86/include/asm/hw_irq.h | 4
arch/x86/include/asm/ibt.h | 16
arch/x86/include/asm/idtentry.h | 6
arch/x86/include/asm/inst.h | 2
arch/x86/include/asm/intel-family.h | 1
arch/x86/include/asm/irqflags.h | 10
arch/x86/include/asm/jump_label.h | 4
arch/x86/include/asm/kasan.h | 2
arch/x86/include/asm/kexec.h | 4
arch/x86/include/asm/linkage.h | 6
arch/x86/include/asm/mem_encrypt.h | 4
arch/x86/include/asm/msr.h | 4
arch/x86/include/asm/nmi.h | 2
arch/x86/include/asm/nops.h | 2
arch/x86/include/asm/nospec-branch.h | 6
arch/x86/include/asm/orc_types.h | 4
arch/x86/include/asm/page.h | 4
arch/x86/include/asm/page_32.h | 4
arch/x86/include/asm/page_32_types.h | 4
arch/x86/include/asm/page_64.h | 4
arch/x86/include/asm/page_64_types.h | 2
arch/x86/include/asm/page_types.h | 4
arch/x86/include/asm/paravirt.h | 14
arch/x86/include/asm/paravirt_types.h | 4
arch/x86/include/asm/percpu.h | 32
arch/x86/include/asm/perf_event.h | 1
arch/x86/include/asm/pgtable-2level_types.h | 4
arch/x86/include/asm/pgtable-3level_types.h | 4
arch/x86/include/asm/pgtable-invert.h | 4
arch/x86/include/asm/pgtable.h | 12
arch/x86/include/asm/pgtable_32.h | 4
arch/x86/include/asm/pgtable_32_areas.h | 2
arch/x86/include/asm/pgtable_64.h | 6
arch/x86/include/asm/pgtable_64_types.h | 4
arch/x86/include/asm/pgtable_types.h | 10
arch/x86/include/asm/prom.h | 4
arch/x86/include/asm/pti.h | 4
arch/x86/include/asm/ptrace.h | 4
arch/x86/include/asm/purgatory.h | 4
arch/x86/include/asm/pvclock-abi.h | 4
arch/x86/include/asm/realmode.h | 4
arch/x86/include/asm/segment.h | 8
arch/x86/include/asm/setup.h | 6
arch/x86/include/asm/setup_data.h | 4
arch/x86/include/asm/sev-common.h | 2
arch/x86/include/asm/shared/tdx.h | 4
arch/x86/include/asm/shstk.h | 4
arch/x86/include/asm/signal.h | 8
arch/x86/include/asm/smap.h | 6
arch/x86/include/asm/smp.h | 4
arch/x86/include/asm/tdx.h | 4
arch/x86/include/asm/thread_info.h | 12
arch/x86/include/asm/unwind_hints.h | 4
arch/x86/include/asm/vdso/getrandom.h | 4
arch/x86/include/asm/vdso/gettimeofday.h | 4
arch/x86/include/asm/vdso/processor.h | 4
arch/x86/include/asm/vdso/vsyscall.h | 4
arch/x86/include/asm/xen/interface.h | 10
arch/x86/include/asm/xen/interface_32.h | 4
arch/x86/include/asm/xen/interface_64.h | 4
arch/x86/include/uapi/asm/bootparam.h | 4
arch/x86/include/uapi/asm/e820.h | 4
arch/x86/include/uapi/asm/ldt.h | 4
arch/x86/include/uapi/asm/msr.h | 4
arch/x86/include/uapi/asm/ptrace-abi.h | 6
arch/x86/include/uapi/asm/ptrace.h | 4
arch/x86/include/uapi/asm/setup_data.h | 4
arch/x86/include/uapi/asm/signal.h | 8
arch/x86/kernel/alternative.c | 30
arch/x86/kernel/amd_node.c | 41
arch/x86/kernel/cfi.c | 22
arch/x86/kernel/cpu/bugs.c | 10
arch/x86/kernel/cpu/microcode/intel.c | 2
arch/x86/kernel/nmi.c | 42
arch/x86/kernel/paravirt.c | 17
arch/x86/kernel/reboot.c | 10
arch/x86/kernel/smpboot.c | 9
arch/x86/kernel/traps.c | 82 +
arch/x86/math-emu/control_w.h | 2
arch/x86/math-emu/exception.h | 6
arch/x86/math-emu/fpu_emu.h | 6
arch/x86/math-emu/status_w.h | 6
arch/x86/mm/init.c | 9
arch/x86/mm/init_64.c | 15
arch/x86/mm/kaslr.c | 10
arch/x86/mm/pgtable.c | 27
arch/x86/power/cpu.c | 14
arch/x86/realmode/rm/realmode.h | 4
arch/x86/realmode/rm/wakeup.h | 2
arch/x86/um/os-Linux/mcontext.c | 3
block/badblocks.c | 5
block/bdev.c | 50 -
block/blk-cgroup.c | 22
block/blk-settings.c | 5
block/blk-sysfs.c | 102 +-
block/blk-throttle.c | 15
block/blk-zoned.c | 5
block/blk.h | 3
block/bounce.c | 2
block/fops.c | 16
block/ioctl.c | 6
crypto/ahash.c | 4
crypto/algif_hash.c | 4
crypto/lzo-rle.c | 2
crypto/lzo.c | 2
crypto/skcipher.c | 1
drivers/accel/amdxdna/aie2_ctx.c | 29
drivers/accel/amdxdna/amdxdna_ctx.c | 2
drivers/accel/amdxdna/amdxdna_ctx.h | 3
drivers/accel/amdxdna/amdxdna_mailbox.c | 17
drivers/accel/qaic/qaic_drv.c | 2
drivers/acpi/Kconfig | 2
drivers/acpi/acpi_pnp.c | 2
drivers/acpi/hed.c | 7
drivers/auxdisplay/charlcd.c | 5
drivers/auxdisplay/charlcd.h | 5
drivers/auxdisplay/hd44780.c | 2
drivers/auxdisplay/lcd2s.c | 2
drivers/auxdisplay/panel.c | 2
drivers/base/faux.c | 15
drivers/base/power/main.c | 7
drivers/block/loop.c | 25
drivers/block/null_blk/main.c | 86 +
drivers/block/ublk_drv.c | 53 -
drivers/bluetooth/btmtksdio.c | 15
drivers/bluetooth/btusb.c | 98 --
drivers/char/tpm/tpm2-sessions.c | 2
drivers/clk/clk-s2mps11.c | 3
drivers/clk/imx/clk-imx8mp.c | 151 +++
drivers/clk/qcom/Kconfig | 2
drivers/clk/qcom/camcc-sm8250.c | 56 -
drivers/clk/qcom/clk-alpha-pll.c | 52 -
drivers/clk/qcom/lpassaudiocc-sc7280.c | 23
drivers/clk/renesas/rzg2l-cpg.c | 102 +-
drivers/clk/sunxi-ng/ccu-sun20i-d1.c | 44
drivers/clk/sunxi-ng/ccu-sun50i-h616.c | 36
drivers/clk/sunxi-ng/ccu_mp.h | 22
drivers/clocksource/mips-gic-timer.c | 6
drivers/clocksource/timer-riscv.c | 6
drivers/cpufreq/amd-pstate.c | 1
drivers/cpufreq/cpufreq-dt-platdev.c | 1
drivers/cpufreq/tegra186-cpufreq.c | 7
drivers/cpuidle/governors/menu.c | 13
drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c | 7
drivers/crypto/mxs-dcp.c | 8
drivers/dma/fsl-edma-main.c | 2
drivers/dma/idxd/cdev.c | 9
drivers/dma/ti/k3-udma-glue.c | 15
drivers/dpll/dpll_core.c | 5
drivers/edac/ie31200_edac.c | 28
drivers/firmware/arm_ffa/bus.c | 1
drivers/firmware/arm_ffa/driver.c | 12
drivers/firmware/arm_scmi/bus.c | 19
drivers/firmware/xilinx/zynqmp.c | 6
drivers/fpga/altera-cvp.c | 2
drivers/gpio/gpiolib.c | 3
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 13
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 10
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 102 --
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 18
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 143 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 31
drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 30
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 14
drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 54 -
drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 3
drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 16
drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 4
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 38
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 7
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3
drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 6
drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c | 30
drivers/gpu/drm/amd/amdgpu/amdgpu_sync.h | 4
drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c | 42
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 17
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 2
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 41
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 1
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 14
drivers/gpu/drm/amd/amdgpu/gfx_v10_0_cleaner_shader.h | 35
drivers/gpu/drm/amd/amdgpu/gfx_v10_1_10_cleaner_shader.asm | 126 ++
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 47 -
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 48 -
drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c | 10
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 1
drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2
drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.h | 1
drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c | 1
drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2
drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c | 25
drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c | 27
drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c | 31
drivers/gpu/drm/amd/amdgpu/nv.c | 16
drivers/gpu/drm/amd/amdgpu/soc15.c | 8
drivers/gpu/drm/amd/amdgpu/soc21.c | 10
drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 14
drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.h | 9
drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 452 +++++-----
drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c | 48 -
drivers/gpu/drm/amd/amdkfd/cik_event_interrupt.c | 18
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 25
drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 14
drivers/gpu/drm/amd/amdkfd/kfd_device.c | 2
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 124 --
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c | 69 +
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_v10.c | 41
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_v11.c | 41
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_v12.c | 41
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_v9.c | 38
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_vi.c | 71 -
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 43
drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c | 2
drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c | 2
drivers/gpu/drm/amd/amdkfd/kfd_packet_manager_v9.c | 4
drivers/gpu/drm/amd/amdkfd/kfd_packet_manager_vi.c | 3
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 11
drivers/gpu/drm/amd/amdkfd/kfd_process.c | 137 +--
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 10
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 21
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 23
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 41
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 6
drivers/gpu/drm/amd/display/dc/basics/dc_common.c | 3
drivers/gpu/drm/amd/display/dc/bios/command_table2.c | 9
drivers/gpu/drm/amd/display/dc/bios/command_table_helper2.c | 3
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 22
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c | 15
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 13
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c | 2
drivers/gpu/drm/amd/display/dc/core/dc.c | 22
drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 21
drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 71 +
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 50 -
drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 12
drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 5
drivers/gpu/drm/amd/display/dc/dc_types.h | 7
drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c | 3
drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 4
drivers/gpu/drm/amd/display/dc/dio/dcn10/dcn10_stream_encoder.c | 3
drivers/gpu/drm/amd/display/dc/dio/dcn401/dcn401_dio_stream_encoder.c | 3
drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 6
drivers/gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c | 1
drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_utils.c | 1
drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c | 22
drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_types.h | 1
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4.c | 30
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 33
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h | 5
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c | 21
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_top/dml2_top_soc15.c | 8
drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h | 1
drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 11
drivers/gpu/drm/amd/display/dc/hpo/dcn31/dcn31_hpo_dp_stream_encoder.c | 3
drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 10
drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 55 -
drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 22
drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 4
drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 3
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 92 --
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.h | 3
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_init.c | 2
drivers/gpu/drm/amd/display/dc/hwss/hw_sequencer.h | 6
drivers/gpu/drm/amd/display/dc/inc/core_types.h | 2
drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h | 1
drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h | 6
drivers/gpu/drm/amd/display/dc/inc/resource.h | 2
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c | 42
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c | 8
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c | 5
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_8b_10b.c | 7
drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c | 25
drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c | 42
drivers/gpu/drm/amd/display/dc/spl/dc_spl.c | 87 +
drivers/gpu/drm/amd/display/dc/spl/dc_spl_types.h | 12
drivers/gpu/drm/amd/display/dc/spl/spl_fixpt31_32.c | 2
drivers/gpu/drm/amd/display/dc/spl/spl_fixpt31_32.h | 4
drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 6
drivers/gpu/drm/amd/display/dmub/src/dmub_dcn31.c | 17
drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c | 4
drivers/gpu/drm/amd/display/dmub/src/dmub_dcn401.c | 47 -
drivers/gpu/drm/amd/display/dmub/src/dmub_dcn401.h | 3
drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c | 4
drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_offset.h | 32
drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_sh_mask.h | 48 +
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 1
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 5
drivers/gpu/drm/ast/ast_main.c | 30
drivers/gpu/drm/ast/ast_mode.c | 10
drivers/gpu/drm/bridge/adv7511/adv7511_audio.c | 2
drivers/gpu/drm/drm_atomic_helper.c | 28
drivers/gpu/drm/drm_buddy.c | 5
drivers/gpu/drm/drm_edid.c | 1
drivers/gpu/drm/drm_gem.c | 4
drivers/gpu/drm/i915/display/intel_dp_mst.c | 3
drivers/gpu/drm/mediatek/mtk_dpi.c | 5
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 32
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h | 2
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 7
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 2
drivers/gpu/drm/panel/panel-edp.c | 1
drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 40
drivers/gpu/drm/ttm/ttm_bo.c | 3
drivers/gpu/drm/v3d/v3d_drv.c | 25
drivers/gpu/drm/virtio/virtgpu_drv.c | 9
drivers/gpu/drm/xe/display/xe_display.c | 3
drivers/gpu/drm/xe/xe_bo.c | 22
drivers/gpu/drm/xe/xe_debugfs.c | 3
drivers/gpu/drm/xe/xe_device.c | 10
drivers/gpu/drm/xe/xe_drm_client.c | 8
drivers/gpu/drm/xe/xe_gen_wa_oob.c | 6
drivers/gpu/drm/xe/xe_gt.c | 3
drivers/gpu/drm/xe/xe_gt_idle.c | 23
drivers/gpu/drm/xe/xe_gt_idle.h | 1
drivers/gpu/drm/xe/xe_gt_idle_types.h | 3
drivers/gpu/drm/xe/xe_gt_sriov_pf.c | 49 +
drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c | 66 +
drivers/gpu/drm/xe/xe_gt_sriov_pf_config.h | 1
drivers/gpu/drm/xe/xe_gt_sriov_pf_types.h | 10
drivers/gpu/drm/xe/xe_gt_sriov_vf.c | 12
drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 22
drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h | 2
drivers/gpu/drm/xe/xe_guc_log.c | 8
drivers/gpu/drm/xe/xe_guc_pc.c | 22
drivers/gpu/drm/xe/xe_guc_relay.c | 2
drivers/gpu/drm/xe/xe_mmio.c | 10
drivers/gpu/drm/xe/xe_oa.c | 1
drivers/gpu/drm/xe/xe_pci.c | 37
drivers/gpu/drm/xe/xe_pci_sriov.c | 51 +
drivers/gpu/drm/xe/xe_pci_types.h | 1
drivers/gpu/drm/xe/xe_pt.c | 14
drivers/gpu/drm/xe/xe_pt.h | 3
drivers/gpu/drm/xe/xe_sa.c | 3
drivers/gpu/drm/xe/xe_tile.c | 12
drivers/gpu/drm/xe/xe_tile.h | 1
drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c | 17
drivers/gpu/drm/xe/xe_ttm_stolen_mgr.h | 2
drivers/gpu/drm/xe/xe_vm.c | 32
drivers/hid/Kconfig | 1
drivers/hid/usbhid/usbkbd.c | 2
drivers/hwmon/acpi_power_meter.c | 8
drivers/hwmon/dell-smm-hwmon.c | 5
drivers/hwmon/gpio-fan.c | 16
drivers/hwmon/xgene-hwmon.c | 2
drivers/hwtracing/coresight/coresight-core.c | 2
drivers/hwtracing/coresight/coresight-etb10.c | 26
drivers/hwtracing/coresight/coresight-trace-id.c | 22
drivers/hwtracing/intel_th/Kconfig | 1
drivers/hwtracing/intel_th/msu.c | 31
drivers/i2c/busses/i2c-amd-asf-plat.c | 2
drivers/i2c/busses/i2c-pxa.c | 5
drivers/i2c/busses/i2c-qcom-geni.c | 6
drivers/i2c/busses/i2c-qup.c | 36
drivers/i3c/master/svc-i3c-master.c | 4
drivers/iio/accel/fxls8962af-core.c | 7
drivers/iio/adc/ad7606.c | 10
drivers/iio/adc/ad7944.c | 16
drivers/iio/adc/qcom-spmi-iadc.c | 4
drivers/iio/dac/ad3552r-hs.c | 29
drivers/iio/dac/ad3552r-hs.h | 8
drivers/iio/dac/adi-axi-dac.c | 22
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 7
drivers/infiniband/core/umem.c | 36
drivers/infiniband/core/uverbs_cmd.c | 144 +--
drivers/infiniband/core/verbs.c | 11
drivers/input/joystick/xpad.c | 3
drivers/iommu/amd/io_pgtable_v2.c | 2
drivers/iommu/dma-iommu.c | 28
drivers/iommu/intel/iommu.c | 37
drivers/iommu/intel/svm.c | 43
drivers/iommu/iommu-priv.h | 2
drivers/iommu/iommu.c | 2
drivers/iommu/iommufd/device.c | 34
drivers/iommu/iommufd/hw_pagetable.c | 3
drivers/iommu/of_iommu.c | 6
drivers/irqchip/irq-riscv-aplic-direct.c | 24
drivers/irqchip/irq-riscv-imsic-early.c | 8
drivers/irqchip/irq-riscv-imsic-platform.c | 16
drivers/irqchip/irq-riscv-imsic-state.c | 96 +-
drivers/irqchip/irq-riscv-imsic-state.h | 7
drivers/leds/Kconfig | 1
drivers/leds/leds-st1202.c | 4
drivers/leds/rgb/leds-pwm-multicolor.c | 5
drivers/leds/trigger/ledtrig-netdev.c | 16
drivers/mailbox/mailbox.c | 7
drivers/mailbox/pcc.c | 8
drivers/md/dm-cache-target.c | 24
drivers/md/dm-table.c | 4
drivers/md/dm-vdo/indexer/index-layout.c | 5
drivers/md/dm-vdo/vdo.c | 11
drivers/md/dm.c | 8
drivers/media/cec/core/cec-pin.c | 11
drivers/media/i2c/adv7180.c | 34
drivers/media/i2c/imx219.c | 2
drivers/media/i2c/imx335.c | 21
drivers/media/i2c/ov2740.c | 4
drivers/media/i2c/tc358746.c | 19
drivers/media/platform/qcom/camss/camss-csid.c | 60 -
drivers/media/platform/qcom/camss/camss-vfe.c | 4
drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-core.c | 3
drivers/media/platform/st/stm32/stm32-csi.c | 36
drivers/media/test-drivers/vivid/vivid-kthread-cap.c | 11
drivers/media/test-drivers/vivid/vivid-kthread-out.c | 11
drivers/media/test-drivers/vivid/vivid-kthread-touch.c | 11
drivers/media/test-drivers/vivid/vivid-sdr-cap.c | 11
drivers/media/usb/cx231xx/cx231xx-417.c | 2
drivers/media/usb/uvc/uvc_ctrl.c | 77 -
drivers/media/usb/uvc/uvc_v4l2.c | 6
drivers/media/v4l2-core/v4l2-subdev.c | 2
drivers/message/fusion/mptscsih.c | 4
drivers/mfd/axp20x.c | 1
drivers/mfd/syscon.c | 9
drivers/mfd/tps65219.c | 7
drivers/misc/eeprom/ee1004.c | 4
drivers/misc/mei/vsc-tp.c | 14
drivers/misc/pci_endpoint_test.c | 6
drivers/mmc/host/dw_mmc-exynos.c | 41
drivers/mmc/host/sdhci-pci-core.c | 6
drivers/mmc/host/sdhci.c | 9
drivers/mmc/host/sdhci_am654.c | 35
drivers/net/bonding/bond_main.c | 2
drivers/net/can/c_can/c_can_platform.c | 2
drivers/net/can/kvaser_pciefd.c | 101 +-
drivers/net/can/slcan/slcan-core.c | 26
drivers/net/ethernet/apm/xgene-v2/main.c | 4
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13
drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1
drivers/net/ethernet/freescale/fec_main.c | 52 -
drivers/net/ethernet/intel/ice/ice_ethtool.c | 3
drivers/net/ethernet/intel/ice/ice_irq.c | 25
drivers/net/ethernet/intel/ice/ice_lag.c | 6
drivers/net/ethernet/intel/ice/ice_lib.c | 2
drivers/net/ethernet/intel/ice/ice_main.c | 6
drivers/net/ethernet/intel/ice/ice_virtchnl.c | 1
drivers/net/ethernet/intel/idpf/idpf.h | 2
drivers/net/ethernet/intel/idpf/idpf_lib.c | 10
drivers/net/ethernet/intel/idpf/idpf_txrx.c | 18
drivers/net/ethernet/intel/igc/igc_xdp.c | 19
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 4
drivers/net/ethernet/intel/ixgbe/ixgbe_type_e610.h | 3
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 14
drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 2
drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 24
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 11
drivers/net/ethernet/marvell/octeontx2/nic/Makefile | 2
drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 7
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 114 +-
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 10
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 34
drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 124 +-
drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.h | 7
drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 21
drivers/net/ethernet/marvell/octeontx2/nic/otx2_xsk.c | 182 ++++
drivers/net/ethernet/marvell/octeontx2/nic/otx2_xsk.h | 21
drivers/net/ethernet/marvell/octeontx2/nic/qos_sq.c | 2
drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 22
drivers/net/ethernet/mellanox/mlx4/alloc.c | 6
drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2
drivers/net/ethernet/mellanox/mlx5/core/en.h | 3
drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 16
drivers/net/ethernet/mellanox/mlx5/core/en/params.h | 1
drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1
drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 49 -
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 28
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 40
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 5
drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c | 3
drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 13
drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.h | 5
drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c | 2
drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c | 13
drivers/net/ethernet/mellanox/mlx5/core/events.c | 11
drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.c | 6
drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.h | 2
drivers/net/ethernet/mellanox/mlx5/core/health.c | 1
drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c | 3
drivers/net/ethernet/meta/fbnic/fbnic_fw.c | 16
drivers/net/ethernet/meta/fbnic/fbnic_fw.h | 8
drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 2
drivers/net/ethernet/microchip/lan743x_main.c | 19
drivers/net/ethernet/microsoft/mana/gdma_main.c | 2
drivers/net/ethernet/realtek/r8169_main.c | 32
drivers/net/ethernet/stmicro/stmmac/common.h | 4
drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 21
drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2
drivers/net/ethernet/stmicro/stmmac/stmmac.h | 7
drivers/net/ethernet/tehuti/tn40.c | 9
drivers/net/ethernet/tehuti/tn40.h | 33
drivers/net/ethernet/tehuti/tn40_mdio.c | 82 +
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 4
drivers/net/ethernet/ti/cpsw_new.c | 1
drivers/net/ethernet/ti/icssg/icssg_common.c | 2
drivers/net/ieee802154/ca8210.c | 9
drivers/net/mctp/mctp-i2c.c | 2
drivers/net/netdevsim/netdev.c | 31
drivers/net/netdevsim/netdevsim.h | 1
drivers/net/phy/nxp-c45-tja11xx.c | 54 +
drivers/net/phy/phylink.c | 2
drivers/net/usb/r8152.c | 1
drivers/net/vmxnet3/vmxnet3_drv.c | 5
drivers/net/vxlan/vxlan_core.c | 36
drivers/net/wireless/ath/ath11k/dp.h | 6
drivers/net/wireless/ath/ath11k/dp_rx.c | 117 +-
drivers/net/wireless/ath/ath12k/core.c | 45
drivers/net/wireless/ath/ath12k/core.h | 4
drivers/net/wireless/ath/ath12k/dp_mon.c | 19
drivers/net/wireless/ath/ath12k/dp_rx.c | 22
drivers/net/wireless/ath/ath12k/dp_rx.h | 5
drivers/net/wireless/ath/ath12k/dp_tx.c | 145 +++
drivers/net/wireless/ath/ath12k/hal_desc.h | 2
drivers/net/wireless/ath/ath12k/hal_rx.h | 8
drivers/net/wireless/ath/ath12k/hal_tx.h | 10
drivers/net/wireless/ath/ath12k/mac.c | 102 +-
drivers/net/wireless/ath/ath12k/mac.h | 5
drivers/net/wireless/ath/ath12k/pci.c | 13
drivers/net/wireless/ath/ath12k/rx_desc.h | 5
drivers/net/wireless/ath/ath12k/wmi.c | 4
drivers/net/wireless/ath/ath9k/init.c | 4
drivers/net/wireless/intel/iwlwifi/cfg/dr.c | 2
drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 4
drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 8
drivers/net/wireless/intel/iwlwifi/fw/uefi.h | 4
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 10
drivers/net/wireless/intel/iwlwifi/iwl-trans.c | 8
drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 4
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 15
drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 3
drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2
drivers/net/wireless/marvell/mwifiex/11n.c | 6
drivers/net/wireless/mediatek/mt76/channel.c | 3
drivers/net/wireless/mediatek/mt76/mt76.h | 3
drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h | 3
drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2
drivers/net/wireless/mediatek/mt76/mt76x0/pci.c | 3
drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 3
drivers/net/wireless/mediatek/mt76/mt76x2/pci.c | 3
drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 3
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 76 +
drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h | 3
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 44
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 30
drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 3
drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 2
drivers/net/wireless/mediatek/mt76/scan.c | 21
drivers/net/wireless/mediatek/mt76/tx.c | 3
drivers/net/wireless/realtek/rtl8xxxu/core.c | 17
drivers/net/wireless/realtek/rtw88/fw.c | 15
drivers/net/wireless/realtek/rtw88/fw.h | 1
drivers/net/wireless/realtek/rtw88/mac.c | 7
drivers/net/wireless/realtek/rtw88/main.c | 54 -
drivers/net/wireless/realtek/rtw88/main.h | 1
drivers/net/wireless/realtek/rtw88/reg.h | 3
drivers/net/wireless/realtek/rtw88/rtw8822b.c | 14
drivers/net/wireless/realtek/rtw88/util.c | 3
drivers/net/wireless/realtek/rtw89/coex.c | 107 +-
drivers/net/wireless/realtek/rtw89/coex.h | 2
drivers/net/wireless/realtek/rtw89/core.c | 67 +
drivers/net/wireless/realtek/rtw89/core.h | 6
drivers/net/wireless/realtek/rtw89/fw.c | 101 ++
drivers/net/wireless/realtek/rtw89/fw.h | 12
drivers/net/wireless/realtek/rtw89/mac.c | 55 +
drivers/net/wireless/realtek/rtw89/mac.h | 3
drivers/net/wireless/realtek/rtw89/mac80211.c | 1
drivers/net/wireless/realtek/rtw89/reg.h | 4
drivers/net/wireless/realtek/rtw89/regd.c | 2
drivers/net/wireless/realtek/rtw89/rtw8851b.c | 8
drivers/net/wireless/realtek/rtw89/rtw8852a.c | 8
drivers/net/wireless/realtek/rtw89/rtw8852b.c | 8
drivers/net/wireless/realtek/rtw89/rtw8852bt.c | 8
drivers/net/wireless/realtek/rtw89/rtw8852c.c | 8
drivers/net/wireless/realtek/rtw89/rtw8922a.c | 2
drivers/net/wireless/realtek/rtw89/ser.c | 4
drivers/net/wireless/virtual/mac80211_hwsim.c | 14
drivers/nvdimm/label.c | 3
drivers/nvme/host/pci.c | 6
drivers/nvme/target/pci-epf.c | 66 -
drivers/nvme/target/tcp.c | 3
drivers/nvmem/core.c | 40
drivers/nvmem/qfprom.c | 26
drivers/nvmem/rockchip-otp.c | 17
drivers/pci/Kconfig | 6
drivers/pci/ats.c | 33
drivers/pci/controller/dwc/pcie-designware-ep.c | 2
drivers/pci/controller/dwc/pcie-designware-host.c | 2
drivers/pci/controller/pcie-brcmstb.c | 5
drivers/pci/controller/pcie-xilinx-cpm.c | 3
drivers/pci/controller/vmd.c | 20
drivers/pci/endpoint/functions/pci-epf-mhi.c | 2
drivers/pci/endpoint/functions/pci-epf-test.c | 2
drivers/pci/setup-bus.c | 6
drivers/perf/arm_pmuv3.c | 4
drivers/phy/phy-core.c | 7
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 95 +-
drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 4
drivers/phy/rockchip/phy-rockchip-usbdp.c | 87 +
drivers/phy/samsung/phy-exynos5-usbdrd.c | 7
drivers/pinctrl/bcm/pinctrl-bcm281xx.c | 44
drivers/pinctrl/devicetree.c | 10
drivers/pinctrl/meson/pinctrl-meson.c | 2
drivers/pinctrl/qcom/Kconfig.msm | 4
drivers/pinctrl/qcom/pinctrl-msm.c | 23
drivers/pinctrl/qcom/pinctrl-msm8917.c | 8
drivers/pinctrl/renesas/pinctrl-rzg2l.c | 19
drivers/pinctrl/sophgo/pinctrl-cv18xx.c | 33
drivers/pinctrl/tegra/pinctrl-tegra.c | 59 +
drivers/pinctrl/tegra/pinctrl-tegra.h | 6
drivers/platform/x86/asus-wmi.c | 11
drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c | 2
drivers/platform/x86/ideapad-laptop.c | 16
drivers/platform/x86/intel/hid.c | 21
drivers/platform/x86/think-lmi.c | 26
drivers/platform/x86/think-lmi.h | 1
drivers/pmdomain/core.c | 2
drivers/pmdomain/imx/gpcv2.c | 2
drivers/pmdomain/renesas/rcar-gen4-sysc.c | 5
drivers/pmdomain/renesas/rcar-sysc.c | 5
drivers/power/supply/axp20x_battery.c | 21
drivers/pps/generators/pps_gen-dummy.c | 2
drivers/pps/generators/pps_gen.c | 14
drivers/pps/generators/sysfs.c | 6
drivers/ptp/ptp_ocp.c | 24
drivers/regulator/ad5398.c | 12
drivers/remoteproc/qcom_wcnss.c | 34
drivers/rtc/rtc-ds1307.c | 4
drivers/rtc/rtc-rv3032.c | 2
drivers/s390/crypto/vfio_ap_ops.c | 72 +
drivers/scsi/aacraid/aachba.c | 4
drivers/scsi/arm/acornscsi.c | 2
drivers/scsi/ips.c | 8
drivers/scsi/lpfc/lpfc_els.c | 10
drivers/scsi/lpfc/lpfc_hbadisc.c | 29
drivers/scsi/lpfc/lpfc_init.c | 2
drivers/scsi/megaraid.c | 10
drivers/scsi/megaraid/megaraid_mbox.c | 10
drivers/scsi/mpi3mr/mpi3mr_fw.c | 8
drivers/scsi/mpt3sas/mpt3sas_ctl.c | 12
drivers/scsi/scsi_debug.c | 55 +
drivers/scsi/scsi_sysctl.c | 4
drivers/scsi/st.c | 29
drivers/scsi/st.h | 2
drivers/soc/apple/rtkit-internal.h | 1
drivers/soc/apple/rtkit.c | 58 -
drivers/soc/mediatek/mtk-mutex.c | 6
drivers/soc/samsung/exynos-asv.c | 1
drivers/soc/samsung/exynos-chipid.c | 1
drivers/soc/samsung/exynos-pmu.c | 1
drivers/soc/samsung/exynos-usi.c | 1
drivers/soc/samsung/exynos3250-pmu.c | 1
drivers/soc/samsung/exynos5250-pmu.c | 1
drivers/soc/samsung/exynos5420-pmu.c | 1
drivers/soc/ti/k3-socinfo.c | 13
drivers/soundwire/amd_manager.c | 2
drivers/soundwire/bus.c | 9
drivers/soundwire/cadence_master.c | 22
drivers/spi/spi-fsl-dspi.c | 46 -
drivers/spi/spi-mux.c | 4
drivers/spi/spi-rockchip.c | 2
drivers/spi/spi-zynqmp-gqspi.c | 20
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 69 -
drivers/target/iscsi/iscsi_target.c | 2
drivers/target/target_core_device.c | 8
drivers/target/target_core_pr.c | 6
drivers/target/target_core_spc.c | 34
drivers/thermal/intel/x86_pkg_temp_thermal.c | 1
drivers/thermal/mediatek/lvts_thermal.c | 3
drivers/thermal/qoriq_thermal.c | 13
drivers/thunderbolt/retimer.c | 8
drivers/tty/serial/8250/8250_port.c | 2
drivers/tty/serial/atmel_serial.c | 2
drivers/tty/serial/imx.c | 2
drivers/tty/serial/serial_mctrl_gpio.c | 34
drivers/tty/serial/serial_mctrl_gpio.h | 17
drivers/tty/serial/sh-sci.c | 98 ++
drivers/tty/serial/stm32-usart.c | 2
drivers/ufs/core/ufshcd.c | 29
drivers/usb/gadget/function/f_mass_storage.c | 4
drivers/usb/host/xhci-mem.c | 34
drivers/usb/host/xhci-ring.c | 12
drivers/usb/host/xhci.h | 8
drivers/usb/storage/debug.c | 4
drivers/vdpa/mlx5/net/mlx5_vnet.c | 3
drivers/vfio/pci/vfio_pci_config.c | 3
drivers/vfio/pci/vfio_pci_core.c | 10
drivers/vfio/pci/vfio_pci_intrs.c | 2
drivers/vhost/scsi.c | 23
drivers/video/fbdev/core/bitblit.c | 5
drivers/video/fbdev/core/fbcon.c | 10
drivers/video/fbdev/core/fbcon.h | 38
drivers/video/fbdev/core/fbcon_ccw.c | 5
drivers/video/fbdev/core/fbcon_cw.c | 5
drivers/video/fbdev/core/fbcon_ud.c | 5
drivers/video/fbdev/core/tileblit.c | 45
drivers/video/fbdev/fsl-diu-fb.c | 1
drivers/virtio/virtio.c | 35
drivers/virtio/virtio_ring.c | 2
drivers/watchdog/aspeed_wdt.c | 81 +
drivers/watchdog/s3c2410_wdt.c | 10
drivers/xen/pci.c | 32
drivers/xen/platform-pci.c | 4
drivers/xen/xenbus/xenbus_probe.c | 14
fs/btrfs/block-group.c | 18
fs/btrfs/compression.c | 2
fs/btrfs/discard.c | 34
fs/btrfs/disk-io.c | 28
fs/btrfs/extent_io.c | 7
fs/btrfs/extent_io.h | 2
fs/btrfs/scrub.c | 4
fs/btrfs/send.c | 6
fs/btrfs/tree-checker.c | 2
fs/buffer.c | 61 -
fs/dlm/lowcomms.c | 4
fs/erofs/internal.h | 4
fs/erofs/super.c | 46 -
fs/erofs/zdata.c | 4
fs/exfat/inode.c | 159 +--
fs/ext4/balloc.c | 4
fs/ext4/ext4.h | 5
fs/ext4/extents.c | 19
fs/ext4/inode.c | 81 +
fs/ext4/mballoc.c | 3
fs/ext4/page-io.c | 16
fs/ext4/super.c | 19
fs/f2fs/sysfs.c | 74 +
fs/fuse/dir.c | 2
fs/gfs2/glock.c | 11
fs/jbd2/recovery.c | 69 +
fs/jbd2/revoke.c | 23
fs/namespace.c | 6
fs/nfs/delegation.c | 3
fs/nfs/flexfilelayout/flexfilelayout.c | 1
fs/nfs/inode.c | 2
fs/nfs/internal.h | 5
fs/nfs/nfs3proc.c | 2
fs/nfs/nfs4proc.c | 9
fs/nfs/nfs4state.c | 10
fs/nilfs2/the_nilfs.c | 3
fs/ocfs2/journal.c | 2
fs/orangefs/inode.c | 7
fs/pidfs.c | 9
fs/pipe.c | 4
fs/pstore/inode.c | 2
fs/pstore/internal.h | 4
fs/pstore/platform.c | 11
fs/smb/client/cifsacl.c | 21
fs/smb/client/cifspdu.h | 5
fs/smb/client/cifsproto.h | 7
fs/smb/client/cifssmb.c | 95 +-
fs/smb/client/connect.c | 30
fs/smb/client/fs_context.c | 13
fs/smb/client/fs_context.h | 3
fs/smb/client/link.c | 11
fs/smb/client/readdir.c | 7
fs/smb/client/smb1ops.c | 228 ++++-
fs/smb/client/smb2file.c | 11
fs/smb/client/smb2inode.c | 8
fs/smb/client/smb2ops.c | 34
fs/smb/client/smb2pdu.c | 4
fs/smb/client/transport.c | 2
fs/smb/client/xattr.c | 15
fs/smb/common/smb2pdu.h | 3
fs/smb/server/smb2pdu.c | 9
fs/smb/server/vfs.c | 14
include/crypto/hash.h | 3
include/drm/drm_atomic.h | 23
include/drm/drm_gem.h | 13
include/linux/alloc_tag.h | 12
include/linux/blkdev.h | 1
include/linux/bpf-cgroup.h | 1
include/linux/bpf.h | 7
include/linux/buffer_head.h | 8
include/linux/codetag.h | 8
include/linux/coresight.h | 2
include/linux/device.h | 119 --
include/linux/device/devres.h | 129 ++
include/linux/dma-mapping.h | 12
include/linux/dma/k3-udma-glue.h | 3
include/linux/err.h | 3
include/linux/gpio/driver.h | 3
include/linux/highmem.h | 10
include/linux/io.h | 2
include/linux/ipv6.h | 1
include/linux/jbd2.h | 2
include/linux/lzo.h | 8
include/linux/mfd/axp20x.h | 1
include/linux/mlx4/device.h | 2
include/linux/mlx5/eswitch.h | 2
include/linux/mlx5/fs.h | 2
include/linux/mm.h | 2
include/linux/mman.h | 2
include/linux/mroute_base.h | 5
include/linux/msi.h | 33
include/linux/objtool.h | 4
include/linux/page-flags.h | 7
include/linux/pci-ats.h | 3
include/linux/percpu.h | 4
include/linux/perf_event.h | 8
include/linux/pnp.h | 2
include/linux/pps_gen_kernel.h | 4
include/linux/rcupdate.h | 2
include/linux/rcutree.h | 2
include/linux/ring_buffer.h | 3
include/linux/spi/spi.h | 5
include/linux/tcp.h | 2
include/linux/trace.h | 4
include/linux/trace_seq.h | 8
include/linux/usb/r8152.h | 1
include/linux/virtio.h | 3
include/media/v4l2-subdev.h | 4
include/net/cfg80211.h | 4
include/net/dropreason.h | 6
include/net/mac80211.h | 4
include/net/xfrm.h | 1
include/rdma/uverbs_std_types.h | 2
include/scsi/scsi_proto.h | 4
include/sound/hda_codec.h | 1
include/sound/pcm.h | 2
include/sound/soc_sdw_utils.h | 1
include/trace/events/btrfs.h | 2
include/trace/events/scsi.h | 4
include/trace/events/target.h | 4
include/uapi/linux/bpf.h | 1
include/uapi/linux/iommufd.h | 14
include/uapi/linux/nl80211.h | 52 -
include/uapi/linux/snmp.h | 1
include/uapi/linux/taskstats.h | 47 -
include/ufs/ufs_quirks.h | 6
io_uring/fdinfo.c | 4
io_uring/io_uring.c | 96 +-
io_uring/msg_ring.c | 1
io_uring/net.c | 14
kernel/bpf/bpf_iter.c | 13
kernel/bpf/bpf_struct_ops.c | 98 --
kernel/bpf/cgroup.c | 33
kernel/bpf/disasm.c | 4
kernel/bpf/hashtab.c | 2
kernel/bpf/syscall.c | 8
kernel/bpf/verifier.c | 56 -
kernel/cgroup/cgroup.c | 2
kernel/cgroup/rstat.c | 12
kernel/dma/mapping.c | 25
kernel/events/core.c | 100 +-
kernel/events/hw_breakpoint.c | 5
kernel/events/ring_buffer.c | 1
kernel/exit.c | 6
kernel/fork.c | 9
kernel/module/main.c | 1
kernel/padata.c | 3
kernel/printk/printk.c | 14
kernel/rcu/rcu.h | 2
kernel/rcu/tree.c | 15
kernel/rcu/tree_plugin.h | 22
kernel/rseq.c | 60 +
kernel/sched/fair.c | 6
kernel/signal.c | 3
kernel/softirq.c | 18
kernel/time/hrtimer.c | 29
kernel/time/posix-timers.c | 26
kernel/time/timer_list.c | 4
kernel/trace/ring_buffer.c | 31
kernel/trace/trace.c | 41
kernel/trace/trace.h | 25
kernel/vhost_task.c | 2
lib/alloc_tag.c | 87 +
lib/codetag.c | 5
lib/dynamic_queue_limits.c | 2
lib/lzo/Makefile | 2
lib/lzo/lzo1x_compress.c | 102 +-
lib/lzo/lzo1x_compress_safe.c | 18
mm/hugetlb.c | 8
mm/kasan/shadow.c | 92 +-
mm/memcontrol.c | 6
mm/page_alloc.c | 8
mm/vmalloc.c | 13
net/bluetooth/hci_event.c | 3
net/bluetooth/l2cap_core.c | 15
net/bridge/br_mdb.c | 2
net/bridge/br_nf_core.c | 7
net/bridge/br_private.h | 1
net/can/bcm.c | 79 +
net/core/dev.c | 12
net/core/dev.h | 12
net/core/net-sysfs.c | 5
net/core/page_pool.c | 7
net/core/pktgen.c | 13
net/core/rtnetlink.c | 10
net/dsa/tag_ksz.c | 19
net/hsr/hsr_device.c | 2
net/hsr/hsr_forward.c | 4
net/hsr/hsr_framereg.c | 95 ++
net/hsr/hsr_framereg.h | 8
net/hsr/hsr_main.h | 2
net/ipv4/esp4.c | 53 -
net/ipv4/fib_frontend.c | 28
net/ipv4/fib_rules.c | 4
net/ipv4/fib_trie.c | 22
net/ipv4/inet_hashtables.c | 37
net/ipv4/ip_gre.c | 16
net/ipv4/ipmr.c | 12
net/ipv4/proc.c | 1
net/ipv4/syncookies.c | 1
net/ipv4/tcp_input.c | 57 -
net/ipv4/tcp_minisocks.c | 26
net/ipv4/tcp_output.c | 6
net/ipv4/xfrm4_input.c | 18
net/ipv6/esp6.c | 53 -
net/ipv6/fib6_rules.c | 4
net/ipv6/ip6_gre.c | 2
net/ipv6/ip6_output.c | 11
net/ipv6/ip6_tunnel.c | 3
net/ipv6/ip6_vti.c | 3
net/ipv6/ip6mr.c | 12
net/ipv6/sit.c | 8
net/ipv6/xfrm6_input.c | 18
net/llc/af_llc.c | 8
net/mac80211/agg-tx.c | 5
net/mac80211/cfg.c | 14
net/mac80211/driver-ops.h | 3
net/mac80211/drop.h | 21
net/mac80211/ethtool.c | 2
net/mac80211/ieee80211_i.h | 13
net/mac80211/iface.c | 60 -
net/mac80211/main.c | 16
net/mac80211/mlme.c | 150 +++
net/mac80211/rx.c | 194 +---
net/mac80211/status.c | 32
net/mac80211/tx.c | 2
net/mac80211/util.c | 3
net/mptcp/pm_userspace.c | 8
net/netfilter/nf_conntrack_standalone.c | 12
net/sched/sch_hfsc.c | 6
net/smc/smc_pnet.c | 8
net/sunrpc/clnt.c | 3
net/sunrpc/rpcb_clnt.c | 5
net/sunrpc/sched.c | 2
net/tipc/crypto.c | 5
net/wireless/chan.c | 8
net/wireless/mlme.c | 4
net/wireless/nl80211.c | 4
net/wireless/reg.c | 4
net/xdp/xsk.c | 2
net/xfrm/espintcp.c | 4
net/xfrm/xfrm_policy.c | 3
net/xfrm/xfrm_state.c | 6
net/xfrm/xfrm_user.c | 12
samples/bpf/Makefile | 2
scripts/Makefile.extrawarn | 11
scripts/config | 26
scripts/kconfig/confdata.c | 19
scripts/kconfig/merge_config.sh | 4
security/integrity/ima/ima_main.c | 4
security/smack/smackfs.c | 21
sound/core/oss/pcm_oss.c | 3
sound/core/pcm_native.c | 11
sound/core/seq/seq_clientmgr.c | 5
sound/core/seq/seq_memory.c | 1
sound/pci/hda/hda_beep.c | 15
sound/pci/hda/patch_realtek.c | 77 +
sound/soc/codecs/cs42l43-jack.c | 7
sound/soc/codecs/mt6359-accdet.h | 9
sound/soc/codecs/pcm3168a.c | 6
sound/soc/codecs/pcm6240.c | 28
sound/soc/codecs/pcm6240.h | 7
sound/soc/codecs/rt722-sdca-sdw.c | 49 +
sound/soc/codecs/sma1307.c | 27
sound/soc/codecs/tas2764.c | 53 -
sound/soc/codecs/wsa883x.c | 2
sound/soc/codecs/wsa884x.c | 2
sound/soc/fsl/imx-card.c | 2
sound/soc/intel/boards/bytcr_rt5640.c | 13
sound/soc/mediatek/mt8188/mt8188-afe-clk.c | 8
sound/soc/mediatek/mt8188/mt8188-afe-clk.h | 8
sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 4
sound/soc/qcom/sm8250.c | 3
sound/soc/sdw_utils/soc_sdw_bridge_cs35l56.c | 4
sound/soc/sdw_utils/soc_sdw_cs42l43.c | 10
sound/soc/sdw_utils/soc_sdw_cs_amp.c | 24
sound/soc/soc-dai.c | 8
sound/soc/soc-ops.c | 29
sound/soc/sof/intel/hda-bus.c | 2
sound/soc/sof/intel/hda.c | 16
sound/soc/sof/ipc4-control.c | 11
sound/soc/sof/ipc4-pcm.c | 3
sound/soc/sof/topology.c | 18
sound/soc/sunxi/sun4i-codec.c | 56 +
sound/usb/midi.c | 16
tools/arch/x86/include/asm/asm.h | 8
tools/arch/x86/include/asm/nops.h | 2
tools/arch/x86/include/asm/orc_types.h | 4
tools/arch/x86/include/asm/pvclock-abi.h | 4
tools/bpf/bpftool/btf.c | 14
tools/bpf/bpftool/btf_dumper.c | 2
tools/bpf/bpftool/cgroup.c | 2
tools/bpf/bpftool/common.c | 7
tools/bpf/bpftool/jit_disasm.c | 3
tools/bpf/bpftool/map_perf_ring.c | 6
tools/bpf/bpftool/net.c | 4
tools/bpf/bpftool/netlink_dumper.c | 6
tools/bpf/bpftool/prog.c | 12
tools/bpf/bpftool/tracelog.c | 2
tools/bpf/bpftool/xlated_dumper.c | 6
tools/build/Makefile.build | 6
tools/include/uapi/linux/bpf.h | 1
tools/lib/bpf/libbpf.c | 2
tools/net/ynl/lib/ynl.c | 2
tools/net/ynl/pyynl/ynl_gen_c.py | 3
tools/objtool/check.c | 21
tools/power/x86/turbostat/turbostat.8 | 1
tools/power/x86/turbostat/turbostat.c | 13
tools/testing/kunit/kunit_parser.py | 9
tools/testing/kunit/qemu_configs/x86_64.py | 4
tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c | 1
tools/testing/selftests/iommu/iommufd.c | 4
tools/testing/selftests/net/forwarding/bridge_mdb.sh | 2
tools/testing/selftests/net/gro.sh | 3
tools/testing/selftests/net/nl_netdev.py | 18
tools/testing/selftests/pci_endpoint/pci_endpoint_test.c | 2
1081 files changed, 12343 insertions(+), 5740 deletions(-)
Aaradhana Sahu (2):
wifi: ath12k: Enable MLO setup ready and teardown commands for single split-phy device
wifi: ath12k: Fetch regdb.bin file from board-2.bin
Aaron Kling (1):
cpufreq: tegra186: Share policy per cluster
Aditya Kumar Singh (1):
wifi: ath12k: use arvif instead of link_conf in ath12k_mac_set_key()
Adrian Hunter (1):
perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
Ahmad Fatoum (2):
clk: imx8mp: inform CCF of maximum frequency of clocks
pmdomain: imx: gpcv2: use proper helper for property detection
Al Viro (2):
hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure
__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
Alain Volmat (2):
media: stm32: csi: use ARRAY_SIZE to search D-PHY table
media: stm32: csi: add missing pm_runtime_put on error
Aleksander Jan Bajkowski (1):
r8152: add vendor/device ID pair for Dell Alienware AW1022z
Alex Deucher (7):
drm/amdgpu: don't free conflicting apertures for non-display devices
drm/amdgpu: adjust drm_firmware_drivers_only() handling
drm/amdgpu/gfx12: don't read registers in mqd init
drm/amdgpu/gfx11: don't read registers in mqd init
drm/amdgpu/mes11: fix set_hw_resources_1 calculation
drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer()
drm/amdgpu/vcn4.0.5: split code along instances
Alex Sierra (1):
drm/amdkfd: clear F8_MODE for gfx950
Alex Williamson (1):
vfio/pci: Handle INTx IRQ_NOTCONNECTED
Alexander Duyck (1):
eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs
Alexander Gordeev (1):
kasan: avoid sleepable page allocation from atomic context
Alexander Stein (1):
hwmon: (gpio-fan) Add missing mutex locks
Alexander Sverdlin (1):
net: ethernet: ti: cpsw_new: populate netdev of_node
Alexander Wetzel (2):
wifi: mac80211: Drop cooked monitor support
wifi: mac80211: Add counter for all monitor interfaces
Alexandre Belloni (2):
rtc: rv3032: fix EERD location
rtc: ds1307: stop disabling alarms on probe
Alexandre Ghiti (1):
riscv: Call secondary mmu notifier when flushing the tlb
Alexei Lazar (2):
net/mlx5: XDP, Enable TX side XDP multi-buffer support
net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
Alexey Klimov (1):
ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
Alexis Lothoré (1):
serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
Alice Guo (1):
thermal/drivers/qoriq: Power down TMU on system suspend
Alistair Francis (1):
nvmet-tcp: don't restore null sk_state_change
Amber Lin (1):
drm/amdkfd: Correct F8_MODE for gfx950
Amery Hung (2):
bpf: Search and add kfuncs in struct_ops prologue and epilogue
bpf: Make every prog keep a copy of ctx_arg_info
Andre Przywara (1):
clk: sunxi-ng: d1: Add missing divider for MMC mod clocks
Andreas Gruenbacher (1):
gfs2: Check for empty queue in run_queue
Andreas Schwab (1):
powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
Andrei Botila (1):
net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104
Andrew Bresticker (1):
irqchip/riscv-imsic: Start local sync timer on correct CPU
Andrew Davis (1):
soc: ti: k3-socinfo: Do not use syscon helper to build regmap
Andrew Jones (1):
irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base
Andrey Vatoropin (1):
hwmon: (xgene-hwmon) use appropriate type for the latency value
André Draszik (2):
phy: exynos5-usbdrd: fix EDS distribution tuning (gs101)
clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe()
Andy Shevchenko (5):
tracing: Mark binary printing functions with __printf() attribute
auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common"
ieee802154: ca8210: Use proper setters and getters for bitwise types
hrtimers: Replace hrtimer_clock_to_base_table with switch-case
driver core: Split devres APIs to device/devres.h
Andy Yan (2):
phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set
drm/rockchip: vop2: Add uv swap for cluster window
Angelo Dureghello (3):
iio: adc: ad7606: protect register access
iio: dac: ad3552r-hs: use instruction mode for configuration
iio: dac: adi-axi-dac: add bus mode setup
AngeloGioacchino Del Regno (2):
soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables
drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
Anjaneyulu (1):
wifi: cfg80211: allow IR in 20 MHz configurations
Ankur Arora (3):
rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
rcu: handle unstable rdp in rcu_read_unlock_strict()
rcu: fix header guard for rcu_all_qs()
Anthony Krowiak (1):
s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log
Anup Patel (1):
irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector
Aric Cyr (1):
drm/amd/display: Request HW cursor on DCN3.2 with SubVP
Arnd Bergmann (5):
soc: samsung: include linux/array_size.h where needed
net: xgene-v2: remove incorrect ACPI_PTR annotation
EDAC/ie31200: work around false positive build warning
watchdog: aspeed: fix 64-bit division
octeontx2: hide unused label
Artur Weber (1):
pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
Asad Kamal (1):
drm/amd/pm: Skip P2S load for SMU v13.0.12
Assadian, Navid (1):
drm/amd/display: Fix mismatch type comparison
Athira Rajeev (1):
arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src
Austin Zheng (3):
drm/amd/display: Account For OTO Prefetch Bandwidth When Calculating Urgent Bandwidth
drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It
drm/amd/display: Call FP Protect Before Mode Programming/Mode Support
Avraham Stern (1):
wifi: iwlwifi: mvm: fix setting the TK when associated
Avula Sri Charan (1):
wifi: ath12k: Avoid napi_sync() before napi_enable()
Axel Forsman (2):
can: kvaser_pciefd: Continue parsing DMA buf after dropped RX
can: kvaser_pciefd: Fix echo_skb race
Balbir Singh (4):
dma/mapping.c: dev_dbg support for dma_addressing_limited
dma-mapping: Fix warning reported for missing prototype
x86/kaslr: Reduce KASLR entropy on most x86 systems
x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers
Baokun Li (2):
ext4: reject the 'data_err=abort' option in nojournal mode
ext4: do not convert the unwritten extents if data writeback fails
Bard Liao (1):
soundwire: cadence_master: set frame shape and divider based on actual clk freq
Bart Van Assche (1):
scsi: usb: Rename the RESERVE and RELEASE constants
Bartosz Golaszewski (1):
gpiolib: sanitize the return value of gpio_chip::set_config()
Benjamin Berg (2):
um: Store full CSGSFS and SS register from mcontext
wifi: mac80211: add HT and VHT basic set verification
Benjamin Lin (1):
wifi: mt76: mt7996: revise TXS size
Benjamin Segall (1):
posix-timers: Invoke cond_resched() during exit_itimers()
Bibo Mao (1):
MIPS: Use arch specific syscall name match function
Bitterblue Smith (9):
wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
wifi: rtw88: Fix rtw_mac_power_switch() for RTL8814AU
wifi: rtw88: Fix rtw_update_sta_info() for RTL8814AU
wifi: rtw88: Extend rtw_fw_send_ra_info() for RTL8814AU
wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
Bogdan-Gabriel Roman (1):
spi: spi-fsl-dspi: Halt the module after a new message transfer
Boris Burkov (2):
btrfs: make btrfs_discard_workfn() block_group ref explicit
btrfs: handle empty eb->folios in num_extent_folios()
Brandon Kammerdiener (1):
bpf: fix possible endless loop in BPF map iteration
Brandon Syu (1):
Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY"
Brendan Jackman (1):
kunit: tool: Use qboot on QEMU x86_64
Breno Leitao (3):
x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
netdevsim: call napi_schedule from a timer context
memcg: always call cond_resched() after fn()
Caleb Sander Mateos (2):
ublk: complete command synchronously on error
io_uring: use IO_REQ_LINK_FLAGS more
Carlos Sanchez (1):
can: slcan: allow reception of short error messages
Carolina Jubran (2):
net/mlx5: Preserve rate settings when creating a rate node
net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
Cezary Rojewski (1):
ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode
Chaohai Chen (1):
scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr()
Charlene Liu (3):
drm/amd/display: remove minimum Dispclk and apply oem panel timing.
drm/amd/display: fix dcn4x init failed
drm/amd/display: pass calculated dram_speed_mts to dml2
Charles Keepax (3):
ASoC: rt722-sdca: Add some missing readable registers
ASoC: cs42l43: Disable headphone clamps during type detection
soundwire: bus: Fix race on the creation of the IRQ domain
Chen Linxuan (1):
blk-cgroup: improve policy registration error handling
Chenyuan Yang (2):
ASoC: sma1307: Add NULL check in sma1307_setting_loaded()
ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
Chih-Kang Chang (1):
wifi: rtw89: Parse channel from IE to correct invalid hardware reports during scanning
Chin-Ting Kuo (1):
watchdog: aspeed: Update bootstatus handling
Ching-Te Ku (4):
wifi: rtw89: coex: Fix coexistence report not show as expected
wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang
wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event
wifi: rtw89: coex: Add protect to avoid A2DP lag while Wi-Fi connecting
Choong Yong Liang (1):
net: phylink: use pl->link_interface in phylink_expects_phy()
Chris Lu (2):
Bluetooth: btmtksdio: Check function enabled before doing close
Bluetooth: btmtksdio: Do close if SDIO card removed without close
Chris Morgan (2):
power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree
mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs
Christian Brauner (1):
pidfs: improve multi-threaded exec and premature thread-group leader exit polling
Christian Bruel (1):
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
Christian Göttsche (1):
ext4: reorder capability check last
Christian König (4):
drm/amdgpu: rework how the cleaner shader is emitted v3
drm/amdgpu: rework how isolation is enforced v2
drm/amdgpu: use GFP_NOWAIT for memory allocations
drm/amdgpu: remove all KFD fences from the BO on release
Christoph Hellwig (3):
block: mark bounce buffering as incompatible with integrity
loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize
loop: don't require ->write_iter for writable files in loop_configure
ChunHao Lin (1):
r8169: disable RTL8126 ZRX-DC timeout
Chung Chung (1):
dm vdo indexer: prevent unterminated string warning
Claudiu Beznea (5):
phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data
phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
serial: sh-sci: Update the suspend/resume support
pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down
Coly Li (1):
badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0
Cong Wang (1):
sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
Conor Dooley (1):
RISC-V: add vector extension validation checks
Cristian Ciocaltea (1):
drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0
Csókás, Bence (1):
net: fec: Refactor MAC reset to function
Damien Le Moal (2):
nvmet: pci-epf: Keep completion queues mapped
nvmet: pci-epf: clear completion queue IRQ flag on delete
Damon Ding (1):
phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF
Dan Carpenter (3):
ASoC: sma1307: Fix error handling in sma1307_setting_loaded()
pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
Dang Huynh (1):
pinctrl: qcom: msm8917: Add MSM8937 wsa_reset pin
Daniel Gabay (1):
wifi: iwlwifi: w/a FW SMPS mode selection
Daniel Gomez (2):
kconfig: merge_config: use an empty file as initfile
drm/xe: xe_gen_wa_oob: replace program_invocation_short_name
Daniel Hsu (1):
mctp: Fix incorrect tx flow invalidation condition in mctp-i2c
Danny Wang (1):
drm/amd/display: Do not enable replay when vtotal update is pending.
Darrick J. Wong (2):
block: fix race between set_blocksize and read paths
block: hoist block size validation code to a separate function
Dave Ertman (1):
ice: Fix LACP bonds without SRIOV environment
Dave Jiang (1):
dmaengine: idxd: Fix ->poll() return value
David (Ming Qiang) Wu (1):
drm/amdgpu: read back register after written for VCN v4.0.5
David Hildenbrand (1):
kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
David Lechner (1):
iio: adc: ad7944: don't use storagebits for sizing
David Plowman (1):
media: i2c: imx219: Correct the minimum vblanking value
David Rosca (1):
drm/amdgpu: Update SRIOV video codec caps
David Sterba (1):
btrfs: tree-checker: adjust error code for header level check
David Wang (1):
module: release codetag section when module load fails
David Wei (1):
tools: ynl-gen: validate 0 len strings from kernel
Davidlohr Bueso (6):
fs/buffer: split locking for pagecache lookups
fs/buffer: introduce sleeping flavors for pagecache lookups
fs/buffer: use sleeping version of __find_get_block()
fs/ocfs2: use sleeping version of __find_get_block()
fs/jbd2: use sleeping version of __find_get_block()
fs/ext4: use sleeping version of sb_find_get_block()
Depeng Shao (2):
media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available
media: qcom: camss: Add default case in vfe_src_pad_code
Dhananjay Ugwekar (1):
cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost
Dian-Syuan Yang (1):
wifi: rtw89: set force HE TB mode when connecting to 11ax AP
Dillon Varone (5):
drm/amd/display: Fix DMUB reset sequence for DCN401
drm/amd/display: Fix p-state type when p-state is unsupported
drm/amd/display: Fixes for mcache programming in DML21
drm/amd/display: Ammend DCPG IP control sequences to align with HW guidance
drm/amd/display: Populate register address for dentist for dcn401
Diogo Ivo (2):
ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list
arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
Dmitry Baryshkov (6):
nvmem: core: fix bit offsets of more than one byte
nvmem: core: verify cell's raw_len
nvmem: core: update raw_len if the bit reading is required
nvmem: qfprom: switch to 4-byte aligned reads
phy: core: don't require set_mode() callback for phy_get_mode() to work
pinctrl: qcom: switch to devm_register_sys_off_handler()
Dmitry Bogdanov (1):
scsi: target: iscsi: Fix timeout on deleted connection
Dominik Grzegorzek (1):
padata: do not leak refcount in reorder_work
Dongli Zhang (1):
vhost-scsi: protect vq->log_used with vq->mutex
Douglas Anderson (1):
drm/panel-edp: Add Starry 116KHD024006
Ed Burcher (1):
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
Eddie James (1):
eeprom: ee1004: Check chip before probing
Eder Zulian (1):
mfd: syscon: Add check for invalid resource size
Eduard Zingerman (3):
bpf: don't do clean_live_states when state->loop_entry->branches > 0
bpf: copy_verifier_state() should copy 'loop_entry' field
bpf: abort verification if env->cur_state->loop_entry != NULL
Emily Deng (1):
drm/amdgpu: Fix missing drain retry fault the last entry
Emmanuel Grumbach (2):
wifi: iwlwifi: fix the ECKV UEFI variable name
wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx
En-Wei Wu (1):
Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling
Eric Dumazet (7):
cgroup/rstat: avoid disabling irqs for O(num_cpu)
posix-timers: Add cond_resched() to posix_timer_add() search loop
tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
tcp: be less liberal in TSEcr received while in SYN_RECV state
net: flush_backlog() small changes
net-sysfs: restore behavior for not running devices
idpf: fix idpf_vport_splitq_napi_poll()
Eric Huang (1):
drm/amdkfd: fix missing L2 cache info in topology
Eric Woudstra (1):
net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only
Erick Shepherd (2):
mmc: host: Wait for Vdd to settle on card power off
mmc: sdhci: Disable SD card clock before changing parameters
Felix Fietkau (5):
wifi: mt76: scan: fix setting tx_info fields
wifi: mt76: mt7996: implement driver specific get_txpower function
wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
wifi: mt76: mt7996: use the correct vif link for scanning/roc
wifi: mt76: scan: set vif offchannel link for scanning/roc
Felix Kuehling (1):
drm/amdgpu: Allow P2P access through XGMI
Filipe Manana (3):
btrfs: fix non-empty delayed iputs list on unmount due to async workers
btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work()
btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
Flora Cui (2):
drm/amdgpu/discovery: check ip_discovery fw file available
drm/amdgpu: release xcp_mgr on exit
Florent Revest (1):
mm: fix VM_UFFD_MINOR == VM_SHADOW_STACK on USERFAULTFD=y && ARM64_GCS=y
Frank Li (3):
PCI: dwc: ep: Ensure proper iteration over outbound map windows
PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off()
i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA)
Frederick Lawler (1):
ima: process_measurement() needlessly takes inode_lock() on MAY_READ
Frediano Ziglio (1):
xen: Add support for XenServer 6.1 platform device
Gabor Juhos (1):
arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
Gao Xiang (1):
erofs: initialize decompression early
Gaurav Batra (2):
powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory
powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits
Gašper Nemgar (1):
platform/x86: ideapad-laptop: add support for some new buttons
Ge Yang (1):
mm/hugetlb: fix kernel NULL pointer dereference when replacing free hugetlb folios
Geert Uytterhoeven (3):
ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only
serial: sh-sci: Save and restore more registers
pmdomain: renesas: rcar: Remove obsolete nullify checks
Geetha sowjanya (1):
octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
George Shen (3):
drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination
drm/amd/display: Read LTTPR ALPM caps during link cap retrieval
drm/amd/display: Update CR AUX RD interval interpretation
Goldwyn Rodrigues (1):
btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
Greg Kroah-Hartman (3):
driver core: faux: only create the device if probe() succeeds
spi: use container_of_cont() for to_spi_device()
Linux 6.14.9
Guangguan Wang (1):
net/smc: use the correct ndev to find pnetid by pnetid table
Gustavo Sousa (1):
drm/xe: Disambiguate GMDID-based IP names
Hangbin Liu (1):
bonding: report duplicate MAC address in all situations
Hans Verkuil (2):
media: cx231xx: set device_caps for 417
media: test-drivers: vivid: don't call schedule in loop
Hans de Goede (1):
mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type
Hans-Frieder Vogt (2):
net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards
net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus
Haoran Jiang (1):
samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
Hariprasad Kelam (1):
Octeontx2-af: RPM: Register driver with PCI subsys IDs
Harish Kasiviswanathan (3):
drm/amdkfd: Set per-process flags only once for gfx9/10/11/12
drm/amdkfd: Set per-process flags only once cik/vi
drm/amdgpu: Set snoop bit for SDMA for MI series
Harry VanZyllDeJong (1):
drm/amd/display: Add support for disconnected eDP streams
Harry Wentland (1):
drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink
Hector Martin (4):
soc: apple: rtkit: Implement OSLog buffers properly
ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG
ASoC: tas2764: Mark SW_RESET as volatile
ASoC: tas2764: Power up/down amp on mute ops
Heiko Carstens (1):
s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste()
Heiko Stuebner (2):
nvmem: rockchip-otp: Move read-offset into variant-data
nvmem: rockchip-otp: add rk3576 variant data
Heiner Kallweit (2):
r8169: increase max jumbo packet size on RTL8125/RTL8126
r8169: don't scan PHY addresses > 0
Heming Zhao (1):
dlm: make tcp still work in multi-link env
Herbert Xu (3):
crypto: lzo - Fix compression buffer overrun
crypto: ahash - Set default reqsize from ahash_alg
crypto: skcipher - Zap type in crypto_alloc_sync_skcipher
Huacai Chen (1):
net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size
Huisong Li (1):
hwmon: (acpi_power_meter) Fix the fake power alarm reporting
Ian Rogers (1):
tools/build: Don't pass test log files to linker
Ido Schimmel (2):
vxlan: Annotate FDB data races
bridge: netfilter: Fix forwarding of fragmented packets
Ignacio Moreno Gonzalez (1):
mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled
Ihor Solodrai (1):
selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure
Ilan Peer (2):
wifi: cfg80211: Update the link address when a link is added
wifi: mac80211_hwsim: Fix MLD address translation
Ilia Gavrilov (1):
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
Ilpo Järvinen (2):
tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
PCI: Fix old_size lower bound in calculate_iosize() too
Ilya Bakoulin (2):
drm/amd/display: Fix BT2020 YCbCr limited/full range input
drm/amd/display: Don't try AUX transactions on disconnected link
Imre Deak (1):
drm/i915/dp: Fix determining SST/MST mode during MTP TU state computation
Ingo Molnar (1):
x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP
Inochi Amaoto (1):
pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf
Isaac Scott (1):
regulator: ad5398: Add device tree support
Ivan Pravdin (1):
crypto: algif_hash - fix double free in hash_accept
Jaakko Karrenpalo (1):
net: hsr: Fix PRP duplicate detection
Jacob Keller (1):
ice: fix vf->num_mac count with port representors
Jaegeuk Kim (1):
f2fs: introduce f2fs_base_attr for global sysfs entries
Jakob Unterwurzacher (1):
net: dsa: microchip: linearize skb for tail-tagging switches
Jakub Kicinski (4):
eth: mlx4: don't try to complete XDP frames in netpoll
netdevsim: allow normal queue reset while down
net: page_pool: avoid false positive warning if NAPI was never added
tools: ynl-gen: don't output external constants
Jan Kara (2):
jbd2: do not try to recover wiped journal
jbd2: Avoid long replay times due to high number or revoke blocks
Janne Grunau (1):
soc: apple: rtkit: Use high prio work queue
Jason Andryuk (1):
xenbus: Allow PVH dom0 a non-local xenstore
Jason Gunthorpe (2):
iommu/vt-d: Check if SVA is supported when attaching the SVA domain
genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
Jedrzej Jagielski (1):
ixgbe: add support for thermal sensor event reception
Jeff Chen (1):
wifi: mwifiex: Fix HT40 bandwidth issue.
Jens Axboe (2):
io_uring/fdinfo: annotate racy sq/cq head/tail reads
io_uring/net: only retry recv bundle for a full transfer
Jernej Skrabec (1):
Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
Jessica Zhang (2):
drm/msm/dpu: Set possible clones for all encoders
drm: Add valid clones check
Jianbo Liu (1):
net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode
Jiang Liu (2):
drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
amdgpu/soc15: enable asic reset for dGPU in case of suspend abort
Jiasheng Jiang (1):
dpll: Add an assertion to check freq_supported_num
Jiayuan Chen (1):
bpftool: Using the right format specifiers
Jing Su (1):
dql: Fix dql->limit value when reset.
Jing Zhou (1):
drm/amd/display: Guard against setting dispclk low for dcn31x
Jinliang Zheng (1):
dm: fix unconditional IO throttle caused by REQ_PREFLUSH
Jinqian Yang (1):
arm64: Add support for HIP09 Spectre-BHB mitigation
Johannes Berg (11):
wifi: iwlwifi: fix debug actions order
wifi: iwlwifi: mark Br device not integrated
wifi: mac80211: don't include MLE in ML reconf per-STA profile
wifi: mac80211: fix warning on disconnect during failed ML reconf
wifi: mac80211: fix U-APSD check in ML reconfiguration
wifi: iwlwifi: use correct IMR dump variable
wifi: mac80211: always send max agg subframe num in strict mode
wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
wifi: iwlwifi: add support for Killer on MTL
wifi: mac80211: restore monitor for outgoing frames
Johannes Thumshirn (1):
block: only update request sector if needed
John Harrison (1):
drm/xe/guc: Drop error messages about missing GuC logs
John Olender (1):
drm/amd/display: Defer BW-optimization-blocked DRR adjustments
Jon Hunter (1):
arm64: tegra: Resize aperture for the IGX PCIe C5 slot
Jonas Karlman (1):
net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe
Jonathan Kim (1):
drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12
Jonathan McDowell (1):
tpm: Convert warn to dbg in tpm2_start_auth_session()
Jordan Crouse (1):
clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
Josh Poimboeuf (2):
objtool: Properly disable uaccess validation
objtool: Fix error handling inconsistencies in check()
Joshua Aberback (1):
drm/amd/display: Increase block_sequence array size
Judith Mendez (1):
mmc: sdhci_am654: Add SDHCI_QUIRK2_SUPPRESS_V1P8_ENA quirk to am62 compatible
Justin Tee (4):
scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk
scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when pci_irq_vector() fails
scsi: lpfc: Reduce log message generation during ELS ring clean up
K Prateek Nayak (1):
fs/pipe: Limit the slots in pipe_resize_ring()
Kai Mäkisara (4):
scsi: st: Tighten the page format heuristics with MODE SELECT
scsi: st: ERASE does not change tape location
scsi: scsi_debug: First fixes for tapes
scsi: st: Restore some drive settings after reset
Kai Vehmanen (1):
ASoc: SOF: topology: connect DAI to a single DAI link
Karl Chan (1):
clk: qcom: ipq5018: allow it to be bulid on arm32
Karthikeyan Periyasamy (1):
wifi: ath12k: Update the peer id in PPDU end user stats TLV
Kate Hsuan (1):
HID: Kconfig: Add LEDS_CLASS_MULTICOLOR dependency to HID_LOGITECH
Kaustabh Chakraborty (1):
mmc: dw_mmc: add exynos7870 DW MMC support
Kees Cook (6):
PNP: Expand length of fixup id string
net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
pstore: Change kmsg_bytes storage size to u32
btrfs: compression: adjust cb->compressed_folios allocation type
mm: vmalloc: actually use the in-place vrealloc region
mm: vmalloc: only zero-init on vrealloc shrink
Kevin Krakauer (1):
selftests/net: have `gro.sh -t` return a correct exit code
Konstantin Andreev (2):
smack: recognize ipv4 CIPSO w/o categories
smack: Revert "smackfs: Added check catlen"
Konstantin Shkolnyy (1):
vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines
Konstantin Taranov (1):
net/mana: fix warning in the writer of client oob
Krzysztof Kozlowski (7):
ASoC: codecs: wsa884x: Correct VI sense channel mask
ASoC: codecs: wsa883x: Correct VI sense channel mask
can: c_can: Use of_property_present() to test existence of DT property
clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate
iio: accel: fxls8962af: Fix wakeup source leaks on device unbind
iio: adc: qcom-spmi-iadc: Fix wakeup source leaks on device unbind
iio: imu: st_lsm6dsx: Fix wakeup source leaks on device unbind
Kuan-Chung Chen (1):
wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU
Kuhanh Murugasen Krishnan (1):
fpga: altera-cvp: Increase credit timeout
Kunihiko Hayashi (1):
net: stmmac: Correct usage of maximum queue number macros
Kuninori Morimoto (1):
ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
Kuniyuki Iwashima (3):
ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
ipv4: fib: Hold rtnl_net_lock() in ip_rt_ioctl().
ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
Kurt Borja (1):
hwmon: (dell-smm) Increment the number of fans
Kyunghwan Seo (1):
watchdog: s3c2410_wdt: Fix PMU register bits for ExynosAutoV920 SoC
Lad Prabhakar (1):
clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation
Larisa Grigore (2):
spi: spi-fsl-dspi: restrict register range for regmap access
spi: spi-fsl-dspi: Reset SR flags before sending a new message
Lee Trager (1):
eth: fbnic: Prepend TSENE FW fields with FBNIC_FW
Len Brown (1):
tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options
Leo Zeng (1):
Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP"
Leon Huang (1):
drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch
Leon Romanovsky (1):
xfrm: prevent high SEQ input in non-ESN mode
Li Bin (1):
ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
Lijo Lazar (5):
drm/amdgpu: Reinit FW shared flags on VCN v5.0.1
drm/amdgpu: Avoid HDP flush on JPEG v5.0.1
drm/amdgpu: Add offset normalization in VCN v5.0.1
drm/amd/pm: Fetch current power limit from PMFW
drm/amdgpu: Use active umc info from discovery
Lin.Cao (1):
drm/buddy: fix issue that force_merge cannot free all roots
Lingbo Kong (2):
wifi: ath12k: report station mode receive rate for IEEE 802.11be
wifi: ath12k: report station mode transmit rate
Linus Torvalds (3):
gcc-15: make 'unterminated string initialization' just a warning
gcc-15: disable '-Wunterminated-string-initialization' entirely for now
Fix mis-uses of 'cc-option' for warning disablement
Linus Walleij (1):
ASoC: pcm6240: Drop bogus code handling IRQ as GPIO
Lizhi Hou (2):
accel/amdxdna: Check interrupt register before mailbox_rx_worker exits
accel/amdxdna: Refactor hardware context destroy routine
Lorenzo Stoakes (1):
intel_th: avoid using deprecated page->mapping, index fields
Lucas De Marchi (2):
drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init()
drm/xe: Fix xe_tile_init_noalloc() error propagation
Luis de Arquer (1):
spi-rockchip: Fix register out of bounds access
Luiz Augusto von Dentz (1):
Bluetooth: L2CAP: Fix not checking l2cap_chan security level
Maarten Lankhorst (2):
drm/xe: Move suballocator init to after display init
drm/xe: Do not attempt to bootstrap VF in execlists mode
Maciej S. Szmigiero (1):
ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7
Maher Sanalla (1):
RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
Manish Pandey (1):
scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices
Manuel Fombuena (2):
leds: Kconfig: leds-st1202: Add select for required LEDS_TRIGGER_PATTERN
leds: leds-st1202: Initialize hardware before DT node child operations
Marcin Bernatowicz (1):
drm/xe/client: Skip show_run_ticks if unable to read timestamp
Marcos Paulo de Souza (1):
printk: Check CON_SUSPEND when unblanking a console
Marek Szyprowski (1):
dma-mapping: avoid potential unused data compilation warning
Marek Vasut (1):
leds: trigger: netdev: Configure LED blink interval for HW offload
Mario Limonciello (2):
x86/amd_node: Add SMN offsets to exclusive region access
Revert "drm/amd: Keep display off while going into S4"
Mark Harmstone (1):
btrfs: avoid linker error in btrfs_find_create_tree_block()
Mark Pearson (1):
platform/x86: think-lmi: Fix attribute name usage for non-compliant items
Mark Zhang (1):
net/mlx5e: Use right API to free bitmap memory
Markus Elfring (1):
media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
Martin Blumenstingl (1):
pinctrl: meson: define the pull up/down resistor value as 60 kOhm
Martin KaFai Lau (1):
bpf: Use kallsyms to find the function name of a struct_ops's stub function
Martin Povišer (1):
ASoC: ops: Enforce platform maximum on initial value
Martin Tsai (1):
drm/amd/display: Support multiple options during psr entry.
Masahiro Yamada (1):
kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf
Matt Johnston (1):
fuse: Return EPERM rather than ENOSYS from link()
Matthew Brost (2):
drm/xe: Nuke VM's mapping upon close
drm/xe: Retry BO allocation
Matthew Sakai (1):
dm vdo: use a short static string for thread name prefix
Matthew Wilcox (Oracle) (2):
orangefs: Do not truncate file size
highmem: add folio_test_partial_kmap()
Matthias Fend (1):
media: tc358746: improve calculation of the D-PHY timing registers
Matthieu Baerts (NGI0) (1):
mptcp: pm: userspace: flags: clearer msg if no remote addr
Matti Lehtimäki (2):
remoteproc: qcom_wcnss: Handle platforms with only single power domain
remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
Michael Chan (1):
bnxt_en: Set NPAR 1.2 support when registering with firmware
Michael Jeanson (1):
rseq: Fix segfault on registration when rseq_cs is non-zero
Michael Margolin (1):
RDMA/core: Fix best page size finding when it can cross SG entries
Michael S. Tsirkin (2):
virtio: break and reset virtio devices on device_shutdown()
virtgpu: don't reset on shutdown
Michal Pecio (1):
usb: xhci: Don't change the status of stalled TDs on failed Stop EP
Michal Swiatkowski (3):
ice: init flow director before RDMA
ice: treat dyn_allowed only as suggestion
ice: count combined queues using Rx/Tx count
Michal Wajdeczko (7):
drm/xe/pf: Release all VFs configs on device removal
drm/xe/relay: Don't use GFP_KERNEL for new transactions
drm/xe/pf: Reset GuC VF config when unprovisioning critical resource
drm/xe/pf: Move VFs reprovisioning to worker
drm/xe/sa: Always call drm_suballoc_manager_fini()
drm/xe/vf: Perform early GT MMIO initialization to read GMDID
drm/xe: Always setup GT MMIO adjustment data
Mika Westerberg (1):
thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer
Mike Christie (1):
vhost-scsi: Return queue full for page alloc failures during copy
Mikulas Patocka (1):
dm: restrict dm device size to 2^63-512 bytes
Ming Lei (2):
loop: move vfs_fsync() out of loop_update_dio()
blk-throttle: don't take carryover for prioritized processing of metadata
Ming Yen Hsieh (1):
wifi: mt76: mt7925: load the appropriate CLC data based on hardware type
Ming-Hung Tsai (1):
dm cache: prevent BUG_ON by blocking retries on failed device resumes
Miri Korenblit (2):
wifi: iwlwifi: don't warn when if there is a FW error
wifi: iwlwifi: don't warn during reprobe
Moshe Shemesh (1):
net/mlx5: Avoid report two health errors on same syndrome
Mrinmay Sarkar (1):
PCI: epf-mhi: Update device ID for SA8775P
Mukesh Kumar Savaliya (1):
i2c: qcom-geni: Update i2c frequency table to match hardware guidance
Mykyta Yatsenko (1):
bpf: Return prog btf_id without capable check
Naman Trivedi (1):
arm64: zynqmp: add clock-output-names property in clock nodes
Namjae Jeon (2):
cifs: add validation check for the fields in smb_aces
ksmbd: fix stream write failure
Nandakumar Edamana (1):
libbpf: Fix out-of-bound read
Nathan Chancellor (2):
i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
kbuild: Properly disable -Wunterminated-string-initialization for clang
Navid Assadian (1):
drm/amd/display: Add opp recout adjustment
Nicholas Kazlauskas (2):
drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35
drm/amd/display: Guard against setting dispclk low when active
Nicholas Susanto (1):
drm/amd/display: Enable urgent latency adjustment on DCN35
Nick Hu (1):
clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug
Nicolas Bouchinet (2):
netfilter: conntrack: Bound nf_conntrack sysctl writes
scsi: logging: Fix scsi_logging_level bounds
Nicolas Bretz (1):
ext4: on a remount, only log the ro or r/w state when it has changed
Nicolas Escande (1):
wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override
Niklas Cassel (2):
misc: pci_endpoint_test: Give disabled BARs a distinct error code
selftests: pci_endpoint: Skip disabled BARs
Niklas Neronin (1):
usb: xhci: set page size to the xHCI-supported size
Niklas Söderlund (1):
media: adv7180: Disable test-pattern control on adv7180
Nilay Shroff (1):
block: acquire q->limits_lock while reading sysfs attributes
Nir Lichtman (1):
x86/build: Fix broken copy command in genimage.sh when making isoimage
Nícolas F. R. A. Prado (4):
thermal/drivers/mediatek/lvts: Start sensor interrupts disabled
ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile
ASoC: mediatek: mt8188: Add reference for dmic clocks
Oak Zeng (1):
drm/xe: Reject BO eviction if BO is bound to current VM
Oliver Hartkopp (2):
can: bcm: add locking for bcm_op runtime updates
can: bcm: add missing rcu read protection for procfs content
Olivier Moysan (1):
drm: bridge: adv7511: fill stream capabilities
Ovidiu Bunea (1):
drm/amd/display: Exit idle optimizations before accessing PHY
P Praneesh (3):
wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV
wifi: ath12k: Fix end offset bit definition in monitor ring descriptor
wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation
Pali Rohár (10):
cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES
cifs: Fix querying and creating MF symlinks over SMB1
cifs: Fix access_flags_to_smbopen_mode
cifs: Fix negotiate retry functionality
cifs: Set default Netbios RFC1001 server name to hostname in UNC
cifs: Fix establishing NetBIOS session for SMB2+ connection
cifs: Fix getting DACL-only xattr system.cifs_acl and system.smb3_acl
cifs: Check if server supports reparse points before using them
cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info()
cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function
Paolo Abeni (1):
mr: consolidate the ipmr_can_free_table() checks.
Patrisious Haddad (1):
net/mlx5: Change POOL_NEXT_SIZE define value and make it global
Paul Burton (2):
MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
clocksource: mips-gic-timer: Enable counter when CPUs start
Paul Chaignon (1):
xfrm: Sanitize marks before insert
Paul E. McKenney (1):
rcu: Fix get_state_synchronize_rcu_full() GP-start detection
Paul Elder (1):
media: imx335: Set vblank immediately
Paul Kocialkowski (1):
net: dwmac-sun8i: Use parsed internal PHY address instead of 1
Pavan Kumar Linga (1):
idpf: fix null-ptr-deref in idpf_features_check
Pavel Begunkov (4):
io_uring: don't duplicate flushing in io_req_post_cqe
io_uring/msg: initialise msg request opcode
io_uring: sanitise ring params earlier
io_uring: fix overflow resched cqe reordering
Pavel Nikulin (1):
platform/x86: asus-wmi: Disable OOBE state after resume from hibernation
Paweł Anikiel (1):
x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88
Pedro Nishiyama (1):
Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
Peichen Huang (1):
drm/amd/display: not abort link train when bw is low
Pengyu Luo (1):
cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist
Peter Seiderer (2):
net: pktgen: fix mpls maximum labels list parsing
net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
Peter Ujfalusi (3):
ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext
ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms
ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction
Peter Zijlstra (5):
perf/core: Clean up perf_try_init_event()
perf/core: Fix perf_mmap() failure path
x86/ibt: Handle FineIBT in handle_cfi_failure()
x86/traps: Cleanup and robustify decode_bug()
x86/boot: Mark start_secondary() with __noendbr
Peter Zijlstra (Intel) (1):
perf: Avoid the read if the count is already updated
Peterson Guo (1):
drm/amd/display: Reverse the visual confirm recouts
Petr Machata (2):
vxlan: Join / leave MC group after remote changes
bridge: mdb: Allow replace of a host-joined group
Philip Redkin (1):
x86/mm: Check return value from memblock_phys_alloc_range()
Philip Yang (1):
drm/amdkfd: KFD release_work possible circular locking
Philippe Simons (1):
clk: sunxi-ng: h616: Reparent GPU clock during frequency changes
Ping-Ke Shih (7):
wifi: rtw89: fw: propagate error code from rtw89_h2c_tx()
wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32()
wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware
wifi: rtw89: fw: validate multi-firmware header before getting its size
wifi: rtw89: fw: validate multi-firmware header before accessing
wifi: rtw89: call power_on ahead before selecting firmware
wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet
Prathamesh Shete (1):
pinctrl-tegra: Restore SFSEL bit when freeing pins
Qu Wenruo (2):
btrfs: run btrfs_error_commit_super() early
btrfs: avoid NULL pointer dereference if no valid csum tree
Quan Zhou (2):
wifi: mt76: mt7925: Simplify HIF suspend handling to avoid suspend fail
wifi: mt76: mt7925: fix fails to enter low power mode in suspend state
Raag Jadav (2):
devres: Introduce devm_kmemdup_array()
err.h: move IOMEM_ERR_PTR() to err.h
Rae Moar (1):
kunit: tool: Fix bug in parsing test plan
Rafael J. Wysocki (1):
cpuidle: menu: Avoid discarding useful information
Ramasamy Kaliappan (1):
wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band
Ranjan Kumar (2):
scsi: mpi3mr: Add level check to control event logging
scsi: mpi3mr: Update timestamp only for supervisor IOCs
Ravi Bangoria (2):
perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
perf/amd/ibs: Fix ->config to sample period calculation for OP PMU
Rex Lu (1):
wifi: mt76: mt7996: fix SER reset trigger on WED reset
Ricardo Ribalda (2):
media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value
Rik van Riel (1):
x86/mm: Make MMU_GATHER_RCU_TABLE_FREE unconditional
Ritesh Harjani (IBM) (1):
book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n
Rob Herring (Arm) (1):
perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters
Robert Richter (1):
libnvdimm/labels: Fix divide error in nd_label_data_init()
Robin Murphy (1):
iommu: Keep dev->iommu state consistent
Rodrigo Vivi (2):
drm/xe/display: Remove hpd cancel work sync from runtime pm path
drm/xe: Fix PVC RPe and RPa information
Roger Pau Monne (2):
PCI: vmd: Disable MSI remapping bypass under Xen
xen/pci: Do not register devices with segments >= 0x10000
Roger Quadros (1):
dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
Ronak Doshi (1):
vmxnet3: update MTU after device quiesce
Rosen Penev (1):
wifi: ath9k: return by of_get_mac_address
Ryan Roberts (2):
arm64/mm: Check pmd_table() in pmd_trans_huge()
arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
Ryan Walklin (2):
ASoC: sun4i-codec: support hp-det-gpios property
ASoC: sun4i-codec: correct dapm widgets and controls for h616
Ryo Takakura (1):
lockdep: Fix wait context check on softirq for PREEMPT_RT
Ryusuke Konishi (1):
nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
Sabrina Dubroca (2):
espintcp: fix skb leaks
espintcp: remove encap socket caching to avoid reference leak
Sagi Maimon (1):
ptp: ocp: Limit signal/freq counts in summary output functions
Sakari Ailus (2):
media: v4l: Memset argument to 0 before calling get_mbus_config pad op
media: i2c: ov2740: Free control handler on error path
Saket Kumar Bhaskar (1):
perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type
Salah Triki (1):
smb: server: smb2pdu: check return value of xa_store()
Samiullah Khawaja (1):
xsk: Bring back busy polling support in XDP_COPY
Samson Tam (3):
drm/amd/display: fix check for identity ratio
drm/amd/display: Fix mismatch type comparison in custom_float
drm/amd/display: remove TF check for LLS policy
Samuel Holland (1):
riscv: Allow NOMMU kernels to access all of RAM
Saranya Gopal (1):
platform/x86/intel: hid: Add Pantherlake support
Satyanarayana K V P (2):
drm/xe/vf: Retry sending MMIO request to GUC on timeout error
drm/xe/pf: Create a link between PF and VF devices
Sean Anderson (1):
spi: zynqmp-gqspi: Always acknowledge interrupts
Sean Wang (1):
Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal
Seongman Lee (1):
x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro
Sergio Perez Gonzalez (1):
spi: spi-mux: Fix coverity issue, unchecked return value
Seyediman Seyedarab (1):
kbuild: fix argument parsing in scripts/config
Shahar Shitrit (2):
net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
net/mlx5: Apply rate-limiting to high temperature warning
Shashank Gupta (1):
crypto: octeontx2 - suppress auth failure screaming due to negative tests
Shayne Chen (1):
wifi: mt76: Check link_conf pointer in mt76_connac_mcu_sta_basic_tlv()
Shin'ichiro Kawasaki (1):
null_blk: generate null_blk configfs features string
Shivasharan S (1):
scsi: mpt3sas: Send a diag reset if target reset fails
Shiwu Zhang (1):
drm/amdgpu: enlarge the VBIOS binary size limit
Shixiong Ou (1):
fbdev: fsl-diu-fb: add missing device_remove_file()
Shree Ramamoorthy (1):
mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check
Shuicheng Lin (2):
drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set
drm/xe: Use xe_mmio_read32() to read mtcfg register
Shyam Sundar S K (1):
i2c: amd-asf: Set cmd variable when encountering an error
Simona Vetter (1):
drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
Siva Durga Prasad Paladugu (1):
firmware: xilinx: Dont send linux address to get fpga config get status
Soeren Moch (1):
wifi: rtl8xxxu: retry firmware download on error
Sohil Mehta (2):
x86/smpboot: Fix INIT delay assignment for extended Intel Families
x86/microcode: Update the Intel processor flag scan check
Song Liu (1):
bpf: arm64: Silence "UBSAN: negation-overflow" warning
Song Yoong Siang (1):
igc: Avoid unnecessary link down event in XDP_SETUP_PROG process
Srinivasan Shanmugam (2):
drm/amdgpu/gfx10: Add cleaner shader for GFX10.1.10
drm/amdkfd: Fix error handling for missing PASID in 'kfd_process_device_init_vm'
Stanimir Varbanov (2):
PCI: brcmstb: Expand inbound window size up to 64GB
PCI: brcmstb: Add a softdep to MIP MSI-X driver
Stanley Chu (1):
i3c: master: svc: Fix missing STOP for master request
Stefan Binding (2):
ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers
ASoC: intel/sdw_utils: Add volume limit to cs35l56 speakers
Stefan Wahren (3):
staging: vchiq_arm: Create keep-alive thread during probe
drm/v3d: Add clock handling
dmaengine: fsl-edma: Fix return code for unhandled interrupts
Stefano Garzarella (1):
vhost_task: fix vhost_task_create() documentation
Stephan Gerhold (1):
i2c: qup: Vote for interconnect bandwidth to DRAM
Steven Rostedt (1):
ring-buffer: Use kaslr address instead of text delta
Subbaraya Sundeep (1):
octeontx2-af: Set LMT_ENA bit for APR table entries
Subramanian Mohan (1):
pps: generators: replace copy of pps-gen info struct with const pointer
Sudeep Holla (4):
mailbox: pcc: Use acpi_os_ioremap() instead of ioremap()
firmware: arm_ffa: Reject higher major version as incompatible
firmware: arm_ffa: Handle the presence of host partition in the partition info
firmware: arm_scmi: Relax duplicate name constraint across protocol ids
Suman Ghosh (4):
octeontx2-pf: use xdp_return_frame() to free xdp buffers
octeontx2-pf: Add AF_XDP non-zero copy support
octeontx2-pf: AF_XDP zero copy receive support
octeontx2-pf: Avoid adding dcbnl_ops for LBK and SDP vf
Sungjong Seo (1):
exfat: call bh_read in get_block only when necessary
Sunil Khatri (1):
drm/ttm: fix the warning for hit_low and evict_low
Suren Baghdasaryan (1):
alloc_tag: allocate percpu counters for module tags dynamically
Sven Schwermer (1):
crypto: mxs-dcp - Only set OTP_KEY bit for OTP key
Svyatoslav Ryhel (1):
ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
Takashi Iwai (5):
ALSA: seq: Improve data consistency at polling
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
ALSA: usb-audio: Fix duplicated name in MIDI substream names
ALSA: pcm: Fix race of buffer access at PCM OSS layer
Taniya Das (1):
clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490
Tao Zhou (1):
drm/amdgpu: increase RAS bad page threshold
Tavian Barnes (1):
ASoC: SOF: Intel: hda: Fix UAF when reloading module
Thangaraj Samynathan (1):
net: lan743x: Restore SGMII CTRL register on resume
Thippeswamy Havalige (1):
PCI: xilinx-cpm: Add cpm_csr register mapping for CPM5_HOST1 variant
Thomas Gleixner (1):
posix-timers: Ensure that timer initialization is fully visible
Thomas Huth (2):
x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-UAPI headers
x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers
Thomas Weißschuh (1):
timer_list: Don't use %pK through printk()
Thomas Zimmermann (4):
drm/gem: Test for imported GEM buffers with helper
drm/ast: Find VBIOS mode from regular display size
drm/ast: Hide Gens 1 to 3 TX detection in branch
drm/gem: Internally test import_attach for imported objects
Tianyang Zhang (1):
mm/page_alloc.c: avoid infinite retries caused by cpuset race
Tiwei Bie (1):
um: Update min_low_pfn to match changes in uml_reserved
Tobias Brunner (1):
xfrm: Fix UDP GRO handling for some corner cases
Tom Chung (1):
drm/amd/display: Initial psr_version with correct setting
Trond Myklebust (7):
NFSv4: Check for delegation validity in nfs_start_delegation_return_locked()
NFS: Don't allow waiting for exiting tasks
SUNRPC: Don't allow waiting for exiting tasks
NFSv4: Treat ENETUNREACH errors as fatal for state recovery
SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
SUNRPC: rpcbind should never reset the port to the value '0'
pNFS/flexfiles: Report ENETDOWN as a connection error
Tudor Ambarus (1):
mailbox: use error ret code of of_parse_phandle_with_args()
Uday Shankar (1):
ublk: enforce ublks_max only for unprivileged devices
Umesh Nerlige Ramappa (1):
drm/xe/oa: Ensure that polled read returns latest data
Uros Bizjak (1):
x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op()
Valentin Caron (1):
pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
Vasant Hegde (1):
iommu/amd/pgtbl_v2: Improve error handling
Vicki Pfau (1):
Input: xpad - add more controllers
Victor Lu (1):
drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
Victor Skvortsov (2):
drm/amdgpu: Skip pcie_replay_count sysfs creation for VF
drm/amdgpu: Skip err_count sysfs creation on VF unsupported RAS blocks
Vijendar Mukunda (1):
soundwire: amd: change the soundwire wake enable/disable sequence
Viktor Malik (1):
bpftool: Fix readlink usage in get_fd_type
Vinay Belgaumkar (1):
drm/xe: Add locks in gtidle code
Vinicius Costa Gomes (1):
dmaengine: idxd: Fix allowing write() from different address spaces
Vinith Kumar R (1):
wifi: ath12k: Report proper tx completion status to mac80211
Viresh Kumar (1):
firmware: arm_ffa: Set dma_mask for ffa devices
Vitalii Mordan (1):
i2c: pxa: fix call balance of i2c->clk handling routines
Vitaliy Shevtsov (1):
media: cec: use us_to_ktime() where appropriate
Vladimir Kondratiev (1):
irqchip/riscv-aplic: Add support for hart indexes
Vladimir Moskovkin (1):
platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store()
Waiman Long (1):
x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
Wang Liang (1):
net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
Wang Yaxin (1):
taskstats: fix struct taskstats breaks backward compatibility since version 15
Wang Zhaolong (3):
smb: client: Store original IO parameters and prevent zero IO sizes
smb: client: Fix use-after-free in cifs_fill_dirent
smb: client: Reset all search buffer pointers when releasing buffer
Wentao Guan (2):
nvme-pci: add quirks for device 126f:1001
nvme-pci: add quirks for WDC Blue SN550 15b7:5009
Willem de Bruijn (2):
ipv6: save dontfrag in cork
ipv6: remove leftover ip6 cookie initializer
William Tu (3):
net/mlx5e: set the tx_queue_len for pfifo_fast
net/mlx5e: reduce rep rxq depth to 256 for ECPF
net/mlx5e: reduce the max log mpwrq sz for ECPF and reps
Xiao Liang (2):
net: ipv6: Init tunnel link-netns before registering dev
rtnetlink: Lookup device in target netns when creating link
Xiaofei Tan (1):
ACPI: HED: Always initialize before evged
Xiaogang Chen (2):
drm/amdkfd: Have kfd driver use same PASID values from graphic driver
drm/amdkfd: Fix pasid value leak
Xin Li (Intel) (1):
x86/fred: Fix system hang during S4 resume with FRED enabled
Xin Wang (1):
drm/xe/debugfs: fixed the return value of wedged_mode_set
Xu Yang (1):
PM: sleep: Suppress sleeping parent warning in special case
Yeoreum Yun (2):
coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t
coresight: change coresight_trace_id_map's lock type to raw_spinlock_t
Yi Liu (2):
iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability
iommufd: Disallow allocating nested parent domain with fault ID
Yihan Zhu (1):
drm/amd/display: handle max_downscale_src_width fail check
Yonghong Song (1):
bpf: Allow pre-ordering for bpf cgroup progs
Youssef Samir (1):
accel/qaic: Mask out SR-IOV PCI resources
Yuanjun Gong (1):
leds: pwm-multicolor: Add check for fwnode_property_read_u32
Zhang Rui (1):
thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature
Zhang Yi (2):
ext4: don't write back data before punch hole in nojournal mode
ext4: remove writable userspace mappings before truncating page cache
Zhi Wang (1):
drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE
Zhikai Zhai (1):
drm/amd/display: calculate the remain segments for all pipes
Zhongqiu Han (1):
virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
Zhongwei Zhang (1):
drm/amd/display: Correct timing_adjust_pending flag setting.
Zsolt Kajtar (2):
fbcon: Use correct erase colour for clearing in fbcon
fbdev: core: tileblit: Implement missing margin clearing for tileblit
feijuan.li (1):
drm/edid: fixed the bug that hdr metadata was not reset
gaoxu (1):
cgroup: Fix compilation issue due to cgroup_mutex not being exported
junan (1):
HID: usbkbd: Fix the bit shift number for LED_KANA
shantiprasad shettar (1):
bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set
zihan zhou (1):
sched: Reduce the default slice to avoid tasks getting an extra tick
7 months, 2 weeks
- 1
- 1
Linux 6.12.31
by Greg Kroah-Hartman
I'm announcing the release of the 6.12.31 kernel.
All users of the 6.12 kernel series must upgrade.
The updated 6.12.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.12.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/admin-guide/kernel-parameters.txt | 2
Documentation/driver-api/serial/driver.rst | 2
Documentation/hwmon/dell-smm-hwmon.rst | 14
Makefile | 6
arch/arm/boot/dts/nvidia/tegra114.dtsi | 2
arch/arm/mach-at91/pm.c | 21
arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts | 38 -
arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts | 14
arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi | 22
arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 8
arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 2
arch/arm64/boot/dts/nvidia/tegra234-p3740-0002+p3701-0008.dts | 10
arch/arm64/boot/dts/xilinx/zynqmp-clk-ccf.dtsi | 15
arch/arm64/include/asm/cputype.h | 2
arch/arm64/include/asm/pgtable.h | 27 -
arch/arm64/kernel/proton-pack.c | 1
arch/loongarch/kernel/Makefile | 8
arch/loongarch/kvm/Makefile | 2
arch/mips/include/asm/ftrace.h | 16
arch/mips/kernel/pm-cps.c | 30 -
arch/powerpc/include/asm/mmzone.h | 1
arch/powerpc/kernel/prom_init.c | 4
arch/powerpc/mm/book3s64/radix_pgtable.c | 3
arch/powerpc/mm/numa.c | 2
arch/powerpc/perf/core-book3s.c | 20
arch/powerpc/perf/isa207-common.c | 4
arch/powerpc/platforms/pseries/iommu.c | 139 ++++--
arch/riscv/include/asm/page.h | 12
arch/riscv/include/asm/pgtable.h | 2
arch/riscv/kernel/Makefile | 4
arch/riscv/mm/tlbflush.c | 37 -
arch/s390/hypfs/hypfs_diag_fs.c | 2
arch/s390/include/asm/tlb.h | 2
arch/um/kernel/mem.c | 1
arch/x86/Kconfig | 1
arch/x86/boot/genimage.sh | 5
arch/x86/entry/entry.S | 2
arch/x86/events/amd/ibs.c | 20
arch/x86/events/intel/ds.c | 9
arch/x86/include/asm/bug.h | 5
arch/x86/include/asm/cfi.h | 11
arch/x86/include/asm/ibt.h | 4
arch/x86/include/asm/intel-family.h | 1
arch/x86/include/asm/nmi.h | 2
arch/x86/include/asm/percpu.h | 28 -
arch/x86/include/asm/perf_event.h | 1
arch/x86/include/asm/sev-common.h | 2
arch/x86/include/uapi/asm/bootparam.h | 4
arch/x86/include/uapi/asm/e820.h | 4
arch/x86/include/uapi/asm/ldt.h | 4
arch/x86/include/uapi/asm/msr.h | 4
arch/x86/include/uapi/asm/ptrace-abi.h | 6
arch/x86/include/uapi/asm/ptrace.h | 4
arch/x86/include/uapi/asm/setup_data.h | 4
arch/x86/include/uapi/asm/signal.h | 8
arch/x86/kernel/alternative.c | 30 +
arch/x86/kernel/cfi.c | 22
arch/x86/kernel/cpu/bugs.c | 10
arch/x86/kernel/cpu/microcode/intel.c | 2
arch/x86/kernel/nmi.c | 42 +
arch/x86/kernel/reboot.c | 10
arch/x86/kernel/smpboot.c | 6
arch/x86/kernel/traps.c | 82 ++-
arch/x86/mm/init.c | 9
arch/x86/mm/init_64.c | 15
arch/x86/mm/kaslr.c | 10
arch/x86/power/cpu.c | 14
arch/x86/um/os-Linux/mcontext.c | 3
block/badblocks.c | 5
block/bdev.c | 17
block/blk-cgroup.c | 22
block/blk-settings.c | 5
block/blk-throttle.c | 15
block/blk-zoned.c | 5
block/blk.h | 3
block/bounce.c | 2
block/fops.c | 16
block/ioctl.c | 6
crypto/ahash.c | 4
crypto/algif_hash.c | 4
crypto/lzo-rle.c | 2
crypto/lzo.c | 2
crypto/skcipher.c | 1
drivers/accel/qaic/qaic_drv.c | 2
drivers/acpi/Kconfig | 2
drivers/acpi/acpi_pnp.c | 2
drivers/acpi/hed.c | 7
drivers/auxdisplay/charlcd.c | 5
drivers/auxdisplay/charlcd.h | 5
drivers/auxdisplay/hd44780.c | 2
drivers/auxdisplay/lcd2s.c | 2
drivers/auxdisplay/panel.c | 2
drivers/block/loop.c | 5
drivers/block/ublk_drv.c | 53 +-
drivers/bluetooth/btmtksdio.c | 15
drivers/bluetooth/btusb.c | 98 +---
drivers/char/tpm/tpm2-sessions.c | 2
drivers/clk/clk-s2mps11.c | 3
drivers/clk/imx/clk-imx8mp.c | 151 ++++++
drivers/clk/qcom/Kconfig | 2
drivers/clk/qcom/camcc-sm8250.c | 56 +-
drivers/clk/qcom/clk-alpha-pll.c | 52 +-
drivers/clk/qcom/lpassaudiocc-sc7280.c | 23 -
drivers/clk/renesas/rzg2l-cpg.c | 102 ++--
drivers/clk/sunxi-ng/ccu-sun20i-d1.c | 44 +
drivers/clk/sunxi-ng/ccu_mp.h | 22
drivers/clocksource/mips-gic-timer.c | 6
drivers/clocksource/timer-riscv.c | 6
drivers/cpufreq/amd-pstate.c | 1
drivers/cpufreq/cpufreq-dt-platdev.c | 1
drivers/cpufreq/tegra186-cpufreq.c | 7
drivers/cpuidle/governors/menu.c | 13
drivers/crypto/marvell/octeontx2/otx2_cptvf_reqmgr.c | 7
drivers/crypto/mxs-dcp.c | 8
drivers/dma/fsl-edma-main.c | 2
drivers/dma/idxd/cdev.c | 9
drivers/dpll/dpll_core.c | 5
drivers/edac/ie31200_edac.c | 28 -
drivers/firmware/arm_ffa/bus.c | 1
drivers/firmware/arm_ffa/driver.c | 12
drivers/firmware/arm_scmi/bus.c | 19
drivers/firmware/xilinx/zynqmp.c | 6
drivers/fpga/altera-cvp.c | 2
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 5
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 52 --
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 30 +
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 31 -
drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 30 +
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 14
drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 3
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 38 +
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 7
drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c | 42 +
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 47 +-
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 48 +-
drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c | 10
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 1
drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2
drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c | 25 +
drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c | 27 +
drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c | 31 +
drivers/gpu/drm/amd/amdgpu/nv.c | 16
drivers/gpu/drm/amd/amdgpu/soc21.c | 10
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 39 -
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c | 69 ++-
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_v10.c | 41 +
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_v11.c | 41 +
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_v12.c | 41 +
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_v9.c | 35 +
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_vi.c | 71 +--
drivers/gpu/drm/amd/amdkfd/kfd_process.c | 16
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 23 -
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 41 +
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 6
drivers/gpu/drm/amd/display/dc/basics/dc_common.c | 3
drivers/gpu/drm/amd/display/dc/bios/command_table2.c | 9
drivers/gpu/drm/amd/display/dc/bios/command_table_helper2.c | 3
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 22
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c | 15
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 13
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c | 2
drivers/gpu/drm/amd/display/dc/core/dc.c | 22
drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 21
drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4
drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 12
drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 5
drivers/gpu/drm/amd/display/dc/dc_types.h | 7
drivers/gpu/drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c | 3
drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c | 3
drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 4
drivers/gpu/drm/amd/display/dc/dio/dcn10/dcn10_stream_encoder.c | 3
drivers/gpu/drm/amd/display/dc/dio/dcn401/dcn401_dio_stream_encoder.c | 3
drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 6
drivers/gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c | 1
drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c | 8
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 5
drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h | 1
drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 11
drivers/gpu/drm/amd/display/dc/hpo/dcn31/dcn31_hpo_dp_stream_encoder.c | 3
drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 10
drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 7
drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 8
drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 4
drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 3
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 139 +++++-
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.h | 7
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_init.c | 4
drivers/gpu/drm/amd/display/dc/hwss/hw_sequencer.h | 6
drivers/gpu/drm/amd/display/dc/inc/core_types.h | 2
drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h | 1
drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h | 6
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c | 42 +
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_phy.c | 8
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c | 5
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_8b_10b.c | 7
drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c | 25 -
drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c | 42 -
drivers/gpu/drm/amd/display/dc/spl/dc_spl.c | 4
drivers/gpu/drm/amd/display/dc/spl/dc_spl_types.h | 2
drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 6
drivers/gpu/drm/amd/display/dmub/src/dmub_dcn31.c | 17
drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c | 4
drivers/gpu/drm/amd/display/dmub/src/dmub_dcn401.c | 47 +-
drivers/gpu/drm/amd/display/dmub/src/dmub_dcn401.h | 3
drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c | 4
drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_offset.h | 32 +
drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_sh_mask.h | 48 ++
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 1
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 5
drivers/gpu/drm/ast/ast_mode.c | 10
drivers/gpu/drm/bridge/adv7511/adv7511_audio.c | 2
drivers/gpu/drm/drm_atomic_helper.c | 28 +
drivers/gpu/drm/drm_buddy.c | 5
drivers/gpu/drm/drm_edid.c | 1
drivers/gpu/drm/drm_gem.c | 4
drivers/gpu/drm/mediatek/mtk_dpi.c | 5
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 2
drivers/gpu/drm/panel/panel-edp.c | 1
drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 40 +
drivers/gpu/drm/v3d/v3d_drv.c | 25 -
drivers/gpu/drm/xe/xe_bo.c | 22
drivers/gpu/drm/xe/xe_debugfs.c | 3
drivers/gpu/drm/xe/xe_device.c | 10
drivers/gpu/drm/xe/xe_gen_wa_oob.c | 6
drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c | 37 +
drivers/gpu/drm/xe/xe_gt_sriov_vf.c | 12
drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 22
drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h | 2
drivers/gpu/drm/xe/xe_guc_relay.c | 2
drivers/gpu/drm/xe/xe_oa.c | 1
drivers/gpu/drm/xe/xe_pci_sriov.c | 51 ++
drivers/gpu/drm/xe/xe_pt.c | 14
drivers/gpu/drm/xe/xe_pt.h | 3
drivers/gpu/drm/xe/xe_sa.c | 3
drivers/gpu/drm/xe/xe_tile.c | 12
drivers/gpu/drm/xe/xe_tile.h | 1
drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c | 17
drivers/gpu/drm/xe/xe_ttm_stolen_mgr.h | 2
drivers/gpu/drm/xe/xe_vm.c | 32 +
drivers/hid/usbhid/usbkbd.c | 2
drivers/hwmon/dell-smm-hwmon.c | 5
drivers/hwmon/gpio-fan.c | 16
drivers/hwmon/xgene-hwmon.c | 2
drivers/hwtracing/coresight/coresight-etb10.c | 26 -
drivers/hwtracing/intel_th/Kconfig | 1
drivers/hwtracing/intel_th/msu.c | 31 -
drivers/i2c/busses/i2c-designware-pcidrv.c | 33 -
drivers/i2c/busses/i2c-designware-platdrv.c | 48 +-
drivers/i2c/busses/i2c-pxa.c | 5
drivers/i2c/busses/i2c-qup.c | 36 +
drivers/i3c/master/svc-i3c-master.c | 4
drivers/iio/adc/ad7944.c | 16
drivers/infiniband/core/umem.c | 36 +
drivers/infiniband/core/uverbs_cmd.c | 144 +++---
drivers/infiniband/core/verbs.c | 11
drivers/input/joystick/xpad.c | 3
drivers/iommu/amd/io_pgtable_v2.c | 2
drivers/iommu/dma-iommu.c | 28 -
drivers/iommu/iommu-priv.h | 2
drivers/iommu/iommu.c | 2
drivers/iommu/iommufd/device.c | 34 +
drivers/iommu/iommufd/hw_pagetable.c | 3
drivers/iommu/of_iommu.c | 6
drivers/irqchip/irq-riscv-aplic-direct.c | 24 -
drivers/irqchip/irq-riscv-imsic-early.c | 8
drivers/irqchip/irq-riscv-imsic-platform.c | 16
drivers/irqchip/irq-riscv-imsic-state.c | 96 ++--
drivers/irqchip/irq-riscv-imsic-state.h | 7
drivers/leds/rgb/leds-pwm-multicolor.c | 5
drivers/leds/trigger/ledtrig-netdev.c | 16
drivers/mailbox/mailbox.c | 7
drivers/mailbox/pcc.c | 8
drivers/md/dm-cache-target.c | 24 +
drivers/md/dm-table.c | 4
drivers/md/dm-vdo/indexer/index-layout.c | 5
drivers/md/dm-vdo/vdo.c | 11
drivers/md/dm.c | 8
drivers/media/i2c/adv7180.c | 34 -
drivers/media/i2c/imx219.c | 2
drivers/media/i2c/imx335.c | 21
drivers/media/i2c/tc358746.c | 19
drivers/media/platform/qcom/camss/camss-csid.c | 60 +-
drivers/media/platform/qcom/camss/camss-vfe.c | 4
drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-core.c | 3
drivers/media/test-drivers/vivid/vivid-kthread-cap.c | 11
drivers/media/test-drivers/vivid/vivid-kthread-out.c | 11
drivers/media/test-drivers/vivid/vivid-kthread-touch.c | 11
drivers/media/test-drivers/vivid/vivid-sdr-cap.c | 11
drivers/media/usb/cx231xx/cx231xx-417.c | 2
drivers/media/usb/uvc/uvc_ctrl.c | 77 +--
drivers/media/usb/uvc/uvc_v4l2.c | 6
drivers/media/v4l2-core/v4l2-subdev.c | 2
drivers/mfd/axp20x.c | 1
drivers/mfd/tps65219.c | 7
drivers/misc/eeprom/ee1004.c | 4
drivers/misc/mei/vsc-tp.c | 14
drivers/misc/pci_endpoint_test.c | 6
drivers/mmc/host/dw_mmc-exynos.c | 41 +
drivers/mmc/host/sdhci-pci-core.c | 6
drivers/mmc/host/sdhci.c | 9
drivers/net/bonding/bond_main.c | 2
drivers/net/can/c_can/c_can_platform.c | 2
drivers/net/can/kvaser_pciefd.c | 101 ++--
drivers/net/can/slcan/slcan-core.c | 26 -
drivers/net/ethernet/apm/xgene-v2/main.c | 4
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8
drivers/net/ethernet/freescale/enetc/enetc.c | 16
drivers/net/ethernet/freescale/fec_main.c | 52 +-
drivers/net/ethernet/intel/ice/ice_ethtool.c | 3
drivers/net/ethernet/intel/ice/ice_irq.c | 25 -
drivers/net/ethernet/intel/ice/ice_lag.c | 6
drivers/net/ethernet/intel/ice/ice_lib.c | 2
drivers/net/ethernet/intel/ice/ice_main.c | 6
drivers/net/ethernet/intel/ice/ice_virtchnl.c | 1
drivers/net/ethernet/intel/idpf/idpf.h | 2
drivers/net/ethernet/intel/idpf/idpf_lib.c | 10
drivers/net/ethernet/intel/idpf/idpf_txrx.c | 18
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 14
drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 2
drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 24 -
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 11
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 8
drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 22
drivers/net/ethernet/mellanox/mlx4/alloc.c | 6
drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2
drivers/net/ethernet/mellanox/mlx5/core/en.h | 3
drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 16
drivers/net/ethernet/mellanox/mlx5/core/en/params.h | 1
drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1
drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 49 --
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 28 -
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 36 -
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 5
drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c | 3
drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 13
drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.h | 5
drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c | 2
drivers/net/ethernet/mellanox/mlx5/core/events.c | 11
drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.c | 6
drivers/net/ethernet/mellanox/mlx5/core/fs_ft_pool.h | 2
drivers/net/ethernet/mellanox/mlx5/core/health.c | 1
drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c | 3
drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 2
drivers/net/ethernet/microchip/lan743x_main.c | 19
drivers/net/ethernet/microsoft/mana/gdma_main.c | 2
drivers/net/ethernet/realtek/r8169_main.c | 28 +
drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 21
drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2
drivers/net/ethernet/tehuti/tn40.c | 9
drivers/net/ethernet/tehuti/tn40.h | 33 +
drivers/net/ethernet/tehuti/tn40_mdio.c | 82 +++
drivers/net/ethernet/ti/cpsw_new.c | 1
drivers/net/ieee802154/ca8210.c | 9
drivers/net/mctp/mctp-i2c.c | 2
drivers/net/phy/nxp-c45-tja11xx.c | 54 ++
drivers/net/phy/phylink.c | 2
drivers/net/usb/r8152.c | 1
drivers/net/vmxnet3/vmxnet3_drv.c | 5
drivers/net/vxlan/vxlan_core.c | 36 +
drivers/net/wireless/ath/ath11k/dp.h | 6
drivers/net/wireless/ath/ath11k/dp_rx.c | 117 ++---
drivers/net/wireless/ath/ath12k/core.c | 12
drivers/net/wireless/ath/ath12k/core.h | 1
drivers/net/wireless/ath/ath12k/dp_mon.c | 16
drivers/net/wireless/ath/ath12k/dp_tx.c | 6
drivers/net/wireless/ath/ath12k/hal_desc.h | 2
drivers/net/wireless/ath/ath12k/hal_rx.h | 3
drivers/net/wireless/ath/ath12k/pci.c | 13
drivers/net/wireless/ath/ath12k/wmi.c | 4
drivers/net/wireless/ath/ath9k/init.c | 4
drivers/net/wireless/intel/iwlwifi/cfg/dr.c | 2
drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 4
drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 8
drivers/net/wireless/intel/iwlwifi/fw/uefi.h | 4
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 10
drivers/net/wireless/intel/iwlwifi/iwl-trans.c | 8
drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 4
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 15
drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 3
drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2
drivers/net/wireless/marvell/mwifiex/11n.c | 6
drivers/net/wireless/mediatek/mt76/mt76.h | 1
drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h | 3
drivers/net/wireless/mediatek/mt76/mt76x0/pci.c | 3
drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 3
drivers/net/wireless/mediatek/mt76/mt76x2/pci.c | 3
drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 3
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 64 ++
drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h | 3
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4
drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 3
drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 2
drivers/net/wireless/mediatek/mt76/tx.c | 3
drivers/net/wireless/realtek/rtl8xxxu/core.c | 17
drivers/net/wireless/realtek/rtw88/mac.c | 6
drivers/net/wireless/realtek/rtw88/main.c | 40 -
drivers/net/wireless/realtek/rtw88/reg.h | 3
drivers/net/wireless/realtek/rtw88/rtw8822b.c | 14
drivers/net/wireless/realtek/rtw88/util.c | 3
drivers/net/wireless/realtek/rtw89/coex.c | 14
drivers/net/wireless/realtek/rtw89/core.c | 23 -
drivers/net/wireless/realtek/rtw89/core.h | 2
drivers/net/wireless/realtek/rtw89/fw.c | 101 ++++
drivers/net/wireless/realtek/rtw89/fw.h | 12
drivers/net/wireless/realtek/rtw89/mac.c | 55 ++
drivers/net/wireless/realtek/rtw89/mac.h | 3
drivers/net/wireless/realtek/rtw89/mac80211.c | 1
drivers/net/wireless/realtek/rtw89/reg.h | 4
drivers/net/wireless/realtek/rtw89/regd.c | 2
drivers/net/wireless/realtek/rtw89/rtw8851b.c | 1
drivers/net/wireless/realtek/rtw89/rtw8852a.c | 1
drivers/net/wireless/realtek/rtw89/rtw8852b.c | 1
drivers/net/wireless/realtek/rtw89/rtw8852bt.c | 1
drivers/net/wireless/realtek/rtw89/rtw8852c.c | 1
drivers/net/wireless/realtek/rtw89/rtw8922a.c | 1
drivers/net/wireless/realtek/rtw89/ser.c | 4
drivers/net/wireless/virtual/mac80211_hwsim.c | 14
drivers/nvdimm/label.c | 3
drivers/nvme/host/pci.c | 6
drivers/nvme/target/tcp.c | 3
drivers/nvmem/core.c | 40 +
drivers/nvmem/qfprom.c | 26 -
drivers/nvmem/rockchip-otp.c | 17
drivers/pci/Kconfig | 6
drivers/pci/ats.c | 33 +
drivers/pci/controller/dwc/pcie-designware-ep.c | 2
drivers/pci/controller/dwc/pcie-designware-host.c | 2
drivers/pci/controller/pcie-brcmstb.c | 5
drivers/pci/controller/vmd.c | 20
drivers/pci/endpoint/functions/pci-epf-mhi.c | 2
drivers/pci/endpoint/functions/pci-epf-test.c | 2
drivers/pci/setup-bus.c | 6
drivers/perf/arm_pmuv3.c | 4
drivers/phy/phy-core.c | 7
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 95 ++--
drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 4
drivers/phy/rockchip/phy-rockchip-usbdp.c | 87 ++-
drivers/phy/samsung/phy-exynos5-usbdrd.c | 7
drivers/pinctrl/bcm/pinctrl-bcm281xx.c | 44 -
drivers/pinctrl/devicetree.c | 10
drivers/pinctrl/meson/pinctrl-meson.c | 2
drivers/pinctrl/qcom/pinctrl-msm.c | 23 -
drivers/pinctrl/renesas/pinctrl-rzg2l.c | 19
drivers/pinctrl/sophgo/pinctrl-cv18xx.c | 33 +
drivers/pinctrl/tegra/pinctrl-tegra.c | 59 ++
drivers/pinctrl/tegra/pinctrl-tegra.h | 6
drivers/platform/x86/asus-wmi.c | 11
drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c | 2
drivers/platform/x86/ideapad-laptop.c | 16
drivers/platform/x86/intel/hid.c | 21
drivers/platform/x86/think-lmi.c | 26 -
drivers/platform/x86/think-lmi.h | 1
drivers/pmdomain/core.c | 2
drivers/pmdomain/imx/gpcv2.c | 2
drivers/pmdomain/renesas/rcar-gen4-sysc.c | 5
drivers/pmdomain/renesas/rcar-sysc.c | 5
drivers/power/supply/axp20x_battery.c | 21
drivers/ptp/ptp_ocp.c | 24 -
drivers/regulator/ad5398.c | 12
drivers/remoteproc/qcom_wcnss.c | 34 +
drivers/rtc/rtc-ds1307.c | 4
drivers/rtc/rtc-rv3032.c | 2
drivers/s390/crypto/vfio_ap_ops.c | 72 ++-
drivers/scsi/lpfc/lpfc_hbadisc.c | 29 -
drivers/scsi/lpfc/lpfc_init.c | 2
drivers/scsi/mpi3mr/mpi3mr_fw.c | 8
drivers/scsi/mpt3sas/mpt3sas_ctl.c | 12
drivers/scsi/scsi_debug.c | 55 ++
drivers/scsi/scsi_sysctl.c | 4
drivers/scsi/st.c | 29 +
drivers/scsi/st.h | 2
drivers/soc/apple/rtkit-internal.h | 1
drivers/soc/apple/rtkit.c | 58 +-
drivers/soc/mediatek/mtk-mutex.c | 6
drivers/soc/samsung/exynos-asv.c | 1
drivers/soc/samsung/exynos-chipid.c | 1
drivers/soc/samsung/exynos-pmu.c | 1
drivers/soc/samsung/exynos-usi.c | 1
drivers/soc/samsung/exynos3250-pmu.c | 1
drivers/soc/samsung/exynos5250-pmu.c | 1
drivers/soc/samsung/exynos5420-pmu.c | 1
drivers/soc/ti/k3-socinfo.c | 13
drivers/soundwire/amd_manager.c | 2
drivers/soundwire/bus.c | 9
drivers/soundwire/cadence_master.c | 22
drivers/spi/spi-fsl-dspi.c | 46 +-
drivers/spi/spi-mux.c | 4
drivers/spi/spi-rockchip.c | 2
drivers/spi/spi-zynqmp-gqspi.c | 20
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 69 +--
drivers/target/iscsi/iscsi_target.c | 2
drivers/target/target_core_spc.c | 14
drivers/thermal/intel/x86_pkg_temp_thermal.c | 1
drivers/thermal/mediatek/lvts_thermal.c | 3
drivers/thermal/qoriq_thermal.c | 13
drivers/thunderbolt/retimer.c | 8
drivers/tty/serial/8250/8250_port.c | 2
drivers/tty/serial/atmel_serial.c | 2
drivers/tty/serial/imx.c | 2
drivers/tty/serial/serial_mctrl_gpio.c | 34 +
drivers/tty/serial/serial_mctrl_gpio.h | 17
drivers/tty/serial/sh-sci.c | 98 ++++
drivers/tty/serial/stm32-usart.c | 2
drivers/ufs/core/ufshcd.c | 29 +
drivers/usb/host/xhci-mem.c | 34 -
drivers/usb/host/xhci-ring.c | 12
drivers/usb/host/xhci.h | 8
drivers/vdpa/mlx5/net/mlx5_vnet.c | 3
drivers/vfio/pci/vfio_pci_config.c | 3
drivers/vfio/pci/vfio_pci_core.c | 10
drivers/vfio/pci/vfio_pci_intrs.c | 2
drivers/vhost/scsi.c | 23 -
drivers/video/fbdev/core/bitblit.c | 5
drivers/video/fbdev/core/fbcon.c | 10
drivers/video/fbdev/core/fbcon.h | 38 -
drivers/video/fbdev/core/fbcon_ccw.c | 5
drivers/video/fbdev/core/fbcon_cw.c | 5
drivers/video/fbdev/core/fbcon_ud.c | 5
drivers/video/fbdev/core/tileblit.c | 45 +
drivers/video/fbdev/fsl-diu-fb.c | 1
drivers/virtio/virtio_ring.c | 2
drivers/watchdog/aspeed_wdt.c | 81 +++
drivers/xen/pci.c | 32 +
drivers/xen/platform-pci.c | 4
drivers/xen/xenbus/xenbus_probe.c | 14
fs/btrfs/block-group.c | 18
fs/btrfs/compression.c | 2
fs/btrfs/discard.c | 34 -
fs/btrfs/disk-io.c | 28 -
fs/btrfs/extent_io.c | 7
fs/btrfs/extent_io.h | 2
fs/btrfs/scrub.c | 4
fs/btrfs/send.c | 6
fs/buffer.c | 61 +-
fs/dlm/lowcomms.c | 4
fs/erofs/internal.h | 4
fs/erofs/super.c | 46 --
fs/erofs/zdata.c | 4
fs/exfat/inode.c | 159 +++---
fs/ext4/balloc.c | 4
fs/ext4/ext4.h | 5
fs/ext4/extents.c | 19
fs/ext4/inode.c | 81 ++-
fs/ext4/mballoc.c | 3
fs/ext4/page-io.c | 16
fs/ext4/super.c | 19
fs/f2fs/sysfs.c | 74 ++-
fs/fuse/dir.c | 2
fs/gfs2/glock.c | 11
fs/jbd2/recovery.c | 11
fs/jbd2/revoke.c | 15
fs/namespace.c | 6
fs/nfs/delegation.c | 3
fs/nfs/flexfilelayout/flexfilelayout.c | 1
fs/nfs/inode.c | 2
fs/nfs/internal.h | 5
fs/nfs/nfs3proc.c | 2
fs/nfs/nfs4proc.c | 9
fs/nfs/nfs4state.c | 10
fs/nilfs2/the_nilfs.c | 3
fs/ocfs2/journal.c | 2
fs/orangefs/inode.c | 7
fs/pidfs.c | 9
fs/pstore/inode.c | 2
fs/pstore/internal.h | 4
fs/pstore/platform.c | 11
fs/smb/client/cifsacl.c | 17
fs/smb/client/cifspdu.h | 5
fs/smb/client/cifsproto.h | 7
fs/smb/client/cifssmb.c | 57 ++
fs/smb/client/connect.c | 30 +
fs/smb/client/fs_context.c | 13
fs/smb/client/fs_context.h | 3
fs/smb/client/link.c | 8
fs/smb/client/readdir.c | 7
fs/smb/client/smb1ops.c | 228 ++++++++--
fs/smb/client/smb2file.c | 11
fs/smb/client/smb2ops.c | 30 -
fs/smb/client/transport.c | 2
fs/smb/common/smb2pdu.h | 3
fs/smb/server/smb2pdu.c | 9
fs/smb/server/vfs.c | 14
include/crypto/hash.h | 3
include/drm/drm_atomic.h | 23 -
include/drm/drm_gem.h | 13
include/linux/bpf-cgroup.h | 1
include/linux/buffer_head.h | 8
include/linux/device.h | 119 -----
include/linux/device/devres.h | 129 +++++
include/linux/dma-mapping.h | 12
include/linux/err.h | 3
include/linux/highmem.h | 10
include/linux/io.h | 2
include/linux/ipv6.h | 1
include/linux/lzo.h | 8
include/linux/mfd/axp20x.h | 1
include/linux/mlx4/device.h | 2
include/linux/mlx5/eswitch.h | 2
include/linux/mlx5/fs.h | 2
include/linux/mman.h | 2
include/linux/msi.h | 33 -
include/linux/page-flags.h | 7
include/linux/pci-ats.h | 3
include/linux/perf_event.h | 8
include/linux/pnp.h | 2
include/linux/rcupdate.h | 2
include/linux/rcutree.h | 2
include/linux/spi/spi.h | 5
include/linux/trace.h | 4
include/linux/trace_seq.h | 8
include/linux/usb/r8152.h | 1
include/media/v4l2-subdev.h | 4
include/net/cfg80211.h | 3
include/net/mac80211.h | 4
include/net/xfrm.h | 1
include/rdma/uverbs_std_types.h | 2
include/sound/hda_codec.h | 1
include/sound/pcm.h | 2
include/trace/events/btrfs.h | 2
include/uapi/linux/bpf.h | 1
include/uapi/linux/iommufd.h | 14
include/uapi/linux/nl80211.h | 52 +-
include/ufs/ufs_quirks.h | 6
io_uring/fdinfo.c | 4
io_uring/io_uring.c | 12
io_uring/msg_ring.c | 1
kernel/bpf/bpf_struct_ops.c | 98 +---
kernel/bpf/cgroup.c | 33 +
kernel/bpf/hashtab.c | 2
kernel/bpf/syscall.c | 7
kernel/bpf/verifier.c | 34 +
kernel/cgroup/cgroup.c | 2
kernel/cgroup/rstat.c | 12
kernel/dma/mapping.c | 25 -
kernel/events/core.c | 98 ++--
kernel/events/hw_breakpoint.c | 5
kernel/events/ring_buffer.c | 1
kernel/exit.c | 6
kernel/fork.c | 9
kernel/padata.c | 3
kernel/printk/printk.c | 14
kernel/rcu/rcu.h | 2
kernel/rcu/tree.c | 15
kernel/rcu/tree_plugin.h | 22
kernel/sched/fair.c | 6
kernel/signal.c | 3
kernel/softirq.c | 18
kernel/time/hrtimer.c | 29 -
kernel/time/posix-timers.c | 22
kernel/time/timer_list.c | 4
kernel/trace/trace.c | 11
kernel/trace/trace.h | 16
kernel/vhost_task.c | 2
lib/dynamic_queue_limits.c | 2
lib/lzo/Makefile | 2
lib/lzo/lzo1x_compress.c | 102 +++-
lib/lzo/lzo1x_compress_safe.c | 18
mm/memcontrol.c | 6
mm/page_alloc.c | 8
mm/vmalloc.c | 13
net/bluetooth/hci_event.c | 3
net/bluetooth/l2cap_core.c | 15
net/bridge/br_mdb.c | 2
net/bridge/br_nf_core.c | 7
net/bridge/br_private.h | 1
net/can/bcm.c | 79 ++-
net/core/dev.c | 12
net/core/dev.h | 12
net/core/page_pool.c | 7
net/core/pktgen.c | 13
net/dsa/tag_ksz.c | 19
net/hsr/hsr_device.c | 2
net/hsr/hsr_forward.c | 4
net/hsr/hsr_framereg.c | 95 ++++
net/hsr/hsr_framereg.h | 8
net/hsr/hsr_main.h | 2
net/ipv4/esp4.c | 53 --
net/ipv4/fib_frontend.c | 18
net/ipv4/fib_rules.c | 4
net/ipv4/fib_trie.c | 22
net/ipv4/inet_hashtables.c | 37 +
net/ipv4/ip_gre.c | 16
net/ipv4/tcp_input.c | 56 +-
net/ipv4/xfrm4_input.c | 18
net/ipv6/esp6.c | 53 --
net/ipv6/fib6_rules.c | 4
net/ipv6/ip6_gre.c | 2
net/ipv6/ip6_output.c | 9
net/ipv6/ip6_tunnel.c | 3
net/ipv6/ip6_vti.c | 3
net/ipv6/sit.c | 8
net/ipv6/xfrm6_input.c | 18
net/llc/af_llc.c | 8
net/mac80211/driver-ops.h | 3
net/mac80211/mlme.c | 10
net/mptcp/pm_userspace.c | 8
net/netfilter/nf_conntrack_standalone.c | 12
net/sched/sch_hfsc.c | 6
net/smc/smc_pnet.c | 8
net/sunrpc/clnt.c | 3
net/sunrpc/rpcb_clnt.c | 5
net/sunrpc/sched.c | 2
net/tipc/crypto.c | 5
net/wireless/chan.c | 8
net/wireless/nl80211.c | 4
net/wireless/reg.c | 4
net/xfrm/espintcp.c | 4
net/xfrm/xfrm_policy.c | 3
net/xfrm/xfrm_state.c | 6
net/xfrm/xfrm_user.c | 12
samples/bpf/Makefile | 2
scripts/Makefile.extrawarn | 11
scripts/config | 26 -
scripts/kconfig/confdata.c | 19
scripts/kconfig/merge_config.sh | 4
security/integrity/ima/ima_main.c | 4
security/smack/smackfs.c | 21
sound/core/oss/pcm_oss.c | 3
sound/core/pcm_native.c | 11
sound/core/seq/seq_clientmgr.c | 5
sound/core/seq/seq_memory.c | 1
sound/pci/hda/hda_beep.c | 15
sound/pci/hda/patch_realtek.c | 77 +++
sound/soc/codecs/cs42l43-jack.c | 7
sound/soc/codecs/mt6359-accdet.h | 9
sound/soc/codecs/pcm3168a.c | 6
sound/soc/codecs/pcm6240.c | 28 -
sound/soc/codecs/pcm6240.h | 7
sound/soc/codecs/rt722-sdca-sdw.c | 49 ++
sound/soc/codecs/tas2764.c | 53 +-
sound/soc/codecs/wsa883x.c | 2
sound/soc/codecs/wsa884x.c | 2
sound/soc/fsl/imx-card.c | 2
sound/soc/intel/boards/bytcr_rt5640.c | 13
sound/soc/mediatek/mt8188/mt8188-afe-clk.c | 8
sound/soc/mediatek/mt8188/mt8188-afe-clk.h | 8
sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 4
sound/soc/qcom/sm8250.c | 3
sound/soc/sdw_utils/soc_sdw_cs42l43.c | 10
sound/soc/soc-dai.c | 8
sound/soc/soc-ops.c | 29 +
sound/soc/sof/intel/hda-bus.c | 2
sound/soc/sof/intel/hda.c | 16
sound/soc/sof/ipc4-control.c | 11
sound/soc/sof/ipc4-pcm.c | 3
sound/soc/sof/topology.c | 18
sound/soc/sunxi/sun4i-codec.c | 53 ++
sound/usb/midi.c | 16
tools/bpf/bpftool/common.c | 3
tools/build/Makefile.build | 6
tools/include/uapi/linux/bpf.h | 1
tools/lib/bpf/libbpf.c | 2
tools/net/ynl/lib/ynl.c | 2
tools/net/ynl/ynl-gen-c.py | 3
tools/objtool/check.c | 21
tools/power/x86/turbostat/turbostat.8 | 1
tools/power/x86/turbostat/turbostat.c | 13
tools/testing/kunit/qemu_configs/x86_64.py | 4
tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c | 1
tools/testing/selftests/iommu/iommufd.c | 4
tools/testing/selftests/net/forwarding/bridge_mdb.sh | 2
tools/testing/selftests/net/gro.sh | 3
767 files changed, 8223 insertions(+), 3618 deletions(-)
Aaradhana Sahu (1):
wifi: ath12k: Fetch regdb.bin file from board-2.bin
Aaron Kling (1):
cpufreq: tegra186: Share policy per cluster
Adrian Hunter (1):
perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
Ahmad Fatoum (2):
clk: imx8mp: inform CCF of maximum frequency of clocks
pmdomain: imx: gpcv2: use proper helper for property detection
Al Viro (2):
hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure
__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
Aleksander Jan Bajkowski (1):
r8152: add vendor/device ID pair for Dell Alienware AW1022z
Alex Deucher (5):
drm/amdgpu: adjust drm_firmware_drivers_only() handling
drm/amdgpu/gfx12: don't read registers in mqd init
drm/amdgpu/gfx11: don't read registers in mqd init
drm/amdgpu/mes11: fix set_hw_resources_1 calculation
drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer()
Alex Williamson (1):
vfio/pci: Handle INTx IRQ_NOTCONNECTED
Alexander Duyck (1):
eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs
Alexander Stein (1):
hwmon: (gpio-fan) Add missing mutex locks
Alexander Sverdlin (1):
net: ethernet: ti: cpsw_new: populate netdev of_node
Alexandre Belloni (2):
rtc: rv3032: fix EERD location
rtc: ds1307: stop disabling alarms on probe
Alexandre Ghiti (1):
riscv: Call secondary mmu notifier when flushing the tlb
Alexei Lazar (2):
net/mlx5: XDP, Enable TX side XDP multi-buffer support
net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
Alexey Klimov (1):
ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
Alexis Lothoré (1):
serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
Alice Guo (1):
thermal/drivers/qoriq: Power down TMU on system suspend
Alistair Francis (1):
nvmet-tcp: don't restore null sk_state_change
Amber Lin (1):
drm/amdkfd: Correct F8_MODE for gfx950
Amery Hung (1):
bpf: Search and add kfuncs in struct_ops prologue and epilogue
Andre Przywara (1):
clk: sunxi-ng: d1: Add missing divider for MMC mod clocks
Andreas Gruenbacher (1):
gfs2: Check for empty queue in run_queue
Andreas Schwab (1):
powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
Andrei Botila (1):
net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104
Andrew Bresticker (1):
irqchip/riscv-imsic: Start local sync timer on correct CPU
Andrew Davis (1):
soc: ti: k3-socinfo: Do not use syscon helper to build regmap
Andrew Jones (1):
irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base
Andrey Vatoropin (1):
hwmon: (xgene-hwmon) use appropriate type for the latency value
André Draszik (2):
phy: exynos5-usbdrd: fix EDS distribution tuning (gs101)
clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe()
Andy Shevchenko (6):
i2c: designware: Use temporary variable for struct device
tracing: Mark binary printing functions with __printf() attribute
auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common"
ieee802154: ca8210: Use proper setters and getters for bitwise types
hrtimers: Replace hrtimer_clock_to_base_table with switch-case
driver core: Split devres APIs to device/devres.h
Andy Yan (2):
phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set
drm/rockchip: vop2: Add uv swap for cluster window
AngeloGioacchino Del Regno (2):
soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables
drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
Anjaneyulu (1):
wifi: cfg80211: allow IR in 20 MHz configurations
Ankur Arora (3):
rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
rcu: handle unstable rdp in rcu_read_unlock_strict()
rcu: fix header guard for rcu_all_qs()
Anthony Krowiak (1):
s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log
Anup Patel (1):
irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector
Aric Cyr (1):
drm/amd/display: Request HW cursor on DCN3.2 with SubVP
Arnd Bergmann (4):
soc: samsung: include linux/array_size.h where needed
net: xgene-v2: remove incorrect ACPI_PTR annotation
EDAC/ie31200: work around false positive build warning
watchdog: aspeed: fix 64-bit division
Artur Weber (1):
pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
Asad Kamal (1):
drm/amd/pm: Skip P2S load for SMU v13.0.12
Assadian, Navid (1):
drm/amd/display: Fix mismatch type comparison
Athira Rajeev (1):
arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src
Austin Zheng (2):
drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It
drm/amd/display: Call FP Protect Before Mode Programming/Mode Support
Avraham Stern (1):
wifi: iwlwifi: mvm: fix setting the TK when associated
Avula Sri Charan (1):
wifi: ath12k: Avoid napi_sync() before napi_enable()
Axel Forsman (2):
can: kvaser_pciefd: Continue parsing DMA buf after dropped RX
can: kvaser_pciefd: Fix echo_skb race
Balbir Singh (4):
dma/mapping.c: dev_dbg support for dma_addressing_limited
dma-mapping: Fix warning reported for missing prototype
x86/kaslr: Reduce KASLR entropy on most x86 systems
x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers
Baokun Li (2):
ext4: reject the 'data_err=abort' option in nojournal mode
ext4: do not convert the unwritten extents if data writeback fails
Bard Liao (1):
soundwire: cadence_master: set frame shape and divider based on actual clk freq
Benjamin Berg (1):
um: Store full CSGSFS and SS register from mcontext
Benjamin Lin (1):
wifi: mt76: mt7996: revise TXS size
Bibo Mao (1):
MIPS: Use arch specific syscall name match function
Bitterblue Smith (6):
wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
Bogdan-Gabriel Roman (1):
spi: spi-fsl-dspi: Halt the module after a new message transfer
Boris Burkov (2):
btrfs: make btrfs_discard_workfn() block_group ref explicit
btrfs: handle empty eb->folios in num_extent_folios()
Brandon Kammerdiener (1):
bpf: fix possible endless loop in BPF map iteration
Brandon Syu (1):
Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY"
Brendan Jackman (1):
kunit: tool: Use qboot on QEMU x86_64
Breno Leitao (2):
x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
memcg: always call cond_resched() after fn()
Caleb Sander Mateos (1):
ublk: complete command synchronously on error
Carlos Sanchez (1):
can: slcan: allow reception of short error messages
Carolina Jubran (1):
net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
Cezary Rojewski (1):
ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode
Chaohai Chen (1):
scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr()
Charlene Liu (3):
drm/amd/display: remove minimum Dispclk and apply oem panel timing.
drm/amd/display: fix dcn4x init failed
drm/amd/display: pass calculated dram_speed_mts to dml2
Charles Keepax (3):
ASoC: rt722-sdca: Add some missing readable registers
ASoC: cs42l43: Disable headphone clamps during type detection
soundwire: bus: Fix race on the creation of the IRQ domain
Chen Linxuan (1):
blk-cgroup: improve policy registration error handling
Chenyuan Yang (1):
ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
Chin-Ting Kuo (1):
watchdog: aspeed: Update bootstatus handling
Ching-Te Ku (2):
wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang
wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event
Choong Yong Liang (1):
net: phylink: use pl->link_interface in phylink_expects_phy()
Chris Lu (2):
Bluetooth: btmtksdio: Check function enabled before doing close
Bluetooth: btmtksdio: Do close if SDIO card removed without close
Chris Morgan (2):
power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree
mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs
Christian Brauner (1):
pidfs: improve multi-threaded exec and premature thread-group leader exit polling
Christian Bruel (1):
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
Christian Göttsche (1):
ext4: reorder capability check last
Christian König (1):
drm/amdgpu: remove all KFD fences from the BO on release
Christoph Hellwig (3):
block: mark bounce buffering as incompatible with integrity
loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize
loop: don't require ->write_iter for writable files in loop_configure
Christophe JAILLET (1):
i2c: designware: Fix an error handling path in i2c_dw_pci_probe()
ChunHao Lin (1):
r8169: disable RTL8126 ZRX-DC timeout
Chung Chung (1):
dm vdo indexer: prevent unterminated string warning
Claudiu Beznea (5):
phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data
phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
serial: sh-sci: Update the suspend/resume support
pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down
Coly Li (1):
badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0
Cong Wang (1):
sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
Cristian Ciocaltea (1):
drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0
Csókás, Bence (1):
net: fec: Refactor MAC reset to function
Damon Ding (1):
phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF
Dan Carpenter (2):
pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
Daniel Gabay (1):
wifi: iwlwifi: w/a FW SMPS mode selection
Daniel Gomez (2):
kconfig: merge_config: use an empty file as initfile
drm/xe: xe_gen_wa_oob: replace program_invocation_short_name
Daniel Hsu (1):
mctp: Fix incorrect tx flow invalidation condition in mctp-i2c
Danny Wang (1):
drm/amd/display: Do not enable replay when vtotal update is pending.
Darrick J. Wong (1):
block: fix race between set_blocksize and read paths
Dave Ertman (1):
ice: Fix LACP bonds without SRIOV environment
Dave Jiang (1):
dmaengine: idxd: Fix ->poll() return value
David Hildenbrand (1):
kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
David Lechner (1):
iio: adc: ad7944: don't use storagebits for sizing
David Plowman (1):
media: i2c: imx219: Correct the minimum vblanking value
David Rosca (1):
drm/amdgpu: Update SRIOV video codec caps
David Wei (1):
tools: ynl-gen: validate 0 len strings from kernel
Davidlohr Bueso (6):
fs/buffer: split locking for pagecache lookups
fs/buffer: introduce sleeping flavors for pagecache lookups
fs/buffer: use sleeping version of __find_get_block()
fs/ocfs2: use sleeping version of __find_get_block()
fs/jbd2: use sleeping version of __find_get_block()
fs/ext4: use sleeping version of sb_find_get_block()
Depeng Shao (2):
media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available
media: qcom: camss: Add default case in vfe_src_pad_code
Dhananjay Ugwekar (1):
cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost
Dian-Syuan Yang (1):
wifi: rtw89: set force HE TB mode when connecting to 11ax AP
Dillon Varone (4):
drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401
drm/amd/display: Fix DMUB reset sequence for DCN401
drm/amd/display: Fix p-state type when p-state is unsupported
drm/amd/display: Populate register address for dentist for dcn401
Diogo Ivo (2):
ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list
arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
Dmitry Baryshkov (6):
nvmem: core: fix bit offsets of more than one byte
nvmem: core: verify cell's raw_len
nvmem: core: update raw_len if the bit reading is required
nvmem: qfprom: switch to 4-byte aligned reads
phy: core: don't require set_mode() callback for phy_get_mode() to work
pinctrl: qcom: switch to devm_register_sys_off_handler()
Dmitry Bogdanov (1):
scsi: target: iscsi: Fix timeout on deleted connection
Dominik Grzegorzek (1):
padata: do not leak refcount in reorder_work
Dongli Zhang (1):
vhost-scsi: protect vq->log_used with vq->mutex
Douglas Anderson (1):
drm/panel-edp: Add Starry 116KHD024006
Ed Burcher (1):
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
Eddie James (1):
eeprom: ee1004: Check chip before probing
Eduard Zingerman (3):
bpf: don't do clean_live_states when state->loop_entry->branches > 0
bpf: copy_verifier_state() should copy 'loop_entry' field
bpf: abort verification if env->cur_state->loop_entry != NULL
Emily Deng (1):
drm/amdgpu: Fix missing drain retry fault the last entry
Emmanuel Grumbach (2):
wifi: iwlwifi: fix the ECKV UEFI variable name
wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx
En-Wei Wu (1):
Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling
Eric Dumazet (5):
cgroup/rstat: avoid disabling irqs for O(num_cpu)
posix-timers: Add cond_resched() to posix_timer_add() search loop
tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
net: flush_backlog() small changes
idpf: fix idpf_vport_splitq_napi_poll()
Eric Huang (1):
drm/amdkfd: fix missing L2 cache info in topology
Eric Woudstra (1):
net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only
Erick Shepherd (2):
mmc: host: Wait for Vdd to settle on card power off
mmc: sdhci: Disable SD card clock before changing parameters
Felix Fietkau (1):
wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
Felix Kuehling (1):
drm/amdgpu: Allow P2P access through XGMI
Filipe Manana (3):
btrfs: fix non-empty delayed iputs list on unmount due to async workers
btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work()
btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
Flora Cui (2):
drm/amdgpu/discovery: check ip_discovery fw file available
drm/amdgpu: release xcp_mgr on exit
Frank Li (3):
PCI: dwc: ep: Ensure proper iteration over outbound map windows
PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off()
i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA)
Frederick Lawler (1):
ima: process_measurement() needlessly takes inode_lock() on MAY_READ
Frediano Ziglio (1):
xen: Add support for XenServer 6.1 platform device
Gabor Juhos (1):
arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
Gao Xiang (1):
erofs: initialize decompression early
Gaurav Batra (2):
powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory
powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits
Gašper Nemgar (1):
platform/x86: ideapad-laptop: add support for some new buttons
Geert Uytterhoeven (3):
ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only
pmdomain: renesas: rcar: Remove obsolete nullify checks
serial: sh-sci: Save and restore more registers
Geetha sowjanya (1):
octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
George Shen (3):
drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination
drm/amd/display: Read LTTPR ALPM caps during link cap retrieval
drm/amd/display: Update CR AUX RD interval interpretation
Goldwyn Rodrigues (1):
btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
Greg Kroah-Hartman (2):
spi: use container_of_cont() for to_spi_device()
Linux 6.12.31
Guangguan Wang (1):
net/smc: use the correct ndev to find pnetid by pnetid table
Hangbin Liu (1):
bonding: report duplicate MAC address in all situations
Hans Verkuil (2):
media: cx231xx: set device_caps for 417
media: test-drivers: vivid: don't call schedule in loop
Hans de Goede (1):
mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type
Hans-Frieder Vogt (2):
net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards
net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus
Haoran Jiang (1):
samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
Hariprasad Kelam (1):
Octeontx2-af: RPM: Register driver with PCI subsys IDs
Harish Kasiviswanathan (3):
drm/amdkfd: Set per-process flags only once for gfx9/10/11/12
drm/amdkfd: Set per-process flags only once cik/vi
drm/amdgpu: Set snoop bit for SDMA for MI series
Harry VanZyllDeJong (1):
drm/amd/display: Add support for disconnected eDP streams
Harry Wentland (1):
drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink
Hector Martin (4):
soc: apple: rtkit: Implement OSLog buffers properly
ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG
ASoC: tas2764: Mark SW_RESET as volatile
ASoC: tas2764: Power up/down amp on mute ops
Heiko Carstens (1):
s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste()
Heiko Stuebner (2):
nvmem: rockchip-otp: Move read-offset into variant-data
nvmem: rockchip-otp: add rk3576 variant data
Heiner Kallweit (1):
r8169: don't scan PHY addresses > 0
Heming Zhao (1):
dlm: make tcp still work in multi-link env
Herbert Xu (3):
crypto: lzo - Fix compression buffer overrun
crypto: ahash - Set default reqsize from ahash_alg
crypto: skcipher - Zap type in crypto_alloc_sync_skcipher
Huacai Chen (1):
net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size
Ian Rogers (1):
tools/build: Don't pass test log files to linker
Ido Schimmel (2):
vxlan: Annotate FDB data races
bridge: netfilter: Fix forwarding of fragmented packets
Ignacio Moreno Gonzalez (1):
mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled
Ihor Solodrai (1):
selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure
Ilan Peer (1):
wifi: mac80211_hwsim: Fix MLD address translation
Ilia Gavrilov (1):
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
Ilpo Järvinen (2):
tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
PCI: Fix old_size lower bound in calculate_iosize() too
Ilya Bakoulin (2):
drm/amd/display: Fix BT2020 YCbCr limited/full range input
drm/amd/display: Don't try AUX transactions on disconnected link
Ingo Molnar (1):
x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP
Inochi Amaoto (1):
pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf
Isaac Scott (1):
regulator: ad5398: Add device tree support
Ivan Pravdin (1):
crypto: algif_hash - fix double free in hash_accept
Jaakko Karrenpalo (1):
net: hsr: Fix PRP duplicate detection
Jacob Keller (1):
ice: fix vf->num_mac count with port representors
Jaegeuk Kim (1):
f2fs: introduce f2fs_base_attr for global sysfs entries
Jakob Unterwurzacher (1):
net: dsa: microchip: linearize skb for tail-tagging switches
Jakub Kicinski (3):
eth: mlx4: don't try to complete XDP frames in netpoll
net: page_pool: avoid false positive warning if NAPI was never added
tools: ynl-gen: don't output external constants
Jan Kara (1):
jbd2: do not try to recover wiped journal
Janne Grunau (1):
soc: apple: rtkit: Use high prio work queue
Jason Andryuk (1):
xenbus: Allow PVH dom0 a non-local xenstore
Jason Gunthorpe (1):
genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
Jeff Chen (1):
wifi: mwifiex: Fix HT40 bandwidth issue.
Jens Axboe (1):
io_uring/fdinfo: annotate racy sq/cq head/tail reads
Jernej Skrabec (1):
Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
Jessica Zhang (1):
drm: Add valid clones check
Jianbo Liu (1):
net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode
Jiang Liu (1):
drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
Jiasheng Jiang (1):
dpll: Add an assertion to check freq_supported_num
Jing Su (1):
dql: Fix dql->limit value when reset.
Jing Zhou (1):
drm/amd/display: Guard against setting dispclk low for dcn31x
Jinliang Zheng (1):
dm: fix unconditional IO throttle caused by REQ_PREFLUSH
Jinqian Yang (1):
arm64: Add support for HIP09 Spectre-BHB mitigation
Johannes Berg (7):
wifi: iwlwifi: fix debug actions order
wifi: iwlwifi: mark Br device not integrated
wifi: mac80211: fix warning on disconnect during failed ML reconf
wifi: iwlwifi: use correct IMR dump variable
wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
wifi: iwlwifi: add support for Killer on MTL
Johannes Thumshirn (1):
block: only update request sector if needed
John Olender (1):
drm/amd/display: Defer BW-optimization-blocked DRR adjustments
Jon Hunter (1):
arm64: tegra: Resize aperture for the IGX PCIe C5 slot
Jonas Karlman (1):
net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe
Jonathan Kim (1):
drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12
Jonathan McDowell (1):
tpm: Convert warn to dbg in tpm2_start_auth_session()
Jordan Crouse (1):
clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
Josh Poimboeuf (2):
objtool: Properly disable uaccess validation
objtool: Fix error handling inconsistencies in check()
Joshua Aberback (1):
drm/amd/display: Increase block_sequence array size
Justin Tee (3):
scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk
scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when pci_irq_vector() fails
Kai Mäkisara (4):
scsi: st: Tighten the page format heuristics with MODE SELECT
scsi: st: ERASE does not change tape location
scsi: scsi_debug: First fixes for tapes
scsi: st: Restore some drive settings after reset
Kai Vehmanen (1):
ASoc: SOF: topology: connect DAI to a single DAI link
Karl Chan (1):
clk: qcom: ipq5018: allow it to be bulid on arm32
Kaustabh Chakraborty (1):
mmc: dw_mmc: add exynos7870 DW MMC support
Kees Cook (6):
PNP: Expand length of fixup id string
net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
pstore: Change kmsg_bytes storage size to u32
btrfs: compression: adjust cb->compressed_folios allocation type
mm: vmalloc: actually use the in-place vrealloc region
mm: vmalloc: only zero-init on vrealloc shrink
Kevin Krakauer (1):
selftests/net: have `gro.sh -t` return a correct exit code
Konstantin Andreev (2):
smack: recognize ipv4 CIPSO w/o categories
smack: Revert "smackfs: Added check catlen"
Konstantin Shkolnyy (1):
vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines
Konstantin Taranov (1):
net/mana: fix warning in the writer of client oob
Krzysztof Kozlowski (4):
ASoC: codecs: wsa884x: Correct VI sense channel mask
ASoC: codecs: wsa883x: Correct VI sense channel mask
can: c_can: Use of_property_present() to test existence of DT property
clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate
Kuan-Chung Chen (1):
wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU
Kuhanh Murugasen Krishnan (1):
fpga: altera-cvp: Increase credit timeout
Kuninori Morimoto (1):
ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
Kuniyuki Iwashima (2):
ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
Kurt Borja (1):
hwmon: (dell-smm) Increment the number of fans
Lad Prabhakar (1):
clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation
Larisa Grigore (2):
spi: spi-fsl-dspi: restrict register range for regmap access
spi: spi-fsl-dspi: Reset SR flags before sending a new message
Len Brown (1):
tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options
Leo Zeng (1):
Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP"
Leon Huang (1):
drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch
Leon Romanovsky (1):
xfrm: prevent high SEQ input in non-ESN mode
Li Bin (1):
ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
Lijo Lazar (2):
drm/amd/pm: Fetch current power limit from PMFW
drm/amdgpu: Use active umc info from discovery
Lin.Cao (1):
drm/buddy: fix issue that force_merge cannot free all roots
Linus Torvalds (3):
gcc-15: make 'unterminated string initialization' just a warning
gcc-15: disable '-Wunterminated-string-initialization' entirely for now
Fix mis-uses of 'cc-option' for warning disablement
Linus Walleij (1):
ASoC: pcm6240: Drop bogus code handling IRQ as GPIO
Lorenzo Stoakes (1):
intel_th: avoid using deprecated page->mapping, index fields
Lucas De Marchi (2):
drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init()
drm/xe: Fix xe_tile_init_noalloc() error propagation
Luis de Arquer (1):
spi-rockchip: Fix register out of bounds access
Luiz Augusto von Dentz (1):
Bluetooth: L2CAP: Fix not checking l2cap_chan security level
Maarten Lankhorst (2):
drm/xe: Move suballocator init to after display init
drm/xe: Do not attempt to bootstrap VF in execlists mode
Maciej S. Szmigiero (1):
ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7
Maher Sanalla (1):
RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
Manish Pandey (1):
scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices
Marcos Paulo de Souza (1):
printk: Check CON_SUSPEND when unblanking a console
Marek Szyprowski (1):
dma-mapping: avoid potential unused data compilation warning
Marek Vasut (1):
leds: trigger: netdev: Configure LED blink interval for HW offload
Mario Limonciello (1):
Revert "drm/amd: Keep display off while going into S4"
Mark Harmstone (1):
btrfs: avoid linker error in btrfs_find_create_tree_block()
Mark Pearson (1):
platform/x86: think-lmi: Fix attribute name usage for non-compliant items
Markus Elfring (1):
media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
Martin Blumenstingl (1):
pinctrl: meson: define the pull up/down resistor value as 60 kOhm
Martin KaFai Lau (1):
bpf: Use kallsyms to find the function name of a struct_ops's stub function
Martin Povišer (1):
ASoC: ops: Enforce platform maximum on initial value
Martin Tsai (1):
drm/amd/display: Support multiple options during psr entry.
Masahiro Yamada (1):
kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf
Matt Johnston (1):
fuse: Return EPERM rather than ENOSYS from link()
Matthew Brost (2):
drm/xe: Nuke VM's mapping upon close
drm/xe: Retry BO allocation
Matthew Sakai (1):
dm vdo: use a short static string for thread name prefix
Matthew Wilcox (Oracle) (2):
orangefs: Do not truncate file size
highmem: add folio_test_partial_kmap()
Matthias Fend (1):
media: tc358746: improve calculation of the D-PHY timing registers
Matthieu Baerts (NGI0) (1):
mptcp: pm: userspace: flags: clearer msg if no remote addr
Matti Lehtimäki (2):
remoteproc: qcom_wcnss: Handle platforms with only single power domain
remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
Michael Margolin (1):
RDMA/core: Fix best page size finding when it can cross SG entries
Michal Pecio (1):
usb: xhci: Don't change the status of stalled TDs on failed Stop EP
Michal Swiatkowski (3):
ice: init flow director before RDMA
ice: treat dyn_allowed only as suggestion
ice: count combined queues using Rx/Tx count
Michal Wajdeczko (3):
drm/xe/relay: Don't use GFP_KERNEL for new transactions
drm/xe/pf: Reset GuC VF config when unprovisioning critical resource
drm/xe/sa: Always call drm_suballoc_manager_fini()
Mika Westerberg (1):
thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer
Mike Christie (1):
vhost-scsi: Return queue full for page alloc failures during copy
Mikulas Patocka (1):
dm: restrict dm device size to 2^63-512 bytes
Ming Lei (1):
blk-throttle: don't take carryover for prioritized processing of metadata
Ming Yen Hsieh (1):
wifi: mt76: mt7925: load the appropriate CLC data based on hardware type
Ming-Hung Tsai (1):
dm cache: prevent BUG_ON by blocking retries on failed device resumes
Miri Korenblit (2):
wifi: iwlwifi: don't warn when if there is a FW error
wifi: iwlwifi: don't warn during reprobe
Moshe Shemesh (1):
net/mlx5: Avoid report two health errors on same syndrome
Mrinmay Sarkar (1):
PCI: epf-mhi: Update device ID for SA8775P
Mykyta Yatsenko (1):
bpf: Return prog btf_id without capable check
Naman Trivedi (1):
arm64: zynqmp: add clock-output-names property in clock nodes
Namjae Jeon (2):
cifs: add validation check for the fields in smb_aces
ksmbd: fix stream write failure
Nandakumar Edamana (1):
libbpf: Fix out-of-bound read
Nathan Chancellor (2):
kbuild: Properly disable -Wunterminated-string-initialization for clang
i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
Nicholas Kazlauskas (2):
drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35
drm/amd/display: Guard against setting dispclk low when active
Nicholas Susanto (1):
drm/amd/display: Enable urgent latency adjustment on DCN35
Nick Hu (1):
clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug
Nicolas Bouchinet (2):
netfilter: conntrack: Bound nf_conntrack sysctl writes
scsi: logging: Fix scsi_logging_level bounds
Nicolas Bretz (1):
ext4: on a remount, only log the ro or r/w state when it has changed
Nicolas Escande (1):
wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override
Niklas Cassel (1):
misc: pci_endpoint_test: Give disabled BARs a distinct error code
Niklas Neronin (1):
usb: xhci: set page size to the xHCI-supported size
Niklas Söderlund (1):
media: adv7180: Disable test-pattern control on adv7180
Nir Lichtman (1):
x86/build: Fix broken copy command in genimage.sh when making isoimage
Nícolas F. R. A. Prado (4):
thermal/drivers/mediatek/lvts: Start sensor interrupts disabled
ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile
ASoC: mediatek: mt8188: Add reference for dmic clocks
Oak Zeng (1):
drm/xe: Reject BO eviction if BO is bound to current VM
Oliver Hartkopp (2):
can: bcm: add locking for bcm_op runtime updates
can: bcm: add missing rcu read protection for procfs content
Olivier Moysan (1):
drm: bridge: adv7511: fill stream capabilities
Ovidiu Bunea (1):
drm/amd/display: Exit idle optimizations before accessing PHY
P Praneesh (3):
wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV
wifi: ath12k: Fix end offset bit definition in monitor ring descriptor
wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation
Pali Rohár (7):
cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES
cifs: Fix querying and creating MF symlinks over SMB1
cifs: Fix negotiate retry functionality
cifs: Set default Netbios RFC1001 server name to hostname in UNC
cifs: Fix establishing NetBIOS session for SMB2+ connection
cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info()
cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function
Patrisious Haddad (1):
net/mlx5: Change POOL_NEXT_SIZE define value and make it global
Paul Burton (2):
MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
clocksource: mips-gic-timer: Enable counter when CPUs start
Paul Chaignon (1):
xfrm: Sanitize marks before insert
Paul E. McKenney (1):
rcu: Fix get_state_synchronize_rcu_full() GP-start detection
Paul Elder (1):
media: imx335: Set vblank immediately
Paul Kocialkowski (1):
net: dwmac-sun8i: Use parsed internal PHY address instead of 1
Pavan Kumar Linga (1):
idpf: fix null-ptr-deref in idpf_features_check
Pavel Begunkov (3):
io_uring: don't duplicate flushing in io_req_post_cqe
io_uring/msg: initialise msg request opcode
io_uring: fix overflow resched cqe reordering
Pavel Nikulin (1):
platform/x86: asus-wmi: Disable OOBE state after resume from hibernation
Paweł Anikiel (1):
x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88
Pedro Nishiyama (1):
Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
Peichen Huang (1):
drm/amd/display: not abort link train when bw is low
Pengyu Luo (1):
cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist
Peter Seiderer (2):
net: pktgen: fix mpls maximum labels list parsing
net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
Peter Ujfalusi (3):
ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext
ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms
ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction
Peter Zijlstra (3):
perf/core: Clean up perf_try_init_event()
x86/ibt: Handle FineIBT in handle_cfi_failure()
x86/traps: Cleanup and robustify decode_bug()
Peter Zijlstra (Intel) (1):
perf: Avoid the read if the count is already updated
Petr Machata (2):
vxlan: Join / leave MC group after remote changes
bridge: mdb: Allow replace of a host-joined group
Philip Redkin (1):
x86/mm: Check return value from memblock_phys_alloc_range()
Philip Yang (1):
drm/amdkfd: KFD release_work possible circular locking
Ping-Ke Shih (7):
wifi: rtw89: fw: propagate error code from rtw89_h2c_tx()
wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32()
wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware
wifi: rtw89: fw: validate multi-firmware header before getting its size
wifi: rtw89: fw: validate multi-firmware header before accessing
wifi: rtw89: call power_on ahead before selecting firmware
wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet
Prathamesh Shete (1):
pinctrl-tegra: Restore SFSEL bit when freeing pins
Qu Wenruo (2):
btrfs: run btrfs_error_commit_super() early
btrfs: avoid NULL pointer dereference if no valid csum tree
Quan Zhou (1):
wifi: mt76: mt7925: fix fails to enter low power mode in suspend state
Raag Jadav (2):
devres: Introduce devm_kmemdup_array()
err.h: move IOMEM_ERR_PTR() to err.h
Rafael J. Wysocki (1):
cpuidle: menu: Avoid discarding useful information
Ramasamy Kaliappan (1):
wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band
Ranjan Kumar (2):
scsi: mpi3mr: Add level check to control event logging
scsi: mpi3mr: Update timestamp only for supervisor IOCs
Ravi Bangoria (2):
perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
perf/amd/ibs: Fix ->config to sample period calculation for OP PMU
Rex Lu (1):
wifi: mt76: mt7996: fix SER reset trigger on WED reset
Ricardo Ribalda (2):
media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value
Ritesh Harjani (IBM) (1):
book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n
Rob Herring (Arm) (1):
perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters
Robert Richter (1):
libnvdimm/labels: Fix divide error in nd_label_data_init()
Robin Murphy (1):
iommu: Keep dev->iommu state consistent
Roger Pau Monne (2):
PCI: vmd: Disable MSI remapping bypass under Xen
xen/pci: Do not register devices with segments >= 0x10000
Ronak Doshi (1):
vmxnet3: update MTU after device quiesce
Rosen Penev (1):
wifi: ath9k: return by of_get_mac_address
Ryan Roberts (2):
arm64/mm: Check pmd_table() in pmd_trans_huge()
arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
Ryan Walklin (1):
ASoC: sun4i-codec: support hp-det-gpios property
Ryo Takakura (1):
lockdep: Fix wait context check on softirq for PREEMPT_RT
Ryusuke Konishi (1):
nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
Sabrina Dubroca (2):
espintcp: fix skb leaks
espintcp: remove encap socket caching to avoid reference leak
Sagi Maimon (1):
ptp: ocp: Limit signal/freq counts in summary output functions
Sakari Ailus (1):
media: v4l: Memset argument to 0 before calling get_mbus_config pad op
Saket Kumar Bhaskar (1):
perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type
Salah Triki (1):
smb: server: smb2pdu: check return value of xa_store()
Samuel Holland (1):
riscv: Allow NOMMU kernels to access all of RAM
Saranya Gopal (1):
platform/x86/intel: hid: Add Pantherlake support
Satyanarayana K V P (2):
drm/xe/vf: Retry sending MMIO request to GUC on timeout error
drm/xe/pf: Create a link between PF and VF devices
Sean Anderson (1):
spi: zynqmp-gqspi: Always acknowledge interrupts
Sean Wang (1):
Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal
Seongman Lee (1):
x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro
Sergio Perez Gonzalez (1):
spi: spi-mux: Fix coverity issue, unchecked return value
Seyediman Seyedarab (1):
kbuild: fix argument parsing in scripts/config
Shahar Shitrit (2):
net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
net/mlx5: Apply rate-limiting to high temperature warning
Shashank Gupta (1):
crypto: octeontx2 - suppress auth failure screaming due to negative tests
Shivasharan S (1):
scsi: mpt3sas: Send a diag reset if target reset fails
Shiwu Zhang (1):
drm/amdgpu: enlarge the VBIOS binary size limit
Shixiong Ou (1):
fbdev: fsl-diu-fb: add missing device_remove_file()
Shree Ramamoorthy (1):
mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check
Shuicheng Lin (1):
drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set
Simona Vetter (1):
drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
Siva Durga Prasad Paladugu (1):
firmware: xilinx: Dont send linux address to get fpga config get status
Soeren Moch (1):
wifi: rtl8xxxu: retry firmware download on error
Sohil Mehta (2):
x86/smpboot: Fix INIT delay assignment for extended Intel Families
x86/microcode: Update the Intel processor flag scan check
Stanimir Varbanov (2):
PCI: brcmstb: Expand inbound window size up to 64GB
PCI: brcmstb: Add a softdep to MIP MSI-X driver
Stanley Chu (1):
i3c: master: svc: Fix missing STOP for master request
Stefan Binding (1):
ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers
Stefan Wahren (3):
staging: vchiq_arm: Create keep-alive thread during probe
drm/v3d: Add clock handling
dmaengine: fsl-edma: Fix return code for unhandled interrupts
Stefano Garzarella (1):
vhost_task: fix vhost_task_create() documentation
Stephan Gerhold (1):
i2c: qup: Vote for interconnect bandwidth to DRAM
Subbaraya Sundeep (1):
octeontx2-af: Set LMT_ENA bit for APR table entries
Sudeep Holla (4):
mailbox: pcc: Use acpi_os_ioremap() instead of ioremap()
firmware: arm_ffa: Reject higher major version as incompatible
firmware: arm_ffa: Handle the presence of host partition in the partition info
firmware: arm_scmi: Relax duplicate name constraint across protocol ids
Suman Ghosh (1):
octeontx2-pf: Add AF_XDP non-zero copy support
Sungjong Seo (1):
exfat: call bh_read in get_block only when necessary
Sven Schwermer (1):
crypto: mxs-dcp - Only set OTP_KEY bit for OTP key
Svyatoslav Ryhel (1):
ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
Takashi Iwai (5):
ALSA: seq: Improve data consistency at polling
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
ALSA: usb-audio: Fix duplicated name in MIDI substream names
ALSA: pcm: Fix race of buffer access at PCM OSS layer
Taniya Das (1):
clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490
Tavian Barnes (1):
ASoC: SOF: Intel: hda: Fix UAF when reloading module
Thangaraj Samynathan (1):
net: lan743x: Restore SGMII CTRL register on resume
Thomas Gleixner (1):
posix-timers: Ensure that timer initialization is fully visible
Thomas Huth (1):
x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers
Thomas Weißschuh (1):
timer_list: Don't use %pK through printk()
Thomas Zimmermann (3):
drm/gem: Test for imported GEM buffers with helper
drm/ast: Find VBIOS mode from regular display size
drm/gem: Internally test import_attach for imported objects
Tianyang Zhang (1):
mm/page_alloc.c: avoid infinite retries caused by cpuset race
Tiwei Bie (1):
um: Update min_low_pfn to match changes in uml_reserved
Tobias Brunner (1):
xfrm: Fix UDP GRO handling for some corner cases
Tom Chung (1):
drm/amd/display: Initial psr_version with correct setting
Trond Myklebust (7):
NFSv4: Check for delegation validity in nfs_start_delegation_return_locked()
NFS: Don't allow waiting for exiting tasks
SUNRPC: Don't allow waiting for exiting tasks
NFSv4: Treat ENETUNREACH errors as fatal for state recovery
SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
SUNRPC: rpcbind should never reset the port to the value '0'
pNFS/flexfiles: Report ENETDOWN as a connection error
Tudor Ambarus (1):
mailbox: use error ret code of of_parse_phandle_with_args()
Uday Shankar (1):
ublk: enforce ublks_max only for unprivileged devices
Umesh Nerlige Ramappa (1):
drm/xe/oa: Ensure that polled read returns latest data
Uros Bizjak (1):
x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op()
Valentin Caron (1):
pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
Vasant Hegde (1):
iommu/amd/pgtbl_v2: Improve error handling
Vicki Pfau (1):
Input: xpad - add more controllers
Victor Lu (1):
drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
Victor Skvortsov (1):
drm/amdgpu: Skip pcie_replay_count sysfs creation for VF
Vijendar Mukunda (1):
soundwire: amd: change the soundwire wake enable/disable sequence
Viktor Malik (1):
bpftool: Fix readlink usage in get_fd_type
Vinicius Costa Gomes (1):
dmaengine: idxd: Fix allowing write() from different address spaces
Vinith Kumar R (1):
wifi: ath12k: Report proper tx completion status to mac80211
Viresh Kumar (1):
firmware: arm_ffa: Set dma_mask for ffa devices
Vitalii Mordan (1):
i2c: pxa: fix call balance of i2c->clk handling routines
Vladimir Kondratiev (1):
irqchip/riscv-aplic: Add support for hart indexes
Vladimir Moskovkin (1):
platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store()
Vladimir Oltean (1):
net: enetc: refactor bulk flipping of RX buffers to separate function
Waiman Long (1):
x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
Wang Liang (1):
net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
Wang Zhaolong (3):
smb: client: Store original IO parameters and prevent zero IO sizes
smb: client: Fix use-after-free in cifs_fill_dirent
smb: client: Reset all search buffer pointers when releasing buffer
Wentao Guan (2):
nvme-pci: add quirks for device 126f:1001
nvme-pci: add quirks for WDC Blue SN550 15b7:5009
Willem de Bruijn (1):
ipv6: save dontfrag in cork
William Tu (3):
net/mlx5e: set the tx_queue_len for pfifo_fast
net/mlx5e: reduce rep rxq depth to 256 for ECPF
net/mlx5e: reduce the max log mpwrq sz for ECPF and reps
Xiao Liang (1):
net: ipv6: Init tunnel link-netns before registering dev
Xiaofei Tan (1):
ACPI: HED: Always initialize before evged
Xin Li (Intel) (1):
x86/fred: Fix system hang during S4 resume with FRED enabled
Xin Wang (1):
drm/xe/debugfs: fixed the return value of wedged_mode_set
Yeoreum Yun (1):
coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t
Yi Liu (2):
iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability
iommufd: Disallow allocating nested parent domain with fault ID
Yihan Zhu (1):
drm/amd/display: handle max_downscale_src_width fail check
Yonghong Song (1):
bpf: Allow pre-ordering for bpf cgroup progs
Youssef Samir (1):
accel/qaic: Mask out SR-IOV PCI resources
Yuanjun Gong (1):
leds: pwm-multicolor: Add check for fwnode_property_read_u32
Zhang Rui (1):
thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature
Zhang Yi (2):
ext4: don't write back data before punch hole in nojournal mode
ext4: remove writable userspace mappings before truncating page cache
Zhi Wang (1):
drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE
Zhikai Zhai (1):
drm/amd/display: calculate the remain segments for all pipes
Zhongqiu Han (1):
virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
Zhongwei Zhang (1):
drm/amd/display: Correct timing_adjust_pending flag setting.
Zsolt Kajtar (2):
fbcon: Use correct erase colour for clearing in fbcon
fbdev: core: tileblit: Implement missing margin clearing for tileblit
feijuan.li (1):
drm/edid: fixed the bug that hdr metadata was not reset
gaoxu (1):
cgroup: Fix compilation issue due to cgroup_mutex not being exported
junan (1):
HID: usbkbd: Fix the bit shift number for LED_KANA
shantiprasad shettar (1):
bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set
zihan zhou (1):
sched: Reduce the default slice to avoid tasks getting an extra tick
7 months, 2 weeks
- 1
- 1
[PATCH -stable,5.4 0/3] Netfilter fixes for -stable
by Pablo Neira Ayuso
Hi Greg, Sasha,
This batch contains a backport fix for 5.4 -stable.
The following list shows the backported patches, I am using original commit
IDs for reference:
1) 8965d42bcf54 ("netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx")
This is a stable dependency for the next patch.
2) c03d278fdf35 ("netfilter: nf_tables: wait for rcu grace period on net_device removal")
3) b04df3da1b5c ("netfilter: nf_tables: do not defer rule destruction via call_rcu")
This is a fix-for-fix for patch 2.
These three patches are required to fix the netdevice release path for
netdev family basechains.
NOTE: -stable kernels >= 5.4 already provide these backport fixes.
Please, apply,
Thanks
** BLURB HERE ***
Florian Westphal (2):
netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
netfilter: nf_tables: do not defer rule destruction via call_rcu
Pablo Neira Ayuso (1):
netfilter: nf_tables: wait for rcu grace period on net_device removal
net/netfilter/nf_tables_api.c | 51 ++++++++++++++++++++++++-----------
1 file changed, 36 insertions(+), 15 deletions(-)
--
2.30.2
7 months, 2 weeks
- 1
- 3
[PATCH] leds: flash: leds-qcom-flash: Fix registry access after re-bind
by Krzysztof Kozlowski
Driver in probe() updates each of 'reg_field' with 'reg_base':
for (i = 0; i < REG_MAX_COUNT; i++)
regs[i].reg += reg_base;
'reg_field' array (under variable 'regs' above) is statically allocated,
this each re-bind would add another 'reg_base' leading to bogus
register addresses. Constify the local 'reg_field' array and duplicate
it in probe to solve this.
Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
---
This is a nice example why constifying static memory is useful.
---
drivers/leds/flash/leds-qcom-flash.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c
index b4c19be51c4d..b8a48c15d797 100644
--- a/drivers/leds/flash/leds-qcom-flash.c
+++ b/drivers/leds/flash/leds-qcom-flash.c
@@ -117,7 +117,7 @@ enum {
REG_MAX_COUNT,
};
-static struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
+static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
REG_FIELD(0x08, 0, 7), /* status1 */
REG_FIELD(0x09, 0, 7), /* status2 */
REG_FIELD(0x0a, 0, 7), /* status3 */
@@ -132,7 +132,7 @@ static struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */
};
-static struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = {
+static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = {
REG_FIELD(0x06, 0, 7), /* status1 */
REG_FIELD(0x07, 0, 6), /* status2 */
REG_FIELD(0x09, 0, 7), /* status3 */
@@ -854,11 +854,17 @@ static int qcom_flash_led_probe(struct platform_device *pdev)
if (val == FLASH_SUBTYPE_3CH_PM8150_VAL || val == FLASH_SUBTYPE_3CH_PMI8998_VAL) {
flash_data->hw_type = QCOM_MVFLASH_3CH;
flash_data->max_channels = 3;
- regs = mvflash_3ch_regs;
+ regs = devm_kmemdup(dev, mvflash_3ch_regs, sizeof(mvflash_3ch_regs),
+ GFP_KERNEL);
+ if (!regs)
+ return -ENOMEM;
} else if (val == FLASH_SUBTYPE_4CH_VAL) {
flash_data->hw_type = QCOM_MVFLASH_4CH;
flash_data->max_channels = 4;
- regs = mvflash_4ch_regs;
+ regs = devm_kmemdup(dev, mvflash_4ch_regs, sizeof(mvflash_3ch_regs),
+ GFP_KERNEL);
+ if (!regs)
+ return -ENOMEM;
rc = regmap_read(regmap, reg_base + FLASH_REVISION_REG, &val);
if (rc < 0) {
@@ -880,6 +886,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev)
dev_err(dev, "Failed to allocate regmap field, rc=%d\n", rc);
return rc;
}
+ devm_kfree(dev, regs); /* devm_regmap_field_bulk_alloc() makes copies */
platform_set_drvdata(pdev, flash_data);
mutex_init(&flash_data->lock);
--
2.45.2
7 months, 2 weeks
- 2
- 2
[PATCH v3] drm/xe/sched: stop re-submitting signalled jobs
by Matthew Auld
Customer is reporting a really subtle issue where we get random DMAR
faults, hangs and other nasties for kernel migration jobs when stressing
stuff like s2idle/s3/s4. The explosions seems to happen somewhere
after resuming the system with splats looking something like:
PM: suspend exit
rfkill: input handler disabled
xe 0000:00:02.0: [drm] GT0: Engine reset: engine_class=bcs, logical_mask: 0x2, guc_id=0
xe 0000:00:02.0: [drm] GT0: Timedout job: seqno=24496, lrc_seqno=24496, guc_id=0, flags=0x13 in no process [-1]
xe 0000:00:02.0: [drm] GT0: Kernel-submitted job timed out
The likely cause appears to be a race between suspend cancelling the
worker that processes the free_job()'s, such that we still have pending
jobs to be freed after the cancel. Following from this, on resume the
pending_list will now contain at least one already complete job, but it
looks like we call drm_sched_resubmit_jobs(), which will then call
run_job() on everything still on the pending_list. But if the job was
already complete, then all the resources tied to the job, like the bb
itself, any memory that is being accessed, the iommu mappings etc. might
be long gone since those are usually tied to the fence signalling.
This scenario can be seen in ftrace when running a slightly modified
xe_pm (kernel was only modified to inject artificial latency into
free_job to make the race easier to hit):
xe_sched_job_run: dev=0000:00:02.0, fence=0xffff888276cc8540, seqno=0, lrc_seqno=0, gt=0, guc_id=0, batch_addr=0x000000146910 ...
xe_exec_queue_stop: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=0, guc_state=0x0, flags=0x13
xe_exec_queue_stop: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=1, guc_state=0x0, flags=0x4
xe_exec_queue_stop: dev=0000:00:02.0, 4:0x1, gt=1, width=1, guc_id=0, guc_state=0x0, flags=0x3
xe_exec_queue_stop: dev=0000:00:02.0, 1:0x1, gt=1, width=1, guc_id=1, guc_state=0x0, flags=0x3
xe_exec_queue_stop: dev=0000:00:02.0, 4:0x1, gt=1, width=1, guc_id=2, guc_state=0x0, flags=0x3
xe_exec_queue_resubmit: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=0, guc_state=0x0, flags=0x13
xe_sched_job_run: dev=0000:00:02.0, fence=0xffff888276cc8540, seqno=0, lrc_seqno=0, gt=0, guc_id=0, batch_addr=0x000000146910 ...
.....
xe_exec_queue_memory_cat_error: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=0, guc_state=0x3, flags=0x13
So the job_run() is clearly triggered twice for the same job, even
though the first must have already signalled to completion during
suspend. We can also see a CAT error after the re-submit.
To prevent this try to call xe_sched_stop() to forcefully remove
anything on the pending_list that has already signalled, before we
re-submit.
v2:
- Make sure to re-arm the fence callbacks with sched_start().
v3 (Matt B):
- Stop using drm_sched_resubmit_jobs(), which appears to be deprecated
and just open-code a simple loop such that we skip calling run_job()
and anything already signalled.
Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4856
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: Matthew Auld <matthew.auld(a)intel.com>
Cc: Thomas Hellström <thomas.hellstrom(a)linux.intel.com>
Cc: Matthew Brost <matthew.brost(a)intel.com>
Cc: William Tseng <william.tseng(a)intel.com>
Cc: <stable(a)vger.kernel.org> # v6.8+
---
drivers/gpu/drm/xe/xe_gpu_scheduler.h | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/xe_gpu_scheduler.h b/drivers/gpu/drm/xe/xe_gpu_scheduler.h
index c250ea773491..308061f0cf37 100644
--- a/drivers/gpu/drm/xe/xe_gpu_scheduler.h
+++ b/drivers/gpu/drm/xe/xe_gpu_scheduler.h
@@ -51,7 +51,15 @@ static inline void xe_sched_tdr_queue_imm(struct xe_gpu_scheduler *sched)
static inline void xe_sched_resubmit_jobs(struct xe_gpu_scheduler *sched)
{
- drm_sched_resubmit_jobs(&sched->base);
+ struct drm_sched_job *s_job;
+
+ list_for_each_entry(s_job, &sched->base.pending_list, list) {
+ struct drm_sched_fence *s_fence = s_job->s_fence;
+ struct dma_fence *hw_fence = s_fence->parent;
+
+ if (hw_fence && !dma_fence_is_signaled(hw_fence))
+ sched->base.ops->run_job(s_job);
+ }
}
static inline bool
--
2.49.0
7 months, 2 weeks
- 3
- 4
[PATCH] net: ch9200: fix uninitialised access during mii_nway_restart
by Qasim Ijaz
In mii_nway_restart() the code attempts to call
mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read()
utilises a local buffer called "buff", which is initialised
with control_read(). However "buff" is conditionally
initialised inside control_read():
if (err == size) {
memcpy(data, buf, size);
}
If the condition of "err == size" is not met, then
"buff" remains uninitialised. Once this happens the
uninitialised "buff" is accessed and returned during
ch9200_mdio_read():
return (buff[0] | buff[1] << 8);
The problem stems from the fact that ch9200_mdio_read()
ignores the return value of control_read(), leading to
uinit-access of "buff".
To fix this we should check the return value of
control_read() and return early on error.
Reported-by: syzbot <syzbot+3361c2d6f78a3e0892f9(a)syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=3361c2d6f78a3e0892f9
Tested-by: syzbot <syzbot+3361c2d6f78a3e0892f9(a)syzkaller.appspotmail.com>
Fixes: 4a476bd6d1d9 ("usbnet: New driver for QinHeng CH9200 devices")
Cc: stable(a)vger.kernel.org
Signed-off-by: Qasim Ijaz <qasdev00(a)gmail.com>
---
drivers/net/usb/ch9200.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c
index f69d9b902da0..a206ffa76f1b 100644
--- a/drivers/net/usb/ch9200.c
+++ b/drivers/net/usb/ch9200.c
@@ -178,6 +178,7 @@ static int ch9200_mdio_read(struct net_device *netdev, int phy_id, int loc)
{
struct usbnet *dev = netdev_priv(netdev);
unsigned char buff[2];
+ int ret;
netdev_dbg(netdev, "%s phy_id:%02x loc:%02x\n",
__func__, phy_id, loc);
@@ -185,8 +186,10 @@ static int ch9200_mdio_read(struct net_device *netdev, int phy_id, int loc)
if (phy_id != 0)
return -ENODEV;
- control_read(dev, REQUEST_READ, 0, loc * 2, buff, 0x02,
- CONTROL_TIMEOUT_MS);
+ ret = control_read(dev, REQUEST_READ, 0, loc * 2, buff, 0x02,
+ CONTROL_TIMEOUT_MS);
+ if (ret < 0)
+ return ret;
return (buff[0] | buff[1] << 8);
}
--
2.39.5
7 months, 2 weeks
- 2
- 1
[PATCH] net: af_key: Add error check in set_sadb_address()
by Wentao Liang
The function set_sadb_address() calls the function
pfkey_sockaddr_fill(), but does not check its return value.
A proper implementation can be found in set_sadb_kmaddress().
Add an error check for set_sadb_address(), return error code
if the function fails.
Fixes: e5b56652c11b ("key: Share common code path to fill sockaddr{}.")
Cc: stable(a)vger.kernel.org # v2.6
Signed-off-by: Wentao Liang <vulab(a)iscas.ac.cn>
---
net/key/af_key.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index c56bb4f451e6..537c9604e356 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3474,15 +3474,17 @@ static int set_sadb_address(struct sk_buff *skb, int sasize, int type,
switch (type) {
case SADB_EXT_ADDRESS_SRC:
addr->sadb_address_prefixlen = sel->prefixlen_s;
- pfkey_sockaddr_fill(&sel->saddr, 0,
- (struct sockaddr *)(addr + 1),
- sel->family);
+ if (!pfkey_sockaddr_fill(&sel->saddr, 0,
+ (struct sockaddr *)(addr + 1),
+ sel->family))
+ return -EINVAL;
break;
case SADB_EXT_ADDRESS_DST:
addr->sadb_address_prefixlen = sel->prefixlen_d;
- pfkey_sockaddr_fill(&sel->daddr, 0,
- (struct sockaddr *)(addr + 1),
- sel->family);
+ if (!pfkey_sockaddr_fill(&sel->daddr, 0,
+ (struct sockaddr *)(addr + 1),
+ sel->family))
+ return -EINVAL;
break;
default:
return -EINVAL;
--
2.42.0.windows.2
7 months, 2 weeks
- 3
- 2
[PATCH 2/5] LoongArch: KVM: Check interrupt route from physical cpu with eiointc
by Bibo Mao
With eiointc interrupt controller, physical cpu id is set for irq
route. However function kvm_get_vcpu() is used to get destination vCPU
when delivering irq. With API kvm_get_vcpu(), logical cpu is used.
With API kvm_get_vcpu_by_cpuid(), vCPU can be searched from physical
cpu id.
Cc: stable(a)vger.kernel.org
Fixes: 3956a52bc05b ("LoongArch: KVM: Add EIOINTC read and write functions")
Signed-off-by: Bibo Mao <maobibo(a)loongson.cn>
---
arch/loongarch/kvm/intc/eiointc.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
diff --git a/arch/loongarch/kvm/intc/eiointc.c b/arch/loongarch/kvm/intc/eiointc.c
index d2c521b0e923..0b648c56b0c3 100644
--- a/arch/loongarch/kvm/intc/eiointc.c
+++ b/arch/loongarch/kvm/intc/eiointc.c
@@ -9,7 +9,8 @@
static void eiointc_set_sw_coreisr(struct loongarch_eiointc *s)
{
- int ipnum, cpu, irq_index, irq_mask, irq;
+ int ipnum, cpu, irq_index, irq_mask, irq, cpuid;
+ struct kvm_vcpu *vcpu;
for (irq = 0; irq < EIOINTC_IRQS; irq++) {
ipnum = s->ipmap.reg_u8[irq / 32];
@@ -20,7 +21,12 @@ static void eiointc_set_sw_coreisr(struct loongarch_eiointc *s)
irq_index = irq / 32;
irq_mask = BIT(irq & 0x1f);
- cpu = s->coremap.reg_u8[irq];
+ cpuid = s->coremap.reg_u8[irq];
+ vcpu = kvm_get_vcpu_by_cpuid(s->kvm, cpuid);
+ if (vcpu == NULL)
+ continue;
+
+ cpu = vcpu->vcpu_id;
if (!!(s->coreisr.reg_u32[cpu][irq_index] & irq_mask))
set_bit(irq, s->sw_coreisr[cpu][ipnum]);
else
@@ -68,17 +74,23 @@ static void eiointc_update_irq(struct loongarch_eiointc *s, int irq, int level)
static inline void eiointc_update_sw_coremap(struct loongarch_eiointc *s,
int irq, u64 val, u32 len, bool notify)
{
- int i, cpu;
+ int i, cpu, cpuid;
+ struct kvm_vcpu *vcpu;
for (i = 0; i < len; i++) {
- cpu = val & 0xff;
+ cpuid = val & 0xff;
val = val >> 8;
if (!(s->status & BIT(EIOINTC_ENABLE_CPU_ENCODE))) {
- cpu = ffs(cpu) - 1;
- cpu = (cpu >= 4) ? 0 : cpu;
+ cpuid = ffs(cpuid) - 1;
+ cpuid = (cpuid >= 4) ? 0 : cpuid;
}
+ vcpu = kvm_get_vcpu_by_cpuid(s->kvm, cpuid);
+ if (vcpu == NULL)
+ continue;
+
+ cpu = vcpu->vcpu_id;
if (s->sw_coremap[irq + i] == cpu)
continue;
--
2.39.3
7 months, 2 weeks
- 1
- 0