- Linux-stable-mirror - lists.linaro.org

[PATCH v3 3/3] mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather

by David Hildenbrand (Red Hat)

As reported, ever since commit 1013af4f585f ("mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race") we can end up in some situations where we perform so many IPI broadcasts when unsharing hugetlb PMD page tables that it severely regresses some workloads. In particular, when we fork()+exit(), or when we munmap() a large area backed by many shared PMD tables, we perform one IPI broadcast per unshared PMD table. There are two optimizations to be had: (1) When we process (unshare) multiple such PMD tables, such as during exit(), it is sufficient to send a single IPI broadcast (as long as we respect locking rules) instead of one per PMD table. Locking prevents that any of these PMD tables could get reused before we drop the lock. (2) When we are not the last sharer (> 2 users including us), there is no need to send the IPI broadcast. The shared PMD tables cannot become exclusive (fully unshared) before an IPI will be broadcasted by the last sharer. Concurrent GUP-fast could walk into a PMD table just before we unshared it. It could then succeed in grabbing a page from the shared page table even after munmap() etc succeeded (and supressed an IPI). But there is not difference compared to GUP-fast just sleeping for a while after grabbing the page and re-enabling IRQs. Most importantly, GUP-fast will never walk into page tables that are no-longer shared, because the last sharer will issue an IPI broadcast. (if ever required, checking whether the PUD changed in GUP-fast after grabbing the page like we do in the PTE case could handle this) So let's rework PMD sharing TLB flushing + IPI sync to use the mmu_gather infrastructure so we can implement these optimizations and demystify the code at least a bit. Extend the mmu_gather infrastructure to be able to deal with our special hugetlb PMD table sharing implementation. To make initialization of the mmu_gather easier when working on a single VMA (in particular, when dealing with hugetlb), provide tlb_gather_mmu_vma(). We'll consolidate the handling for (full) unsharing of PMD tables in tlb_unshare_pmd_ptdesc() and tlb_flush_unshared_tables(), and track in "struct mmu_gather" whether we had (full) unsharing of PMD tables. Because locking is very special (concurrent unsharing+reuse must be prevented), we disallow deferring flushing to tlb_finish_mmu() and instead require an explicit earlier call to tlb_flush_unshared_tables(). From hugetlb code, we call huge_pmd_unshare_flush() where we make sure that the expected lock protecting us from concurrent unsharing+reuse is still held. Check with a VM_WARN_ON_ONCE() in tlb_finish_mmu() that tlb_flush_unshared_tables() was properly called earlier. Document it all properly. Notes about tlb_remove_table_sync_one() interaction with unsharing: There are two fairly tricky things: (1) tlb_remove_table_sync_one() is a NOP on architectures without CONFIG_MMU_GATHER_RCU_TABLE_FREE. Here, the assumption is that the previous TLB flush would send an IPI to all relevant CPUs. Careful: some architectures like x86 only send IPIs to all relevant CPUs when tlb->freed_tables is set. The relevant architectures should be selecting MMU_GATHER_RCU_TABLE_FREE, but x86 might not do that in stable kernels and it might have been problematic before this patch. Also, the arch flushing behavior (independent of IPIs) is different when tlb->freed_tables is set. Do we have to enlighten them to also take care of tlb->unshared_tables? So far we didn't care, so hopefully we are fine. Of course, we could be setting tlb->freed_tables as well, but that might then unnecessarily flush too much, because the semantics of tlb->freed_tables are a bit fuzzy. This patch changes nothing in this regard. (2) tlb_remove_table_sync_one() is not a NOP on architectures with CONFIG_MMU_GATHER_RCU_TABLE_FREE that actually don't need a sync. Take x86 as an example: in the common case (!pv, !X86_FEATURE_INVLPGB) we still issue IPIs during TLB flushes and don't actually need the second tlb_remove_table_sync_one(). This optimized can be implemented on top of this, by checking e.g., in tlb_remove_table_sync_one() whether we really need IPIs. But as described in (1), it really must honor tlb->freed_tables then to send IPIs to all relevant CPUs. Notes on TLB flushing changes: (1) Flushing for non-shared PMD tables We're converting from flush_hugetlb_tlb_range() to tlb_remove_huge_tlb_entry(). Given that we properly initialize the MMU gather in tlb_gather_mmu_vma() to be hugetlb aware, similar to __unmap_hugepage_range(), that should be fine. (2) Flushing for shared PMD tables We're converting from various things (flush_hugetlb_tlb_range(), tlb_flush_pmd_range(), flush_tlb_range()) to tlb_flush_pmd_range(). tlb_flush_pmd_range() achieves the same that tlb_remove_huge_tlb_entry() would achieve in these scenarios. Note that tlb_remove_huge_tlb_entry() also calls __tlb_remove_tlb_entry(), however that is only implemented on powerpc, which does not support PMD table sharing. Similar to (1), tlb_gather_mmu_vma() should make sure that TLB flushing keeps on working as expected. Further, note that the ptdesc_pmd_pts_dec() in huge_pmd_share() is not a concern, as we are holding the i_mmap_lock the whole time, preventing concurrent unsharing. That ptdesc_pmd_pts_dec() usage will be removed separately as a cleanup later. There are plenty more cleanups to be had, but they have to wait until this is fixed. Fixes: 1013af4f585f ("mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race") Reported-by: Uschakow, Stanislav" <suschako(a)amazon.de> Closes: https://lore.kernel.org/all/4d3878531c76479d9f8ca9789dc6485d@amazon.de/ Tested-by: Laurence Oberman <loberman(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: David Hildenbrand (Red Hat) <david(a)kernel.org> --- include/asm-generic/tlb.h | 77 +++++++++++++++++++++++- include/linux/hugetlb.h | 15 +++-- include/linux/mm_types.h | 1 + mm/hugetlb.c | 123 ++++++++++++++++++++++---------------- mm/mmu_gather.c | 33 ++++++++++ mm/rmap.c | 25 +++++--- 6 files changed, 208 insertions(+), 66 deletions(-) diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h index 1fff717cae510..4d679d2a206b4 100644 --- a/include/asm-generic/tlb.h +++ b/include/asm-generic/tlb.h @@ -46,7 +46,8 @@ * * The mmu_gather API consists of: * - * - tlb_gather_mmu() / tlb_gather_mmu_fullmm() / tlb_finish_mmu() + * - tlb_gather_mmu() / tlb_gather_mmu_fullmm() / tlb_gather_mmu_vma() / + * tlb_finish_mmu() * * start and finish a mmu_gather * @@ -364,6 +365,20 @@ struct mmu_gather { unsigned int vma_huge : 1; unsigned int vma_pfn : 1; + /* + * Did we unshare (unmap) any shared page tables? For now only + * used for hugetlb PMD table sharing. + */ + unsigned int unshared_tables : 1; + + /* + * Did we unshare any page tables such that they are now exclusive + * and could get reused+modified by the new owner? When setting this + * flag, "unshared_tables" will be set as well. For now only used + * for hugetlb PMD table sharing. + */ + unsigned int fully_unshared_tables : 1; + unsigned int batch_count; #ifndef CONFIG_MMU_GATHER_NO_GATHER @@ -400,6 +415,7 @@ static inline void __tlb_reset_range(struct mmu_gather *tlb) tlb->cleared_pmds = 0; tlb->cleared_puds = 0; tlb->cleared_p4ds = 0; + tlb->unshared_tables = 0; /* * Do not reset mmu_gather::vma_* fields here, we do not * call into tlb_start_vma() again to set them if there is an @@ -484,7 +500,7 @@ static inline void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb) * these bits. */ if (!(tlb->freed_tables || tlb->cleared_ptes || tlb->cleared_pmds || - tlb->cleared_puds || tlb->cleared_p4ds)) + tlb->cleared_puds || tlb->cleared_p4ds || tlb->unshared_tables)) return; tlb_flush(tlb); @@ -773,6 +789,63 @@ static inline bool huge_pmd_needs_flush(pmd_t oldpmd, pmd_t newpmd) } #endif +#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING +static inline void tlb_unshare_pmd_ptdesc(struct mmu_gather *tlb, struct ptdesc *pt, + unsigned long addr) +{ + /* + * The caller must make sure that concurrent unsharing + exclusive + * reuse is impossible until tlb_flush_unshared_tables() was called. + */ + VM_WARN_ON_ONCE(!ptdesc_pmd_is_shared(pt)); + ptdesc_pmd_pts_dec(pt); + + /* Clearing a PUD pointing at a PMD table with PMD leaves. */ + tlb_flush_pmd_range(tlb, addr & PUD_MASK, PUD_SIZE); + + /* + * If the page table is now exclusively owned, we fully unshared + * a page table. + */ + if (!ptdesc_pmd_is_shared(pt)) + tlb->fully_unshared_tables = true; + tlb->unshared_tables = true; +} + +static inline void tlb_flush_unshared_tables(struct mmu_gather *tlb) +{ + /* + * As soon as the caller drops locks to allow for reuse of + * previously-shared tables, these tables could get modified and + * even reused outside of hugetlb context, so we have to make sure that + * any page table walkers (incl. TLB, GUP-fast) are aware of that + * change. + * + * Even if we are not fully unsharing a PMD table, we must + * flush the TLB for the unsharer now. + */ + if (tlb->unshared_tables) + tlb_flush_mmu_tlbonly(tlb); + + /* + * Similarly, we must make sure that concurrent GUP-fast will not + * walk previously-shared page tables that are getting modified+reused + * elsewhere. So broadcast an IPI to wait for any concurrent GUP-fast. + * + * We only perform this when we are the last sharer of a page table, + * as the IPI will reach all CPUs: any GUP-fast. + * + * Note that on configs where tlb_remove_table_sync_one() is a NOP, + * the expectation is that the tlb_flush_mmu_tlbonly() would have issued + * required IPIs already for us. + */ + if (tlb->fully_unshared_tables) { + tlb_remove_table_sync_one(); + tlb->fully_unshared_tables = false; + } +} +#endif /* CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING */ + #endif /* CONFIG_MMU */ #endif /* _ASM_GENERIC__TLB_H */ diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 03c8725efa289..e51b8ef0cebd9 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -240,8 +240,9 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma, pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, unsigned long sz); unsigned long hugetlb_mask_last_page(struct hstate *h); -int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep); +int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long addr, pte_t *ptep); +void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma); void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end); @@ -300,13 +301,17 @@ static inline struct address_space *hugetlb_folio_mapping_lock_write( return NULL; } -static inline int huge_pmd_unshare(struct mm_struct *mm, - struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) +static inline int huge_pmd_unshare(struct mmu_gather *tlb, + struct vm_area_struct *vma, unsigned long addr, pte_t *ptep) { return 0; } +static inline void huge_pmd_unshare_flush(struct mmu_gather *tlb, + struct vm_area_struct *vma) +{ +} + static inline void adjust_range_if_pmd_sharing_possible( struct vm_area_struct *vma, unsigned long *start, unsigned long *end) diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 42af2292951d4..d1053b2c1f800 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -1522,6 +1522,7 @@ static inline unsigned int mm_cid_size(void) struct mmu_gather; extern void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm); extern void tlb_gather_mmu_fullmm(struct mmu_gather *tlb, struct mm_struct *mm); +void tlb_gather_mmu_vma(struct mmu_gather *tlb, struct vm_area_struct *vma); extern void tlb_finish_mmu(struct mmu_gather *tlb); struct vm_fault; diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 3c77cdef12a32..2609b6d58f99e 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5096,7 +5096,7 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, unsigned long last_addr_mask; pte_t *src_pte, *dst_pte; struct mmu_notifier_range range; - bool shared_pmd = false; + struct mmu_gather tlb; mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, mm, old_addr, old_end); @@ -5106,6 +5106,7 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, * range. */ flush_cache_range(vma, range.start, range.end); + tlb_gather_mmu_vma(&tlb, vma); mmu_notifier_invalidate_range_start(&range); last_addr_mask = hugetlb_mask_last_page(h); @@ -5122,8 +5123,7 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, if (huge_pte_none(huge_ptep_get(mm, old_addr, src_pte))) continue; - if (huge_pmd_unshare(mm, vma, old_addr, src_pte)) { - shared_pmd = true; + if (huge_pmd_unshare(&tlb, vma, old_addr, src_pte)) { old_addr |= last_addr_mask; new_addr |= last_addr_mask; continue; @@ -5134,15 +5134,16 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, break; move_huge_pte(vma, old_addr, new_addr, src_pte, dst_pte, sz); + tlb_remove_huge_tlb_entry(h, &tlb, src_pte, old_addr); } - if (shared_pmd) - flush_hugetlb_tlb_range(vma, range.start, range.end); - else - flush_hugetlb_tlb_range(vma, old_end - len, old_end); + tlb_flush_mmu_tlbonly(&tlb); + huge_pmd_unshare_flush(&tlb, vma); + mmu_notifier_invalidate_range_end(&range); i_mmap_unlock_write(mapping); hugetlb_vma_unlock_write(vma); + tlb_finish_mmu(&tlb); return len + old_addr - old_end; } @@ -5161,7 +5162,6 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long sz = huge_page_size(h); bool adjust_reservation; unsigned long last_addr_mask; - bool force_flush = false; WARN_ON(!is_vm_hugetlb_page(vma)); BUG_ON(start & ~huge_page_mask(h)); @@ -5184,10 +5184,8 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, } ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, vma, address, ptep)) { + if (huge_pmd_unshare(tlb, vma, address, ptep)) { spin_unlock(ptl); - tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE); - force_flush = true; address |= last_addr_mask; continue; } @@ -5303,14 +5301,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, } tlb_end_vma(tlb, vma); - /* - * There is nothing protecting a previously-shared page table that we - * unshared through huge_pmd_unshare() from getting freed after we - * release i_mmap_rwsem, so flush the TLB now. If huge_pmd_unshare() - * succeeded, flush the range corresponding to the pud. - */ - if (force_flush) - tlb_flush_mmu_tlbonly(tlb); + huge_pmd_unshare_flush(tlb, vma); } void __hugetlb_zap_begin(struct vm_area_struct *vma, @@ -6409,11 +6400,11 @@ long hugetlb_change_protection(struct vm_area_struct *vma, pte_t pte; struct hstate *h = hstate_vma(vma); long pages = 0, psize = huge_page_size(h); - bool shared_pmd = false; struct mmu_notifier_range range; unsigned long last_addr_mask; bool uffd_wp = cp_flags & MM_CP_UFFD_WP; bool uffd_wp_resolve = cp_flags & MM_CP_UFFD_WP_RESOLVE; + struct mmu_gather tlb; /* * In the case of shared PMDs, the area to flush could be beyond @@ -6426,6 +6417,7 @@ long hugetlb_change_protection(struct vm_area_struct *vma, BUG_ON(address >= end); flush_cache_range(vma, range.start, range.end); + tlb_gather_mmu_vma(&tlb, vma); mmu_notifier_invalidate_range_start(&range); hugetlb_vma_lock_write(vma); @@ -6452,7 +6444,7 @@ long hugetlb_change_protection(struct vm_area_struct *vma, } } ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, vma, address, ptep)) { + if (huge_pmd_unshare(&tlb, vma, address, ptep)) { /* * When uffd-wp is enabled on the vma, unshare * shouldn't happen at all. Warn about it if it @@ -6461,7 +6453,6 @@ long hugetlb_change_protection(struct vm_area_struct *vma, WARN_ON_ONCE(uffd_wp || uffd_wp_resolve); pages++; spin_unlock(ptl); - shared_pmd = true; address |= last_addr_mask; continue; } @@ -6522,22 +6513,16 @@ long hugetlb_change_protection(struct vm_area_struct *vma, pte = huge_pte_clear_uffd_wp(pte); huge_ptep_modify_prot_commit(vma, address, ptep, old_pte, pte); pages++; + tlb_remove_huge_tlb_entry(h, &tlb, ptep, address); } next: spin_unlock(ptl); cond_resched(); } - /* - * There is nothing protecting a previously-shared page table that we - * unshared through huge_pmd_unshare() from getting freed after we - * release i_mmap_rwsem, so flush the TLB now. If huge_pmd_unshare() - * succeeded, flush the range corresponding to the pud. - */ - if (shared_pmd) - flush_hugetlb_tlb_range(vma, range.start, range.end); - else - flush_hugetlb_tlb_range(vma, start, end); + + tlb_flush_mmu_tlbonly(&tlb); + huge_pmd_unshare_flush(&tlb, vma); /* * No need to call mmu_notifier_arch_invalidate_secondary_tlbs() we are * downgrading page table protection not changing it to point to a new @@ -6548,6 +6533,7 @@ long hugetlb_change_protection(struct vm_area_struct *vma, i_mmap_unlock_write(vma->vm_file->f_mapping); hugetlb_vma_unlock_write(vma); mmu_notifier_invalidate_range_end(&range); + tlb_finish_mmu(&tlb); return pages > 0 ? (pages << h->order) : pages; } @@ -6904,18 +6890,27 @@ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, return pte; } -/* - * unmap huge page backed by shared pte. +/** + * huge_pmd_unshare - Unmap a pmd table if it is shared by multiple users + * @tlb: the current mmu_gather. + * @vma: the vma covering the pmd table. + * @addr: the address we are trying to unshare. + * @ptep: pointer into the (pmd) page table. + * + * Called with the page table lock held, the i_mmap_rwsem held in write mode + * and the hugetlb vma lock held in write mode. * - * Called with page table lock held. + * Note: The caller must call huge_pmd_unshare_flush() before dropping the + * i_mmap_rwsem. * - * returns: 1 successfully unmapped a shared pte page - * 0 the underlying pte page is not shared, or it is the last user + * Returns: 1 if it was a shared PMD table and it got unmapped, or 0 if it + * was not a shared PMD table. */ -int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) +int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long addr, pte_t *ptep) { unsigned long sz = huge_page_size(hstate_vma(vma)); + struct mm_struct *mm = vma->vm_mm; pgd_t *pgd = pgd_offset(mm, addr); p4d_t *p4d = p4d_offset(pgd, addr); pud_t *pud = pud_offset(p4d, addr); @@ -6927,18 +6922,36 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, i_mmap_assert_write_locked(vma->vm_file->f_mapping); hugetlb_vma_assert_locked(vma); pud_clear(pud); - /* - * Once our caller drops the rmap lock, some other process might be - * using this page table as a normal, non-hugetlb page table. - * Wait for pending gup_fast() in other threads to finish before letting - * that happen. - */ - tlb_remove_table_sync_one(); - ptdesc_pmd_pts_dec(virt_to_ptdesc(ptep)); + + tlb_unshare_pmd_ptdesc(tlb, virt_to_ptdesc(ptep), addr); + mm_dec_nr_pmds(mm); return 1; } +/* + * huge_pmd_unshare_flush - Complete a sequence of huge_pmd_unshare() calls + * @tlb: the current mmu_gather. + * @vma: the vma covering the pmd table. + * + * Perform necessary TLB flushes or IPI broadcasts to synchronize PMD table + * unsharing with concurrent page table walkers. + * + * This function must be called after a sequence of huge_pmd_unshare() + * calls while still holding the i_mmap_rwsem. + */ +void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma) +{ + /* + * We must synchronize page table unsharing such that nobody will + * try reusing a previously-shared page table while it might still + * be in use by previous sharers (TLB, GUP_fast). + */ + i_mmap_assert_write_locked(vma->vm_file->f_mapping); + + tlb_flush_unshared_tables(tlb); +} + #else /* !CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING */ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, @@ -6947,12 +6960,16 @@ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, return NULL; } -int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) +int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long addr, pte_t *ptep) { return 0; } +void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma) +{ +} + void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end) { @@ -7219,6 +7236,7 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, unsigned long sz = huge_page_size(h); struct mm_struct *mm = vma->vm_mm; struct mmu_notifier_range range; + struct mmu_gather tlb; unsigned long address; spinlock_t *ptl; pte_t *ptep; @@ -7230,6 +7248,8 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, return; flush_cache_range(vma, start, end); + tlb_gather_mmu_vma(&tlb, vma); + /* * No need to call adjust_range_if_pmd_sharing_possible(), because * we have already done the PUD_SIZE alignment. @@ -7248,10 +7268,10 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, if (!ptep) continue; ptl = huge_pte_lock(h, mm, ptep); - huge_pmd_unshare(mm, vma, address, ptep); + huge_pmd_unshare(&tlb, vma, address, ptep); spin_unlock(ptl); } - flush_hugetlb_tlb_range(vma, start, end); + huge_pmd_unshare_flush(&tlb, vma); if (take_locks) { i_mmap_unlock_write(vma->vm_file->f_mapping); hugetlb_vma_unlock_write(vma); @@ -7261,6 +7281,7 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, * Documentation/mm/mmu_notifier.rst. */ mmu_notifier_invalidate_range_end(&range); + tlb_finish_mmu(&tlb); } /* diff --git a/mm/mmu_gather.c b/mm/mmu_gather.c index 247e3f9db6c7a..cd32c2dbf501b 100644 --- a/mm/mmu_gather.c +++ b/mm/mmu_gather.c @@ -10,6 +10,7 @@ #include <linux/swap.h> #include <linux/rmap.h> #include <linux/pgalloc.h> +#include <linux/hugetlb.h> #include <asm/tlb.h> @@ -426,6 +427,7 @@ static void __tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, #endif tlb->vma_pfn = 0; + tlb->fully_unshared_tables = 0; __tlb_reset_range(tlb); inc_tlb_flush_pending(tlb->mm); } @@ -459,6 +461,31 @@ void tlb_gather_mmu_fullmm(struct mmu_gather *tlb, struct mm_struct *mm) __tlb_gather_mmu(tlb, mm, true); } +/** + * tlb_gather_mmu - initialize an mmu_gather structure for operating on a single + * VMA + * @tlb: the mmu_gather structure to initialize + * @vma: the vm_area_struct + * + * Called to initialize an (on-stack) mmu_gather structure for operating on + * a single VMA. In contrast to tlb_gather_mmu(), calling this function will + * not require another call to tlb_start_vma(). In contrast to tlb_start_vma(), + * this function will *not* call flush_cache_range(). + * + * For hugetlb VMAs, this function will also initialize the mmu_gather + * page_size accordingly, not requiring a separate call to + * tlb_change_page_size(). + * + */ +void tlb_gather_mmu_vma(struct mmu_gather *tlb, struct vm_area_struct *vma) +{ + tlb_gather_mmu(tlb, vma->vm_mm); + tlb_update_vma_flags(tlb, vma); + if (is_vm_hugetlb_page(vma)) + /* All entries have the same size. */ + tlb_change_page_size(tlb, huge_page_size(hstate_vma(vma))); +} + /** * tlb_finish_mmu - finish an mmu_gather structure * @tlb: the mmu_gather structure to finish @@ -468,6 +495,12 @@ void tlb_gather_mmu_fullmm(struct mmu_gather *tlb, struct mm_struct *mm) */ void tlb_finish_mmu(struct mmu_gather *tlb) { + /* + * We expect an earlier huge_pmd_unshare_flush() call to sort this out, + * due to complicated locking requirements with page table unsharing. + */ + VM_WARN_ON_ONCE(tlb->fully_unshared_tables); + /* * If there are parallel threads are doing PTE changes on same range * under non-exclusive lock (e.g., mmap_lock read-side) but defer TLB diff --git a/mm/rmap.c b/mm/rmap.c index 748f48727a162..7b9879ef442d9 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -76,7 +76,7 @@ #include <linux/mm_inline.h> #include <linux/oom.h> -#include <asm/tlbflush.h> +#include <asm/tlb.h> #define CREATE_TRACE_POINTS #include <trace/events/migrate.h> @@ -2008,13 +2008,17 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma, * if unsuccessful. */ if (!anon) { + struct mmu_gather tlb; + VM_BUG_ON(!(flags & TTU_RMAP_LOCKED)); if (!hugetlb_vma_trylock_write(vma)) goto walk_abort; - if (huge_pmd_unshare(mm, vma, address, pvmw.pte)) { + + tlb_gather_mmu_vma(&tlb, vma); + if (huge_pmd_unshare(&tlb, vma, address, pvmw.pte)) { hugetlb_vma_unlock_write(vma); - flush_tlb_range(vma, - range.start, range.end); + huge_pmd_unshare_flush(&tlb, vma); + tlb_finish_mmu(&tlb); /* * The PMD table was unmapped, * consequently unmapping the folio. @@ -2022,6 +2026,7 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma, goto walk_done; } hugetlb_vma_unlock_write(vma); + tlb_finish_mmu(&tlb); } pteval = huge_ptep_clear_flush(vma, address, pvmw.pte); if (pte_dirty(pteval)) @@ -2398,17 +2403,20 @@ static bool try_to_migrate_one(struct folio *folio, struct vm_area_struct *vma, * fail if unsuccessful. */ if (!anon) { + struct mmu_gather tlb; + VM_BUG_ON(!(flags & TTU_RMAP_LOCKED)); if (!hugetlb_vma_trylock_write(vma)) { page_vma_mapped_walk_done(&pvmw); ret = false; break; } - if (huge_pmd_unshare(mm, vma, address, pvmw.pte)) { - hugetlb_vma_unlock_write(vma); - flush_tlb_range(vma, - range.start, range.end); + tlb_gather_mmu_vma(&tlb, vma); + if (huge_pmd_unshare(&tlb, vma, address, pvmw.pte)) { + hugetlb_vma_unlock_write(vma); + huge_pmd_unshare_flush(&tlb, vma); + tlb_finish_mmu(&tlb); /* * The PMD table was unmapped, * consequently unmapping the folio. @@ -2417,6 +2425,7 @@ static bool try_to_migrate_one(struct folio *folio, struct vm_area_struct *vma, break; } hugetlb_vma_unlock_write(vma); + tlb_finish_mmu(&tlb); } /* Nuke the hugetlb page table entry */ pteval = huge_ptep_clear_flush(vma, address, pvmw.pte); -- 2.52.0

14 minutes

1
0
0 0

[PATCH 1/2] ublk: add UBLK_F_NO_AUTO_PART_SCAN feature flag

by Ming Lei

Add a new feature flag UBLK_F_NO_AUTO_PART_SCAN to allow users to suppress automatic partition scanning when starting a ublk device. This is useful for network-backed devices where partition scanning can cause issues: - Partition scan triggers synchronous I/O during device startup - If userspace server crashes during scan, recovery is problematic - For remotely-managed devices, partition probing may not be needed Users can manually trigger partition scanning later when appropriate using standard tools (e.g., partprobe, blockdev --rereadpt). Reported-by: Yoav Cohen <yoav(a)nvidia.com> Link: https://lore.kernel.org/linux-block/DM4PR12MB63280C5637917C071C2F0D65A9A8A@… Cc: stable(a)vger.kernel.org Signed-off-by: Ming Lei <ming.lei(a)redhat.com> --- - suggest to backport to stable, which is useful for avoiding problematic recovery, also the change is simple enough drivers/block/ublk_drv.c | 16 +++++++++++++--- include/uapi/linux/ublk_cmd.h | 8 ++++++++ 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 78f3e22151b9..ca6ec8ed443f 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -73,7 +73,8 @@ | UBLK_F_AUTO_BUF_REG \ | UBLK_F_QUIESCE \ | UBLK_F_PER_IO_DAEMON \ - | UBLK_F_BUF_REG_OFF_DAEMON) + | UBLK_F_BUF_REG_OFF_DAEMON \ + | UBLK_F_NO_AUTO_PART_SCAN) #define UBLK_F_ALL_RECOVERY_FLAGS (UBLK_F_USER_RECOVERY \ | UBLK_F_USER_RECOVERY_REISSUE \ @@ -2930,8 +2931,13 @@ static int ublk_ctrl_start_dev(struct ublk_device *ub, ublk_apply_params(ub); - /* don't probe partitions if any daemon task is un-trusted */ - if (ub->unprivileged_daemons) + /* + * Don't probe partitions if: + * - any daemon task is un-trusted, or + * - user explicitly requested to suppress partition scan + */ + if (ub->unprivileged_daemons || + (ub->dev_info.flags & UBLK_F_NO_AUTO_PART_SCAN)) set_bit(GD_SUPPRESS_PART_SCAN, &disk->state); ublk_get_device(ub); @@ -2947,6 +2953,10 @@ static int ublk_ctrl_start_dev(struct ublk_device *ub, if (ret) goto out_put_cdev; + /* allow user to probe partitions from userspace */ + if (!ub->unprivileged_daemons && + (ub->dev_info.flags & UBLK_F_NO_AUTO_PART_SCAN)) + clear_bit(GD_SUPPRESS_PART_SCAN, &disk->state); set_bit(UB_STATE_USED, &ub->state); out_put_cdev: diff --git a/include/uapi/linux/ublk_cmd.h b/include/uapi/linux/ublk_cmd.h index ec77dabba45b..0827db14a215 100644 --- a/include/uapi/linux/ublk_cmd.h +++ b/include/uapi/linux/ublk_cmd.h @@ -311,6 +311,14 @@ */ #define UBLK_F_BUF_REG_OFF_DAEMON (1ULL << 14) +/* + * If this feature is set, the kernel will not automatically scan for partitions + * when the device is started. This is useful for network-backed devices where + * partition scanning can cause deadlocks if the userspace server crashes during + * the scan. Users can manually trigger partition scanning later when appropriate. + */ +#define UBLK_F_NO_AUTO_PART_SCAN (1ULL << 15) + /* device state */ #define UBLK_S_DEV_DEAD 0 #define UBLK_S_DEV_LIVE 1 -- 2.47.0

1 hour, 1 minute

2
3
0 0

[alternative-merged] buildid-validate-page-backed-file-before-parsing-build-id.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: buildid: validate page-backed file before parsing build ID has been removed from the -mm tree. Its filename was buildid-validate-page-backed-file-before-parsing-build-id.patch This patch was dropped because an alternative patch was or shall be merged ------------------------------------------------------ From: Jinchao Wang <wangjinchao600(a)gmail.com> Subject: buildid: validate page-backed file before parsing build ID Date: Tue, 23 Dec 2025 18:32:07 +0800 __build_id_parse() only works on page-backed storage. Its helper paths eventually call mapping->a_ops->read_folio(), so explicitly reject VMAs that do not map a regular file or lack valid address_space operations. Link: https://lkml.kernel.org/r/20251223103214.2412446-1-wangjinchao600@gmail.com Fixes: ad41251c290d ("lib/buildid: implement sleepable build_id_parse() API") Signed-off-by: Jinchao Wang <wangjinchao600(a)gmail.com> Reported-by: <syzbot+e008db2ac01e282550ee(a)syzkaller.appspotmail.com> Tested-by: <syzbot+e008db2ac01e282550ee(a)syzkaller.appspotmail.com> Link: https://lkml.kernel.org/r/694a67ab.050a0220.19928e.001c.GAE@google.com Closes: https://lkml.kernel.org/r/693540fe.a70a0220.38f243.004c.GAE@google.com Cc: Axel Rasmussen <axelrasmussen(a)google.com> Cc: David Hildenbrand (Red Hat) <david(a)kernel.org> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: Wei Xu <weixugc(a)google.com> Cc: Yuanchu Xie <yuanchu(a)google.com> Cc: Andrii Nakryiko <andrii(a)kernel.org> Cc: Eduard Zingerman <eddyz87(a)gmail.com> Cc: Omar Sandoval <osandov(a)fb.com> Cc: Deepanshu Kartikey <kartikey406(a)gmail.com> Cc: Alexei Starovoitov <ast(a)kernel.org> Cc: Daniel Borkman <daniel(a)iogearbox.net> Cc: Hao Luo <haoluo(a)google.com> Cc: Jiri Olsa <jolsa(a)kernel.org> Cc: John Fastabend <john.fastabend(a)gmail.com> Cc: KP Singh <kpsingh(a)kernel.org> Cc: Martin KaFai Lau <martin.lau(a)linux.dev> Cc: Song Liu <song(a)kernel.org> Cc: Stanislav Fomichev <sdf(a)fomichev.me> Cc: Yonghong Song <yonghong.song(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/buildid.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/lib/buildid.c~buildid-validate-page-backed-file-before-parsing-build-id +++ a/lib/buildid.c @@ -288,7 +288,10 @@ static int __build_id_parse(struct vm_ar int ret; /* only works for page backed storage */ - if (!vma->vm_file) + if (!vma->vm_file || + !S_ISREG(file_inode(vma->vm_file)->i_mode) || + !vma->vm_file->f_mapping->a_ops || + !vma->vm_file->f_mapping->a_ops->read_folio) return -EINVAL; freader_init_from_file(&r, buf, sizeof(buf), vma->vm_file, may_fault); _ Patches currently in -mm which might be from wangjinchao600(a)gmail.com are

1 hour, 37 minutes

1
0
0 0

[merged mm-hotfixes-stable] mm-page_owner-fix-memory-leak-in-page_owner_stack_fops-release.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/page_owner: fix memory leak in page_owner_stack_fops->release() has been removed from the -mm tree. Its filename was mm-page_owner-fix-memory-leak-in-page_owner_stack_fops-release.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Ran Xiaokai <ran.xiaokai(a)zte.com.cn> Subject: mm/page_owner: fix memory leak in page_owner_stack_fops->release() Date: Fri, 19 Dec 2025 07:42:32 +0000 The page_owner_stack_fops->open() callback invokes seq_open_private(), therefore its corresponding ->release() callback must call seq_release_private(). Otherwise it will cause a memory leak of struct stack_print_ctx. Link: https://lkml.kernel.org/r/20251219074232.136482-1-ranxiaokai627@163.com Fixes: 765973a09803 ("mm,page_owner: display all stacks and their count") Signed-off-by: Ran Xiaokai <ran.xiaokai(a)zte.com.cn> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: Andrey Konovalov <andreyknvl(a)gmail.com> Cc: Brendan Jackman <jackmanb(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Marco Elver <elver(a)google.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Zi Yan <ziy(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/page_owner.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/page_owner.c~mm-page_owner-fix-memory-leak-in-page_owner_stack_fops-release +++ a/mm/page_owner.c @@ -952,7 +952,7 @@ static const struct file_operations page .open = page_owner_stack_open, .read = seq_read, .llseek = seq_lseek, - .release = seq_release, + .release = seq_release_private, }; static int page_owner_threshold_get(void *data, u64 *val) _ Patches currently in -mm which might be from ran.xiaokai(a)zte.com.cn are

1 hour, 40 minutes

1
0
0 0

[merged mm-hotfixes-stable] mm-consider-non-anon-swap-cache-folios-in-folio_expected_ref_count.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm: consider non-anon swap cache folios in folio_expected_ref_count() has been removed from the -mm tree. Its filename was mm-consider-non-anon-swap-cache-folios-in-folio_expected_ref_count.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Bijan Tabatabai <bijan311(a)gmail.com> Subject: mm: consider non-anon swap cache folios in folio_expected_ref_count() Date: Tue, 16 Dec 2025 14:07:27 -0600 Currently, folio_expected_ref_count() only adds references for the swap cache if the folio is anonymous. However, according to the comment above the definition of PG_swapcache in enum pageflags, shmem folios can also have PG_swapcache set. This patch makes sure references for the swap cache are added if folio_test_swapcache(folio) is true. This issue was found when trying to hot-unplug memory in a QEMU/KVM virtual machine. When initiating hot-unplug when most of the guest memory is allocated, hot-unplug hangs partway through removal due to migration failures. The following message would be printed several times, and would be printed again about every five seconds: [ 49.641309] migrating pfn b12f25 failed ret:7 [ 49.641310] page: refcount:2 mapcount:0 mapping:0000000033bd8fe2 index:0x7f404d925 pfn:0xb12f25 [ 49.641311] aops:swap_aops [ 49.641313] flags: 0x300000000030508(uptodate|active|owner_priv_1|reclaim|swapbacked|node=0|zone=3) [ 49.641314] raw: 0300000000030508 ffffed312c4bc908 ffffed312c4bc9c8 0000000000000000 [ 49.641315] raw: 00000007f404d925 00000000000c823b 00000002ffffffff 0000000000000000 [ 49.641315] page dumped because: migration failure When debugging this, I found that these migration failures were due to __migrate_folio() returning -EAGAIN for a small set of folios because the expected reference count it calculates via folio_expected_ref_count() is one less than the actual reference count of the folios. Furthermore, all of the affected folios were not anonymous, but had the PG_swapcache flag set, inspiring this patch. After applying this patch, the memory hot-unplug behaves as expected. I tested this on a machine running Ubuntu 24.04 with kernel version 6.8.0-90-generic and 64GB of memory. The guest VM is managed by libvirt and runs Ubuntu 24.04 with kernel version 6.18 (though the head of the mm-unstable branch as a Dec 16, 2025 was also tested and behaves the same) and 48GB of memory. The libvirt XML definition for the VM can be found at [1]. CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_MOVABLE is set in the guest kernel so the hot-pluggable memory is automatically onlined. Below are the steps to reproduce this behavior: 1) Define and start and virtual machine host$ virsh -c qemu:///system define ./test_vm.xml # test_vm.xml from [1] host$ virsh -c qemu:///system start test_vm 2) Setup swap in the guest guest$ sudo fallocate -l 32G /swapfile guest$ sudo chmod 0600 /swapfile guest$ sudo mkswap /swapfile guest$ sudo swapon /swapfile 3) Use alloc_data [2] to allocate most of the remaining guest memory guest$ ./alloc_data 45 4) In a separate guest terminal, monitor the amount of used memory guest$ watch -n1 free -h 5) When alloc_data has finished allocating, initiate the memory hot-unplug using the provided xml file [3] host$ virsh -c qemu:///system detach-device test_vm ./remove.xml --live After initiating the memory hot-unplug, you should see the amount of available memory in the guest decrease, and the amount of used swap data increase. If everything works as expected, when all of the memory is unplugged, there should be around 8.5-9GB of data in swap. If the unplugging is unsuccessful, the amount of used swap data will settle below that. If that happens, you should be able to see log messages in dmesg similar to the one posted above. Link: https://lkml.kernel.org/r/20251216200727.2360228-1-bijan311@gmail.com Link: https://github.com/BijanT/linux_patch_files/blob/main/test_vm.xml [1] Link: https://github.com/BijanT/linux_patch_files/blob/main/alloc_data.c [2] Link: https://github.com/BijanT/linux_patch_files/blob/main/remove.xml [3] Fixes: 86ebd50224c0 ("mm: add folio_expected_ref_count() for reference count calculation") Signed-off-by: Bijan Tabatabai <bijan311(a)gmail.com> Acked-by: David Hildenbrand (Red Hat) <david(a)kernel.org> Acked-by: Zi Yan <ziy(a)nvidia.com> Reviewed-by: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Shivank Garg <shivankg(a)amd.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Kairui Song <ryncsn(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/mm.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/include/linux/mm.h~mm-consider-non-anon-swap-cache-folios-in-folio_expected_ref_count +++ a/include/linux/mm.h @@ -2459,10 +2459,10 @@ static inline int folio_expected_ref_cou if (WARN_ON_ONCE(page_has_type(&folio->page) && !folio_test_hugetlb(folio))) return 0; - if (folio_test_anon(folio)) { - /* One reference per page from the swapcache. */ - ref_count += folio_test_swapcache(folio) << order; - } else { + /* One reference per page from the swapcache. */ + ref_count += folio_test_swapcache(folio) << order; + + if (!folio_test_anon(folio)) { /* One reference per page from the pagecache. */ ref_count += !!folio->mapping << order; /* One reference from PG_private. */ _ Patches currently in -mm which might be from bijan311(a)gmail.com are

1 hour, 41 minutes

1
0
0 0

[merged mm-hotfixes-stable] rust-maple_tree-rcu_read_lock-in-destructor-to-silence-lockdep.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: rust: maple_tree: rcu_read_lock() in destructor to silence lockdep has been removed from the -mm tree. Its filename was rust-maple_tree-rcu_read_lock-in-destructor-to-silence-lockdep.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Alice Ryhl <aliceryhl(a)google.com> Subject: rust: maple_tree: rcu_read_lock() in destructor to silence lockdep Date: Wed, 17 Dec 2025 13:10:37 +0000 When running the Rust maple tree kunit tests with lockdep, you may trigger a warning that looks like this: lib/maple_tree.c:780 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 no locks held by kunit_try_catch/344. stack backtrace: CPU: 3 UID: 0 PID: 344 Comm: kunit_try_catch Tainted: G N 6.19.0-rc1+ #2 NONE Tainted: [N]=TEST Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x71/0x90 lockdep_rcu_suspicious+0x150/0x190 mas_start+0x104/0x150 mas_find+0x179/0x240 _RINvNtCs5QSdWC790r4_4core3ptr13drop_in_placeINtNtCs1cdwasc6FUb_6kernel10maple_tree9MapleTreeINtNtNtBL_5alloc4kbox3BoxlNtNtB1x_9allocator7KmallocEEECsgxAQYCfdR72_25doctests_kernel_generated+0xaf/0x130 rust_doctest_kernel_maple_tree_rs_0+0x600/0x6b0 ? lock_release+0xeb/0x2a0 ? kunit_try_catch_run+0x210/0x210 kunit_try_run_case+0x74/0x160 ? kunit_try_catch_run+0x210/0x210 kunit_generic_run_threadfn_adapter+0x12/0x30 kthread+0x21c/0x230 ? __do_trace_sched_kthread_stop_ret+0x40/0x40 ret_from_fork+0x16c/0x270 ? __do_trace_sched_kthread_stop_ret+0x40/0x40 ret_from_fork_asm+0x11/0x20 </TASK> This is because the destructor of maple tree calls mas_find() without taking rcu_read_lock() or the spinlock. Doing that is actually ok in this case since the destructor has exclusive access to the entire maple tree, but it triggers a lockdep warning. To fix that, take the rcu read lock. In the future, it's possible that memory reclaim could gain a feature where it reallocates entries in maple trees even if no user-code is touching it. If that feature is added, then this use of rcu read lock would become load-bearing, so I did not make it conditional on lockdep. We have to repeatedly take and release rcu because the destructor of T might perform operations that sleep. Link: https://lkml.kernel.org/r/20251217-maple-drop-rcu-v1-1-702af063573f@google.… Fixes: da939ef4c494 ("rust: maple_tree: add MapleTree") Signed-off-by: Alice Ryhl <aliceryhl(a)google.com> Reported-by: Andreas Hindborg <a.hindborg(a)kernel.org> Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/x/topic/x/near/5642151… Reviewed-by: Gary Guo <gary(a)garyguo.net> Reviewed-by: Daniel Almeida <daniel.almeida(a)collabora.com> Cc: Andrew Ballance <andrewjballance(a)gmail.com> Cc: Bj��rn Roy Baron <bjorn3_gh(a)protonmail.com> Cc: Boqun Feng <boqun.feng(a)gmail.com> Cc: Danilo Krummrich <dakr(a)kernel.org> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Miguel Ojeda <ojeda(a)kernel.org> Cc: Trevor Gross <tmgross(a)umich.edu> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- rust/kernel/maple_tree.rs | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) --- a/rust/kernel/maple_tree.rs~rust-maple_tree-rcu_read_lock-in-destructor-to-silence-lockdep +++ a/rust/kernel/maple_tree.rs @@ -265,7 +265,16 @@ impl<T: ForeignOwnable> MapleTree<T> { loop { // This uses the raw accessor because we're destroying pointers without removing them // from the maple tree, which is only valid because this is the destructor. - let ptr = ma_state.mas_find_raw(usize::MAX); + // + // Take the rcu lock because mas_find_raw() requires that you hold either the spinlock + // or the rcu read lock. This is only really required if memory reclaim might + // reallocate entries in the tree, as we otherwise have exclusive access. That feature + // doesn't exist yet, so for now, taking the rcu lock only serves the purpose of + // silencing lockdep. + let ptr = { + let _rcu = kernel::sync::rcu::Guard::new(); + ma_state.mas_find_raw(usize::MAX) + }; if ptr.is_null() { break; } _ Patches currently in -mm which might be from aliceryhl(a)google.com are

1 hour, 41 minutes

1
0
0 0

[merged mm-hotfixes-stable] tools-mm-page_owner_sort-fix-timestamp-comparison-for-stable-sorting.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: tools/mm/page_owner_sort: fix timestamp comparison for stable sorting has been removed from the -mm tree. Its filename was tools-mm-page_owner_sort-fix-timestamp-comparison-for-stable-sorting.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Kaushlendra Kumar <kaushlendra.kumar(a)intel.com> Subject: tools/mm/page_owner_sort: fix timestamp comparison for stable sorting Date: Tue, 9 Dec 2025 10:15:52 +0530 The ternary operator in compare_ts() returns 1 when timestamps are equal, causing unstable sorting behavior. Replace with explicit three-way comparison that returns 0 for equal timestamps, ensuring stable qsort ordering and consistent output. Link: https://lkml.kernel.org/r/20251209044552.3396468-1-kaushlendra.kumar@intel.… Fixes: 8f9c447e2e2b ("tools/vm/page_owner_sort.c: support sorting pid and time") Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar(a)intel.com> Cc: Chongxi Zhao <zhaochongxi2019(a)email.szu.edu.cn> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- tools/mm/page_owner_sort.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/tools/mm/page_owner_sort.c~tools-mm-page_owner_sort-fix-timestamp-comparison-for-stable-sorting +++ a/tools/mm/page_owner_sort.c @@ -181,7 +181,11 @@ static int compare_ts(const void *p1, co { const struct block_list *l1 = p1, *l2 = p2; - return l1->ts_nsec < l2->ts_nsec ? -1 : 1; + if (l1->ts_nsec < l2->ts_nsec) + return -1; + if (l1->ts_nsec > l2->ts_nsec) + return 1; + return 0; } static int compare_cull_condition(const void *p1, const void *p2) _ Patches currently in -mm which might be from kaushlendra.kumar(a)intel.com are tools-mm-thp_swap_allocator_test-fix-small-folio-alignment.patch tools-mm-slabinfo-fix-partial-long-option-mapping.patch

1 hour, 41 minutes

1
0
0 0

[merged mm-hotfixes-stable] selftests-mm-fix-thread-state-check-in-uffd-unit-tests.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: selftests/mm: fix thread state check in uffd-unit-tests has been removed from the -mm tree. Its filename was selftests-mm-fix-thread-state-check-in-uffd-unit-tests.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Wake Liu <wakel(a)google.com> Subject: selftests/mm: fix thread state check in uffd-unit-tests Date: Wed, 10 Dec 2025 17:14:08 +0800 In the thread_state_get() function, the logic to find the thread's state character was using `sizeof(header) - 1` to calculate the offset from the "State:\t" string. The `header` variable is a `const char *` pointer. `sizeof()` on a pointer returns the size of the pointer itself, not the length of the string literal it points to. This makes the code's behavior dependent on the architecture's pointer size. This bug was identified on a 32-bit ARM build (`gsi_tv_arm`) for Android, running on an ARMv8-based device, compiled with Clang 19.0.1. On this 32-bit architecture, `sizeof(char *)` is 4. The expression `sizeof(header) - 1` resulted in an incorrect offset of 3, causing the test to read the wrong character from `/proc/[tid]/status` and fail. On 64-bit architectures, `sizeof(char *)` is 8, so the expression coincidentally evaluates to 7, which matches the length of "State:\t". This is why the bug likely remained hidden on 64-bit builds. To fix this and make the code portable and correct across all architectures, this patch replaces `sizeof(header) - 1` with `strlen(header)`. The `strlen()` function correctly calculates the string's length, ensuring the correct offset is always used. Link: https://lkml.kernel.org/r/20251210091408.3781445-1-wakel@google.com Fixes: f60b6634cd88 ("mm/selftests: add a test to verify mmap_changing race with -EAGAIN") Signed-off-by: Wake Liu <wakel(a)google.com> Acked-by: Peter Xu <peterx(a)redhat.com> Reviewed-by: Mike Rapoport (Microsoft) <rppt(a)kernel.org> Cc: Bill Wendling <morbo(a)google.com> Cc: Justin Stitt <justinstitt(a)google.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Nathan Chancellor <nathan(a)kernel.org> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- tools/testing/selftests/mm/uffd-unit-tests.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/tools/testing/selftests/mm/uffd-unit-tests.c~selftests-mm-fix-thread-state-check-in-uffd-unit-tests +++ a/tools/testing/selftests/mm/uffd-unit-tests.c @@ -1317,7 +1317,7 @@ static thread_state thread_state_get(pid p = strstr(tmp, header); if (p) { /* For example, "State:\tD (disk sleep)" */ - c = *(p + sizeof(header) - 1); + c = *(p + strlen(header)); return c == 'D' ? THR_STATE_UNINTERRUPTIBLE : THR_STATE_UNKNOWN; } _ Patches currently in -mm which might be from wakel(a)google.com are

1 hour, 41 minutes

1
0
0 0

[merged mm-hotfixes-stable] kernel-kexec-fix-ima-when-allocation-happens-in-cma-area.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: kernel/kexec: fix IMA when allocation happens in CMA area has been removed from the -mm tree. Its filename was kernel-kexec-fix-ima-when-allocation-happens-in-cma-area.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Pingfan Liu <piliu(a)redhat.com> Subject: kernel/kexec: fix IMA when allocation happens in CMA area Date: Tue, 16 Dec 2025 09:48:52 +0800 *** Bug description *** When I tested kexec with the latest kernel, I ran into the following warning: [ 40.712410] ------------[ cut here ]------------ [ 40.712576] WARNING: CPU: 2 PID: 1562 at kernel/kexec_core.c:1001 kimage_map_segment+0x144/0x198 [...] [ 40.816047] Call trace: [ 40.818498] kimage_map_segment+0x144/0x198 (P) [ 40.823221] ima_kexec_post_load+0x58/0xc0 [ 40.827246] __do_sys_kexec_file_load+0x29c/0x368 [...] [ 40.855423] ---[ end trace 0000000000000000 ]--- *** How to reproduce *** This bug is only triggered when the kexec target address is allocated in the CMA area. If no CMA area is reserved in the kernel, use the "cma=" option in the kernel command line to reserve one. *** Root cause *** The commit 07d24902977e ("kexec: enable CMA based contiguous allocation") allocates the kexec target address directly on the CMA area to avoid copying during the jump. In this case, there is no IND_SOURCE for the kexec segment. But the current implementation of kimage_map_segment() assumes that IND_SOURCE pages exist and map them into a contiguous virtual address by vmap(). *** Solution *** If IMA segment is allocated in the CMA area, use its page_address() directly. Link: https://lkml.kernel.org/r/20251216014852.8737-2-piliu@redhat.com Fixes: 07d24902977e ("kexec: enable CMA based contiguous allocation") Signed-off-by: Pingfan Liu <piliu(a)redhat.com> Acked-by: Baoquan He <bhe(a)redhat.com> Cc: Alexander Graf <graf(a)amazon.com> Cc: Steven Chen <chenste(a)linux.microsoft.com> Cc: Mimi Zohar <zohar(a)linux.ibm.com> Cc: Roberto Sassu <roberto.sassu(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- kernel/kexec_core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/kernel/kexec_core.c~kernel-kexec-fix-ima-when-allocation-happens-in-cma-area +++ a/kernel/kexec_core.c @@ -960,13 +960,17 @@ void *kimage_map_segment(struct kimage * kimage_entry_t *ptr, entry; struct page **src_pages; unsigned int npages; + struct page *cma; void *vaddr = NULL; int i; + cma = image->segment_cma[idx]; + if (cma) + return page_address(cma); + addr = image->segment[idx].mem; size = image->segment[idx].memsz; eaddr = addr + size; - /* * Collect the source pages and map them in a contiguous VA range. */ @@ -1007,7 +1011,8 @@ void *kimage_map_segment(struct kimage * void kimage_unmap_segment(void *segment_buffer) { - vunmap(segment_buffer); + if (is_vmalloc_addr(segment_buffer)) + vunmap(segment_buffer); } struct kexec_load_limit { _ Patches currently in -mm which might be from piliu(a)redhat.com are

1 hour, 41 minutes

1
0
0 0

[merged mm-hotfixes-stable] kernel-kexec-change-the-prototype-of-kimage_map_segment.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: kernel/kexec: change the prototype of kimage_map_segment() has been removed from the -mm tree. Its filename was kernel-kexec-change-the-prototype-of-kimage_map_segment.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Pingfan Liu <piliu(a)redhat.com> Subject: kernel/kexec: change the prototype of kimage_map_segment() Date: Tue, 16 Dec 2025 09:48:51 +0800 The kexec segment index will be required to extract the corresponding information for that segment in kimage_map_segment(). Additionally, kexec_segment already holds the kexec relocation destination address and size. Therefore, the prototype of kimage_map_segment() can be changed. Link: https://lkml.kernel.org/r/20251216014852.8737-1-piliu@redhat.com Fixes: 07d24902977e ("kexec: enable CMA based contiguous allocation") Signed-off-by: Pingfan Liu <piliu(a)redhat.com> Acked-by: Baoquan He <bhe(a)redhat.com> Cc: Mimi Zohar <zohar(a)linux.ibm.com> Cc: Roberto Sassu <roberto.sassu(a)huawei.com> Cc: Alexander Graf <graf(a)amazon.com> Cc: Steven Chen <chenste(a)linux.microsoft.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/kexec.h | 4 ++-- kernel/kexec_core.c | 9 ++++++--- security/integrity/ima/ima_kexec.c | 4 +--- 3 files changed, 9 insertions(+), 8 deletions(-) --- a/include/linux/kexec.h~kernel-kexec-change-the-prototype-of-kimage_map_segment +++ a/include/linux/kexec.h @@ -530,7 +530,7 @@ extern bool kexec_file_dbg_print; #define kexec_dprintk(fmt, arg...) \ do { if (kexec_file_dbg_print) pr_info(fmt, ##arg); } while (0) -extern void *kimage_map_segment(struct kimage *image, unsigned long addr, unsigned long size); +extern void *kimage_map_segment(struct kimage *image, int idx); extern void kimage_unmap_segment(void *buffer); #else /* !CONFIG_KEXEC_CORE */ struct pt_regs; @@ -540,7 +540,7 @@ static inline void __crash_kexec(struct static inline void crash_kexec(struct pt_regs *regs) { } static inline int kexec_should_crash(struct task_struct *p) { return 0; } static inline int kexec_crash_loaded(void) { return 0; } -static inline void *kimage_map_segment(struct kimage *image, unsigned long addr, unsigned long size) +static inline void *kimage_map_segment(struct kimage *image, int idx) { return NULL; } static inline void kimage_unmap_segment(void *buffer) { } #define kexec_in_progress false --- a/kernel/kexec_core.c~kernel-kexec-change-the-prototype-of-kimage_map_segment +++ a/kernel/kexec_core.c @@ -953,17 +953,20 @@ int kimage_load_segment(struct kimage *i return result; } -void *kimage_map_segment(struct kimage *image, - unsigned long addr, unsigned long size) +void *kimage_map_segment(struct kimage *image, int idx) { + unsigned long addr, size, eaddr; unsigned long src_page_addr, dest_page_addr = 0; - unsigned long eaddr = addr + size; kimage_entry_t *ptr, entry; struct page **src_pages; unsigned int npages; void *vaddr = NULL; int i; + addr = image->segment[idx].mem; + size = image->segment[idx].memsz; + eaddr = addr + size; + /* * Collect the source pages and map them in a contiguous VA range. */ --- a/security/integrity/ima/ima_kexec.c~kernel-kexec-change-the-prototype-of-kimage_map_segment +++ a/security/integrity/ima/ima_kexec.c @@ -250,9 +250,7 @@ void ima_kexec_post_load(struct kimage * if (!image->ima_buffer_addr) return; - ima_kexec_buffer = kimage_map_segment(image, - image->ima_buffer_addr, - image->ima_buffer_size); + ima_kexec_buffer = kimage_map_segment(image, image->ima_segment_index); if (!ima_kexec_buffer) { pr_err("Could not map measurements buffer.\n"); return; _ Patches currently in -mm which might be from piliu(a)redhat.com are

1 hour, 41 minutes

1
0
0 0

[merged mm-hotfixes-stable] mm-page_alloc-change-all-pageblocks-migrate-type-on-coalescing.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/page_alloc: change all pageblocks migrate type on coalescing has been removed from the -mm tree. Its filename was mm-page_alloc-change-all-pageblocks-migrate-type-on-coalescing.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Alexander Gordeev <agordeev(a)linux.ibm.com> Subject: mm/page_alloc: change all pageblocks migrate type on coalescing Date: Fri, 12 Dec 2025 16:14:57 +0100 When a page is freed it coalesces with a buddy into a higher order page while possible. When the buddy page migrate type differs, it is expected to be updated to match the one of the page being freed. However, only the first pageblock of the buddy page is updated, while the rest of the pageblocks are left unchanged. That causes warnings in later expand() and other code paths (like below), since an inconsistency between migration type of the list containing the page and the page-owned pageblocks migration types is introduced. [ 308.986589] ------------[ cut here ]------------ [ 308.987227] page type is 0, passed migratetype is 1 (nr=256) [ 308.987275] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:812 expand+0x23c/0x270 [ 308.987293] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E) [ 308.987439] Unloaded tainted modules: hmac_s390(E):2 [ 308.987650] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G E 6.18.0-gcc-bpf-debug #431 PREEMPT [ 308.987657] Tainted: [E]=UNSIGNED_MODULE [ 308.987661] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0) [ 308.987666] Krnl PSW : 0404f00180000000 00000349976fa600 (expand+0x240/0x270) [ 308.987676] R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 308.987682] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88 [ 308.987688] 0000000000000005 0000034980000005 000002be803ac000 0000023efe6c8300 [ 308.987692] 0000000000000008 0000034998d57290 000002be00000100 0000023e00000008 [ 308.987696] 0000000000000000 0000000000000000 00000349976fa5fc 000002c99b1eb6f0 [ 308.987708] Krnl Code: 00000349976fa5f0: c020008a02f2 larl %r2,000003499883abd4 00000349976fa5f6: c0e5ffe3f4b5 brasl %r14,0000034997378f60 #00000349976fa5fc: af000000 mc 0,0 >00000349976fa600: a7f4ff4c brc 15,00000349976fa498 00000349976fa604: b9040026 lgr %r2,%r6 00000349976fa608: c0300088317f larl %r3,0000034998800906 00000349976fa60e: c0e5fffdb6e1 brasl %r14,00000349976b13d0 00000349976fa614: af000000 mc 0,0 [ 308.987734] Call Trace: [ 308.987738] [<00000349976fa600>] expand+0x240/0x270 [ 308.987744] ([<00000349976fa5fc>] expand+0x23c/0x270) [ 308.987749] [<00000349976ff95e>] rmqueue_bulk+0x71e/0x940 [ 308.987754] [<00000349976ffd7e>] __rmqueue_pcplist+0x1fe/0x2a0 [ 308.987759] [<0000034997700966>] rmqueue.isra.0+0xb46/0xf40 [ 308.987763] [<0000034997703ec8>] get_page_from_freelist+0x198/0x8d0 [ 308.987768] [<0000034997706fa8>] __alloc_frozen_pages_noprof+0x198/0x400 [ 308.987774] [<00000349977536f8>] alloc_pages_mpol+0xb8/0x220 [ 308.987781] [<0000034997753bf6>] folio_alloc_mpol_noprof+0x26/0xc0 [ 308.987786] [<0000034997753e4c>] vma_alloc_folio_noprof+0x6c/0xa0 [ 308.987791] [<0000034997775b22>] vma_alloc_anon_folio_pmd+0x42/0x240 [ 308.987799] [<000003499777bfea>] __do_huge_pmd_anonymous_page+0x3a/0x210 [ 308.987804] [<00000349976cb08e>] __handle_mm_fault+0x4de/0x500 [ 308.987809] [<00000349976cb14c>] handle_mm_fault+0x9c/0x3a0 [ 308.987813] [<000003499734d70e>] do_exception+0x1de/0x540 [ 308.987822] [<0000034998387390>] __do_pgm_check+0x130/0x220 [ 308.987830] [<000003499839a934>] pgm_check_handler+0x114/0x160 [ 308.987838] 3 locks held by mempig_verify/5224: [ 308.987842] #0: 0000023ea44c1e08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0xb2/0x2a0 [ 308.987859] #1: 0000023ee4d41b18 (&pcp->lock){+.+.}-{2:2}, at: rmqueue.isra.0+0xad6/0xf40 [ 308.987871] #2: 0000023efe6c8998 (&zone->lock){..-.}-{2:2}, at: rmqueue_bulk+0x5a/0x940 [ 308.987886] Last Breaking-Event-Address: [ 308.987890] [<0000034997379096>] __warn_printk+0x136/0x140 [ 308.987897] irq event stamp: 52330356 [ 308.987901] hardirqs last enabled at (52330355): [<000003499838742e>] __do_pgm_check+0x1ce/0x220 [ 308.987907] hardirqs last disabled at (52330356): [<000003499839932e>] _raw_spin_lock_irqsave+0x9e/0xe0 [ 308.987913] softirqs last enabled at (52329882): [<0000034997383786>] handle_softirqs+0x2c6/0x530 [ 308.987922] softirqs last disabled at (52329859): [<0000034997382f86>] __irq_exit_rcu+0x126/0x140 [ 308.987929] ---[ end trace 0000000000000000 ]--- [ 308.987936] ------------[ cut here ]------------ [ 308.987940] page type is 0, passed migratetype is 1 (nr=256) [ 308.987951] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:860 __del_page_from_free_list+0x1be/0x1e0 [ 308.987960] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E) [ 308.988070] Unloaded tainted modules: hmac_s390(E):2 [ 308.988087] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G W E 6.18.0-gcc-bpf-debug #431 PREEMPT [ 308.988095] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE [ 308.988100] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0) [ 308.988105] Krnl PSW : 0404f00180000000 00000349976f9e32 (__del_page_from_free_list+0x1c2/0x1e0) [ 308.988118] R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 308.988127] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88 [ 308.988133] 0000000000000005 0000034980000005 0000034998d57290 0000023efe6c8300 [ 308.988139] 0000000000000001 0000000000000008 000002be00000100 000002be803ac000 [ 308.988144] 0000000000000000 0000000000000001 00000349976f9e2e 000002c99b1eb728 [ 308.988153] Krnl Code: 00000349976f9e22: c020008a06d9 larl %r2,000003499883abd4 00000349976f9e28: c0e5ffe3f89c brasl %r14,0000034997378f60 #00000349976f9e2e: af000000 mc 0,0 >00000349976f9e32: a7f4ff4e brc 15,00000349976f9cce 00000349976f9e36: b904002b lgr %r2,%r11 00000349976f9e3a: c030008a06e7 larl %r3,000003499883ac08 00000349976f9e40: c0e5fffdbac8 brasl %r14,00000349976b13d0 00000349976f9e46: af000000 mc 0,0 [ 308.988184] Call Trace: [ 308.988188] [<00000349976f9e32>] __del_page_from_free_list+0x1c2/0x1e0 [ 308.988195] ([<00000349976f9e2e>] __del_page_from_free_list+0x1be/0x1e0) [ 308.988202] [<00000349976ff946>] rmqueue_bulk+0x706/0x940 [ 308.988208] [<00000349976ffd7e>] __rmqueue_pcplist+0x1fe/0x2a0 [ 308.988214] [<0000034997700966>] rmqueue.isra.0+0xb46/0xf40 [ 308.988221] [<0000034997703ec8>] get_page_from_freelist+0x198/0x8d0 [ 308.988227] [<0000034997706fa8>] __alloc_frozen_pages_noprof+0x198/0x400 [ 308.988233] [<00000349977536f8>] alloc_pages_mpol+0xb8/0x220 [ 308.988240] [<0000034997753bf6>] folio_alloc_mpol_noprof+0x26/0xc0 [ 308.988247] [<0000034997753e4c>] vma_alloc_folio_noprof+0x6c/0xa0 [ 308.988253] [<0000034997775b22>] vma_alloc_anon_folio_pmd+0x42/0x240 [ 308.988260] [<000003499777bfea>] __do_huge_pmd_anonymous_page+0x3a/0x210 [ 308.988267] [<00000349976cb08e>] __handle_mm_fault+0x4de/0x500 [ 308.988273] [<00000349976cb14c>] handle_mm_fault+0x9c/0x3a0 [ 308.988279] [<000003499734d70e>] do_exception+0x1de/0x540 [ 308.988286] [<0000034998387390>] __do_pgm_check+0x130/0x220 [ 308.988293] [<000003499839a934>] pgm_check_handler+0x114/0x160 [ 308.988300] 3 locks held by mempig_verify/5224: [ 308.988305] #0: 0000023ea44c1e08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0xb2/0x2a0 [ 308.988322] #1: 0000023ee4d41b18 (&pcp->lock){+.+.}-{2:2}, at: rmqueue.isra.0+0xad6/0xf40 [ 308.988334] #2: 0000023efe6c8998 (&zone->lock){..-.}-{2:2}, at: rmqueue_bulk+0x5a/0x940 [ 308.988346] Last Breaking-Event-Address: [ 308.988350] [<0000034997379096>] __warn_printk+0x136/0x140 [ 308.988356] irq event stamp: 52330356 [ 308.988360] hardirqs last enabled at (52330355): [<000003499838742e>] __do_pgm_check+0x1ce/0x220 [ 308.988366] hardirqs last disabled at (52330356): [<000003499839932e>] _raw_spin_lock_irqsave+0x9e/0xe0 [ 308.988373] softirqs last enabled at (52329882): [<0000034997383786>] handle_softirqs+0x2c6/0x530 [ 308.988380] softirqs last disabled at (52329859): [<0000034997382f86>] __irq_exit_rcu+0x126/0x140 [ 308.988388] ---[ end trace 0000000000000000 ]--- Link: https://lkml.kernel.org/r/20251215081002.3353900A9c-agordeev@linux.ibm.com Link: https://lkml.kernel.org/r/20251212151457.3898073Add-agordeev@linux.ibm.com Fixes: e6cf9e1c4cde ("mm: page_alloc: fix up block types when merging compatible blocks") Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Reported-by: Marc Hartmayer <mhartmay(a)linux.ibm.com> Closes: https://lore.kernel.org/linux-mm/87wmalyktd.fsf@linux.ibm.com/ Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Wei Yang <richard.weiyang(a)gmail.com> Cc: Marc Hartmayer <mhartmay(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/page_alloc.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) --- a/mm/page_alloc.c~mm-page_alloc-change-all-pageblocks-migrate-type-on-coalescing +++ a/mm/page_alloc.c @@ -914,6 +914,17 @@ buddy_merge_likely(unsigned long pfn, un NULL) != NULL; } +static void change_pageblock_range(struct page *pageblock_page, + int start_order, int migratetype) +{ + int nr_pageblocks = 1 << (start_order - pageblock_order); + + while (nr_pageblocks--) { + set_pageblock_migratetype(pageblock_page, migratetype); + pageblock_page += pageblock_nr_pages; + } +} + /* * Freeing function for a buddy system allocator. * @@ -1000,7 +1011,7 @@ static inline void __free_one_page(struc * expand() down the line puts the sub-blocks * on the right freelists. */ - set_pageblock_migratetype(buddy, migratetype); + change_pageblock_range(buddy, order, migratetype); } combined_pfn = buddy_pfn & pfn; @@ -2147,17 +2158,6 @@ bool pageblock_unisolate_and_move_free_p #endif /* CONFIG_MEMORY_ISOLATION */ -static void change_pageblock_range(struct page *pageblock_page, - int start_order, int migratetype) -{ - int nr_pageblocks = 1 << (start_order - pageblock_order); - - while (nr_pageblocks--) { - set_pageblock_migratetype(pageblock_page, migratetype); - pageblock_page += pageblock_nr_pages; - } -} - static inline bool boost_watermark(struct zone *zone) { unsigned long max_boost; _ Patches currently in -mm which might be from agordeev(a)linux.ibm.com are powerpc-64s-do-not-re-activate-batched-tlb-flush.patch

1 hour, 41 minutes

1
0
0 0

[merged mm-hotfixes-stable] kasan-unpoison-vms-addresses-with-a-common-tag.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: kasan: unpoison vms[area] addresses with a common tag has been removed from the -mm tree. Its filename was kasan-unpoison-vms-addresses-with-a-common-tag.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Maciej Wieczor-Retman <maciej.wieczor-retman(a)intel.com> Subject: kasan: unpoison vms[area] addresses with a common tag Date: Thu, 04 Dec 2025 19:00:11 +0000 A KASAN tag mismatch, possibly causing a kernel panic, can be observed on systems with a tag-based KASAN enabled and with multiple NUMA nodes. It was reported on arm64 and reproduced on x86. It can be explained in the following points: 1. There can be more than one virtual memory chunk. 2. Chunk's base address has a tag. 3. The base address points at the first chunk and thus inherits the tag of the first chunk. 4. The subsequent chunks will be accessed with the tag from the first chunk. 5. Thus, the subsequent chunks need to have their tag set to match that of the first chunk. Use the new vmalloc flag that disables random tag assignment in __kasan_unpoison_vmalloc() - pass the same random tag to all the vm_structs by tagging the pointers before they go inside __kasan_unpoison_vmalloc(). Assigning a common tag resolves the pcpu chunk address mismatch. [akpm(a)linux-foundation.org: use WARN_ON_ONCE(), per Andrey] Link: https://lkml.kernel.org/r/CA+fCnZeuGdKSEm11oGT6FS71_vGq1vjq-xY36kxVdFvwmag2… [maciej.wieczor-retman(a)intel.com: remove unneeded pr_warn()] Link: https://lkml.kernel.org/r/919897daaaa3c982a27762a2ee038769ad033991.17649453… Link: https://lkml.kernel.org/r/873821114a9f722ffb5d6702b94782e902883fdf.17648745… Fixes: 1d96320f8d53 ("kasan, vmalloc: add vmalloc tagging for SW_TAGS") Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman(a)intel.com> Reviewed-by: Andrey Konovalov <andreyknvl(a)gmail.com> Cc: Alexander Potapenko <glider(a)google.com> Cc: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> Cc: Danilo Krummrich <dakr(a)kernel.org> Cc: Dmitriy Vyukov <dvyukov(a)google.com> Cc: Jiayuan Chen <jiayuan.chen(a)linux.dev> Cc: Kees Cook <kees(a)kernel.org> Cc: Marco Elver <elver(a)google.com> Cc: "Uladzislau Rezki (Sony)" <urezki(a)gmail.com> Cc: Vincenzo Frascino <vincenzo.frascino(a)arm.com> Cc: <stable(a)vger.kernel.org> [6.1+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/kasan/common.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) --- a/mm/kasan/common.c~kasan-unpoison-vms-addresses-with-a-common-tag +++ a/mm/kasan/common.c @@ -584,11 +584,26 @@ void __kasan_unpoison_vmap_areas(struct unsigned long size; void *addr; int area; + u8 tag; - for (area = 0 ; area < nr_vms ; area++) { + /* + * If KASAN_VMALLOC_KEEP_TAG was set at this point, all vms[] pointers + * would be unpoisoned with the KASAN_TAG_KERNEL which would disable + * KASAN checks down the line. + */ + if (WARN_ON_ONCE(flags & KASAN_VMALLOC_KEEP_TAG)) + return; + + size = vms[0]->size; + addr = vms[0]->addr; + vms[0]->addr = __kasan_unpoison_vmalloc(addr, size, flags); + tag = get_tag(vms[0]->addr); + + for (area = 1 ; area < nr_vms ; area++) { size = vms[area]->size; - addr = vms[area]->addr; - vms[area]->addr = __kasan_unpoison_vmalloc(addr, size, flags); + addr = set_tag(vms[area]->addr, tag); + vms[area]->addr = + __kasan_unpoison_vmalloc(addr, size, flags | KASAN_VMALLOC_KEEP_TAG); } } #endif _ Patches currently in -mm which might be from maciej.wieczor-retman(a)intel.com are

1 hour, 41 minutes

1
0
0 0

[merged mm-hotfixes-stable] kasan-refactor-pcpu-kasan-vmalloc-unpoison.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: kasan: refactor pcpu kasan vmalloc unpoison has been removed from the -mm tree. Its filename was kasan-refactor-pcpu-kasan-vmalloc-unpoison.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Maciej Wieczor-Retman <maciej.wieczor-retman(a)intel.com> Subject: kasan: refactor pcpu kasan vmalloc unpoison Date: Thu, 04 Dec 2025 19:00:04 +0000 A KASAN tag mismatch, possibly causing a kernel panic, can be observed on systems with a tag-based KASAN enabled and with multiple NUMA nodes. It was reported on arm64 and reproduced on x86. It can be explained in the following points: 1. There can be more than one virtual memory chunk. 2. Chunk's base address has a tag. 3. The base address points at the first chunk and thus inherits the tag of the first chunk. 4. The subsequent chunks will be accessed with the tag from the first chunk. 5. Thus, the subsequent chunks need to have their tag set to match that of the first chunk. Refactor code by reusing __kasan_unpoison_vmalloc in a new helper in preparation for the actual fix. Link: https://lkml.kernel.org/r/eb61d93b907e262eefcaa130261a08bcb6c5ce51.17648745… Fixes: 1d96320f8d53 ("kasan, vmalloc: add vmalloc tagging for SW_TAGS") Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman(a)intel.com> Reviewed-by: Andrey Konovalov <andreyknvl(a)gmail.com> Cc: Alexander Potapenko <glider(a)google.com> Cc: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> Cc: Danilo Krummrich <dakr(a)kernel.org> Cc: Dmitriy Vyukov <dvyukov(a)google.com> Cc: Jiayuan Chen <jiayuan.chen(a)linux.dev> Cc: Kees Cook <kees(a)kernel.org> Cc: Marco Elver <elver(a)google.com> Cc: "Uladzislau Rezki (Sony)" <urezki(a)gmail.com> Cc: Vincenzo Frascino <vincenzo.frascino(a)arm.com> Cc: <stable(a)vger.kernel.org> [6.1+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/kasan.h | 15 +++++++++++++++ mm/kasan/common.c | 17 +++++++++++++++++ mm/vmalloc.c | 4 +--- 3 files changed, 33 insertions(+), 3 deletions(-) --- a/include/linux/kasan.h~kasan-refactor-pcpu-kasan-vmalloc-unpoison +++ a/include/linux/kasan.h @@ -631,6 +631,16 @@ static __always_inline void kasan_poison __kasan_poison_vmalloc(start, size); } +void __kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms, + kasan_vmalloc_flags_t flags); +static __always_inline void +kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms, + kasan_vmalloc_flags_t flags) +{ + if (kasan_enabled()) + __kasan_unpoison_vmap_areas(vms, nr_vms, flags); +} + #else /* CONFIG_KASAN_VMALLOC */ static inline void kasan_populate_early_vm_area_shadow(void *start, @@ -655,6 +665,11 @@ static inline void *kasan_unpoison_vmall static inline void kasan_poison_vmalloc(const void *start, unsigned long size) { } +static __always_inline void +kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms, + kasan_vmalloc_flags_t flags) +{ } + #endif /* CONFIG_KASAN_VMALLOC */ #if (defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)) && \ --- a/mm/kasan/common.c~kasan-refactor-pcpu-kasan-vmalloc-unpoison +++ a/mm/kasan/common.c @@ -28,6 +28,7 @@ #include <linux/string.h> #include <linux/types.h> #include <linux/bug.h> +#include <linux/vmalloc.h> #include "kasan.h" #include "../slab.h" @@ -575,3 +576,19 @@ bool __kasan_check_byte(const void *addr } return true; } + +#ifdef CONFIG_KASAN_VMALLOC +void __kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms, + kasan_vmalloc_flags_t flags) +{ + unsigned long size; + void *addr; + int area; + + for (area = 0 ; area < nr_vms ; area++) { + size = vms[area]->size; + addr = vms[area]->addr; + vms[area]->addr = __kasan_unpoison_vmalloc(addr, size, flags); + } +} +#endif --- a/mm/vmalloc.c~kasan-refactor-pcpu-kasan-vmalloc-unpoison +++ a/mm/vmalloc.c @@ -5027,9 +5027,7 @@ retry: * With hardware tag-based KASAN, marking is skipped for * non-VM_ALLOC mappings, see __kasan_unpoison_vmalloc(). */ - for (area = 0; area < nr_vms; area++) - vms[area]->addr = kasan_unpoison_vmalloc(vms[area]->addr, - vms[area]->size, KASAN_VMALLOC_PROT_NORMAL); + kasan_unpoison_vmap_areas(vms, nr_vms, KASAN_VMALLOC_PROT_NORMAL); kfree(vas); return vms; _ Patches currently in -mm which might be from maciej.wieczor-retman(a)intel.com are

1 hour, 41 minutes

1
0
0 0

[merged mm-hotfixes-stable] mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN has been removed from the -mm tree. Its filename was mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Jiayuan Chen <jiayuan.chen(a)linux.dev> Subject: mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN Date: Thu, 04 Dec 2025 18:59:55 +0000 Patch series "kasan: vmalloc: Fixes for the percpu allocator and vrealloc", v3. Patches fix two issues related to KASAN and vmalloc. The first one, a KASAN tag mismatch, possibly resulting in a kernel panic, can be observed on systems with a tag-based KASAN enabled and with multiple NUMA nodes. Initially it was only noticed on x86 [1] but later a similar issue was also reported on arm64 [2]. Specifically the problem is related to how vm_structs interact with pcpu_chunks - both when they are allocated, assigned and when pcpu_chunk addresses are derived. When vm_structs are allocated they are unpoisoned, each with a different random tag, if vmalloc support is enabled along the KASAN mode. Later when first pcpu chunk is allocated it gets its 'base_addr' field set to the first allocated vm_struct. With that it inherits that vm_struct's tag. When pcpu_chunk addresses are later derived (by pcpu_chunk_addr(), for example in pcpu_alloc_noprof()) the base_addr field is used and offsets are added to it. If the initial conditions are satisfied then some of the offsets will point into memory allocated with a different vm_struct. So while the lower bits will get accurately derived the tag bits in the top of the pointer won't match the shadow memory contents. The solution (proposed at v2 of the x86 KASAN series [3]) is to unpoison the vm_structs with the same tag when allocating them for the per cpu allocator (in pcpu_get_vm_areas()). The second one reported by syzkaller [4] is related to vrealloc and happens because of random tag generation when unpoisoning memory without allocating new pages. This breaks shadow memory tracking and needs to reuse the existing tag instead of generating a new one. At the same time an inconsistency in used flags is corrected. This patch (of 3): Syzkaller reported a memory out-of-bounds bug [4]. This patch fixes two issues: 1. In vrealloc the KASAN_VMALLOC_VM_ALLOC flag is missing when unpoisoning the extended region. This flag is required to correctly associate the allocation with KASAN's vmalloc tracking. Note: In contrast, vzalloc (via __vmalloc_node_range_noprof) explicitly sets KASAN_VMALLOC_VM_ALLOC and calls kasan_unpoison_vmalloc() with it. vrealloc must behave consistently -- especially when reusing existing vmalloc regions -- to ensure KASAN can track allocations correctly. 2. When vrealloc reuses an existing vmalloc region (without allocating new pages) KASAN generates a new tag, which breaks tag-based memory access tracking. Introduce KASAN_VMALLOC_KEEP_TAG, a new KASAN flag that allows reusing the tag already attached to the pointer, ensuring consistent tag behavior during reallocation. Pass KASAN_VMALLOC_KEEP_TAG and KASAN_VMALLOC_VM_ALLOC to the kasan_unpoison_vmalloc inside vrealloc_node_align_noprof(). Link: https://lkml.kernel.org/r/cover.1765978969.git.m.wieczorretman@pm.me Link: https://lkml.kernel.org/r/38dece0a4074c43e48150d1e242f8242c73bf1a5.17648745… Link: https://lore.kernel.org/all/e7e04692866d02e6d3b32bb43b998e5d17092ba4.173868… [1] Link: https://lore.kernel.org/all/aMUrW1Znp1GEj7St@MiWiFi-R3L-srv/ [2] Link: https://lore.kernel.org/all/CAPAsAGxDRv_uFeMYu9TwhBVWHCCtkSxoWY4xmFB_vowMbi… [3] Link: https://syzkaller.appspot.com/bug?extid=997752115a851cb0cf36 [4] Fixes: a0309faf1cb0 ("mm: vmalloc: support more granular vrealloc() sizing") Signed-off-by: Jiayuan Chen <jiayuan.chen(a)linux.dev> Co-developed-by: Maciej Wieczor-Retman <maciej.wieczor-retman(a)intel.com> Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman(a)intel.com> Reported-by: syzbot+997752115a851cb0cf36(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e243a2.050a0220.1696c6.007d.GAE@google.com/T/ Reviewed-by: Andrey Konovalov <andreyknvl(a)gmail.com> Cc: Alexander Potapenko <glider(a)google.com> Cc: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> Cc: Danilo Krummrich <dakr(a)kernel.org> Cc: Dmitriy Vyukov <dvyukov(a)google.com> Cc: Kees Cook <kees(a)kernel.org> Cc: Marco Elver <elver(a)google.com> Cc: "Uladzislau Rezki (Sony)" <urezki(a)gmail.com> Cc: Vincenzo Frascino <vincenzo.frascino(a)arm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/kasan.h | 1 + mm/kasan/hw_tags.c | 2 +- mm/kasan/shadow.c | 4 +++- mm/vmalloc.c | 4 +++- 4 files changed, 8 insertions(+), 3 deletions(-) --- a/include/linux/kasan.h~mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan +++ a/include/linux/kasan.h @@ -28,6 +28,7 @@ typedef unsigned int __bitwise kasan_vma #define KASAN_VMALLOC_INIT ((__force kasan_vmalloc_flags_t)0x01u) #define KASAN_VMALLOC_VM_ALLOC ((__force kasan_vmalloc_flags_t)0x02u) #define KASAN_VMALLOC_PROT_NORMAL ((__force kasan_vmalloc_flags_t)0x04u) +#define KASAN_VMALLOC_KEEP_TAG ((__force kasan_vmalloc_flags_t)0x08u) #define KASAN_VMALLOC_PAGE_RANGE 0x1 /* Apply exsiting page range */ #define KASAN_VMALLOC_TLB_FLUSH 0x2 /* TLB flush */ --- a/mm/kasan/hw_tags.c~mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan +++ a/mm/kasan/hw_tags.c @@ -361,7 +361,7 @@ void *__kasan_unpoison_vmalloc(const voi return (void *)start; } - tag = kasan_random_tag(); + tag = (flags & KASAN_VMALLOC_KEEP_TAG) ? get_tag(start) : kasan_random_tag(); start = set_tag(start, tag); /* Unpoison and initialize memory up to size. */ --- a/mm/kasan/shadow.c~mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan +++ a/mm/kasan/shadow.c @@ -631,7 +631,9 @@ void *__kasan_unpoison_vmalloc(const voi !(flags & KASAN_VMALLOC_PROT_NORMAL)) return (void *)start; - start = set_tag(start, kasan_random_tag()); + if (unlikely(!(flags & KASAN_VMALLOC_KEEP_TAG))) + start = set_tag(start, kasan_random_tag()); + kasan_unpoison(start, size, false); return (void *)start; } --- a/mm/vmalloc.c~mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan +++ a/mm/vmalloc.c @@ -4331,7 +4331,9 @@ void *vrealloc_node_align_noprof(const v */ if (size <= alloced_size) { kasan_unpoison_vmalloc(p + old_size, size - old_size, - KASAN_VMALLOC_PROT_NORMAL); + KASAN_VMALLOC_PROT_NORMAL | + KASAN_VMALLOC_VM_ALLOC | + KASAN_VMALLOC_KEEP_TAG); /* * No need to zero memory here, as unused memory will have * already been zeroed at initial allocation time or during _ Patches currently in -mm which might be from jiayuan.chen(a)linux.dev are

1 hour, 41 minutes

1
0
0 0

[merged mm-hotfixes-stable] idr-fix-idr_alloc-returning-an-id-out-of-range.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: idr: fix idr_alloc() returning an ID out of range has been removed from the -mm tree. Its filename was idr-fix-idr_alloc-returning-an-id-out-of-range.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> Subject: idr: fix idr_alloc() returning an ID out of range Date: Fri, 28 Nov 2025 16:18:32 +0000 If you use an IDR with a non-zero base, and specify a range that lies entirely below the base, 'max - base' becomes very large and idr_get_free() can return an ID that lies outside of the requested range. Link: https://lkml.kernel.org/r/20251128161853.3200058-1-willy@infradead.org Fixes: 6ce711f27500 ("idr: Make 1-based IDRs more efficient") Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Reported-by: Jan Sokolowski <jan.sokolowski(a)intel.com> Reported-by: Koen Koning <koen.koning(a)intel.com> Reported-by: Peter Senna Tschudin <peter.senna(a)linux.intel.com> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6449 Reviewed-by: Christian K��nig <christian.koenig(a)amd.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/idr.c | 2 ++ tools/testing/radix-tree/idr-test.c | 21 +++++++++++++++++++++ 2 files changed, 23 insertions(+) --- a/lib/idr.c~idr-fix-idr_alloc-returning-an-id-out-of-range +++ a/lib/idr.c @@ -40,6 +40,8 @@ int idr_alloc_u32(struct idr *idr, void if (WARN_ON_ONCE(!(idr->idr_rt.xa_flags & ROOT_IS_IDR))) idr->idr_rt.xa_flags |= IDR_RT_MARKER; + if (max < base) + return -ENOSPC; id = (id < base) ? 0 : id - base; radix_tree_iter_init(&iter, id); --- a/tools/testing/radix-tree/idr-test.c~idr-fix-idr_alloc-returning-an-id-out-of-range +++ a/tools/testing/radix-tree/idr-test.c @@ -57,6 +57,26 @@ void idr_alloc_test(void) idr_destroy(&idr); } +void idr_alloc2_test(void) +{ + int id; + struct idr idr = IDR_INIT_BASE(idr, 1); + + id = idr_alloc(&idr, idr_alloc2_test, 0, 1, GFP_KERNEL); + assert(id == -ENOSPC); + + id = idr_alloc(&idr, idr_alloc2_test, 1, 2, GFP_KERNEL); + assert(id == 1); + + id = idr_alloc(&idr, idr_alloc2_test, 0, 1, GFP_KERNEL); + assert(id == -ENOSPC); + + id = idr_alloc(&idr, idr_alloc2_test, 0, 2, GFP_KERNEL); + assert(id == -ENOSPC); + + idr_destroy(&idr); +} + void idr_replace_test(void) { DEFINE_IDR(idr); @@ -409,6 +429,7 @@ void idr_checks(void) idr_replace_test(); idr_alloc_test(); + idr_alloc2_test(); idr_null_test(); idr_nowait_test(); idr_get_next_test(0); _ Patches currently in -mm which might be from willy(a)infradead.org are

1 hour, 41 minutes

1
0
0 0

[PATCH 5.10.y 5.15.y RESEND] ipv6: Fix potential uninit-value access in __ip6_make_skb()

by skulkarni＠mvista.com

From: Shigeru Yoshida <syoshida(a)redhat.com> commit 4e13d3a9c25b7080f8a619f961e943fe08c2672c upstream. As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in __ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags instead of testing HDRINCL on the socket to avoid a race condition which causes uninit-value access. Fixes: ea30388baebc ("ipv6: Fix an uninit variable access bug in __ip6_make_skb()") Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Shubham Kulkarni <skulkarni(a)mvista.com> --- Referred stable v6.1.y version of the patch to generate this one [ v6.1 link: https://github.com/gregkh/linux/commit/a05c1ede50e9656f0752e523c7b54f3a3489… ] --- net/ipv6/ip6_output.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 426330b8dfa4..99ee18b3a953 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1917,7 +1917,8 @@ struct sk_buff *__ip6_make_skb(struct sock *sk, struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); u8 icmp6_type; - if (sk->sk_socket->type == SOCK_RAW && !inet_sk(sk)->hdrincl) + if (sk->sk_socket->type == SOCK_RAW && + !(fl6->flowi6_flags & FLOWI_FLAG_KNOWN_NH)) icmp6_type = fl6->fl6_icmp_type; else icmp6_type = icmp6_hdr(skb)->icmp6_type; -- 2.25.1

2 hours, 11 minutes

1
0
0 0

[PATCH] ipv6: Fix potential uninit-value access in __ip6_make_skb()

by skulkarni＠mvista.com

From: Shigeru Yoshida <syoshida(a)redhat.com> commit 4e13d3a9c25b7080f8a619f961e943fe08c2672c upstream. As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in __ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags instead of testing HDRINCL on the socket to avoid a race condition which causes uninit-value access. Fixes: ea30388baebc ("ipv6: Fix an uninit variable access bug in __ip6_make_skb()") Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Shubham Kulkarni <skulkarni(a)mvista.com> --- Referred stable v6.1.y version of the patch to generate this one [ v6.1 link: https://github.com/gregkh/linux/commit/a05c1ede50e9656f0752e523c7b54f3a3489… ] --- net/ipv6/ip6_output.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 426330b8dfa4..99ee18b3a953 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1917,7 +1917,8 @@ struct sk_buff *__ip6_make_skb(struct sock *sk, struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); u8 icmp6_type; - if (sk->sk_socket->type == SOCK_RAW && !inet_sk(sk)->hdrincl) + if (sk->sk_socket->type == SOCK_RAW && + !(fl6->flowi6_flags & FLOWI_FLAG_KNOWN_NH)) icmp6_type = fl6->fl6_icmp_type; else icmp6_type = icmp6_hdr(skb)->icmp6_type; -- 2.25.1

2 hours, 30 minutes

1
1
0 0

[PATCH v3 1/2] mm/memory-failure: fix missing ->mf_stats count in hugetlb poison

by Jane Chu

When a newly poisoned subpage ends up in an already poisoned hugetlb folio, 'num_poisoned_pages' is incremented, but the per node ->mf_stats is not. Fix the inconsistency by designating action_result() to update them both. While at it, define __get_huge_page_for_hwpoison() return values in terms of symbol names for better readibility. Also rename folio_set_hugetlb_hwpoison() to hugetlb_update_hwpoison() since the function does more than the conventional bit setting and the fact three possible return values are expected. Fixes: 18f41fa616ee4 ("mm: memory-failure: bump memory failure stats to pglist_data") Cc: <stable(a)vger.kernel.org> Signed-off-by: Jane Chu <jane.chu(a)oracle.com> --- v2 -> v3: No change. v1 -> v2: adapted David and Liam's comment, define __get_huge_page_for_hwpoison() return values in terms of symbol names instead of naked integers for better readibility. #define instead of enum is used since the function has footprint outside MF, just try to limit the MF specifics local. also renamed folio_set_hugetlb_hwpoison() to hugetlb_update_hwpoison() since the function does more than the conventional bit setting and the fact three possible return values are expected. --- mm/memory-failure.c | 56 ++++++++++++++++++++++++++------------------- 1 file changed, 33 insertions(+), 23 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index fbc5a01260c8..8b47e8a1b12d 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1883,12 +1883,18 @@ static unsigned long __folio_free_raw_hwp(struct folio *folio, bool move_flag) return count; } -static int folio_set_hugetlb_hwpoison(struct folio *folio, struct page *page) +#define MF_HUGETLB_ALREADY_POISONED 3 /* already poisoned */ +#define MF_HUGETLB_ACC_EXISTING_POISON 4 /* accessed existing poisoned page */ +/* + * Set hugetlb folio as hwpoisoned, update folio private raw hwpoison list + * to keep track of the poisoned pages. + */ +static int hugetlb_update_hwpoison(struct folio *folio, struct page *page) { struct llist_head *head; struct raw_hwp_page *raw_hwp; struct raw_hwp_page *p; - int ret = folio_test_set_hwpoison(folio) ? -EHWPOISON : 0; + int ret = folio_test_set_hwpoison(folio) ? MF_HUGETLB_ALREADY_POISONED : 0; /* * Once the hwpoison hugepage has lost reliable raw error info, @@ -1896,20 +1902,18 @@ static int folio_set_hugetlb_hwpoison(struct folio *folio, struct page *page) * so skip to add additional raw error info. */ if (folio_test_hugetlb_raw_hwp_unreliable(folio)) - return -EHWPOISON; + return MF_HUGETLB_ALREADY_POISONED; + head = raw_hwp_list_head(folio); llist_for_each_entry(p, head->first, node) { if (p->page == page) - return -EHWPOISON; + return MF_HUGETLB_ACC_EXISTING_POISON; } raw_hwp = kmalloc(sizeof(struct raw_hwp_page), GFP_ATOMIC); if (raw_hwp) { raw_hwp->page = page; llist_add(&raw_hwp->node, head); - /* the first error event will be counted in action_result(). */ - if (ret) - num_poisoned_pages_inc(page_to_pfn(page)); } else { /* * Failed to save raw error info. We no longer trace all @@ -1955,32 +1959,30 @@ void folio_clear_hugetlb_hwpoison(struct folio *folio) folio_free_raw_hwp(folio, true); } +#define MF_HUGETLB_FREED 0 /* freed hugepage */ +#define MF_HUGETLB_IN_USED 1 /* in-use hugepage */ +#define MF_NOT_HUGETLB 2 /* not a hugepage */ + /* * Called from hugetlb code with hugetlb_lock held. - * - * Return values: - * 0 - free hugepage - * 1 - in-use hugepage - * 2 - not a hugepage - * -EBUSY - the hugepage is busy (try to retry) - * -EHWPOISON - the hugepage is already hwpoisoned */ int __get_huge_page_for_hwpoison(unsigned long pfn, int flags, bool *migratable_cleared) { struct page *page = pfn_to_page(pfn); struct folio *folio = page_folio(page); - int ret = 2; /* fallback to normal page handling */ + int ret = MF_NOT_HUGETLB; bool count_increased = false; + int rc; if (!folio_test_hugetlb(folio)) goto out; if (flags & MF_COUNT_INCREASED) { - ret = 1; + ret = MF_HUGETLB_IN_USED; count_increased = true; } else if (folio_test_hugetlb_freed(folio)) { - ret = 0; + ret = MF_HUGETLB_FREED; } else if (folio_test_hugetlb_migratable(folio)) { ret = folio_try_get(folio); if (ret) @@ -1991,8 +1993,9 @@ int __get_huge_page_for_hwpoison(unsigned long pfn, int flags, goto out; } - if (folio_set_hugetlb_hwpoison(folio, page)) { - ret = -EHWPOISON; + rc = hugetlb_update_hwpoison(folio, page); + if (rc >= MF_HUGETLB_ALREADY_POISONED) { + ret = rc; goto out; } @@ -2029,22 +2032,29 @@ static int try_memory_failure_hugetlb(unsigned long pfn, int flags, int *hugetlb *hugetlb = 1; retry: res = get_huge_page_for_hwpoison(pfn, flags, &migratable_cleared); - if (res == 2) { /* fallback to normal page handling */ + switch (res) { + case MF_NOT_HUGETLB: /* fallback to normal page handling */ *hugetlb = 0; return 0; - } else if (res == -EHWPOISON) { + case MF_HUGETLB_ALREADY_POISONED: + case MF_HUGETLB_ACC_EXISTING_POISON: if (flags & MF_ACTION_REQUIRED) { folio = page_folio(p); res = kill_accessing_process(current, folio_pfn(folio), flags); } - action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); + if (res == MF_HUGETLB_ALREADY_POISONED) + action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); + else + action_result(pfn, MF_MSG_HUGE, MF_FAILED); return res; - } else if (res == -EBUSY) { + case -EBUSY: if (!(flags & MF_NO_RETRY)) { flags |= MF_NO_RETRY; goto retry; } return action_result(pfn, MF_MSG_GET_HWPOISON, MF_IGNORED); + default: + break; } folio = page_folio(p); -- 2.43.5

2 hours, 37 minutes

3
2
0 0

FAILED: patch "[PATCH] x86/msi: Make irq_retrigger() functional for posted MSI" failed to apply to 6.12-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.12-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y git checkout FETCH_HEAD git cherry-pick -x 0edc78b82bea85e1b2165d8e870a5c3535919695 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2025122351-chip-causal-80ed@gregkh' --subject-prefix 'PATCH 6.12.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 0edc78b82bea85e1b2165d8e870a5c3535919695 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner <tglx(a)linutronix.de> Date: Tue, 25 Nov 2025 22:50:45 +0100 Subject: [PATCH] x86/msi: Make irq_retrigger() functional for posted MSI Luigi reported that retriggering a posted MSI interrupt does not work correctly. The reason is that the retrigger happens at the vector domain by sending an IPI to the actual vector on the target CPU. That works correctly exactly once because the posted MSI interrupt chip does not issue an EOI as that's only required for the posted MSI notification vector itself. As a consequence the vector becomes stale in the ISR, which not only affects this vector but also any lower priority vector in the affected APIC because the ISR bit is not cleared. Luigi proposed to set the vector in the remap PIR bitmap and raise the posted MSI notification vector. That works, but that still does not cure a related problem: If there is ever a stray interrupt on such a vector, then the related APIC ISR bit becomes stale due to the lack of EOI as described above. Unlikely to happen, but if it happens it's not debuggable at all. So instead of playing games with the PIR, this can be actually solved for both cases by: 1) Keeping track of the posted interrupt vector handler state 2) Implementing a posted MSI specific irq_ack() callback which checks that state. If the posted vector handler is inactive it issues an EOI, otherwise it delegates that to the posted handler. This is correct versus affinity changes and concurrent events on the posted vector as the actual handler invocation is serialized through the interrupt descriptor lock. Fixes: ed1e48ea4370 ("iommu/vt-d: Enable posted mode for device MSIs") Reported-by: Luigi Rizzo <lrizzo(a)google.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-by: Luigi Rizzo <lrizzo(a)google.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20251125214631.044440658@linutronix.de Closes: https://lore.kernel.org/lkml/20251124104836.3685533-1-lrizzo@google.com diff --git a/arch/x86/include/asm/irq_remapping.h b/arch/x86/include/asm/irq_remapping.h index 5a0d42464d44..4e55d1755846 100644 --- a/arch/x86/include/asm/irq_remapping.h +++ b/arch/x86/include/asm/irq_remapping.h @@ -87,4 +87,11 @@ static inline void panic_if_irq_remap(const char *msg) } #endif /* CONFIG_IRQ_REMAP */ + +#ifdef CONFIG_X86_POSTED_MSI +void intel_ack_posted_msi_irq(struct irq_data *irqd); +#else +#define intel_ack_posted_msi_irq NULL +#endif + #endif /* __X86_IRQ_REMAPPING_H */ diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c index 86f4e574de02..b2fe6181960c 100644 --- a/arch/x86/kernel/irq.c +++ b/arch/x86/kernel/irq.c @@ -397,6 +397,7 @@ DEFINE_IDTENTRY_SYSVEC_SIMPLE(sysvec_kvm_posted_intr_nested_ipi) /* Posted Interrupt Descriptors for coalesced MSIs to be posted */ DEFINE_PER_CPU_ALIGNED(struct pi_desc, posted_msi_pi_desc); +static DEFINE_PER_CPU_CACHE_HOT(bool, posted_msi_handler_active); void intel_posted_msi_init(void) { @@ -414,6 +415,25 @@ void intel_posted_msi_init(void) this_cpu_write(posted_msi_pi_desc.ndst, destination); } +void intel_ack_posted_msi_irq(struct irq_data *irqd) +{ + irq_move_irq(irqd); + + /* + * Handle the rare case that irq_retrigger() raised the actual + * assigned vector on the target CPU, which means that it was not + * invoked via the posted MSI handler below. In that case APIC EOI + * is required as otherwise the ISR entry becomes stale and lower + * priority interrupts are never going to be delivered after that. + * + * If the posted handler invoked the device interrupt handler then + * the EOI would be premature because it would acknowledge the + * posted vector. + */ + if (unlikely(!__this_cpu_read(posted_msi_handler_active))) + apic_eoi(); +} + static __always_inline bool handle_pending_pir(unsigned long *pir, struct pt_regs *regs) { unsigned long pir_copy[NR_PIR_WORDS]; @@ -446,6 +466,8 @@ DEFINE_IDTENTRY_SYSVEC(sysvec_posted_msi_notification) pid = this_cpu_ptr(&posted_msi_pi_desc); + /* Mark the handler active for intel_ack_posted_msi_irq() */ + __this_cpu_write(posted_msi_handler_active, true); inc_irq_stat(posted_msi_notification_count); irq_enter(); @@ -474,6 +496,7 @@ DEFINE_IDTENTRY_SYSVEC(sysvec_posted_msi_notification) apic_eoi(); irq_exit(); + __this_cpu_write(posted_msi_handler_active, false); set_irq_regs(old_regs); } #endif /* X86_POSTED_MSI */ diff --git a/drivers/iommu/intel/irq_remapping.c b/drivers/iommu/intel/irq_remapping.c index 4f9b01dc91e8..8bcbfe3d9c72 100644 --- a/drivers/iommu/intel/irq_remapping.c +++ b/drivers/iommu/intel/irq_remapping.c @@ -1303,17 +1303,17 @@ static struct irq_chip intel_ir_chip = { * irq_enter(); * handle_edge_irq() * irq_chip_ack_parent() - * irq_move_irq(); // No EOI + * intel_ack_posted_msi_irq(); // No EOI * handle_irq_event() * driver_handler() * handle_edge_irq() * irq_chip_ack_parent() - * irq_move_irq(); // No EOI + * intel_ack_posted_msi_irq(); // No EOI * handle_irq_event() * driver_handler() * handle_edge_irq() * irq_chip_ack_parent() - * irq_move_irq(); // No EOI + * intel_ack_posted_msi_irq(); // No EOI * handle_irq_event() * driver_handler() * apic_eoi() @@ -1322,7 +1322,7 @@ static struct irq_chip intel_ir_chip = { */ static struct irq_chip intel_ir_chip_post_msi = { .name = "INTEL-IR-POST", - .irq_ack = irq_move_irq, + .irq_ack = intel_ack_posted_msi_irq, .irq_set_affinity = intel_ir_set_affinity, .irq_compose_msi_msg = intel_ir_compose_msi_msg, .irq_set_vcpu_affinity = intel_ir_set_vcpu_affinity,

2 hours, 45 minutes

2
1
0 0

[PATCH v3 2/2] mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn

by Jane Chu

When a hugetlb folio is being poisoned again, try_memory_failure_hugetlb() passed head pfn to kill_accessing_process(), that is not right. The precise pfn of the poisoned page should be used in order to determine the precise vaddr as the SIGBUS payload. This issue has already been taken care of in the normal path, that is, hwpoison_user_mappings(), see [1][2]. Further more, for [3] to work correctly in the hugetlb repoisoning case, it's essential to inform VM the precise poisoned page, not the head page. [1] https://lkml.kernel.org/r/20231218135837.3310403-1-willy@infradead.org [2] https://lkml.kernel.org/r/20250224211445.2663312-1-jane.chu@oracle.com [3] https://lore.kernel.org/lkml/20251116013223.1557158-1-jiaqiyan@google.com/ Cc: <stable(a)vger.kernel.org> Signed-off-by: Jane Chu <jane.chu(a)oracle.com> Reviewed-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> --- v2 -> v3: incorporated suggestions from Miaohe and Matthew. v1 -> v2: pickup R-B, add stable to cc list. --- mm/memory-failure.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 8b47e8a1b12d..98612ac961b0 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -692,6 +692,8 @@ static int check_hwpoisoned_entry(pte_t pte, unsigned long addr, short shift, unsigned long poisoned_pfn, struct to_kill *tk) { unsigned long pfn = 0; + unsigned long hwpoison_vaddr; + unsigned long mask; if (pte_present(pte)) { pfn = pte_pfn(pte); @@ -702,10 +704,12 @@ static int check_hwpoisoned_entry(pte_t pte, unsigned long addr, short shift, pfn = softleaf_to_pfn(entry); } - if (!pfn || pfn != poisoned_pfn) + mask = ~((1UL << (shift - PAGE_SHIFT)) - 1); + if (!pfn || ((pfn & mask) != (poisoned_pfn & mask))) return 0; - set_to_kill(tk, addr, shift); + hwpoison_vaddr = addr + ((poisoned_pfn - pfn) << PAGE_SHIFT); + set_to_kill(tk, hwpoison_vaddr, shift); return 1; } @@ -2038,10 +2042,8 @@ static int try_memory_failure_hugetlb(unsigned long pfn, int flags, int *hugetlb return 0; case MF_HUGETLB_ALREADY_POISONED: case MF_HUGETLB_ACC_EXISTING_POISON: - if (flags & MF_ACTION_REQUIRED) { - folio = page_folio(p); - res = kill_accessing_process(current, folio_pfn(folio), flags); - } + if (flags & MF_ACTION_REQUIRED) + res = kill_accessing_process(current, pfn, flags); if (res == MF_HUGETLB_ALREADY_POISONED) action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); else -- 2.43.5

2 hours, 47 minutes

3
2
0 0

[PATCH v2 0/2] phy: rockchip: inno-usb2: fix gadget mode disconnection after 6 seconds

by Luca Ceresoli

The USB OTG port of the RK3308 exibits a bug when: - configured as peripheral, and - used in gadget mode, and - the USB cable is connected since before booting The symptom is: about 6 seconds after configuring gadget mode the device is disconnected and then re-enumerated. This happens only once per boot. Investigation showed that in this configuration the charger detection code turns off the PHY after 6 seconds. Patch 1 avoids this when a cable is connected (VBUS present). After patch 1 the connection is stable but communication stops after 6 seconds. this is addressed by patch 2. The topic had been discussed in [0]. Thanks Alan and Minas for the discussion and Louis for having found the 1st issue, leading to patch 1. [0] https://lore.kernel.org/lkml/20250414185458.7767aabc@booty/ Luca Signed-off-by: Luca Ceresoli <luca.ceresoli(a)bootlin.com> --- Changes in v2: - Patch 1: Fixed Co-developed-by: and SoB line order - Added missing Cc: stable(a)vger.kernel.org - Added Théo's Reviewed-by - Improved commit message - Patch 2: trimmed discussion about "there is no disconnection" from commit message to not distract from the actual issue (writes to chg_det.opmode) - Link to v1: https://lore.kernel.org/r/20250722-rk3308-fix-usb-gadget-phy-disconnect-v1-… --- Louis Chauvet (1): phy: rockchip: inno-usb2: fix disconnection in gadget mode Luca Ceresoli (1): phy: rockchip: inno-usb2: fix communication disruption in gadget mode drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- base-commit: cabb748c4b98ef67bbb088be61a2e0c850ebf70d change-id: 20250718-rk3308-fix-usb-gadget-phy-disconnect-d7de71fb28b4 Best regards, -- Luca Ceresoli <luca.ceresoli(a)bootlin.com>

3 hours, 31 minutes

2
3
0 0

[PATCH] phy: ti: gmii-sel: fix regmap leak on probe failure

by Johan Hovold

The mmio regmap that may be allocated during probe is never freed. Switch to using the device managed allocator so that the regmap is released on probe failures (e.g. probe deferral) and on driver unbind. Fixes: 5ab90f40121a ("phy: ti: gmii-sel: Do not use syscon helper to build regmap") Cc: stable(a)vger.kernel.org # 6.14 Cc: Andrew Davis <afd(a)ti.com> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/phy/ti/phy-gmii-sel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c index 50adabb867cb..26209a89703a 100644 --- a/drivers/phy/ti/phy-gmii-sel.c +++ b/drivers/phy/ti/phy-gmii-sel.c @@ -512,7 +512,7 @@ static int phy_gmii_sel_probe(struct platform_device *pdev) return dev_err_probe(dev, PTR_ERR(base), "failed to get base memory resource\n"); - priv->regmap = regmap_init_mmio(dev, base, &phy_gmii_sel_regmap_cfg); + priv->regmap = devm_regmap_init_mmio(dev, base, &phy_gmii_sel_regmap_cfg); if (IS_ERR(priv->regmap)) return dev_err_probe(dev, PTR_ERR(priv->regmap), "Failed to get syscon\n"); -- 2.51.2

3 hours, 31 minutes

3
2
0 0

FAILED: patch "[PATCH] can: gs_usb: gs_can_open(): fix error handling" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 3e54d3b4a8437b6783d4145c86962a2aa51022f3 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2025122306-hurry-upstream-964e@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 3e54d3b4a8437b6783d4145c86962a2aa51022f3 Mon Sep 17 00:00:00 2001 From: Marc Kleine-Budde <mkl(a)pengutronix.de> Date: Mon, 1 Dec 2025 19:26:38 +0100 Subject: [PATCH] can: gs_usb: gs_can_open(): fix error handling Commit 2603be9e8167 ("can: gs_usb: gs_can_open(): improve error handling") added missing error handling to the gs_can_open() function. The driver uses 2 USB anchors to track the allocated URBs: the TX URBs in struct gs_can::tx_submitted for each netdev and the RX URBs in struct gs_usb::rx_submitted for the USB device. gs_can_open() allocates the RX URBs, while TX URBs are allocated during gs_can_start_xmit(). The cleanup in gs_can_open() kills all anchored dev->tx_submitted URBs (which is not necessary since the netdev is not yet registered), but misses the parent->rx_submitted URBs. Fix the problem by killing the rx_submitted instead of the tx_submitted. Fixes: 2603be9e8167 ("can: gs_usb: gs_can_open(): improve error handling") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20251210-gs_usb-fix-error-handling-v1-1-d6a5a03f10… Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c index e29e85b67fd4..a0233e550a5a 100644 --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -1074,7 +1074,7 @@ static int gs_can_open(struct net_device *netdev) usb_free_urb(urb); out_usb_kill_anchored_urbs: if (!parent->active_channels) { - usb_kill_anchored_urbs(&dev->tx_submitted); + usb_kill_anchored_urbs(&parent->rx_submitted); if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP) gs_usb_timestamp_stop(parent);

3 hours, 31 minutes

2
1
0 0

[PATCH v2] phy: fsl-imx8mq-usb: fix typec orientation switch when built as module

by Franz Schnyder

From: Franz Schnyder <franz.schnyder(a)toradex.com> Currently, the PHY only registers the typec orientation switch when it is built in. If the typec driver is built as a module, the switch registration is skipped due to the preprocessor condition, causing orientation detection to fail. With commit 45fe729be9a6 ("usb: typec: Stub out typec_switch APIs when CONFIG_TYPEC=n") the preprocessor condition is not needed anymore and the orientation switch is correctly registered for both built-in and module builds. Fixes: b58f0f86fd61 ("phy: fsl-imx8mq-usb: add tca function driver for imx95") Cc: stable(a)vger.kernel.org Suggested-by: Xu Yang <xu.yang_2(a)nxp.com> Signed-off-by: Franz Schnyder <franz.schnyder(a)toradex.com> --- v2: Drop the preprocessor condition after a better suggestion. Reviewed-by Neil tag not added as patch is different --- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c index b94f242420fc..72e8aff38b92 100644 --- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c @@ -124,8 +124,6 @@ struct imx8mq_usb_phy { static void tca_blk_orientation_set(struct tca_blk *tca, enum typec_orientation orientation); -#ifdef CONFIG_TYPEC - static int tca_blk_typec_switch_set(struct typec_switch_dev *sw, enum typec_orientation orientation) { @@ -173,18 +171,6 @@ static void tca_blk_put_typec_switch(struct typec_switch_dev *sw) typec_switch_unregister(sw); } -#else - -static struct typec_switch_dev *tca_blk_get_typec_switch(struct platform_device *pdev, - struct imx8mq_usb_phy *imx_phy) -{ - return NULL; -} - -static void tca_blk_put_typec_switch(struct typec_switch_dev *sw) {} - -#endif /* CONFIG_TYPEC */ - static void tca_blk_orientation_set(struct tca_blk *tca, enum typec_orientation orientation) { -- 2.43.0

3 hours, 31 minutes

5
4
0 0

+ buildid-validate-page-backed-file-before-parsing-build-id.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: buildid: validate page-backed file before parsing build ID has been added to the -mm mm-hotfixes-unstable branch. Its filename is buildid-validate-page-backed-file-before-parsing-build-id.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Jinchao Wang <wangjinchao600(a)gmail.com> Subject: buildid: validate page-backed file before parsing build ID Date: Tue, 23 Dec 2025 18:32:07 +0800 __build_id_parse() only works on page-backed storage. Its helper paths eventually call mapping->a_ops->read_folio(), so explicitly reject VMAs that do not map a regular file or lack valid address_space operations. Link: https://lkml.kernel.org/r/20251223103214.2412446-1-wangjinchao600@gmail.com Fixes: ad41251c290d ("lib/buildid: implement sleepable build_id_parse() API") Signed-off-by: Jinchao Wang <wangjinchao600(a)gmail.com> Reported-by: <syzbot+e008db2ac01e282550ee(a)syzkaller.appspotmail.com> Tested-by: <syzbot+e008db2ac01e282550ee(a)syzkaller.appspotmail.com> Link: https://lkml.kernel.org/r/694a67ab.050a0220.19928e.001c.GAE@google.com Closes: https://lkml.kernel.org/r/693540fe.a70a0220.38f243.004c.GAE@google.com Cc: Axel Rasmussen <axelrasmussen(a)google.com> Cc: David Hildenbrand (Red Hat) <david(a)kernel.org> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: Wei Xu <weixugc(a)google.com> Cc: Yuanchu Xie <yuanchu(a)google.com> Cc: Andrii Nakryiko <andrii(a)kernel.org> Cc: Eduard Zingerman <eddyz87(a)gmail.com> Cc: Omar Sandoval <osandov(a)fb.com> Cc: Deepanshu Kartikey <kartikey406(a)gmail.com> Cc: Alexei Starovoitov <ast(a)kernel.org> Cc: Daniel Borkman <daniel(a)iogearbox.net> Cc: Hao Luo <haoluo(a)google.com> Cc: Jiri Olsa <jolsa(a)kernel.org> Cc: John Fastabend <john.fastabend(a)gmail.com> Cc: KP Singh <kpsingh(a)kernel.org> Cc: Martin KaFai Lau <martin.lau(a)linux.dev> Cc: Song Liu <song(a)kernel.org> Cc: Stanislav Fomichev <sdf(a)fomichev.me> Cc: Yonghong Song <yonghong.song(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/buildid.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/lib/buildid.c~buildid-validate-page-backed-file-before-parsing-build-id +++ a/lib/buildid.c @@ -288,7 +288,10 @@ static int __build_id_parse(struct vm_ar int ret; /* only works for page backed storage */ - if (!vma->vm_file) + if (!vma->vm_file || + !S_ISREG(file_inode(vma->vm_file)->i_mode) || + !vma->vm_file->f_mapping->a_ops || + !vma->vm_file->f_mapping->a_ops->read_folio) return -EINVAL; freader_init_from_file(&r, buf, sizeof(buf), vma->vm_file, may_fault); _ Patches currently in -mm which might be from wangjinchao600(a)gmail.com are buildid-validate-page-backed-file-before-parsing-build-id.patch

3 hours, 35 minutes

1
0
0 0

[PATCH] wifi: cfg80211: Fix use-after-free in cfg80211_shutdown_all_interfaces

by Daniil Dulov

There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller: BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326 CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events cfg80211_rfkill_block_work Call Trace: <TASK> dump_stack_lvl+0x116/0x1f0 print_report+0xcd/0x630 kasan_report+0xe0/0x110 cfg80211_shutdown_all_interfaces+0x213/0x220 cfg80211_rfkill_block_work+0x1e/0x30 process_one_work+0x9cf/0x1b70 worker_thread+0x6c8/0xf10 kthread+0x3c5/0x780 ret_from_fork+0x56d/0x700 ret_from_fork_asm+0x1a/0x30 </TASK> The problem arises due to the rfkill_block work is not cancelled when cfg80211 device is being freed. In order to fix the issue cancel the corresponding work before destroying rfkill in cfg80211_dev_free(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 1f87f7d3a3b4 ("cfg80211: add rfkill support") Cc: stable(a)vger.kernel.org Signed-off-by: Daniil Dulov <d.dulov(a)aladdin.ru> --- net/wireless/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/core.c b/net/wireless/core.c index 54a34d8d356e..e94f69205f50 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1226,6 +1226,7 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev) spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags); cancel_work_sync(&rdev->wiphy_work); + cancel_work_sync(&rdev->rfkill_block); rfkill_destroy(rdev->wiphy.rfkill); list_for_each_entry_safe(reg, treg, &rdev->beacon_registrations, list) { list_del(&reg->list); -- 2.34.1

4 hours

1
0
0 0

[PATCH] gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths

by Abdun Nihaal

The reference obtained by calling usb_get_dev() is not released in the gpio_mpsse_probe() error paths. Fix that by calling usb_put_dev(). Cc: stable(a)vger.kernel.org Fixes: c46a74ff05c0 ("gpio: add support for FTDI's MPSSE as GPIO") Signed-off-by: Abdun Nihaal <nihaal(a)cse.iitm.ac.in> --- Compile tested only. Issue found using static analysis. drivers/gpio/gpio-mpsse.c | 37 +++++++++++++++++++++++-------------- 1 file changed, 23 insertions(+), 14 deletions(-) diff --git a/drivers/gpio/gpio-mpsse.c b/drivers/gpio/gpio-mpsse.c index ace652ba4df1..b473db9c3c4d 100644 --- a/drivers/gpio/gpio-mpsse.c +++ b/drivers/gpio/gpio-mpsse.c @@ -596,24 +596,26 @@ static int gpio_mpsse_probe(struct usb_interface *interface, priv->intf_id = interface->cur_altsetting->desc.bInterfaceNumber; priv->id = ida_alloc(&gpio_mpsse_ida, GFP_KERNEL); - if (priv->id < 0) - return priv->id; + if (priv->id < 0) { + err = priv->id; + goto error; + } err = devm_add_action_or_reset(dev, gpio_mpsse_ida_remove, priv); if (err) - return err; + goto error; err = devm_mutex_init(dev, &priv->io_mutex); if (err) - return err; + goto error; err = devm_mutex_init(dev, &priv->irq_mutex); if (err) - return err; + goto error; err = devm_mutex_init(dev, &priv->irq_race); if (err) - return err; + goto error; raw_spin_lock_init(&priv->irq_spin); @@ -626,8 +628,10 @@ static int gpio_mpsse_probe(struct usb_interface *interface, id->idVendor, id->idProduct, priv->intf_id, priv->id, serial); - if (!priv->gpio.label) - return -ENOMEM; + if (!priv->gpio.label) { + err = -ENOMEM; + goto error; + } priv->gpio.owner = THIS_MODULE; priv->gpio.parent = interface->usb_dev; @@ -657,12 +661,14 @@ static int gpio_mpsse_probe(struct usb_interface *interface, &priv->bulk_in, &priv->bulk_out, NULL, NULL); if (err) - return err; + goto error; priv->bulk_in_buf = devm_kmalloc(dev, usb_endpoint_maxp(priv->bulk_in), GFP_KERNEL); - if (!priv->bulk_in_buf) - return -ENOMEM; + if (!priv->bulk_in_buf) { + err = -ENOMEM; + goto error; + } usb_set_intfdata(interface, priv); @@ -673,7 +679,7 @@ static int gpio_mpsse_probe(struct usb_interface *interface, MODE_RESET, priv->intf_id + 1, NULL, 0, USB_CTRL_SET_TIMEOUT); if (err) - return err; + goto error; /* Enter MPSSE mode */ err = usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), @@ -682,7 +688,7 @@ static int gpio_mpsse_probe(struct usb_interface *interface, MODE_MPSSE, priv->intf_id + 1, NULL, 0, USB_CTRL_SET_TIMEOUT); if (err) - return err; + goto error; gpio_irq_chip_set_chip(&priv->gpio.irq, &gpio_mpsse_irq_chip); @@ -695,9 +701,12 @@ static int gpio_mpsse_probe(struct usb_interface *interface, err = devm_gpiochip_add_data(dev, &priv->gpio, priv); if (err) - return err; + goto error; return 0; +error: + usb_put_dev(priv->udev); + return err; } static void gpio_mpsse_disconnect(struct usb_interface *intf) -- 2.43.0

4 hours, 56 minutes

2
1
0 0

[PATCH] phy: freescale: imx8m-pcie: assert phy reset during power on

by Rafael Beims

From: Rafael Beims <rafael.beims(a)toradex.com> After U-Boot initializes PCIe with "pcie enum", Linux fails to detect an NVMe disk on some boot cycles with: phy phy-32f00000.pcie-phy.0: phy poweron failed --> -110 Discussion with NXP identified that the iMX8MP PCIe PHY PLL may fail to lock when re-initialized without a reset cycle [1]. The issue reproduces on 7% of tested hardware platforms, with a 30-40% failure rate per affected device across boot cycles. Insert a reset cycle in the power-on routine to ensure the PHY is initialized from a known state. [1] https://community.nxp.com/t5/i-MX-Processors/iMX8MP-PCIe-initialization-in-… Signed-off-by: Rafael Beims <rafael.beims(a)toradex.com> Cc: stable(a)vger.kernel.org --- drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c index 68fcc8114d75..7f5600103a00 100644 --- a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c +++ b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c @@ -89,7 +89,8 @@ static int imx8_pcie_phy_power_on(struct phy *phy) writel(imx8_phy->tx_deemph_gen2, imx8_phy->base + PCIE_PHY_TRSV_REG6); break; - case IMX8MP: /* Do nothing. */ + case IMX8MP: + reset_control_assert(imx8_phy->reset); break; } -- 2.51.0

6 hours, 2 minutes

1
0
0 0

[PATCH v2 0/2] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device

by Jinhui Guo

Hi, all We hit hard-lockups when the Intel IOMMU waits indefinitely for an ATS invalidation that cannot complete, especially under GDR high-load conditions. 1. Hard-lock when a passthrough PCIe NIC with ATS enabled link-down in Intel IOMMU non-scalable mode. Two scenarios exist: NIC link-down with an explicit link-down event and link-down without any event. a) NIC link-down with an explicit link-dow event. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev iommu_deinit_device __iommu_group_remove_device iommu_release_device iommu_bus_notifier blocking_notifier_call_chain bus_notify device_del pci_remove_bus_device pci_stop_and_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist b) NIC link-down without an event - hard-lock on VM destroy. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev __iommu_attach_device __iommu_device_set_domain __iommu_group_set_domain_internal iommu_detach_group vfio_iommu_type1_detach_group vfio_group_detach_container vfio_group_fops_release __fput 2. Hard-lock when a passthrough PCIe NIC with ATS enabled link-down in Intel IOMMU scalable mode; NIC link-down without an event hard-locks on VM destroy. Call Trace: qi_submit_sync qi_flush_dev_iotlb intel_pasid_tear_down_entry device_block_translation blocking_domain_attach_dev __iommu_attach_device __iommu_device_set_domain __iommu_group_set_domain_internal iommu_detach_group vfio_iommu_type1_detach_group vfio_group_detach_container vfio_group_fops_release __fput Fix both issues with two patches: 1. Skip dev-IOTLB flush for inaccessible devices in __context_flush_dev_iotlb() using pci_device_is_present(). 2. Use pci_device_is_present() instead of pci_dev_is_disconnected() to decide when to skip ATS invalidation in devtlb_invalidation_with_pasid(). Best Regards, Jinhui --- v1: https://lore.kernel.org/all/20251210171431.1589-1-guojinhui.liam@bytedance.… Changelog in v1 -> v2 (suggested by Baolu Lu) - Simplify the pci_device_is_present() check in __context_flush_dev_iotlb(). - Add Cc: stable(a)vger.kernel.org to both patches. Jinhui Guo (2): iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode drivers/iommu/intel/pasid.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.20.1

6 hours, 6 minutes

3
6
0 0

[PATCH] usb: ulpi: fix a double free in ulpi_register_interface()

by Haoxiang Li

If ulpi_register() fails, put_device() is called in ulpi_register(), kfree() in ulpi_register_interface() will result in a double free. Also, refactor the device registration sequence to use a unified put_device() cleanup path, addressing multiple error returns in ulpi_register(). Found by code review and compiled on ubuntu 20.04. Fixes: 0a907ee9d95e ("usb: ulpi: Call of_node_put correctly") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- drivers/usb/common/ulpi.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 4a2ee447b213..c81a0cb24067 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -278,6 +278,7 @@ static int ulpi_register(struct device *dev, struct ulpi *ulpi) int ret; struct dentry *root; + device_initialize(&ulpi->dev); ulpi->dev.parent = dev; /* needed early for ops */ ulpi->dev.bus = &ulpi_bus; ulpi->dev.type = &ulpi_dev_type; @@ -287,19 +288,15 @@ static int ulpi_register(struct device *dev, struct ulpi *ulpi) ret = ulpi_of_register(ulpi); if (ret) - return ret; + goto err_register; ret = ulpi_read_id(ulpi); - if (ret) { - of_node_put(ulpi->dev.of_node); - return ret; - } + if (ret) + goto err_register; - ret = device_register(&ulpi->dev); - if (ret) { - put_device(&ulpi->dev); - return ret; - } + ret = device_add(&ulpi->dev); + if (ret) + goto err_register; root = debugfs_create_dir(dev_name(&ulpi->dev), ulpi_root); debugfs_create_file("regs", 0444, root, ulpi, &ulpi_regs_fops); @@ -308,6 +305,10 @@ static int ulpi_register(struct device *dev, struct ulpi *ulpi) ulpi->id.vendor, ulpi->id.product); return 0; + +err_register: + put_device(&ulpi->dev); + return ret; } /** @@ -331,10 +332,8 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } return ulpi; } -- 2.25.1

6 hours, 38 minutes

2
1
0 0

[PATCH v6 2/8] dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock

by Claudiu

From: Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> Both rz_dmac_disable_hw() and rz_dmac_irq_handle_channel() update the CHCTRL register. To avoid concurrency issues when configuring functionalities exposed by this registers, take the virtual channel lock. All other CHCTRL updates were already protected by the same lock. Previously, rz_dmac_disable_hw() disabled and re-enabled local IRQs, before accessing CHCTRL registers but this does not ensure race-free access. Remove the local IRQ disable/enable code as well. Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") Cc: stable(a)vger.kernel.org Signed-off-by: Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> --- Changes in v6: - update patch title and description - in rz_dmac_irq_handle_channel() lock only around the updates for the error path and continued using the vc lock as this is the error path and the channel will anyway be stopped; this avoids updating the code with another lock as it was suggested in the review process of v5 and the code remain simpler for a fix, w/o any impact on performance Changes in v5: - none, this patch is new drivers/dma/sh/rz-dmac.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/dma/sh/rz-dmac.c b/drivers/dma/sh/rz-dmac.c index c8e3d9f77b8a..818d1ef6f0bf 100644 --- a/drivers/dma/sh/rz-dmac.c +++ b/drivers/dma/sh/rz-dmac.c @@ -298,13 +298,10 @@ static void rz_dmac_disable_hw(struct rz_dmac_chan *channel) { struct dma_chan *chan = &channel->vc.chan; struct rz_dmac *dmac = to_rz_dmac(chan->device); - unsigned long flags; dev_dbg(dmac->dev, "%s channel %d\n", __func__, channel->index); - local_irq_save(flags); rz_dmac_ch_writel(channel, CHCTRL_DEFAULT, CHCTRL, 1); - local_irq_restore(flags); } static void rz_dmac_set_dmars_register(struct rz_dmac *dmac, int nr, u32 dmars) @@ -569,8 +566,8 @@ static int rz_dmac_terminate_all(struct dma_chan *chan) unsigned int i; LIST_HEAD(head); - rz_dmac_disable_hw(channel); spin_lock_irqsave(&channel->vc.lock, flags); + rz_dmac_disable_hw(channel); for (i = 0; i < DMAC_NR_LMDESC; i++) lmdesc[i].header = 0; @@ -707,7 +704,9 @@ static void rz_dmac_irq_handle_channel(struct rz_dmac_chan *channel) if (chstat & CHSTAT_ER) { dev_err(dmac->dev, "DMAC err CHSTAT_%d = %08X\n", channel->index, chstat); - rz_dmac_ch_writel(channel, CHCTRL_DEFAULT, CHCTRL, 1); + + scoped_guard(spinlock_irqsave, &channel->vc.lock) + rz_dmac_ch_writel(channel, CHCTRL_DEFAULT, CHCTRL, 1); goto done; } -- 2.43.0

6 hours, 40 minutes

2
1
0 0

[PATCH] scsi: esas2r: fix a resource leak in esas2r_resume()

by Haoxiang Li

Add esas2r_unmap_regions() to release the resources allocated by esas2r_map_regions() in some error paths. Found by code review and compiled on ubuntu 20.04. Fixes: 26780d9e12ed ("[SCSI] esas2r: ATTO Technology ExpressSAS 6G SAS/SATA RAID Adapter Driver") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- drivers/scsi/esas2r/esas2r_init.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/esas2r/esas2r_init.c b/drivers/scsi/esas2r/esas2r_init.c index 04a07fe57be2..114239373f28 100644 --- a/drivers/scsi/esas2r/esas2r_init.c +++ b/drivers/scsi/esas2r/esas2r_init.c @@ -684,7 +684,7 @@ static int __maybe_unused esas2r_resume(struct device *dev) if (!esas2r_power_up(a, true)) { esas2r_debug("yikes, esas2r_power_up failed"); rez = -ENOMEM; - goto error_exit; + goto error_unmap; } esas2r_claim_interrupts(a); @@ -700,9 +700,11 @@ static int __maybe_unused esas2r_resume(struct device *dev) esas2r_debug("yikes, unable to claim IRQ"); esas2r_log(ESAS2R_LOG_CRIT, "could not re-claim IRQ!"); rez = -ENOMEM; - goto error_exit; + goto error_unmap; } +error_unmap: + esas2r_unmap_regions(a); error_exit: esas2r_log_dev(ESAS2R_LOG_CRIT, dev, "esas2r_resume(): %d", rez); -- 2.25.1

6 hours, 49 minutes

1
0
0 0

[PATCH v6 1/8] dmaengine: sh: rz-dmac: Protect the driver specific lists

by Claudiu

From: Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> The driver lists (ld_free, ld_queue) are used in rz_dmac_free_chan_resources(), rz_dmac_terminate_all(), rz_dmac_issue_pending(), and rz_dmac_irq_handler_thread(), all under the virtual channel lock. Take the same lock in rz_dmac_prep_slave_sg() and rz_dmac_prep_dma_memcpy() as well to avoid concurrency issues, since these functions also check whether the lists are empty and update or remove list entries. Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") Cc: stable(a)vger.kernel.org Signed-off-by: Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> --- Changes in v6: - none Changes in v5: - none, this patch is new drivers/dma/sh/rz-dmac.c | 57 ++++++++++++++++++++++------------------ 1 file changed, 32 insertions(+), 25 deletions(-) diff --git a/drivers/dma/sh/rz-dmac.c b/drivers/dma/sh/rz-dmac.c index 9e5f088355e2..c8e3d9f77b8a 100644 --- a/drivers/dma/sh/rz-dmac.c +++ b/drivers/dma/sh/rz-dmac.c @@ -10,6 +10,7 @@ */ #include <linux/bitfield.h> +#include <linux/cleanup.h> #include <linux/dma-mapping.h> #include <linux/dmaengine.h> #include <linux/interrupt.h> @@ -448,6 +449,7 @@ static int rz_dmac_alloc_chan_resources(struct dma_chan *chan) if (!desc) break; + /* No need to lock. This is called only for the 1st client. */ list_add_tail(&desc->node, &channel->ld_free); channel->descs_allocated++; } @@ -503,18 +505,21 @@ rz_dmac_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src, dev_dbg(dmac->dev, "%s channel: %d src=0x%pad dst=0x%pad len=%zu\n", __func__, channel->index, &src, &dest, len); - if (list_empty(&channel->ld_free)) - return NULL; + scoped_guard(spinlock_irqsave, &channel->vc.lock) { + if (list_empty(&channel->ld_free)) + return NULL; + + desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); - desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); + desc->type = RZ_DMAC_DESC_MEMCPY; + desc->src = src; + desc->dest = dest; + desc->len = len; + desc->direction = DMA_MEM_TO_MEM; - desc->type = RZ_DMAC_DESC_MEMCPY; - desc->src = src; - desc->dest = dest; - desc->len = len; - desc->direction = DMA_MEM_TO_MEM; + list_move_tail(channel->ld_free.next, &channel->ld_queue); + } - list_move_tail(channel->ld_free.next, &channel->ld_queue); return vchan_tx_prep(&channel->vc, &desc->vd, flags); } @@ -530,27 +535,29 @@ rz_dmac_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, int dma_length = 0; int i = 0; - if (list_empty(&channel->ld_free)) - return NULL; + scoped_guard(spinlock_irqsave, &channel->vc.lock) { + if (list_empty(&channel->ld_free)) + return NULL; - desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); + desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); - for_each_sg(sgl, sg, sg_len, i) { - dma_length += sg_dma_len(sg); - } + for_each_sg(sgl, sg, sg_len, i) + dma_length += sg_dma_len(sg); - desc->type = RZ_DMAC_DESC_SLAVE_SG; - desc->sg = sgl; - desc->sgcount = sg_len; - desc->len = dma_length; - desc->direction = direction; + desc->type = RZ_DMAC_DESC_SLAVE_SG; + desc->sg = sgl; + desc->sgcount = sg_len; + desc->len = dma_length; + desc->direction = direction; - if (direction == DMA_DEV_TO_MEM) - desc->src = channel->src_per_address; - else - desc->dest = channel->dst_per_address; + if (direction == DMA_DEV_TO_MEM) + desc->src = channel->src_per_address; + else + desc->dest = channel->dst_per_address; + + list_move_tail(channel->ld_free.next, &channel->ld_queue); + } - list_move_tail(channel->ld_free.next, &channel->ld_queue); return vchan_tx_prep(&channel->vc, &desc->vd, flags); } -- 2.43.0

7 hours, 15 minutes

1
0
0 0

[PATCH] cpufreq: amd_freq_sensitivity: Fix sensitivity clamping in amd_powersave_bias_target

by Thorsten Blum

The local variable 'sensitivity' was never clamped to 0 or POWERSAVE_BIAS_MAX because the return value of clamp() was not used. Fix this by assigning the clamped value back to 'sensitivity'. Cc: stable(a)vger.kernel.org Fixes: 9c5320c8ea8b ("cpufreq: AMD "frequency sensitivity feedback" powersave bias for ondemand governor") Signed-off-by: Thorsten Blum <thorsten.blum(a)linux.dev> --- drivers/cpufreq/amd_freq_sensitivity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/cpufreq/amd_freq_sensitivity.c b/drivers/cpufreq/amd_freq_sensitivity.c index 13fed4b9e02b..713ccf24c97d 100644 --- a/drivers/cpufreq/amd_freq_sensitivity.c +++ b/drivers/cpufreq/amd_freq_sensitivity.c @@ -76,7 +76,7 @@ static unsigned int amd_powersave_bias_target(struct cpufreq_policy *policy, sensitivity = POWERSAVE_BIAS_MAX - (POWERSAVE_BIAS_MAX * (d_reference - d_actual) / d_reference); - clamp(sensitivity, 0, POWERSAVE_BIAS_MAX); + sensitivity = clamp(sensitivity, 0, POWERSAVE_BIAS_MAX); /* this workload is not CPU bound, so choose a lower freq */ if (sensitivity < od_tuners->powersave_bias) { -- Thorsten Blum <thorsten.blum(a)linux.dev> GPG: 1D60 735E 8AEF 3BE4 73B6 9D84 7336 78FD 8DFE EAD4

7 hours, 42 minutes

2
3
0 0

[PATCH 0/2] PCI: dwc: Fix missing iATU setup when ECAM is enabled

by Krishna Chaitanya Chundru

When ECAM is enabled, the driver skipped calling dw_pcie_iatu_setup() before configuring ECAM iATU entries. This left IO and MEM outbound windows unprogrammed, resulting in broken IO transactions. Additionally, dw_pcie_config_ecam_iatu() was only called during host initialization, so ECAM-related iATU entries were not restored after suspend/resume, leading to failures in configuration space access. To resolve these issues, the ECAM iATU configuration is moved into dw_pcie_setup_rc(). At the same time, dw_pcie_iatu_setup() is invoked when ECAM is enabled. Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru(a)oss.qualcomm.com> --- Krishna Chaitanya Chundru (2): PCI: dwc: Correct iATU index increment for MSG TLP region PCI: dwc: Fix missing iATU setup when ECAM is enabled drivers/pci/controller/dwc/pcie-designware-host.c | 37 ++++++++++++++--------- drivers/pci/controller/dwc/pcie-designware.c | 3 ++ drivers/pci/controller/dwc/pcie-designware.h | 2 +- 3 files changed, 26 insertions(+), 16 deletions(-) --- base-commit: 3f9f0252130e7dd60d41be0802bf58f6471c691d change-id: 20251203-ecam_io_fix-6e060fecd3b8 Best regards, -- Krishna Chaitanya Chundru <krishna.chundru(a)oss.qualcomm.com>

8 hours, 16 minutes

4
4
0 0

[PATCH] edac x38: fix a resource leak in x38_probe1()

by Haoxiang Li

If edac_mc_alloc() fails, also unmap the window. Add a goto to do so. Found by code review and compiled on ubuntu 20.04. Fixes: df8bc08c192f ("edac x38: new MC driver module") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- drivers/edac/x38_edac.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/edac/x38_edac.c b/drivers/edac/x38_edac.c index 49ab5721aab2..09889b615584 100644 --- a/drivers/edac/x38_edac.c +++ b/drivers/edac/x38_edac.c @@ -342,8 +342,10 @@ static int x38_probe1(struct pci_dev *pdev, int dev_idx) layers[1].size = x38_channel_num; layers[1].is_virt_csrow = false; mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, 0); - if (!mci) - return -ENOMEM; + if (!mci) { + rc = -ENOMEM; + goto fail; + } edac_dbg(3, "MC: init mci\n"); -- 2.25.1

8 hours, 21 minutes

1
0
0 0

[PATCH] edac: fix a resource leak in i3200_probe1()

by Haoxiang Li

If edac_mc_alloc() fails, also unmap the window. Add a goto to do so. Found by code review and compiled on ubuntu 20.04 Fixes: dd8ef1db87a4 ("edac: i3200 memory controller driver") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- drivers/edac/i3200_edac.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c index afccdebf5ac1..fd5dc33c406f 100644 --- a/drivers/edac/i3200_edac.c +++ b/drivers/edac/i3200_edac.c @@ -360,8 +360,10 @@ static int i3200_probe1(struct pci_dev *pdev, int dev_idx) layers[1].is_virt_csrow = false; mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, sizeof(struct i3200_priv)); - if (!mci) - return -ENOMEM; + if (!mci) { + rc = -ENOMEM; + goto fail; + } edac_dbg(3, "MC: init mci\n"); -- 2.25.1

8 hours, 33 minutes

1
0
0 0

[PATCH 0/4] drm: Revert and fix enable/disable sequence

by Tomi Valkeinen

Changing the enable/disable sequence in commit c9b1150a68d9 ("drm/atomic-helper: Re-order bridge chain pre-enable and post-disable") has caused regressions on multiple platforms: R-Car, MCDE, Rockchip. This is an alternate series to Linus' series: https://lore.kernel.org/all/20251202-mcde-drm-regression-thirdfix-v6-0-f1bf… This series first reverts the original commit and reverts a fix for mediatek which is no longer needed. It then exposes helper functions from DRM core, and finally implements the new sequence only in the tidss driver. There is one more fix in upstream for the original commit, commit 5d91394f2361 ("drm/exynos: fimd: Guard display clock control with runtime PM calls"), but I have not reverted that one as it looks like a valid patch in its own. I added Cc stable v6.17+ to all patches, but I didn't add Fixes tags, as I wasn't sure what should they point to. But I could perhaps add Fixes: <original commit> to all of these. Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> --- Linus Walleij (1): drm/atomic-helper: Export and namespace some functions Tomi Valkeinen (3): Revert "drm/atomic-helper: Re-order bridge chain pre-enable and post-disable" Revert "drm/mediatek: dsi: Fix DSI host and panel bridge pre-enable order" drm/tidss: Fix enable/disable order drivers/gpu/drm/drm_atomic_helper.c | 122 ++++++++++++++---- drivers/gpu/drm/mediatek/mtk_dsi.c | 6 - drivers/gpu/drm/tidss/tidss_kms.c | 30 ++++- include/drm/drm_atomic_helper.h | 22 ++++ include/drm/drm_bridge.h | 249 ++++++++++-------------------------- 5 files changed, 214 insertions(+), 215 deletions(-) --- base-commit: 88e721ab978a86426aa08da520de77430fa7bb84 change-id: 20251205-drm-seq-fix-b4ed1f56604b Best regards, -- Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com>

9 hours, 16 minutes

5
15
0 0

[PATCH] net: usb: pegasus: fix memory leak on usb_submit_urb() failure

by Petko Manolov

In update_eth_regs_async() neither the URB nor the request structure are being freed if usb_submit_urb() fails. The patch fixes this long lurking bug in the error path. Signed-off-by: Petko Manolov <petko.manolov(a)konsulko.com> --- drivers/net/usb/pegasus.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c index 81ca64debc5b..7a70207e7364 100644 --- a/drivers/net/usb/pegasus.c +++ b/drivers/net/usb/pegasus.c @@ -168,6 +168,8 @@ static int update_eth_regs_async(pegasus_t *pegasus) netif_device_detach(pegasus->net); netif_err(pegasus, drv, pegasus->net, "%s returned %d\n", __func__, ret); + kfree(req); + usb_free_urb(async_urb); } return ret; } -- 2.52.0

9 hours, 20 minutes

3
2
0 0

[PATCH] dma: qcom: gpi: Fix memory leak in gpi_peripheral_config()

by Miaoqian Lin

Fix a memory leak in gpi_peripheral_config() where the original memory pointed to by gchan->config could be lost if krealloc() fails. The issue occurs when: 1. gchan->config points to previously allocated memory 2. krealloc() fails and returns NULL 3. The function directly assigns NULL to gchan->config, losing the reference to the original memory 4. The original memory becomes unreachable and cannot be freed Fix this by using a temporary variable to hold the krealloc() result and only updating gchan->config when the allocation succeeds. Found via static analysis and code review. Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver") Cc: stable(a)vger.kernel.org Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> --- drivers/dma/qcom/gpi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c index 8e87738086b2..8908b7c71900 100644 --- a/drivers/dma/qcom/gpi.c +++ b/drivers/dma/qcom/gpi.c @@ -1605,14 +1605,16 @@ static int gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config) { struct gchan *gchan = to_gchan(chan); + void *new_config; if (!config->peripheral_config) return -EINVAL; - gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT); - if (!gchan->config) + new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT); + if (!new_config) return -ENOMEM; + gchan->config = new_config; memcpy(gchan->config, config->peripheral_config, config->peripheral_size); return 0; -- 2.39.5 (Apple Git-154)

9 hours, 41 minutes

4
3
0 0

[PATCH] clk: mediatek: Drop __initconst from gates

by Sjoerd Simons

Since commit 8ceff24a754a ("clk: mediatek: clk-gate: Refactor mtk_clk_register_gate to use mtk_gate struct") the mtk_gate structs are no longer just used for initialization/registration, but also at runtime. So drop __initconst annotations. Fixes: 8ceff24a754a ("clk: mediatek: clk-gate: Refactor mtk_clk_register_gate to use mtk_gate struct") Signed-off-by: Sjoerd Simons <sjoerd(a)collabora.com> --- drivers/clk/mediatek/clk-mt7981-eth.c | 6 +++--- drivers/clk/mediatek/clk-mt8516.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/clk/mediatek/clk-mt7981-eth.c b/drivers/clk/mediatek/clk-mt7981-eth.c index 906aec9ddff5..0655ebb6c561 100644 --- a/drivers/clk/mediatek/clk-mt7981-eth.c +++ b/drivers/clk/mediatek/clk-mt7981-eth.c @@ -31,7 +31,7 @@ static const struct mtk_gate_regs sgmii0_cg_regs = { .ops = &mtk_clk_gate_ops_no_setclr_inv, \ } -static const struct mtk_gate sgmii0_clks[] __initconst = { +static const struct mtk_gate sgmii0_clks[] = { GATE_SGMII0(CLK_SGM0_TX_EN, "sgm0_tx_en", "usb_tx250m", 2), GATE_SGMII0(CLK_SGM0_RX_EN, "sgm0_rx_en", "usb_eq_rx250m", 3), GATE_SGMII0(CLK_SGM0_CK0_EN, "sgm0_ck0_en", "usb_ln0", 4), @@ -53,7 +53,7 @@ static const struct mtk_gate_regs sgmii1_cg_regs = { .ops = &mtk_clk_gate_ops_no_setclr_inv, \ } -static const struct mtk_gate sgmii1_clks[] __initconst = { +static const struct mtk_gate sgmii1_clks[] = { GATE_SGMII1(CLK_SGM1_TX_EN, "sgm1_tx_en", "usb_tx250m", 2), GATE_SGMII1(CLK_SGM1_RX_EN, "sgm1_rx_en", "usb_eq_rx250m", 3), GATE_SGMII1(CLK_SGM1_CK1_EN, "sgm1_ck1_en", "usb_ln0", 4), @@ -75,7 +75,7 @@ static const struct mtk_gate_regs eth_cg_regs = { .ops = &mtk_clk_gate_ops_no_setclr_inv, \ } -static const struct mtk_gate eth_clks[] __initconst = { +static const struct mtk_gate eth_clks[] = { GATE_ETH(CLK_ETH_FE_EN, "eth_fe_en", "netsys_2x", 6), GATE_ETH(CLK_ETH_GP2_EN, "eth_gp2_en", "sgm_325m", 7), GATE_ETH(CLK_ETH_GP1_EN, "eth_gp1_en", "sgm_325m", 8), diff --git a/drivers/clk/mediatek/clk-mt8516.c b/drivers/clk/mediatek/clk-mt8516.c index 21eb052b0a53..342a59019fea 100644 --- a/drivers/clk/mediatek/clk-mt8516.c +++ b/drivers/clk/mediatek/clk-mt8516.c @@ -544,7 +544,7 @@ static const struct mtk_gate_regs top5_cg_regs = { #define GATE_TOP5(_id, _name, _parent, _shift) \ GATE_MTK(_id, _name, _parent, &top5_cg_regs, _shift, &mtk_clk_gate_ops_setclr) -static const struct mtk_gate top_clks[] __initconst = { +static const struct mtk_gate top_clks[] = { /* TOP1 */ GATE_TOP1(CLK_TOP_THEM, "them", "ahb_infra_sel", 1), GATE_TOP1(CLK_TOP_APDMA, "apdma", "ahb_infra_sel", 2), --- base-commit: b927546677c876e26eba308550207c2ddf812a43 change-id: 20251223-mtk-gate-a98133ab80c9 Best regards, -- Sjoerd Simons <sjoerd(a)collabora.com>

9 hours, 58 minutes

2
1
0 0

Re: [PATCH AUTOSEL 6.18-6.6] netfilter: nf_tables: avoid chain re-validation if possible

by Florian Westphal

Sasha Levin <sashal(a)kernel.org> wrote: > + if (WARN_ON_ONCE(!nft_is_base_chain(ctx->chain))) > + return false; This WARN will fire unless you also pick up a67fd55f6a09 ("netfilter: nf_tables: remove redundant chain validation on register store") Alternatively, drop the WARN: "if (!nft_is_base_chain...".

10 hours, 53 minutes

1
0
0 0

[PATCH AUTOSEL 6.18-6.6] drm/amd/display: Fix DP no audio issue

by Sasha Levin

From: Charlene Liu <Charlene.Liu(a)amd.com> [ Upstream commit 3886b198bd6e49c801fe9552fcfbfc387a49fbbc ] [why] need to enable APG_CLOCK_ENABLE enable first also need to wake up az from D3 before access az block Reviewed-by: Swapnil Patel <swapnil.patel(a)amd.com> Signed-off-by: Charlene Liu <Charlene.Liu(a)amd.com> Signed-off-by: Chenyu Chen <chen-yu.chen(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit bf5e396957acafd46003318965500914d5f4edfa) Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- LLM Generated explanations, may be completely bogus: ### 3. TECHNICAL ANALYSIS **The Bug:** The original code had an incorrect operation sequence: 1. Called `az_enable()` - attempts to access audio controller registers 2. Called `enable_pme_wa()` - wakes audio controller from D3 power state This is backwards - you cannot access hardware registers while the device is still in D3 (sleeping). The hardware must be woken up FIRST. **The Fix:** The fix simply reorders these operations: 1. Call `enable_pme_wa()` - wake audio controller from D3 first 2. Call `az_enable()` - now safe to access registers ### 4. SCOPE AND RISK ASSESSMENT - **Lines changed:** ~8 lines (just reordering) - **Files touched:** 1 file (dce110_hwseq.c) - **Complexity:** Very low - no new logic, just reordering existing function calls - **Subsystem:** AMD display driver, well-tested and mature - **Risk:** Minimal - same operations, correct sequence ### 5. USER IMPACT - **Affected users:** AMD GPU users with DisplayPort audio output - **Severity:** High - complete loss of audio functionality - **Usage scenario:** Very common (monitors with speakers, AV receivers, docking stations) - **Symptoms:** "DP no audio issue" - a clearly user-visible bug ### 6. STABILITY INDICATORS - Reviewed-by: Swapnil Patel (AMD engineer) - Tested-by: Daniel Wheeler (AMD engineer) - Multiple sign-offs from AMD display team - Cherry-picked from mainline - indicates AMD considers it important ### 7. DEPENDENCY CHECK The dce110_hwseq.c file has been in the kernel for years and the `dce110_enable_audio_stream` function is stable code. The fix only reorders existing calls to `enable_pme_wa()` and `az_enable()` - both of which already exist in stable trees. ## Summary **Meets stable criteria:** - ✅ **Obviously correct:** Simple reordering to match hardware requirements - ✅ **Fixes real bug:** Complete audio failure on DisplayPort is a significant user-visible bug - ✅ **Small and contained:** ~8 lines changed, same functions, just different order - ✅ **No new features:** No new functionality added - ✅ **Tested:** Has Tested-by and Reviewed-by tags from AMD engineers - ✅ **No dependencies:** Uses existing functions already in stable trees **Risk vs Benefit:** - **Benefit:** Restores DisplayPort audio functionality for affected AMD GPU users - **Risk:** Very low - the same operations are performed, just in the correct hardware-required sequence This is an ideal stable backport candidate: a small, surgical fix for a clear user-visible bug (no audio on DP), with proper code review and testing from the hardware vendor. **YES** drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c index ebc220b29d14..0bf98d834e61 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c @@ -1098,13 +1098,13 @@ void dce110_enable_audio_stream(struct pipe_ctx *pipe_ctx) if (dc->current_state->res_ctx.pipe_ctx[i].stream_res.audio != NULL) num_audio++; } + if (num_audio >= 1 && clk_mgr->funcs->enable_pme_wa) { + /*wake AZ from D3 first before access az endpoint*/ + clk_mgr->funcs->enable_pme_wa(clk_mgr); + } pipe_ctx->stream_res.audio->funcs->az_enable(pipe_ctx->stream_res.audio); - if (num_audio >= 1 && clk_mgr->funcs->enable_pme_wa) - /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/ - clk_mgr->funcs->enable_pme_wa(clk_mgr); - link_hwss->enable_audio_packet(pipe_ctx); if (pipe_ctx->stream_res.audio) -- 2.51.0

11 hours

1
0
0 0

[PATCH AUTOSEL 6.18] block: validate pi_offset integrity limit

by Sasha Levin

From: Caleb Sander Mateos <csander(a)purestorage.com> [ Upstream commit ccb8a3c08adf8121e2afb8e704f007ce99324d79 ] The PI tuple must be contained within the metadata value, so validate that pi_offset + pi_tuple_size <= metadata_size. This guards against block drivers that report invalid pi_offset values. Signed-off-by: Caleb Sander Mateos <csander(a)purestorage.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- LLM Generated explanations, may be completely bogus: ## Summary ### Problem Being Fixed The commit fixes an **incomplete bounds validation bug** in the block layer's integrity limit validation code. When the PI (Protection Information) tuple can be placed at a non-zero offset within the metadata buffer (a feature added in kernel 6.9), the validation check only verified that `pi_tuple_size <= metadata_size`, but **completely ignored the pi_offset**. This is mathematically incorrect. If: - `metadata_size = 8` bytes - `pi_tuple_size = 8` bytes - `pi_offset = 4` bytes The old check (`8 > 8`) passes, but the PI tuple would extend 4 bytes beyond the buffer boundary, potentially causing out-of-bounds memory access. ### Why It Matters to Stable Users - **Data Integrity Risk**: Block layer integrity/PI is used in enterprise storage environments (NVMe, SAS with T10 PI) - **Defense Against Buggy Drivers**: The fix prevents the kernel from accepting invalid configurations from misbehaving block drivers - **Potential for Memory Corruption**: Without this validation, accessing PI data could read/write beyond buffer bounds ### Stable Kernel Criteria Assessment | Criterion | Met? | Notes | |-----------|------|-------| | Obviously correct | ✅ | Mathematical correctness: offset + size must fit in buffer | | Fixes real bug | ✅ | Incomplete bounds check could allow invalid configurations | | Small scope | ✅ | 4 lines changed, single file | | No new features | ✅ | Only strengthens existing validation | | No API changes | ✅ | No user-visible changes | ### Risk vs Benefit **Risk**: Extremely low - The change only makes validation stricter - Can only reject configurations that were previously (incorrectly) accepted - Any configuration rejected by the new check was already semantically invalid and potentially dangerous **Benefit**: Moderate to high - Prevents kernel from accepting invalid integrity configurations - Guards against memory corruption in PI-enabled storage stacks - Important for enterprise environments using DIF/PI ### Concerns **Applicability**: The `pi_offset` field was introduced in kernel 6.9 (commit 60d21aac52e2). This fix is only applicable to stable kernels 6.9.y and later. **Dependencies**: None - this is a standalone validation fix. ### Quality Indicators - Reviewed-by: Christoph Hellwig (highly respected kernel developer) - Signed-off-by: Jens Axboe (block layer maintainer) - Part of a series of validation improvements (similar commit for `interval_exp`) - No follow-up fixes needed The fix is small, surgical, obviously correct, and addresses a real validation gap that could lead to memory safety issues. It meets all stable kernel criteria. **YES** block/blk-settings.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/block/blk-settings.c b/block/blk-settings.c index d74b13ec8e54..f2c1940fe6f1 100644 --- a/block/blk-settings.c +++ b/block/blk-settings.c @@ -148,10 +148,9 @@ static int blk_validate_integrity_limits(struct queue_limits *lim) return -EINVAL; } - if (bi->pi_tuple_size > bi->metadata_size) { - pr_warn("pi_tuple_size (%u) exceeds metadata_size (%u)\n", - bi->pi_tuple_size, - bi->metadata_size); + if (bi->pi_offset + bi->pi_tuple_size > bi->metadata_size) { + pr_warn("pi_offset (%u) + pi_tuple_size (%u) exceeds metadata_size (%u)\n", + bi->pi_offset, bi->pi_tuple_size, bi->metadata_size); return -EINVAL; } -- 2.51.0

11 hours

1
0
0 0

[PATCH AUTOSEL 6.18-5.10] powercap: fix race condition in register_control_type()

by Sasha Levin

From: Sumeet Pawnikar <sumeet4linux(a)gmail.com> [ Upstream commit 7bda1910c4bccd4b8d4726620bb3d6bbfb62286e ] The device becomes visible to userspace via device_register() even before it fully initialized by idr_init(). If userspace or another thread tries to register a zone immediately after device_register(), the control_type_valid() will fail because the control_type is not yet in the list. The IDR is not yet initialized, so this race condition causes zone registration failure. Move idr_init() and list addition before device_register() fix the race condition. Signed-off-by: Sumeet Pawnikar <sumeet4linux(a)gmail.com> [ rjw: Subject adjustment, empty line added ] Link: https://patch.msgid.link/20251205190216.5032-1-sumeet4linux@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- LLM Generated explanations, may be completely bogus: This confirms the race condition mechanism: 1. `control_type_valid()` walks `powercap_cntrl_list` to validate control types (lines 329-345) 2. Called at `powercap_register_zone()` entry (line 497) 3. **Race window**: After `device_register()` but before `list_add_tail()`, any zone registration fails because the control_type isn't in the list yet ### 8. FINAL ASSESSMENT | Criteria | Assessment | |----------|------------| | Fixes a real bug | ✅ Race condition causing zone registration failure | | Obviously correct | ✅ Classic init-before-publish pattern | | Small and contained | ✅ ~20 lines in one function | | No new features | ✅ Only reorders existing code | | No new APIs | ✅ No userspace-visible changes | | Low regression risk | ✅ Standard pattern, proper error handling | | Affects stable users | ✅ Powercap used on many Intel systems | **Why this matters to stable users:** - Intel RAPL (Running Average Power Limit) uses powercap - Common on laptops and servers for power management - Race can cause power capping features to fail during boot/module load - This is an existing bug that has been present since powercap was introduced **Risk vs Benefit:** - **Benefit**: Fixes a real race that causes functional failures - **Risk**: Very low - the fix follows standard kernel patterns and adds proper cleanup - **Trade-off**: Strongly favors backporting **Concerns:** - No dependencies on other commits - The change is self-contained and should apply cleanly to stable trees - The powercap subsystem has existed since kernel 3.11, so applicable to all current stable trees The fix is small, surgical, obviously correct, and addresses a real race condition that can cause user-visible failures. It meets all stable kernel criteria. **YES** drivers/powercap/powercap_sys.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c index 4112a0097338..d14b36b75189 100644 --- a/drivers/powercap/powercap_sys.c +++ b/drivers/powercap/powercap_sys.c @@ -625,17 +625,23 @@ struct powercap_control_type *powercap_register_control_type( INIT_LIST_HEAD(&control_type->node); control_type->dev.class = &powercap_class; dev_set_name(&control_type->dev, "%s", name); - result = device_register(&control_type->dev); - if (result) { - put_device(&control_type->dev); - return ERR_PTR(result); - } idr_init(&control_type->idr); mutex_lock(&powercap_cntrl_list_lock); list_add_tail(&control_type->node, &powercap_cntrl_list); mutex_unlock(&powercap_cntrl_list_lock); + result = device_register(&control_type->dev); + if (result) { + mutex_lock(&powercap_cntrl_list_lock); + list_del(&control_type->node); + mutex_unlock(&powercap_cntrl_list_lock); + + idr_destroy(&control_type->idr); + put_device(&control_type->dev); + return ERR_PTR(result); + } + return control_type; } EXPORT_SYMBOL_GPL(powercap_register_control_type); -- 2.51.0

11 hours

1
0
0 0

[PATCH AUTOSEL 6.18-5.10] powercap: fix sscanf() error return value handling

by Sasha Levin

From: Sumeet Pawnikar <sumeet4linux(a)gmail.com> [ Upstream commit efc4c35b741af973de90f6826bf35d3b3ac36bf1 ] Fix inconsistent error handling for sscanf() return value check. Implicit boolean conversion is used instead of explicit return value checks. The code checks if (!sscanf(...)) which is incorrect because: 1. sscanf returns the number of successfully parsed items 2. On success, it returns 1 (one item passed) 3. On failure, it returns 0 or EOF 4. The check 'if (!sscanf(...))' is wrong because it treats success (1) as failure All occurrences of sscanf() now uses explicit return value check. With this behavior it returns '-EINVAL' when parsing fails (returns 0 or EOF), and continues when parsing succeeds (returns 1). Signed-off-by: Sumeet Pawnikar <sumeet4linux(a)gmail.com> [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20251207151549.202452-1-sumeet4linux@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- LLM Generated explanations, may be completely bogus: Looking at this commit carefully to assess its suitability for stable backporting. ## Commit Analysis ### 1. COMMIT MESSAGE ANALYSIS The commit fixes incorrect error handling for `sscanf()` return value checks in the powercap subsystem. The message claims that `if (!sscanf(...))` is wrong because: - `sscanf()` returns the number of successfully parsed items - On success: returns 1 - On failure: returns 0 or EOF (typically -1) ### 2. CODE CHANGE ANALYSIS Three identical changes in `drivers/powercap/powercap_sys.c`: ```c // Before: if (!sscanf(dev_attr->attr.name, "constraint_%d_", &id)) // After: if (sscanf(dev_attr->attr.name, "constraint_%d_", &id) != 1) ``` Let me trace through the bug: - When `sscanf()` returns 0 (no match): `!0` = 1 (true) → error path taken ✓ - When `sscanf()` returns 1 (success): `!1` = 0 (false) → continues ✓ - When `sscanf()` returns EOF (-1): `!(-1)` = 0 (false) → **error path NOT taken** ✗ The critical issue is the EOF case. If `sscanf()` returns EOF (e.g., empty string input), the check passes incorrectly and execution continues with an **uninitialized `id` variable**. This then leads to: ```c if (id >= power_zone->const_id_cnt) // garbage comparison return -EINVAL; pconst = &power_zone->constraints[id]; // POTENTIAL OUT-OF-BOUNDS ACCESS ``` ### 3. CLASSIFICATION This is a **bug fix** that prevents: - Potential out-of-bounds array access - Use of uninitialized variable - Possible kernel crash or memory corruption in edge cases Not a feature addition, code cleanup, or optimization. ### 4. SCOPE AND RISK ASSESSMENT - **Lines changed**: 3 lines (identical pattern) - **Files affected**: 1 file - **Risk**: Extremely low - the change only makes the check stricter and more explicit - **Could break anything?**: No - the new check `!= 1` is strictly more conservative than `!` ### 5. USER IMPACT The powercap subsystem manages: - Intel RAPL power capping - Power domain constraints - Used by tools like powertop, thermald While the EOF triggering condition is rare (would require malformed attribute names), the consequence (OOB access) could be severe. ### 6. STABILITY INDICATORS - Signed-off by Rafael J. Wysocki (Intel power management maintainer) - Self-contained fix with no dependencies - The powercap subsystem has existed since kernel 3.13 ### 7. DEPENDENCY CHECK - No dependencies on other commits - Simple standalone fix - Code exists in all active stable trees ## Summary **What it fixes**: Incorrect sscanf error handling that could allow execution with uninitialized data, potentially leading to out-of-bounds array access. **Why it matters for stable**: While the triggering condition (EOF from sscanf) is rare, the fix prevents a potential memory safety issue. The change is trivially correct with zero regression risk. **Meets stable criteria**: - ✓ Obviously correct (explicit `!= 1` check is cleaner and more robust) - ✓ Fixes a real bug (uninitialized variable use, potential OOB access) - ✓ Small and contained (3 identical one-line changes) - ✓ No new features - ✓ No dependencies **Risk vs benefit**: The benefit (preventing potential memory corruption) outweighs the near-zero risk of regression. **YES** drivers/powercap/powercap_sys.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c index d14b36b75189..1ff369880beb 100644 --- a/drivers/powercap/powercap_sys.c +++ b/drivers/powercap/powercap_sys.c @@ -68,7 +68,7 @@ static ssize_t show_constraint_##_attr(struct device *dev, \ int id; \ struct powercap_zone_constraint *pconst;\ \ - if (!sscanf(dev_attr->attr.name, "constraint_%d_", &id)) \ + if (sscanf(dev_attr->attr.name, "constraint_%d_", &id) != 1) \ return -EINVAL; \ if (id >= power_zone->const_id_cnt) \ return -EINVAL; \ @@ -93,7 +93,7 @@ static ssize_t store_constraint_##_attr(struct device *dev,\ int id; \ struct powercap_zone_constraint *pconst;\ \ - if (!sscanf(dev_attr->attr.name, "constraint_%d_", &id)) \ + if (sscanf(dev_attr->attr.name, "constraint_%d_", &id) != 1) \ return -EINVAL; \ if (id >= power_zone->const_id_cnt) \ return -EINVAL; \ @@ -162,7 +162,7 @@ static ssize_t show_constraint_name(struct device *dev, ssize_t len = -ENODATA; struct powercap_zone_constraint *pconst; - if (!sscanf(dev_attr->attr.name, "constraint_%d_", &id)) + if (sscanf(dev_attr->attr.name, "constraint_%d_", &id) != 1) return -EINVAL; if (id >= power_zone->const_id_cnt) return -EINVAL; -- 2.51.0

11 hours

1
5
0 0

[PATCH AUTOSEL 6.18-6.12] spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ

by Sasha Levin

From: Fei Shao <fshao(a)chromium.org> [ Upstream commit 8c04b77f87e6e321ae6acd28ce1de5553916153f ] This driver is migrated to use threaded IRQ since commit 5972eb05ca32 ("spi: spi-mt65xx: Use threaded interrupt for non-SPIMEM transfer"), and we almost always want to disable the interrupt line to avoid excess interrupts while the threaded handler is processing SPI transfer. Use IRQF_ONESHOT for that purpose. In practice, we see MediaTek devices show SPI transfer timeout errors when communicating with ChromeOS EC in certain scenarios, and with IRQF_ONESHOT, the issue goes away. Signed-off-by: Fei Shao <fshao(a)chromium.org> Link: https://patch.msgid.link/20251217101131.1975131-1-fshao@chromium.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- LLM Generated explanations, may be completely bogus: ### 4. SCOPE AND RISK ASSESSMENT - **Lines changed:** 1 line - **Files touched:** 1 file - **Complexity:** Trivially low - just a flag change - **Risk:** Very low The fix is: - **Obviously correct**: IRQF_ONESHOT is the documented standard for threaded interrupts - **Small and contained**: One flag change - **Fixes a real bug**: Transfer timeout errors on real hardware Looking at the interrupt handler code: - `mtk_spi_interrupt` returns `IRQ_WAKE_THREAD` for non-SPIMEM transfers - Without IRQF_ONESHOT, the IRQ line stays enabled, allowing repeated interrupts while the thread processes - This causes race conditions on `mdata->state` and transfer handling, leading to timeouts ### 5. USER IMPACT - **Who is affected:** Users of MediaTek SPI devices, particularly ChromeOS users with embedded controllers - **Severity:** Medium-High - SPI transfer timeouts can cause significant functionality issues - **Real-world impact:** Confirmed on MediaTek devices communicating with ChromeOS EC ### 6. DEPENDENCY CHECK The prerequisite commit `5972eb05ca32` ("spi: spi-mt65xx: Use threaded interrupt for non-SPIMEM transfer") was first included in **v6.12-rc1**. This means: - This fix is only applicable to 6.12.y stable trees and newer - Older stable trees (6.6.y, 6.1.y, 5.15.y) don't have the threaded IRQ code, so this fix doesn't apply ### 7. SUMMARY | Criterion | Assessment | |-----------|------------| | Fixes real bug | ✅ Yes - SPI transfer timeouts | | Obviously correct | ✅ Yes - standard pattern | | Small and contained | ✅ Yes - 1 line change | | Tested | ✅ Yes - real hardware testing | | Risk | ✅ Very low | | Dependencies | ✅ Clear - requires 5972eb05ca32 (v6.12+) | ### Conclusion This commit is an excellent candidate for stable backporting: 1. **Fixes a real, user-visible bug**: SPI transfer timeouts on MediaTek hardware 2. **Minimal change**: Single flag addition, no logic changes 3. **Obviously correct**: IRQF_ONESHOT is the proper pattern for threaded IRQs with hardirq handlers that return IRQ_WAKE_THREAD 4. **Low risk**: Well-understood kernel mechanism with no side effects 5. **Tested**: Confirmed to resolve the issue on real ChromeOS EC hardware The only consideration is that this fix only applies to stable trees with kernel 6.12 or later (which contain the prerequisite threaded IRQ commit). For those trees, this is a straightforward, low-risk fix that resolves real hardware issues. **YES** drivers/spi/spi-mt65xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c index 4b40985af1ea..90e5813cfdc3 100644 --- a/drivers/spi/spi-mt65xx.c +++ b/drivers/spi/spi-mt65xx.c @@ -1320,7 +1320,7 @@ static int mtk_spi_probe(struct platform_device *pdev) ret = devm_request_threaded_irq(dev, irq, mtk_spi_interrupt, mtk_spi_interrupt_thread, - IRQF_TRIGGER_NONE, dev_name(dev), host); + IRQF_ONESHOT, dev_name(dev), host); if (ret) return dev_err_probe(dev, ret, "failed to register irq\n"); -- 2.51.0

11 hours

1
0
0 0

[PATCH AUTOSEL 6.18-6.6] netfilter: nf_tables: avoid chain re-validation if possible

by Sasha Levin

From: Florian Westphal <fw(a)strlen.de> [ Upstream commit 8e1a1bc4f5a42747c08130b8242ebebd1210b32f ] Hamza Mahfooz reports cpu soft lock-ups in nft_chain_validate(): watchdog: BUG: soft lockup - CPU#1 stuck for 27s! [iptables-nft-re:37547] [..] RIP: 0010:nft_chain_validate+0xcb/0x110 [nf_tables] [..] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_table_validate+0x6b/0xb0 [nf_tables] nf_tables_validate+0x8b/0xa0 [nf_tables] nf_tables_commit+0x1df/0x1eb0 [nf_tables] [..] Currently nf_tables will traverse the entire table (chain graph), starting from the entry points (base chains), exploring all possible paths (chain jumps). But there are cases where we could avoid revalidation. Consider: 1 input -> j2 -> j3 2 input -> j2 -> j3 3 input -> j1 -> j2 -> j3 Then the second rule does not need to revalidate j2, and, by extension j3, because this was already checked during validation of the first rule. We need to validate it only for rule 3. This is needed because chain loop detection also ensures we do not exceed the jump stack: Just because we know that j2 is cycle free, its last jump might now exceed the allowed stack size. We also need to update all reachable chains with the new largest observed call depth. Care has to be taken to revalidate even if the chain depth won't be an issue: chain validation also ensures that expressions are not called from invalid base chains. For example, the masquerade expression can only be called from NAT postrouting base chains. Therefore we also need to keep record of the base chain context (type, hooknum) and revalidate if the chain becomes reachable from a different hook location. Reported-by: Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> Closes: https://lore.kernel.org/netfilter-devel/20251118221735.GA5477@linuxonhyperv… Tested-by: Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- LLM Generated explanations, may be completely bogus: ## Commit Analysis: netfilter: nf_tables: avoid chain re-validation if possible ### 1. COMMIT MESSAGE ANALYSIS **Bug Indicators:** - Reports CPU soft lock-ups in `nft_chain_validate()` - a serious denial-of-service condition - Stack trace shows recursive validation causing 27+ second lockups - Has `Reported-by:` and `Tested-by:` tags from Hamza Mahfooz (Microsoft) - Has `Closes:` link to lore.kernel.org bug report The commit explains that chain validation currently traverses the entire table graph, causing exponential complexity when chains are reachable through multiple paths. This is a clear performance/DoS bug, not a feature addition. ### 2. CODE CHANGE ANALYSIS **Changes to nf_tables.h:** - Adds new `struct nft_chain_validate_state` with hook_mask and depth tracking - Adds `vstate` field to `struct nft_chain` for validation state caching - Changes `nft_chain_validate()` signature to allow chain modification **Changes to nf_tables_api.c:** - `nft_chain_vstate_valid()`: New function checking if chain is already validated for current context - `nft_chain_vstate_update()`: Updates chain's validation state after successful validation - `nft_chain_validate()`: Added early-exit when chain already validated, added depth/base-chain checks - `nft_table_validate()`: Added cleanup loop to clear vstate after validation completes **The technical fix:** Implements memoization to avoid redundant chain validation. If a chain has already been validated at the current call depth and hook context, skip re-validation. ### 3. CLASSIFICATION This is a **bug fix** for a denial-of-service condition. While it adds new structures for state tracking, the purpose is purely to fix the exponential validation complexity causing soft lockups. ### 4. SCOPE AND RISK ASSESSMENT **Size:** ~60 lines added across 2 files **Complexity:** Moderate - adds memoization logic with proper cleanup **Risks:** - Changes validation logic which is security-critical - If memoization is incorrect, could theoretically allow invalid chains or block valid ones - New field in `struct nft_chain` **Mitigations:** - Well-structured with defensive checks (`WARN_ON_ONCE`, `BUILD_BUG_ON`) - Cleanup loop at end of `nft_table_validate()` ensures no stale state - vstate only used during control plane commit phase - Trusted author (Florian Westphal, netfilter maintainer) ### 5. USER IMPACT **Severity: HIGH** - CPU soft lockups make the system unresponsive for 27+ seconds - Triggered by iptables-nft/nftables operations with complex rulesets - Affects any user managing firewalls with multiple jump paths between chains - Could potentially be exploited for DoS if unprivileged users can modify rules ### 6. STABILITY INDICATORS - `Reported-by:` and `Tested-by:` from the same reporter confirms the fix works - Author is a well-known netfilter maintainer - Clear technical explanation in commit message - The fix targets existing core netfilter code that exists in stable trees ### 7. DEPENDENCY CHECK Looking at the code, this doesn't appear to depend on other recent commits. It uses existing macros and structures (`nft_is_base_chain`, `nft_base_chain`, etc.) that should exist in stable kernels. ### DECISION ANALYSIS **Pro-backport:** 1. Fixes real user-reported DoS (CPU soft lockup for 27+ seconds) 2. Tested by reporter, confirmed to resolve the issue 3. Authored by trusted netfilter maintainer 4. Netfilter is critical infrastructure - firewall lockups are serious 5. The bug affects real-world complex rulesets **Against-backport:** 1. Larger than typical stable patches (~60 lines) 2. Adds new data structure and field 3. Touches security-critical validation path 4. Some complexity in the memoization logic ### CONCLUSION Despite being larger than a typical stable fix, this commit addresses a **severe denial-of-service condition** (soft lockups) in critical firewall infrastructure. The 27+ second lockups render systems unusable and this has real user impact. The fix is well-designed with proper cleanup, tested by the reporter, and authored by a trusted netfilter maintainer. The stable kernel rules explicitly allow fixes for "serious crash, deadlock" issues - soft lockups fall into this category. The benefit (fixing DoS) significantly outweighs the risk, and the code quality/testing gives confidence in the fix's correctness. **YES** include/net/netfilter/nf_tables.h | 34 +++++++++++---- net/netfilter/nf_tables_api.c | 69 +++++++++++++++++++++++++++++-- 2 files changed, 91 insertions(+), 12 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index fab7dc73f738..0e266c2d0e7f 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -1091,6 +1091,29 @@ struct nft_rule_blob { __attribute__((aligned(__alignof__(struct nft_rule_dp)))); }; +enum nft_chain_types { + NFT_CHAIN_T_DEFAULT = 0, + NFT_CHAIN_T_ROUTE, + NFT_CHAIN_T_NAT, + NFT_CHAIN_T_MAX +}; + +/** + * struct nft_chain_validate_state - validation state + * + * If a chain is encountered again during table validation it is + * possible to avoid revalidation provided the calling context is + * compatible. This structure stores relevant calling context of + * previous validations. + * + * @hook_mask: the hook numbers and locations the chain is linked to + * @depth: the deepest call chain level the chain is linked to + */ +struct nft_chain_validate_state { + u8 hook_mask[NFT_CHAIN_T_MAX]; + u8 depth; +}; + /** * struct nft_chain - nf_tables chain * @@ -1109,6 +1132,7 @@ struct nft_rule_blob { * @udlen: user data length * @udata: user data in the chain * @blob_next: rule blob pointer to the next in the chain + * @vstate: validation state */ struct nft_chain { struct nft_rule_blob __rcu *blob_gen_0; @@ -1128,9 +1152,10 @@ struct nft_chain { /* Only used during control plane commit phase: */ struct nft_rule_blob *blob_next; + struct nft_chain_validate_state vstate; }; -int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain); +int nft_chain_validate(const struct nft_ctx *ctx, struct nft_chain *chain); int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, const struct nft_set_iter *iter, struct nft_elem_priv *elem_priv); @@ -1138,13 +1163,6 @@ int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set); int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain); void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain); -enum nft_chain_types { - NFT_CHAIN_T_DEFAULT = 0, - NFT_CHAIN_T_ROUTE, - NFT_CHAIN_T_NAT, - NFT_CHAIN_T_MAX -}; - /** * struct nft_chain_type - nf_tables chain type info * diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index eed434e0a970..7fbfa1e5d27c 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -123,6 +123,29 @@ static void nft_validate_state_update(struct nft_table *table, u8 new_validate_s table->validate_state = new_validate_state; } + +static bool nft_chain_vstate_valid(const struct nft_ctx *ctx, + const struct nft_chain *chain) +{ + const struct nft_base_chain *base_chain; + enum nft_chain_types type; + u8 hooknum; + + if (WARN_ON_ONCE(!nft_is_base_chain(ctx->chain))) + return false; + + base_chain = nft_base_chain(ctx->chain); + hooknum = base_chain->ops.hooknum; + type = base_chain->type->type; + + /* chain is already validated for this call depth */ + if (chain->vstate.depth >= ctx->level && + chain->vstate.hook_mask[type] & BIT(hooknum)) + return true; + + return false; +} + static void nf_tables_trans_destroy_work(struct work_struct *w); static void nft_trans_gc_work(struct work_struct *work); @@ -4079,6 +4102,29 @@ static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *r nf_tables_rule_destroy(ctx, rule); } +static void nft_chain_vstate_update(const struct nft_ctx *ctx, struct nft_chain *chain) +{ + const struct nft_base_chain *base_chain; + enum nft_chain_types type; + u8 hooknum; + + /* ctx->chain must hold the calling base chain. */ + if (WARN_ON_ONCE(!nft_is_base_chain(ctx->chain))) { + memset(&chain->vstate, 0, sizeof(chain->vstate)); + return; + } + + base_chain = nft_base_chain(ctx->chain); + hooknum = base_chain->ops.hooknum; + type = base_chain->type->type; + + BUILD_BUG_ON(BIT(NF_INET_NUMHOOKS) > U8_MAX); + + chain->vstate.hook_mask[type] |= BIT(hooknum); + if (chain->vstate.depth < ctx->level) + chain->vstate.depth = ctx->level; +} + /** nft_chain_validate - loop detection and hook validation * * @ctx: context containing call depth and base chain @@ -4088,15 +4134,25 @@ static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *r * and set lookups until either the jump limit is hit or all reachable * chains have been validated. */ -int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) +int nft_chain_validate(const struct nft_ctx *ctx, struct nft_chain *chain) { struct nft_expr *expr, *last; struct nft_rule *rule; int err; + BUILD_BUG_ON(NFT_JUMP_STACK_SIZE > 255); if (ctx->level == NFT_JUMP_STACK_SIZE) return -EMLINK; + if (ctx->level > 0) { + /* jumps to base chains are not allowed. */ + if (nft_is_base_chain(chain)) + return -ELOOP; + + if (nft_chain_vstate_valid(ctx, chain)) + return 0; + } + list_for_each_entry(rule, &chain->rules, list) { if (fatal_signal_pending(current)) return -EINTR; @@ -4117,6 +4173,7 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) } } + nft_chain_vstate_update(ctx, chain); return 0; } EXPORT_SYMBOL_GPL(nft_chain_validate); @@ -4128,7 +4185,7 @@ static int nft_table_validate(struct net *net, const struct nft_table *table) .net = net, .family = table->family, }; - int err; + int err = 0; list_for_each_entry(chain, &table->chains, list) { if (!nft_is_base_chain(chain)) @@ -4137,12 +4194,16 @@ static int nft_table_validate(struct net *net, const struct nft_table *table) ctx.chain = chain; err = nft_chain_validate(&ctx, chain); if (err < 0) - return err; + goto err; cond_resched(); } - return 0; +err: + list_for_each_entry(chain, &table->chains, list) + memset(&chain->vstate, 0, sizeof(chain->vstate)); + + return err; } int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, -- 2.51.0

11 hours

1
0
0 0

[PATCH] tcpm: allow looking for role_sw device in the main node

by Arnaud Ferraris

When ports are defined in the tcpc main node, fwnode_usb_role_switch_get returns an error, meaning usb_role_switch_get (which would succeed) never gets a chance to run as port->role_sw isn't NULL, causing a regression on devices where this is the case. Fix this by turning the NULL check into IS_ERR_OR_NULL, so usb_role_switch_get can actually run and the device get properly probed. Fixes: 2d8713f807a4 ("tcpm: switch check for role_sw device with fw_node") Cc: stable(a)vger.kernel.org Signed-off-by: Arnaud Ferraris <arnaud.ferraris(a)collabora.com> --- drivers/usb/typec/tcpm/tcpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c index cc78770509dbc..37698204d48d2 100644 --- a/drivers/usb/typec/tcpm/tcpm.c +++ b/drivers/usb/typec/tcpm/tcpm.c @@ -7877,7 +7877,7 @@ struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc) port->partner_desc.identity = &port->partner_ident; port->role_sw = fwnode_usb_role_switch_get(tcpc->fwnode); - if (!port->role_sw) + if (IS_ERR_OR_NULL(port->role_sw)) port->role_sw = usb_role_switch_get(port->dev); if (IS_ERR(port->role_sw)) { err = PTR_ERR(port->role_sw); --- base-commit: 765e56e41a5af2d456ddda6cbd617b9d3295ab4e change-id: 20251127-fix-ppp-power-6d47f3a746f8 Best regards, -- Arnaud Ferraris <arnaud.ferraris(a)collabora.com>

11 hours, 20 minutes

3
2
0 0

[PATCH] ALSA: ac97: fix a double free in snd_ac97_controller_register()

by Haoxiang Li

If ac97_add_adapter() fails, put_device() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idr_alloc() fails and in ac97_adapter_release() to do the cleanup. Found by code review. Fixes: 74426fbff66e ("ALSA: ac97: add an ac97 bus") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- sound/ac97/bus.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sound/ac97/bus.c b/sound/ac97/bus.c index f4254703d29f..bb9b795e0226 100644 --- a/sound/ac97/bus.c +++ b/sound/ac97/bus.c @@ -298,6 +298,7 @@ static void ac97_adapter_release(struct device *dev) idr_remove(&ac97_adapter_idr, ac97_ctrl->nr); dev_dbg(&ac97_ctrl->adap, "adapter unregistered by %s\n", dev_name(ac97_ctrl->parent)); + kfree(ac97_ctrl); } static const struct device_type ac97_adapter_type = { @@ -319,7 +320,9 @@ static int ac97_add_adapter(struct ac97_controller *ac97_ctrl) ret = device_register(&ac97_ctrl->adap); if (ret) put_device(&ac97_ctrl->adap); - } + } else + kfree(ac97_ctrl); + if (!ret) { list_add(&ac97_ctrl->controllers, &ac97_controllers); dev_dbg(&ac97_ctrl->adap, "adapter registered by %s\n", @@ -361,14 +364,11 @@ struct ac97_controller *snd_ac97_controller_register( ret = ac97_add_adapter(ac97_ctrl); if (ret) - goto err; + return ERR_PTR(ret); ac97_bus_reset(ac97_ctrl); ac97_bus_scan(ac97_ctrl); return ac97_ctrl; -err: - kfree(ac97_ctrl); - return ERR_PTR(ret); } EXPORT_SYMBOL_GPL(snd_ac97_controller_register); -- 2.25.1

11 hours, 21 minutes

2
1
0 0

[PATCH] debugfs: Fix NULL pointer dereference at debugfs_read_file_str

by yangshiguang1011＠163.com

From: yangshiguang <yangshiguang(a)xiaomi.com> Check in debugfs_read_file_str() if the string pointer is NULL. When creating a node using debugfs_create_str(), the string parameter value can be NULL to indicate empty/unused/ignored. However, reading this node using debugfs_read_file_str() will cause a kernel panic. This should not be fatal, so return an invalid error. Signed-off-by: yangshiguang <yangshiguang(a)xiaomi.com> Fixes: 9af0440ec86e ("debugfs: Implement debugfs_create_str()") Cc: stable(a)vger.kernel.org --- fs/debugfs/file.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c index 3ec3324c2060..a22ff0ceb230 100644 --- a/fs/debugfs/file.c +++ b/fs/debugfs/file.c @@ -1026,6 +1026,9 @@ ssize_t debugfs_read_file_str(struct file *file, char __user *user_buf, return ret; str = *(char **)file->private_data; + if (!str) + return -EINVAL; + len = strlen(str) + 1; copy = kmalloc(len, GFP_KERNEL); if (!copy) { -- 2.43.0

11 hours, 45 minutes

3
5
0 0

[PATCH] net: ipv4: fix regression in local-broadcast routes

by Chanho Min

From: Oscar Maes <oscmaes92(a)gmail.com> [ Upstream commit 5189446ba995556eaa3755a6e875bc06675b88bd ] Commit 9e30ecf23b1b ("net: ipv4: fix incorrect MTU in broadcast routes") introduced a regression where local-broadcast packets would have their gateway set in __mkroute_output, which was caused by fi = NULL being removed. Fix this by resetting the fib_info for local-broadcast packets. This preserves the intended changes for directed-broadcast packets. Cc: stable(a)vger.kernel.org Fixes: 9e30ecf23b1b ("net: ipv4: fix incorrect MTU in broadcast routes") Reported-by: Brett A C Sheffield <bacs(a)librecast.net> Closes: https://lore.kernel.org/regressions/20250822165231.4353-4-bacs@librecast.net Signed-off-by: Oscar Maes <oscmaes92(a)gmail.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20250827062322.4807-1-oscmaes92@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/ipv4/route.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 9a5c9497b393..261ddb6542a4 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -2532,12 +2532,16 @@ static struct rtable *__mkroute_output(const struct fib_result *res, !netif_is_l3_master(dev_out)) return ERR_PTR(-EINVAL); - if (ipv4_is_lbcast(fl4->daddr)) + if (ipv4_is_lbcast(fl4->daddr)) { type = RTN_BROADCAST; - else if (ipv4_is_multicast(fl4->daddr)) + + /* reset fi to prevent gateway resolution */ + fi = NULL; + } else if (ipv4_is_multicast(fl4->daddr)) { type = RTN_MULTICAST; - else if (ipv4_is_zeronet(fl4->daddr)) + } else if (ipv4_is_zeronet(fl4->daddr)) { return ERR_PTR(-EINVAL); + } if (dev_out->flags & IFF_LOOPBACK) flags |= RTCF_LOCAL;

12 hours, 56 minutes

3
3
0 0

[PATCH v5.10.y] btrfs: do not clean up repair bio if submit fails

by Keerthana K

From: Josef Bacik <josef(a)toxicpanda.com> [ Upstream commit 8cbc3001a3264d998d6b6db3e23f935c158abd4d ] The submit helper will always run bio_endio() on the bio if it fails to submit, so cleaning up the bio just leads to a variety of use-after-free and NULL pointer dereference bugs because we race with the endio function that is cleaning up the bio. Instead just return BLK_STS_OK as the repair function has to continue to process the rest of the pages, and the endio for the repair bio will do the appropriate cleanup for the page that it was given. Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: David Sterba <dsterba(a)suse.com> [Minor context change fixed.] Signed-off-by: Bin Lan <bin.lan.cn(a)windriver.com> Signed-off-by: He Zhe <zhe.he(a)windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ Keerthana: Backported the patch to v5.10.y ] Signed-off-by: Keerthana K <keerthana.kalyanasundaram(a)broadcom.com> --- fs/btrfs/extent_io.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c index 489d370ddd60..3d0b854e0c19 100644 --- a/fs/btrfs/extent_io.c +++ b/fs/btrfs/extent_io.c @@ -2655,7 +2655,6 @@ blk_status_t btrfs_submit_read_repair(struct inode *inode, bool need_validation; struct bio *repair_bio; struct btrfs_io_bio *repair_io_bio; - blk_status_t status; btrfs_debug(fs_info, "repair read error: read error at %llu", start); @@ -2699,13 +2698,13 @@ blk_status_t btrfs_submit_read_repair(struct inode *inode, "repair read error: submitting new read to mirror %d, in_validation=%d", failrec->this_mirror, failrec->in_validation); - status = submit_bio_hook(inode, repair_bio, failrec->this_mirror, - failrec->bio_flags); - if (status) { - free_io_failure(failure_tree, tree, failrec); - bio_put(repair_bio); - } - return status; + /* + * At this point we have a bio, so any errors from submit_bio_hook() + * will be handled by the endio on the repair_bio, so we can't return an + * error here. + */ + submit_bio_hook(inode, repair_bio, failrec->this_mirror, failrec->bio_flags); + return BLK_STS_OK; } /* lots and lots of room for performance fixes in the end_bio funcs */ -- 2.43.7

13 hours, 4 minutes

1
0
0 0

[PATCH net] net/smc: Initialize smc hashtables before registering users

by Alexandra Winter

During initialisation of the SMC module initialize smc_v4/6_hashinfo before calling smc_nl_init(), proto_register() or sock_register(), to avoid a race that can cause use of an uninitialised pointer in case an smc protocol is called before the module is done initialising. syzbot report: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] Call Trace: <TASK> smc_diag_dump+0x59/0xa0 net/smc/smc_diag.c:236 netlink_dump+0x647/0xd80 net/netlink/af_netlink.c:2325 __netlink_dump_start+0x59f/0x780 net/netlink/af_netlink.c:2440 netlink_dump_start include/linux/netlink.h:339 [inline] smc_diag_handler_dump+0x1ab/0x250 net/smc/smc_diag.c:251 sock_diag_rcv_msg+0x3dc/0x5f0 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f0/0x990 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901 Fixes: f16a7dd5cf27 ("smc: netlink interface for SMC sockets") Reported-by: syzbot+f69bfae0a4eb29976e44(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f69bfae0a4eb29976e44 Signed-off-by: Alexandra Winter <wintera(a)linux.ibm.com> --- net/smc/af_smc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index f97f77b041d9..b0f4405fb714 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -3524,6 +3524,9 @@ static int __init smc_init(void) goto out_pernet_subsys_stat; smc_clc_init(); + INIT_HLIST_HEAD(&smc_v4_hashinfo.ht); + INIT_HLIST_HEAD(&smc_v6_hashinfo.ht); + rc = smc_nl_init(); if (rc) goto out_ism; @@ -3581,8 +3584,6 @@ static int __init smc_init(void) pr_err("%s: sock_register fails with %d\n", __func__, rc); goto out_proto6; } - INIT_HLIST_HEAD(&smc_v4_hashinfo.ht); - INIT_HLIST_HEAD(&smc_v6_hashinfo.ht); rc = smc_ib_register_client(); if (rc) { -- 2.51.0

13 hours, 4 minutes

3
4
0 0

[PATCH v5.10.y] bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()

by Keerthana K

From: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> commit 928ea98252ad75118950941683893cf904541da9 upstream. In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io triggers KASAN use-after-free. To avoid the use-after-free, keep the reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to fsl_destroy_mc_io(). This patch needs rework to apply to kernels older than v5.15. Fixes: f93627146f0e ("staging: fsl-mc: fix asymmetry in destroy of mc_io") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Link: https://lore.kernel.org/r/20220601105159.87752-1-shinichiro.kawasaki@wdc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ Keerthana: Backported the patch to v5.10.y ] Signed-off-by: Keerthana K <keerthana.kalyanasundaram(a)broadcom.com> --- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index dd7791f48537..4f13e7d8101b 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -1085,14 +1085,14 @@ static int fsl_mc_bus_probe(struct platform_device *pdev) static int fsl_mc_bus_remove(struct platform_device *pdev) { struct fsl_mc *mc = platform_get_drvdata(pdev); + struct fsl_mc_io *mc_io; if (!fsl_mc_is_root_dprc(&mc->root_mc_bus_dev->dev)) return -EINVAL; + mc_io = mc->root_mc_bus_dev->mc_io; fsl_mc_device_remove(mc->root_mc_bus_dev); - - fsl_destroy_mc_io(mc->root_mc_bus_dev->mc_io); - mc->root_mc_bus_dev->mc_io = NULL; + fsl_destroy_mc_io(mc_io); return 0; } -- 2.43.7

13 hours, 19 minutes

1
0
0 0

Request to add mainline merged patch to stable kernels

by JP Dehollain

Hello, I recently used the patch misc: rtsx_pci: Add separate CD/WP pin polarity reversal support with commit ID 807221d, to fix a bug causing the cardreader driver to always load sd cards in read-only mode. On the suggestion of the driver maintainer, I am requesting that this patch be applied to all stable kernel versions, as it is currently only applied to >=6.18. Thanks, JP

13 hours, 26 minutes

2
1
0 0

[PATCH net v4] net: nfc: nci: Fix parameter validation for packet data

by Michael Thalmeier

Since commit 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") communication with nci nfc chips is not working any more. The mentioned commit tries to fix access of uninitialized data, but failed to understand that in some cases the data packet is of variable length and can therefore not be compared to the maximum packet length given by the sizeof(struct). Fixes: 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") Cc: stable(a)vger.kernel.org Signed-off-by: Michael Thalmeier <michael.thalmeier(a)hale.at> --- v4: - formatting fixes v3: - perform complete checks - replace magic numbers with offsetofend and sizeof v2: - Reference correct commit hash --- net/nfc/nci/ntf.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c index 418b84e2b260..a5cafcd10cc3 100644 --- a/net/nfc/nci/ntf.c +++ b/net/nfc/nci/ntf.c @@ -58,7 +58,7 @@ static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, struct nci_conn_info *conn_info; int i; - if (skb->len < sizeof(struct nci_core_conn_credit_ntf)) + if (skb->len < offsetofend(struct nci_core_conn_credit_ntf, num_entries)) return -EINVAL; ntf = (struct nci_core_conn_credit_ntf *)skb->data; @@ -68,6 +68,10 @@ static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, if (ntf->num_entries > NCI_MAX_NUM_CONN) ntf->num_entries = NCI_MAX_NUM_CONN; + if (skb->len < offsetofend(struct nci_core_conn_credit_ntf, num_entries) + + ntf->num_entries * sizeof(struct conn_credit_entry)) + return -EINVAL; + /* update the credits */ for (i = 0; i < ntf->num_entries; i++) { ntf->conn_entries[i].conn_id = @@ -364,7 +368,7 @@ static int nci_rf_discover_ntf_packet(struct nci_dev *ndev, const __u8 *data; bool add_target = true; - if (skb->len < sizeof(struct nci_rf_discover_ntf)) + if (skb->len < offsetofend(struct nci_rf_discover_ntf, rf_tech_specific_params_len)) return -EINVAL; data = skb->data; @@ -380,6 +384,10 @@ static int nci_rf_discover_ntf_packet(struct nci_dev *ndev, pr_debug("rf_tech_specific_params_len %d\n", ntf.rf_tech_specific_params_len); + if (skb->len < (data - skb->data) + + ntf.rf_tech_specific_params_len + sizeof(ntf.ntf_type)) + return -EINVAL; + if (ntf.rf_tech_specific_params_len > 0) { switch (ntf.rf_tech_and_mode) { case NCI_NFC_A_PASSIVE_POLL_MODE: @@ -596,7 +604,7 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, const __u8 *data; int err = NCI_STATUS_OK; - if (skb->len < sizeof(struct nci_rf_intf_activated_ntf)) + if (skb->len < offsetofend(struct nci_rf_intf_activated_ntf, rf_tech_specific_params_len)) return -EINVAL; data = skb->data; @@ -628,6 +636,9 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, if (ntf.rf_interface == NCI_RF_INTERFACE_NFCEE_DIRECT) goto listen; + if (skb->len < (data - skb->data) + ntf.rf_tech_specific_params_len) + return -EINVAL; + if (ntf.rf_tech_specific_params_len > 0) { switch (ntf.activation_rf_tech_and_mode) { case NCI_NFC_A_PASSIVE_POLL_MODE: @@ -668,6 +679,13 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, } } + if (skb->len < (data - skb->data) + + sizeof(ntf.data_exch_rf_tech_and_mode) + + sizeof(ntf.data_exch_tx_bit_rate) + + sizeof(ntf.data_exch_rx_bit_rate) + + sizeof(ntf.activation_params_len)) + return -EINVAL; + ntf.data_exch_rf_tech_and_mode = *data++; ntf.data_exch_tx_bit_rate = *data++; ntf.data_exch_rx_bit_rate = *data++; @@ -679,6 +697,9 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, pr_debug("data_exch_rx_bit_rate 0x%x\n", ntf.data_exch_rx_bit_rate); pr_debug("activation_params_len %d\n", ntf.activation_params_len); + if (skb->len < (data - skb->data) + ntf.activation_params_len) + return -EINVAL; + if (ntf.activation_params_len > 0) { switch (ntf.rf_interface) { case NCI_RF_INTERFACE_ISO_DEP: -- 2.52.0

13 hours, 39 minutes

1
0
0 0

[PATCH 5.10] fbcon: Add check for return value

by Ваторопин Андрей

From: Andrey Vatoropin <a.vatoropin(a)crpt.ru> If fbcon_open() fails when called from con2fb_acquire_newinfo() then info->fbcon_par pointer remains NULL which is later dereferenced. Add check for return value of the function con2fb_acquire_newinfo() to avoid it. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: d1baa4ffa677 ("fbcon: set_con2fb_map fixes") Cc: stable(a)vger.kernel.org Signed-off-by: Andrey Vatoropin <a.vatoropin(a)crpt.ru> --- drivers/video/fbdev/core/fbcon.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 3dd03e02bf97..d9b2b54f00db 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -1057,7 +1057,8 @@ static void fbcon_init(struct vc_data *vc, int init) return; if (!info->fbcon_par) - con2fb_acquire_newinfo(vc, info, vc->vc_num, -1); + if (con2fb_acquire_newinfo(vc, info, vc->vc_num, -1)) + return; /* If we are not the first console on this fb, copy the font from that console */ -- 2.43.0

14 hours, 32 minutes

2
1
0 0

[PATCH] xen/scsiback: fix potential memory leak in scsiback_remove()

by Abdun Nihaal

Memory allocated for struct vscsiblk_info in scsiback_probe() is not freed in scsiback_remove() leading to potential memory leaks on remove, as well as in the scsiback_probe() error paths. Fix that by freeing it in scsiback_remove(). Cc: stable(a)vger.kernel.org Fixes: d9d660f6e562 ("xen-scsiback: Add Xen PV SCSI backend driver") Signed-off-by: Abdun Nihaal <nihaal(a)cse.iitm.ac.in> --- Compile tested only. Issue found using static analysis. drivers/xen/xen-scsiback.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c index 0c51edfd13dc..7d5117e5efe0 100644 --- a/drivers/xen/xen-scsiback.c +++ b/drivers/xen/xen-scsiback.c @@ -1262,6 +1262,7 @@ static void scsiback_remove(struct xenbus_device *dev) gnttab_page_cache_shrink(&info->free_pages, 0); dev_set_drvdata(&dev->dev, NULL); + kfree(info); } static int scsiback_probe(struct xenbus_device *dev, -- 2.43.0

14 hours, 35 minutes

1
0
0 0

[PATCH] media: i2c/tw9906: Fix potential memory leak in tw9906_probe()

by Abdun Nihaal

In one of the error paths in tw9906_probe(), the memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that by calling v4l2_ctrl_handler_free() on the handler in that error path. Cc: stable(a)vger.kernel.org Fixes: a000e9a02b58 ("[media] tw9906: add Techwell tw9906 video decoder") Signed-off-by: Abdun Nihaal <nihaal(a)cse.iitm.ac.in> --- Compile tested only. Issue found using static analysis. drivers/media/i2c/tw9906.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/i2c/tw9906.c b/drivers/media/i2c/tw9906.c index 6220f4fddbab..0ab43fe42d7f 100644 --- a/drivers/media/i2c/tw9906.c +++ b/drivers/media/i2c/tw9906.c @@ -196,6 +196,7 @@ static int tw9906_probe(struct i2c_client *client) if (write_regs(sd, initial_registers) < 0) { v4l2_err(client, "error initializing TW9906\n"); + v4l2_ctrl_handler_free(hdl); return -EINVAL; } -- 2.43.0

15 hours, 16 minutes

1
0
0 0

[PATCH] media: i2c/tw9903: Fix potential memory leak in tw9903_probe()

by Abdun Nihaal

In one of the error paths in tw9903_probe(), the memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that by calling v4l2_ctrl_handler_free() on the handler in that error path. Cc: stable(a)vger.kernel.org Fixes: 0890ec19c65d ("[media] tw9903: add new tw9903 video decoder") Signed-off-by: Abdun Nihaal <nihaal(a)cse.iitm.ac.in> --- Compile tested only. Issue found using static analysis. drivers/media/i2c/tw9903.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/i2c/tw9903.c b/drivers/media/i2c/tw9903.c index b996a05e56f2..c3eafd5d5dc8 100644 --- a/drivers/media/i2c/tw9903.c +++ b/drivers/media/i2c/tw9903.c @@ -228,6 +228,7 @@ static int tw9903_probe(struct i2c_client *client) if (write_regs(sd, initial_registers) < 0) { v4l2_err(client, "error initializing TW9903\n"); + v4l2_ctrl_handler_free(hdl); return -EINVAL; } -- 2.43.0

15 hours, 17 minutes

1
0
0 0

[PATCH V2 0/2] LoongArch: KVM: fix "unreliable stack" issue

by Xianglai Li

When starting multi-core loongarch virtualization on loongarch physical machine, loading livepatch on the physical machine will cause an error similar to the following: [ 411.686289] livepatch: klp_try_switch_task: CPU 31/KVM:3116 has an unreliable stack The specific test steps are as follows: 1.Start a multi-core virtual machine on a physical machine 2.Enter the following command on the physical machine to turn on the debug switch: echo "file kernel/livepatch/transition.c +p" > /sys/kernel/debug/\ dynamic_debug/control 3.Load livepatch: modprobe livepatch-sample Through the above steps, similar prints can be viewed in dmesg. The reason for this issue is that the code of the kvm_exc_entry function was copied in the function kvm_loongarch_env_init. When the cpu needs to execute kvm_exc_entry, it will switch to the copied address for execution. The new address of the kvm_exc_entry function cannot be recognized in ORC, which eventually leads to the arch_stack_walk_reliable function returning an error and printing an exception message. To solve the above problems, we directly compile the switch.S file into the kernel instead of the module. In this way, the function kvm_exc_entry will no longer need to be copied. changlog: V2<-V1: 1.Rollback the modification of function parameter types such as kvm_save_fpu. In the asm-prototypes.h header file, only the parameter types it depends on are included Cc: Huacai Chen <chenhuacai(a)kernel.org> Cc: WANG Xuerui <kernel(a)xen0n.name> Cc: Tianrui Zhao <zhaotianrui(a)loongson.cn> Cc: Bibo Mao <maobibo(a)loongson.cn> Cc: Charlie Jenkins <charlie(a)rivosinc.com> Cc: Xianglai Li <lixianglai(a)loongson.cn> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Xianglai Li (2): LoongArch: KVM: Compile the switch.S file directly into the kernel LoongArch: KVM: fix "unreliable stack" issue arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 21 +++++++++++++ arch/loongarch/include/asm/kvm_host.h | 3 -- arch/loongarch/kvm/Makefile | 2 +- arch/loongarch/kvm/main.c | 35 ++------------------- arch/loongarch/kvm/switch.S | 24 +++++++++++--- 6 files changed, 45 insertions(+), 42 deletions(-) base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8 -- 2.39.1

17 hours, 48 minutes

4
10
0 0

+ mm-memory-failure-teach-kill_accessing_process-to-accept-hugetlb-tail-page-pfn.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-memory-failure-teach-kill_accessing_process-to-accept-hugetlb-tail-page-pfn.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Jane Chu <jane.chu(a)oracle.com> Subject: mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn Date: Mon, 22 Dec 2025 18:21:12 -0700 When a hugetlb folio is being poisoned again, try_memory_failure_hugetlb() passed head pfn to kill_accessing_process(), that is not right. The precise pfn of the poisoned page should be used in order to determine the precise vaddr as the SIGBUS payload. This issue has already been taken care of in the normal path, that is, hwpoison_user_mappings(), see [1][2]. Furthermore, for [3] to work correctly in the hugetlb repoisoning case, it's essential to inform VM the precise poisoned page, not the head page. Link: https://lkml.kernel.org/r/20251223012113.370674-2-jane.chu@oracle.com Link: https://lkml.kernel.org/r/20231218135837.3310403-1-willy@infradead.org [1] Link: https://lkml.kernel.org/r/20250224211445.2663312-1-jane.chu@oracle.com [2] Link: https://lore.kernel.org/lkml/20251116013223.1557158-1-jiaqiyan@google.com/ [3] Signed-off-by: Jane Chu <jane.chu(a)oracle.com> Reviewed-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Cc: "David Hildenbrand (Red Hat)" <david(a)kernel.org> Cc: David Rientjes <rientjes(a)google.com> Cc: Jiaqi Yan <jiaqiyan(a)google.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Miaohe Lin <linmiaohe(a)huawei.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: William Roche <william.roche(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memory-failure.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) --- a/mm/memory-failure.c~mm-memory-failure-teach-kill_accessing_process-to-accept-hugetlb-tail-page-pfn +++ a/mm/memory-failure.c @@ -692,6 +692,8 @@ static int check_hwpoisoned_entry(pte_t unsigned long poisoned_pfn, struct to_kill *tk) { unsigned long pfn = 0; + unsigned long hwpoison_vaddr; + unsigned long mask; if (pte_present(pte)) { pfn = pte_pfn(pte); @@ -702,10 +704,12 @@ static int check_hwpoisoned_entry(pte_t pfn = softleaf_to_pfn(entry); } - if (!pfn || pfn != poisoned_pfn) + mask = ~((1UL << (shift - PAGE_SHIFT)) - 1); + if (!pfn || ((pfn & mask) != (poisoned_pfn & mask))) return 0; - set_to_kill(tk, addr, shift); + hwpoison_vaddr = addr + ((poisoned_pfn - pfn) << PAGE_SHIFT); + set_to_kill(tk, hwpoison_vaddr, shift); return 1; } @@ -2038,10 +2042,8 @@ retry: return 0; case MF_HUGETLB_ALREADY_POISONED: case MF_HUGETLB_ACC_EXISTING_POISON: - if (flags & MF_ACTION_REQUIRED) { - folio = page_folio(p); - res = kill_accessing_process(current, folio_pfn(folio), flags); - } + if (flags & MF_ACTION_REQUIRED) + res = kill_accessing_process(current, pfn, flags); if (res == MF_HUGETLB_ALREADY_POISONED) action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); else _ Patches currently in -mm which might be from jane.chu(a)oracle.com are mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison.patch mm-memory-failure-teach-kill_accessing_process-to-accept-hugetlb-tail-page-pfn.patch

18 hours, 44 minutes

1
0
0 0

+ mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm/memory-failure: fix missing ->mf_stats count in hugetlb poison has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Jane Chu <jane.chu(a)oracle.com> Subject: mm/memory-failure: fix missing ->mf_stats count in hugetlb poison Date: Mon, 22 Dec 2025 18:21:11 -0700 When a newly poisoned subpage ends up in an already poisoned hugetlb folio, 'num_poisoned_pages' is incremented, but the per node ->mf_stats is not. Fix the inconsistency by designating action_result() to update them both. While at it, define __get_huge_page_for_hwpoison() return values in terms of symbol names for better readibility. Also rename folio_set_hugetlb_hwpoison() to hugetlb_update_hwpoison() since the function does more than the conventional bit setting and the fact three possible return values are expected. Link: https://lkml.kernel.org/r/20251223012113.370674-1-jane.chu@oracle.com Fixes: 18f41fa616ee ("mm: memory-failure: bump memory failure stats to pglist_data") Signed-off-by: Jane Chu <jane.chu(a)oracle.com> Cc: "David Hildenbrand (Red Hat)" <david(a)kernel.org> Cc: David Rientjes <rientjes(a)google.com> Cc: Jiaqi Yan <jiaqiyan(a)google.com> Cc: Liam R. Howlett <Liam.Howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Miaohe Lin <linmiaohe(a)huawei.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: William Roche <william.roche(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memory-failure.c | 56 ++++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 23 deletions(-) --- a/mm/memory-failure.c~mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison +++ a/mm/memory-failure.c @@ -1883,12 +1883,18 @@ static unsigned long __folio_free_raw_hw return count; } -static int folio_set_hugetlb_hwpoison(struct folio *folio, struct page *page) +#define MF_HUGETLB_ALREADY_POISONED 3 /* already poisoned */ +#define MF_HUGETLB_ACC_EXISTING_POISON 4 /* accessed existing poisoned page */ +/* + * Set hugetlb folio as hwpoisoned, update folio private raw hwpoison list + * to keep track of the poisoned pages. + */ +static int hugetlb_update_hwpoison(struct folio *folio, struct page *page) { struct llist_head *head; struct raw_hwp_page *raw_hwp; struct raw_hwp_page *p; - int ret = folio_test_set_hwpoison(folio) ? -EHWPOISON : 0; + int ret = folio_test_set_hwpoison(folio) ? MF_HUGETLB_ALREADY_POISONED : 0; /* * Once the hwpoison hugepage has lost reliable raw error info, @@ -1896,20 +1902,18 @@ static int folio_set_hugetlb_hwpoison(st * so skip to add additional raw error info. */ if (folio_test_hugetlb_raw_hwp_unreliable(folio)) - return -EHWPOISON; + return MF_HUGETLB_ALREADY_POISONED; + head = raw_hwp_list_head(folio); llist_for_each_entry(p, head->first, node) { if (p->page == page) - return -EHWPOISON; + return MF_HUGETLB_ACC_EXISTING_POISON; } raw_hwp = kmalloc(sizeof(struct raw_hwp_page), GFP_ATOMIC); if (raw_hwp) { raw_hwp->page = page; llist_add(&raw_hwp->node, head); - /* the first error event will be counted in action_result(). */ - if (ret) - num_poisoned_pages_inc(page_to_pfn(page)); } else { /* * Failed to save raw error info. We no longer trace all @@ -1955,32 +1959,30 @@ void folio_clear_hugetlb_hwpoison(struct folio_free_raw_hwp(folio, true); } +#define MF_HUGETLB_FREED 0 /* freed hugepage */ +#define MF_HUGETLB_IN_USED 1 /* in-use hugepage */ +#define MF_NOT_HUGETLB 2 /* not a hugepage */ + /* * Called from hugetlb code with hugetlb_lock held. - * - * Return values: - * 0 - free hugepage - * 1 - in-use hugepage - * 2 - not a hugepage - * -EBUSY - the hugepage is busy (try to retry) - * -EHWPOISON - the hugepage is already hwpoisoned */ int __get_huge_page_for_hwpoison(unsigned long pfn, int flags, bool *migratable_cleared) { struct page *page = pfn_to_page(pfn); struct folio *folio = page_folio(page); - int ret = 2; /* fallback to normal page handling */ + int ret = MF_NOT_HUGETLB; bool count_increased = false; + int rc; if (!folio_test_hugetlb(folio)) goto out; if (flags & MF_COUNT_INCREASED) { - ret = 1; + ret = MF_HUGETLB_IN_USED; count_increased = true; } else if (folio_test_hugetlb_freed(folio)) { - ret = 0; + ret = MF_HUGETLB_FREED; } else if (folio_test_hugetlb_migratable(folio)) { ret = folio_try_get(folio); if (ret) @@ -1991,8 +1993,9 @@ int __get_huge_page_for_hwpoison(unsigne goto out; } - if (folio_set_hugetlb_hwpoison(folio, page)) { - ret = -EHWPOISON; + rc = hugetlb_update_hwpoison(folio, page); + if (rc >= MF_HUGETLB_ALREADY_POISONED) { + ret = rc; goto out; } @@ -2029,22 +2032,29 @@ static int try_memory_failure_hugetlb(un *hugetlb = 1; retry: res = get_huge_page_for_hwpoison(pfn, flags, &migratable_cleared); - if (res == 2) { /* fallback to normal page handling */ + switch (res) { + case MF_NOT_HUGETLB: /* fallback to normal page handling */ *hugetlb = 0; return 0; - } else if (res == -EHWPOISON) { + case MF_HUGETLB_ALREADY_POISONED: + case MF_HUGETLB_ACC_EXISTING_POISON: if (flags & MF_ACTION_REQUIRED) { folio = page_folio(p); res = kill_accessing_process(current, folio_pfn(folio), flags); } - action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); + if (res == MF_HUGETLB_ALREADY_POISONED) + action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); + else + action_result(pfn, MF_MSG_HUGE, MF_FAILED); return res; - } else if (res == -EBUSY) { + case -EBUSY: if (!(flags & MF_NO_RETRY)) { flags |= MF_NO_RETRY; goto retry; } return action_result(pfn, MF_MSG_GET_HWPOISON, MF_IGNORED); + default: + break; } folio = page_folio(p); _ Patches currently in -mm which might be from jane.chu(a)oracle.com are mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison.patch mm-memory-failure-teach-kill_accessing_process-to-accept-hugetlb-tail-page-pfn.patch

18 hours, 44 minutes

1
0
0 0

[PATCH v2 0/2] block/blk-mq: fix RT kernel issues and interrupt context warnings

by Ionut Nechita (WindRiver)

From: Ionut Nechita <ionut.nechita(a)windriver.com> This series addresses two critical issues in the block layer multiqueue (blk-mq) subsystem when running on PREEMPT_RT kernels. The first patch fixes a severe performance regression where queue_lock contention in the I/O hot path causes IRQ threads to sleep on RT kernels. Testing on MegaRAID 12GSAS controller showed a 76% performance drop (640 MB/s -> 153 MB/s). The fix replaces spinlock with memory barriers to maintain ordering without sleeping. The second patch fixes a WARN_ON that triggers during SCSI device scanning when blk_freeze_queue_start() calls blk_mq_run_hw_queues() synchronously from interrupt context. The warning "WARN_ON_ONCE(!async && in_interrupt())" is resolved by switching to asynchronous execution. Changes in v2: - Removed the blk_mq_cpuhp_lock patch (needs more investigation) - Added fix for WARN_ON in interrupt context during queue freezing - Updated commit messages for clarity Ionut Nechita (2): block/blk-mq: fix RT kernel regression with queue_lock in hot path block: Fix WARN_ON in blk_mq_run_hw_queue when called from interrupt context block/blk-mq.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) -- 2.52.0

18 hours, 46 minutes

4
6
0 0

+ mm-take-into-account-mm_cid-size-for-mm_struct-static-definitions.patch added to mm-new branch

by Andrew Morton

The patch titled Subject: mm: take into account mm_cid size for mm_struct static definitions has been added to the -mm mm-new branch. Its filename is mm-take-into-account-mm_cid-size-for-mm_struct-static-definitions.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-new branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Note, mm-new is a provisional staging ground for work-in-progress patches, and acceptance into mm-new is a notification for others take notice and to finish up reviews. Please do not hesitate to respond to review feedback and post updated versions to replace or incrementally fixup patches in mm-new. The mm-new branch of mm.git is not included in linux-next Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Subject: mm: take into account mm_cid size for mm_struct static definitions Date: Sun, 21 Dec 2025 18:29:24 -0500 Both init_mm and efi_mm static definitions need to make room for the 2 mm_cid cpumasks. This fixes possible out-of-bounds accesses to init_mm and efi_mm. Link: https://lkml.kernel.org/r/20251221232926.450602-4-mathieu.desnoyers@efficio… Fixes: af7f588d8f73 ("sched: Introduce per-memory-map concurrency ID") Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Mark Brown <broonie(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/mm_types.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/include/linux/mm_types.h~mm-take-into-account-mm_cid-size-for-mm_struct-static-definitions +++ a/include/linux/mm_types.h @@ -1368,7 +1368,7 @@ extern struct mm_struct init_mm; #define MM_STRUCT_FLEXIBLE_ARRAY_INIT \ { \ - [0 ... sizeof(cpumask_t)-1] = 0 \ + [0 ... sizeof(cpumask_t) + MM_CID_STATIC_SIZE - 1] = 0 \ } /* Pointer magic because the dynamic array size confuses some compilers. */ @@ -1500,7 +1500,7 @@ static inline int mm_alloc_cid_noprof(st mm_init_cid(mm, p); return 0; } -#define mm_alloc_cid(...) alloc_hooks(mm_alloc_cid_noprof(__VA_ARGS__)) +# define mm_alloc_cid(...) alloc_hooks(mm_alloc_cid_noprof(__VA_ARGS__)) static inline void mm_destroy_cid(struct mm_struct *mm) { @@ -1514,6 +1514,8 @@ static inline unsigned int mm_cid_size(v return cpumask_size() + bitmap_size(num_possible_cpus()); } +/* Use NR_CPUS as worse case for static allocation. */ +# define MM_CID_STATIC_SIZE (2 * sizeof(cpumask_t)) #else /* CONFIG_SCHED_MM_CID */ static inline void mm_init_cid(struct mm_struct *mm, struct task_struct *p) { } static inline int mm_alloc_cid(struct mm_struct *mm, struct task_struct *p) { return 0; } @@ -1522,6 +1524,7 @@ static inline unsigned int mm_cid_size(v { return 0; } +# define MM_CID_STATIC_SIZE 0 #endif /* CONFIG_SCHED_MM_CID */ struct mmu_gather; _ Patches currently in -mm which might be from mathieu.desnoyers(a)efficios.com are lib-introduce-hierarchical-per-cpu-counters.patch mm-fix-oom-killer-inaccuracy-on-large-many-core-systems.patch mm-implement-precise-oom-killer-task-selection.patch mm-add-missing-static-initializer-for-init_mm-mm_cidlock.patch mm-rename-cpu_bitmap-field-to-flexible_array.patch mm-take-into-account-mm_cid-size-for-mm_struct-static-definitions.patch mm-take-into-account-hierarchical-percpu-tree-items-for-static-mm_struct-definitions.patch tsacct-skip-all-kernel-threads.patch

19 hours, 3 minutes

1
0
0 0

+ mm-add-missing-static-initializer-for-init_mm-mm_cidlock.patch added to mm-new branch

by Andrew Morton

The patch titled Subject: mm: add missing static initializer for init_mm::mm_cid.lock has been added to the -mm mm-new branch. Its filename is mm-add-missing-static-initializer-for-init_mm-mm_cidlock.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-new branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Note, mm-new is a provisional staging ground for work-in-progress patches, and acceptance into mm-new is a notification for others take notice and to finish up reviews. Please do not hesitate to respond to review feedback and post updated versions to replace or incrementally fixup patches in mm-new. The mm-new branch of mm.git is not included in linux-next Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Subject: mm: add missing static initializer for init_mm::mm_cid.lock Date: Sun, 21 Dec 2025 18:29:22 -0500 Patch series "MM_CID and HPCC mm_struct static init fixes". Mark Brown reported a regression [1] on linux next due to the hierarchical percpu counters (HPCC). You mentioned they were only in mm-new (and therefore not pulled into -next) [2], but it looks like they got more exposure that we expected. :) This bug hunting got me to fix static initialization issues in both MM_CID (for upstream) and HPCC (mm-new). Mark tested my series and confirmed that it fixes his issues. This patch (of 5): Initialize the mm_cid.lock struct member of init_mm. Link: https://lkml.kernel.org/r/20251221232926.450602-2-mathieu.desnoyers@efficio… Fixes: 8cea569ca785 ("sched/mmcid: Use proper data structures") Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Mark Brown <broonie(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/init-mm.c | 3 +++ 1 file changed, 3 insertions(+) --- a/mm/init-mm.c~mm-add-missing-static-initializer-for-init_mm-mm_cidlock +++ a/mm/init-mm.c @@ -44,6 +44,9 @@ struct mm_struct init_mm = { .mm_lock_seq = SEQCNT_ZERO(init_mm.mm_lock_seq), #endif .user_ns = &init_user_ns, +#ifdef CONFIG_SCHED_MM_CID + .mm_cid.lock = __RAW_SPIN_LOCK_UNLOCKED(init_mm.mm_cid.lock), +#endif .cpu_bitmap = CPU_BITS_NONE, INIT_MM_CONTEXT(init_mm) }; _ Patches currently in -mm which might be from mathieu.desnoyers(a)efficios.com are lib-introduce-hierarchical-per-cpu-counters.patch mm-fix-oom-killer-inaccuracy-on-large-many-core-systems.patch mm-implement-precise-oom-killer-task-selection.patch mm-add-missing-static-initializer-for-init_mm-mm_cidlock.patch mm-rename-cpu_bitmap-field-to-flexible_array.patch mm-take-into-account-mm_cid-size-for-mm_struct-static-definitions.patch mm-take-into-account-hierarchical-percpu-tree-items-for-static-mm_struct-definitions.patch tsacct-skip-all-kernel-threads.patch

19 hours, 4 minutes

1
0
0 0

+ lib-buildid-use-__kernel_read-for-sleepable-context.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: lib/buildid: use __kernel_read() for sleepable context has been added to the -mm mm-hotfixes-unstable branch. Its filename is lib-buildid-use-__kernel_read-for-sleepable-context.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Shakeel Butt <shakeel.butt(a)linux.dev> Subject: lib/buildid: use __kernel_read() for sleepable context Date: Mon, 22 Dec 2025 12:58:59 -0800 Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio". For the sleepable context, convert freader to use __kernel_read() instead of direct page cache access via read_cache_folio(). This simplifies the faultable code path by using the standard kernel file reading interface which handles all the complexity of reading file data. At the moment we are not changing the code for non-sleepable context which uses filemap_get_folio() and only succeeds if the target folios are already in memory and up-to-date. The reason is to keep the patch simple and easier to backport to stable kernels. Syzbot repro does not crash the kernel anymore and the selftests run successfully. In the follow up we will make __kernel_read() with IOCB_NOWAIT work for non-sleepable contexts. In addition, I would like to replace the secretmem check with a more generic approach and will add fstest for the buildid code. Link: https://lkml.kernel.org/r/20251222205859.3968077-1-shakeel.butt@linux.dev Fixes: ad41251c290d ("lib/buildid: implement sleepable build_id_parse() API") Reported-by: syzbot+09b7d050e4806540153d(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=09b7d050e4806540153d Signed-off-by: Shakeel Butt <shakeel.butt(a)linux.dev> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Cc: Alexei Starovoitov <ast(a)kernel.org> Cc: Andrii Nakryiko <andrii(a)kernel.org> Cc: Daniel Borkman <daniel(a)iogearbox.net> Cc: "Darrick J. Wong" <djwong(a)kernel.org> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/buildid.c | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-) --- a/lib/buildid.c~lib-buildid-use-__kernel_read-for-sleepable-context +++ a/lib/buildid.c @@ -5,6 +5,7 @@ #include <linux/elf.h> #include <linux/kernel.h> #include <linux/pagemap.h> +#include <linux/fs.h> #include <linux/secretmem.h> #define BUILD_ID 3 @@ -46,20 +47,9 @@ static int freader_get_folio(struct frea freader_put_folio(r); - /* reject secretmem folios created with memfd_secret() */ - if (secretmem_mapping(r->file->f_mapping)) - return -EFAULT; - + /* only use page cache lookup - fail if not already cached */ r->folio = filemap_get_folio(r->file->f_mapping, file_off >> PAGE_SHIFT); - /* if sleeping is allowed, wait for the page, if necessary */ - if (r->may_fault && (IS_ERR(r->folio) || !folio_test_uptodate(r->folio))) { - filemap_invalidate_lock_shared(r->file->f_mapping); - r->folio = read_cache_folio(r->file->f_mapping, file_off >> PAGE_SHIFT, - NULL, r->file); - filemap_invalidate_unlock_shared(r->file->f_mapping); - } - if (IS_ERR(r->folio) || !folio_test_uptodate(r->folio)) { if (!IS_ERR(r->folio)) folio_put(r->folio); @@ -97,6 +87,24 @@ const void *freader_fetch(struct freader return r->data + file_off; } + /* reject secretmem folios created with memfd_secret() */ + if (secretmem_mapping(r->file->f_mapping)) { + r->err = -EFAULT; + return NULL; + } + + /* use __kernel_read() for sleepable context */ + if (r->may_fault) { + ssize_t ret; + + ret = __kernel_read(r->file, r->buf, sz, &file_off); + if (ret != sz) { + r->err = (ret < 0) ? ret : -EIO; + return NULL; + } + return r->buf; + } + /* fetch or reuse folio for given file offset */ r->err = freader_get_folio(r, file_off); if (r->err) _ Patches currently in -mm which might be from shakeel.butt(a)linux.dev are mm-memcg-fix-unit-conversion-for-k-macro-in-oom-log.patch lib-buildid-use-__kernel_read-for-sleepable-context.patch

20 hours, 29 minutes

1
0
0 0

[PATCH] rapidio: fix a resource leak when rio_add_device() fails

by Haoxiang Li

If rio_add_device() fails, call rio_free_net() to unregister the net device registered by rio_add_net(). Fixes: e8de370188d0 ("rapidio: add mport char device driver") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- drivers/rapidio/devices/rio_mport_cdev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c index 995cfeca972b..4a804b4ad6f7 100644 --- a/drivers/rapidio/devices/rio_mport_cdev.c +++ b/drivers/rapidio/devices/rio_mport_cdev.c @@ -1789,6 +1789,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv, err = rio_add_device(rdev); if (err) { put_device(&rdev->dev); + rio_free_net(net); return err; } -- 2.25.1

21 hours, 52 minutes

3
2
0 0

[PATCH net v2] virtio-net: enable all napis before scheduling refill work

by Bui Quang Minh

Calling napi_disable() on an already disabled napi can cause the deadlock. In commit 4bc12818b363 ("virtio-net: disable delayed refill when pausing rx"), to avoid the deadlock, when pausing the RX in virtnet_rx_pause[_all](), we disable and cancel the delayed refill work. However, in the virtnet_rx_resume_all(), we enable the delayed refill work too early before enabling all the receive queue napis. The deadlock can be reproduced by running selftests/drivers/net/hw/xsk_reconfig.py with multiqueue virtio-net device and inserting a cond_resched() inside the for loop in virtnet_rx_resume_all() to increase the success rate. Because the worker processing the delayed refilled work runs on the same CPU as virtnet_rx_resume_all(), a reschedule is needed to cause the deadlock. In real scenario, the contention on netdev_lock can cause the reschedule. This fixes the deadlock by ensuring all receive queue's napis are enabled before we enable the delayed refill work in virtnet_rx_resume_all() and virtnet_open(). Fixes: 4bc12818b363 ("virtio-net: disable delayed refill when pausing rx") Reported-by: Paolo Abeni <pabeni(a)redhat.com> Closes: https://netdev-ctrl.bots.linux.dev/logs/vmksft/drv-hw-dbg/results/400961/3-… Cc: stable(a)vger.kernel.org Signed-off-by: Bui Quang Minh <minhquangbui99(a)gmail.com> --- Changes in v2: - Move try_fill_recv() before rx napi_enable() - Link to v1: https://lore.kernel.org/netdev/20251208153419.18196-1-minhquangbui99@gmail.… --- drivers/net/virtio_net.c | 71 +++++++++++++++++++++++++--------------- 1 file changed, 45 insertions(+), 26 deletions(-) diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 8e04adb57f52..4e08880a9467 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -3214,21 +3214,31 @@ static void virtnet_update_settings(struct virtnet_info *vi) static int virtnet_open(struct net_device *dev) { struct virtnet_info *vi = netdev_priv(dev); + bool schedule_refill = false; int i, err; - enable_delayed_refill(vi); - + /* - We must call try_fill_recv before enabling napi of the same receive + * queue so that it doesn't race with the call in virtnet_receive. + * - We must enable and schedule delayed refill work only when we have + * enabled all the receive queue's napi. Otherwise, in refill_work, we + * have a deadlock when calling napi_disable on an already disabled + * napi. + */ for (i = 0; i < vi->max_queue_pairs; i++) { if (i < vi->curr_queue_pairs) /* Make sure we have some buffers: if oom use wq. */ if (!try_fill_recv(vi, &vi->rq[i], GFP_KERNEL)) - schedule_delayed_work(&vi->refill, 0); + schedule_refill = true; err = virtnet_enable_queue_pair(vi, i); if (err < 0) goto err_enable_qp; } + enable_delayed_refill(vi); + if (schedule_refill) + schedule_delayed_work(&vi->refill, 0); + if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_STATUS)) { if (vi->status & VIRTIO_NET_S_LINK_UP) netif_carrier_on(vi->dev); @@ -3463,39 +3473,48 @@ static void virtnet_rx_pause(struct virtnet_info *vi, struct receive_queue *rq) __virtnet_rx_pause(vi, rq); } -static void __virtnet_rx_resume(struct virtnet_info *vi, - struct receive_queue *rq, - bool refill) +static void virtnet_rx_resume_all(struct virtnet_info *vi) { - bool running = netif_running(vi->dev); bool schedule_refill = false; + int i; - if (refill && !try_fill_recv(vi, rq, GFP_KERNEL)) - schedule_refill = true; - if (running) - virtnet_napi_enable(rq); - - if (schedule_refill) - schedule_delayed_work(&vi->refill, 0); -} + if (netif_running(vi->dev)) { + /* See the comment in virtnet_open for the ordering rule + * of try_fill_recv, receive queue napi_enable and delayed + * refill enable/schedule. + */ + for (i = 0; i < vi->max_queue_pairs; i++) { + if (i < vi->curr_queue_pairs) + if (!try_fill_recv(vi, &vi->rq[i], GFP_KERNEL)) + schedule_refill = true; -static void virtnet_rx_resume_all(struct virtnet_info *vi) -{ - int i; + virtnet_napi_enable(&vi->rq[i]); + } - enable_delayed_refill(vi); - for (i = 0; i < vi->max_queue_pairs; i++) { - if (i < vi->curr_queue_pairs) - __virtnet_rx_resume(vi, &vi->rq[i], true); - else - __virtnet_rx_resume(vi, &vi->rq[i], false); + enable_delayed_refill(vi); + if (schedule_refill) + schedule_delayed_work(&vi->refill, 0); } } static void virtnet_rx_resume(struct virtnet_info *vi, struct receive_queue *rq) { - enable_delayed_refill(vi); - __virtnet_rx_resume(vi, rq, true); + bool schedule_refill = false; + + if (netif_running(vi->dev)) { + /* See the comment in virtnet_open for the ordering rule + * of try_fill_recv, receive queue napi_enable and delayed + * refill enable/schedule. + */ + if (!try_fill_recv(vi, rq, GFP_KERNEL)) + schedule_refill = true; + + virtnet_napi_enable(rq); + + enable_delayed_refill(vi); + if (schedule_refill) + schedule_delayed_work(&vi->refill, 0); + } } static int virtnet_rx_resize(struct virtnet_info *vi, -- 2.43.0

21 hours, 53 minutes

4
7
0 0

[PATCH v2 0/2] fix demotion targets checks in reclaim/demotion

by Bing Jiao

This patch series addresses two issues in demote_folio_list() and can_demote() in reclaim/demotion. Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim") introduces the cpuset.mems_effective check and applies it to can_demote(). However: 1. It does not apply this check in demote_folio_list(), which leads to situations where pages are demoted to nodes that are explicitly excluded from the task's cpuset.mems. 2. It checks only the nodes in the immediate next demotion hierarchy and does not check all allowed demotion targets in can_demote(). This can cause pages to never be demoted if the nodes in the next demotion hierarchy are not set in mems_effective. To address these bugs, implement a new function mem_cgroup_filter_mems_allowed() to filter out nodes that are not set in mems_effective, and update demote_folio_list() and can_demote() accordingly. Reproduct Bug 1: Assume a system with 4 nodes, where nodes 0-1 are top-tier and nodes 2-3 are far-tier memory. All nodes have equal capacity. Test script to reproduct: echo 1 > /sys/kernel/mm/numa/demotion_enabled mkdir /sys/fs/cgroup/test echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control echo "0-2" > /sys/fs/cgroup/test/cpuset.mems echo $$ > /sys/fs/cgroup/test/cgroup.procs swapoff -a # Expectation: Should respect node 0-2 limit. # Observation: Node 3 shows significant allocation (MemFree drops) stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1 Reproduct Bug 2: Assume a system with 6 nodes, where nodes 0-2 are top-tier, node 3 is far-tier node, and nodes 4-5 are the farthest-tier nodes. All nodes have equal capacity. Test script: echo 1 > /sys/kernel/mm/numa/demotion_enabled mkdir /sys/fs/cgroup/test echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems echo $$ > /sys/fs/cgroup/test/cgroup.procs swapoff -a # Expectation: Pages are demoted to Nodes 4-5 # Observation: No pages are demoted before oom. stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2 Bing Jiao (2): mm/vmscan: respect mems_effective in demote_folio_list() mm/vmscan: check all allowed targets in can_demote() include/linux/cpuset.h | 6 +++--- include/linux/memcontrol.h | 6 +++--- kernel/cgroup/cpuset.c | 12 +++++------- mm/memcontrol.c | 5 +++-- mm/vmscan.c | 27 ++++++++++++++++++--------- 5 files changed, 32 insertions(+), 24 deletions(-) -- 2.52.0.351.gbe84eed79e-goog

22 hours, 46 minutes

3
9
0 0

[PATCH v2] virtio: console: fix lost wakeup when device is written and polled

by Lorenz Bauer

A process issuing blocking writes to a virtio console may get stuck indefinitely if another thread polls the device. Here is how to trigger the bug: - Thread A writes to the port until the virtqueue is full. - Thread A calls wait_port_writable() and goes to sleep, waiting on port->waitqueue. - The host processes some of the write, marks buffers as used and raises an interrupt. - Before the interrupt is serviced, thread B executes port_fops_poll(). This calls reclaim_consumed_buffers() via will_write_block() and consumes all used buffers. - The interrupt is serviced. vring_interrupt() finds no used buffers via more_used() and returns without waking port->waitqueue. - Thread A is still in wait_event(port->waitqueue), waiting for a wakeup that never arrives. The crux is that invoking reclaim_consumed_buffers() may cause vring_interrupt() to omit wakeups. Fix this by calling reclaim_consumed_buffers() in out_int() before waking. This is similar to the call to discard_port_data() in in_intr() which also frees buffer from a non-sleepable context. This in turn guarantees that port->outvq_full is up to date when handling polling. Since in_intr() already populates port->inbuf we use that to avoid changing reader state. Cc: stable(a)vger.kernel.org Signed-off-by: Lorenz Bauer <lmb(a)isovalent.com> --- As far as I can tell all currently maintained stable series kernels need this commit. Applies and builds cleanly on 5.10.247, verified to fix the issue. --- Changes in v2: - Call reclaim_consumed_buffers() in out_intr instead of issuing another wake. - Link to v1: https://lore.kernel.org/r/20251215-virtio-console-lost-wakeup-v1-1-79a5c578… --- drivers/char/virtio_console.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index 088182e54debd6029ea2c2a5542d7a28500e67b8..351e445da35e25910671615a8ecc79165dfc66b7 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -971,10 +971,17 @@ static __poll_t port_fops_poll(struct file *filp, poll_table *wait) return EPOLLHUP; } ret = 0; - if (!will_read_block(port)) + + spin_lock(&port->inbuf_lock); + if (port->inbuf) ret |= EPOLLIN | EPOLLRDNORM; - if (!will_write_block(port)) + spin_unlock(&port->inbuf_lock); + + spin_lock(&port->outvq_lock); + if (!port->outvq_full) ret |= EPOLLOUT; + spin_unlock(&port->outvq_lock); + if (!port->host_connected) ret |= EPOLLHUP; @@ -1698,6 +1705,7 @@ static void flush_bufs(struct virtqueue *vq, bool can_sleep) static void out_intr(struct virtqueue *vq) { struct port *port; + unsigned long flags; port = find_port_by_vq(vq->vdev->priv, vq); if (!port) { @@ -1705,6 +1713,10 @@ static void out_intr(struct virtqueue *vq) return; } + spin_lock_irqsave(&port->outvq_lock, flags); + reclaim_consumed_buffers(port); + spin_unlock_irqrestore(&port->outvq_lock, flags); + wake_up_interruptible(&port->waitqueue); } --- base-commit: d358e5254674b70f34c847715ca509e46eb81e6f change-id: 20251215-virtio-console-lost-wakeup-0f566c5cd35f Best regards, -- Lorenz Bauer <lmb(a)isovalent.com>

1 day

2
3
0 0

[PATCH v2] mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn

by Jane Chu

When a hugetlb folio is being poisoned again, try_memory_failure_hugetlb() passed head pfn to kill_accessing_process(), that is not right. The precise pfn of the poisoned page should be used in order to determine the precise vaddr as the SIGBUS payload. This issue has already been taken care of in the normal path, that is, hwpoison_user_mappings(), see [1][2]. Further more, for [3] to work correctly in the hugetlb repoisoning case, it's essential to inform VM the precise poisoned page, not the head page. [1] https://lkml.kernel.org/r/20231218135837.3310403-1-willy@infradead.org [2] https://lkml.kernel.org/r/20250224211445.2663312-1-jane.chu@oracle.com [3] https://lore.kernel.org/lkml/20251116013223.1557158-1-jiaqiyan@google.com/ Cc: <stable(a)vger.kernel.org> Signed-off-by: Jane Chu <jane.chu(a)oracle.com> Reviewed-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> --- v1 -> v2: pickup R-B, add stable to cc list. --- mm/memory-failure.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 3edebb0cda30..c9d87811b1ea 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -681,9 +681,11 @@ static void set_to_kill(struct to_kill *tk, unsigned long addr, short shift) } static int check_hwpoisoned_entry(pte_t pte, unsigned long addr, short shift, - unsigned long poisoned_pfn, struct to_kill *tk) + unsigned long poisoned_pfn, struct to_kill *tk, + int pte_nr) { unsigned long pfn = 0; + unsigned long hwpoison_vaddr; if (pte_present(pte)) { pfn = pte_pfn(pte); @@ -694,10 +696,11 @@ static int check_hwpoisoned_entry(pte_t pte, unsigned long addr, short shift, pfn = swp_offset_pfn(swp); } - if (!pfn || pfn != poisoned_pfn) + if (!pfn || (pfn > poisoned_pfn || (pfn + pte_nr - 1) < poisoned_pfn)) return 0; - set_to_kill(tk, addr, shift); + hwpoison_vaddr = addr + ((poisoned_pfn - pfn) << PAGE_SHIFT); + set_to_kill(tk, hwpoison_vaddr, shift); return 1; } @@ -749,7 +752,7 @@ static int hwpoison_pte_range(pmd_t *pmdp, unsigned long addr, for (; addr != end; ptep++, addr += PAGE_SIZE) { ret = check_hwpoisoned_entry(ptep_get(ptep), addr, PAGE_SHIFT, - hwp->pfn, &hwp->tk); + hwp->pfn, &hwp->tk, 1); if (ret == 1) break; } @@ -772,8 +775,8 @@ static int hwpoison_hugetlb_range(pte_t *ptep, unsigned long hmask, ptl = huge_pte_lock(h, walk->mm, ptep); pte = huge_ptep_get(walk->mm, addr, ptep); - ret = check_hwpoisoned_entry(pte, addr, huge_page_shift(h), - hwp->pfn, &hwp->tk); + ret = check_hwpoisoned_entry(pte, addr, huge_page_shift(h), hwp->pfn, + &hwp->tk, pages_per_huge_page(h)); spin_unlock(ptl); return ret; } @@ -2023,10 +2026,8 @@ static int try_memory_failure_hugetlb(unsigned long pfn, int flags, int *hugetlb *hugetlb = 0; return 0; } else if (res == -EHWPOISON) { - if (flags & MF_ACTION_REQUIRED) { - folio = page_folio(p); - res = kill_accessing_process(current, folio_pfn(folio), flags); - } + if (flags & MF_ACTION_REQUIRED) + res = kill_accessing_process(current, pfn, flags); action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); return res; } else if (res == -EBUSY) { @@ -2037,6 +2038,7 @@ static int try_memory_failure_hugetlb(unsigned long pfn, int flags, int *hugetlb return action_result(pfn, MF_MSG_GET_HWPOISON, MF_IGNORED); } + folio = page_folio(p); folio_lock(folio); -- 2.43.5

1 day

3
2
0 0

[PATCH] drm/msm/a6xx: fix bogus hwcg register updates

by Johan Hovold

The hw clock gating register sequence consists of register value pairs that are written to the GPU during initialisation. The a690 hwcg sequence has two GMU registers in it that used to amount to random writes in the GPU mapping, but since commit 188db3d7fe66 ("drm/msm/a6xx: Rebase GMU register offsets") they trigger a fault as the updated offsets now lie outside the mapping. This in turn breaks boot of machines like the Lenovo ThinkPad X13s. Note that the updates of these GMU registers is already taken care of properly since commit 40c297eb245b ("drm/msm/a6xx: Set GMU CGC properties on a6xx too"), but for some reason these two entries were left in the table. Fixes: 5e7665b5e484 ("drm/msm/adreno: Add Adreno A690 support") Cc: stable(a)vger.kernel.org # 6.5 Cc: Bjorn Andersson <andersson(a)kernel.org> Cc: Konrad Dybcio <konradybcio(a)kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c index 29107b362346..4c2f739ee9b7 100644 --- a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c +++ b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c @@ -501,8 +501,6 @@ static const struct adreno_reglist a690_hwcg[] = { {REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222}, {REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111}, {REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555}, - {REG_A6XX_GPU_GMU_AO_GMU_CGC_DELAY_CNTL, 0x10111}, - {REG_A6XX_GPU_GMU_AO_GMU_CGC_HYST_CNTL, 0x5555}, {} }; -- 2.51.2

1 day, 1 hour

3
2
0 0

[PATCH] misc: bcm-vk: validate entry_size before memcpy_fromio()

by Guangshuo Li

The driver trusts the 'num' and 'entry_size' fields read from BAR2 and uses them directly to compute the length for memcpy_fromio() without any bounds checking. If these fields get corrupted or otherwise contain invalid values, num * entry_size can exceed the size of proc_mon_info.entries and lead to a potential out-of-bounds write. Add validation for 'entry_size' by ensuring it is non-zero and that num * entry_size does not exceed the size of proc_mon_info.entries. Fixes: ff428d052b3b ("misc: bcm-vk: add get_card_info, peerlog_info, and proc_mon_info") Cc: stable(a)vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> --- drivers/misc/bcm-vk/bcm_vk_dev.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/misc/bcm-vk/bcm_vk_dev.c b/drivers/misc/bcm-vk/bcm_vk_dev.c index a16b99bdaa13..a4a74c10f02b 100644 --- a/drivers/misc/bcm-vk/bcm_vk_dev.c +++ b/drivers/misc/bcm-vk/bcm_vk_dev.c @@ -439,6 +439,7 @@ static void bcm_vk_get_proc_mon_info(struct bcm_vk *vk) struct device *dev = &vk->pdev->dev; struct bcm_vk_proc_mon_info *mon = &vk->proc_mon_info; u32 num, entry_size, offset, buf_size; + size_t max_bytes; u8 *dst; /* calculate offset which is based on peerlog offset */ @@ -458,6 +459,9 @@ static void bcm_vk_get_proc_mon_info(struct bcm_vk *vk) num, BCM_VK_PROC_MON_MAX); return; } + if (!entry_size || (size_t)num > max_bytes / entry_size) { + return; + } mon->num = num; mon->entry_size = entry_size; -- 2.43.0

1 day, 4 hours

2
1
0 0

[PATCH] virtio: console: fix lost wakeup when device is written and polled

by Lorenz Bauer

A process issuing blocking writes to a virtio console may get stuck indefinitely if another thread polls the device. Here is how to trigger the bug: - Thread A writes to the port until the virtqueue is full. - Thread A calls wait_port_writable() and goes to sleep, waiting on port->waitqueue. - The host processes some of the write, marks buffers as used and raises an interrupt. - Before the interrupt is serviced, thread B executes port_fops_poll(). This calls reclaim_consumed_buffers() via will_write_block() and consumes all used buffers. - The interrupt is serviced. vring_interrupt() finds no used buffers via more_used() and returns without waking port->waitqueue. - Thread A is still in wait_event(port->waitqueue), waiting for a wakeup that never arrives. The crux is that invoking reclaim_consumed_buffers() may cause vring_interrupt() to omit wakeups. Fix this by making reclaim_consumed_buffers() issue an additional wake up if it consumed any buffers. Signed-off-by: Lorenz Bauer <lmb(a)isovalent.com> --- As far as I can tell all currently maintained stable series kernels need this commit. I've tested that it applies cleanly to 5.10.247, however wasn't able to build the kernel due to an unrelated link error. Instead I applied it to 5.15.197, which compiled and verified to be fixed. --- drivers/char/virtio_console.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index 088182e54debd6029ea2c2a5542d7a28500e67b8..7cd3ad9da9b53a7a570410f12501acc7fd7e3b9b 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -581,6 +581,7 @@ static ssize_t send_control_msg(struct port *port, unsigned int event, static void reclaim_consumed_buffers(struct port *port) { struct port_buffer *buf; + bool freed = false; unsigned int len; if (!port->portdev) { @@ -589,7 +590,15 @@ static void reclaim_consumed_buffers(struct port *port) } while ((buf = virtqueue_get_buf(port->out_vq, &len))) { free_buf(buf, false); + freed = true; + } + if (freed) { + /* We freed all used buffers. Issue a wake up so that other pending + * tasks do not get stuck. This is necessary because vring_interrupt() + * will drop wakeups from the host if there are no used buffers. + */ port->outvq_full = false; + wake_up_interruptible(&port->waitqueue); } } --- base-commit: d358e5254674b70f34c847715ca509e46eb81e6f change-id: 20251215-virtio-console-lost-wakeup-0f566c5cd35f Best regards, -- Lorenz Bauer <lmb(a)isovalent.com>

1 day, 4 hours

3
4
0 0

[PATCH] x86/CPU/AMD: avoid printing reset reasons on Xen domU

by Ariadne Conill

Xen domU cannot access the given MMIO address for security reasons, resulting in a failed hypercall in ioremap() due to permissions. Fixes: ab8131028710 ("x86/CPU/AMD: Print the reason for the last reset") Signed-off-by: Ariadne Conill <ariadne(a)ariadne.space> Cc: xen-devel(a)lists.xenproject.org Cc: stable(a)vger.kernel.org --- arch/x86/kernel/cpu/amd.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index a6f88ca1a6b4..99308fba4d7d 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -29,6 +29,8 @@ # include <asm/mmconfig.h> #endif +#include <xen/xen.h> + #include "cpu.h" u16 invlpgb_count_max __ro_after_init = 1; @@ -1333,6 +1335,10 @@ static __init int print_s5_reset_status_mmio(void) if (!cpu_feature_enabled(X86_FEATURE_ZEN)) return 0; + /* Xen PV domU cannot access hardware directly, so bail for domU case */ + if (cpu_feature_enabled(X86_FEATURE_XENPV) && !xen_initial_domain()) + return 0; + addr = ioremap(FCH_PM_BASE + FCH_PM_S5_RESET_STATUS, sizeof(value)); if (!addr) return 0; -- 2.51.0

1 day, 5 hours

5
11
0 0

[PATCH v2] usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common

by Mario Limonciello (AMD)

Add missing null check for cci parameter before dereferencing it in ucsi_sync_control_common(). The function can be called with cci=NULL from ucsi_acknowledge(), which leads to a null pointer dereference when accessing *cci in the condition check. The crash occurs because the code checks if cci is not null before calling ucsi->ops->read_cci(ucsi, cci), but then immediately dereferences cci without a null check in the following condition: (*cci & UCSI_CCI_COMMAND_COMPLETE). KASAN trace: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:ucsi_sync_control_common+0x2ae/0x4e0 [typec_ucsi] Cc: stable(a)vger.kernel.org Fixes: 667ecac55861 ("usb: typec: ucsi: return CCI and message from sync_control callback") Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Signed-off-by: Mario Limonciello (AMD) <superm1(a)kernel.org> --- v2: * Add stable tag * Add Heikki's tag --- drivers/usb/typec/ucsi/ucsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c index 9b3df776137a1..7129973f19e7e 100644 --- a/drivers/usb/typec/ucsi/ucsi.c +++ b/drivers/usb/typec/ucsi/ucsi.c @@ -97,7 +97,7 @@ int ucsi_sync_control_common(struct ucsi *ucsi, u64 command, u32 *cci) if (!ret && cci) ret = ucsi->ops->read_cci(ucsi, cci); - if (!ret && ucsi->message_in_size > 0 && + if (!ret && cci && ucsi->message_in_size > 0 && (*cci & UCSI_CCI_COMMAND_COMPLETE)) ret = ucsi->ops->read_message_in(ucsi, ucsi->message_in, ucsi->message_in_size); -- 2.43.0

1 day, 5 hours

2
1
0 0

[PATCH net v3] net: nfc: nci: Fix parameter validation for packet data

by Michael Thalmeier

Since commit 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") communication with nci nfc chips is not working any more. The mentioned commit tries to fix access of uninitialized data, but failed to understand that in some cases the data packet is of variable length and can therefore not be compared to the maximum packet length given by the sizeof(struct). Fixes: 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") Cc: stable(a)vger.kernel.org Signed-off-by: Michael Thalmeier <michael.thalmeier(a)hale.at> --- v3: - perform complete checks - replace magic numbers with offsetofend and sizeof v2: - Reference correct commit hash --- net/nfc/nci/ntf.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c index 418b84e2b260..0190332cf454 100644 --- a/net/nfc/nci/ntf.c +++ b/net/nfc/nci/ntf.c @@ -58,7 +58,7 @@ static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, struct nci_conn_info *conn_info; int i; - if (skb->len < sizeof(struct nci_core_conn_credit_ntf)) + if (skb->len < offsetofend(struct nci_core_conn_credit_ntf, num_entries)) return -EINVAL; ntf = (struct nci_core_conn_credit_ntf *)skb->data; @@ -68,6 +68,10 @@ static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, if (ntf->num_entries > NCI_MAX_NUM_CONN) ntf->num_entries = NCI_MAX_NUM_CONN; + if (skb->len < offsetofend(struct nci_core_conn_credit_ntf, num_entries) + + ntf->num_entries * sizeof(struct conn_credit_entry)) + return -EINVAL; + /* update the credits */ for (i = 0; i < ntf->num_entries; i++) { ntf->conn_entries[i].conn_id = @@ -364,7 +368,7 @@ static int nci_rf_discover_ntf_packet(struct nci_dev *ndev, const __u8 *data; bool add_target = true; - if (skb->len < sizeof(struct nci_rf_discover_ntf)) + if (skb->len < offsetofend(struct nci_rf_discover_ntf, rf_tech_specific_params_len)) return -EINVAL; data = skb->data; @@ -380,6 +384,10 @@ static int nci_rf_discover_ntf_packet(struct nci_dev *ndev, pr_debug("rf_tech_specific_params_len %d\n", ntf.rf_tech_specific_params_len); + if (skb->len < (data - skb->data) + + ntf.rf_tech_specific_params_len + sizeof(ntf.ntf_type)) + return -EINVAL; + if (ntf.rf_tech_specific_params_len > 0) { switch (ntf.rf_tech_and_mode) { case NCI_NFC_A_PASSIVE_POLL_MODE: @@ -596,7 +604,7 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, const __u8 *data; int err = NCI_STATUS_OK; - if (skb->len < sizeof(struct nci_rf_intf_activated_ntf)) + if (skb->len < offsetofend(struct nci_rf_intf_activated_ntf, rf_tech_specific_params_len)) return -EINVAL; data = skb->data; @@ -628,6 +636,9 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, if (ntf.rf_interface == NCI_RF_INTERFACE_NFCEE_DIRECT) goto listen; + if (skb->len < (data - skb->data) + ntf.rf_tech_specific_params_len) + return -EINVAL; + if (ntf.rf_tech_specific_params_len > 0) { switch (ntf.activation_rf_tech_and_mode) { case NCI_NFC_A_PASSIVE_POLL_MODE: @@ -668,6 +679,11 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, } } + if (skb->len < (data - skb->data) + sizeof(ntf.data_exch_rf_tech_and_mode) + + sizeof(ntf.data_exch_tx_bit_rate) + sizeof (ntf.data_exch_rx_bit_rate) + + sizeof(ntf.activation_params_len)) + return -EINVAL; + ntf.data_exch_rf_tech_and_mode = *data++; ntf.data_exch_tx_bit_rate = *data++; ntf.data_exch_rx_bit_rate = *data++; @@ -679,6 +695,9 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, pr_debug("data_exch_rx_bit_rate 0x%x\n", ntf.data_exch_rx_bit_rate); pr_debug("activation_params_len %d\n", ntf.activation_params_len); + if (skb->len < (data - skb->data) + ntf.activation_params_len) + return -EINVAL; + if (ntf.activation_params_len > 0) { switch (ntf.rf_interface) { case NCI_RF_INTERFACE_ISO_DEP: -- 2.52.0

1 day, 5 hours

2
1
0 0

[PATCH] ocfs2: Add check for total number of chains in chain list

by Prithvi Tambewagh

The functions ocfs2_reserve_suballoc_bits(), ocfs2_block_group_alloc(), ocfs2_block_group_alloc_contig() and ocfs2_find_smallest_chain() trust the on-disk values related to the allocation chain. However, KASAN bug was triggered in these functions, and the kernel panicked when accessing redzoned memory. This occurred due to the corrupted value of `cl_count` field of `struct ocfs2_chain_list`. Upon analysis, the value of `cl_count` was observed to be overwhemingly large, due to which the code accessed redzoned memory. The fix introduces an if statement which validates value of `cl_count` (both lower and upper bounds). Lower bound check ensures the value of `cl_count` is not zero and upper bound check ensures that the value of `cl_count` is in the range such that it has a value less than the total size of struct ocfs2_chain_list and maximum number of chains that can be present, so as to fill one block. Reported-by: syzbot+af14efe17dfa46173239(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=af14efe17dfa46173239 Tested-by: syzbot+af14efe17dfa46173239(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Signed-off-by: Prithvi Tambewagh <activprithvi(a)gmail.com> --- fs/ocfs2/suballoc.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c index f7b483f0de2a..7ea63e9cc4f8 100644 --- a/fs/ocfs2/suballoc.c +++ b/fs/ocfs2/suballoc.c @@ -671,6 +671,21 @@ static int ocfs2_block_group_alloc(struct ocfs2_super *osb, BUG_ON(ocfs2_is_cluster_bitmap(alloc_inode)); cl = &fe->id2.i_chain; + unsigned int block_size = osb->sb->s_blocksize; + unsigned int max_cl_count = + (block_size - offsetof(struct ocfs2_chain_list, cl_recs)) / + sizeof(struct ocfs2_chain_rec); + + if (!le16_to_cpu(cl->cl_count) || + le16_to_cpu(cl->cl_count) > max_cl_count) { + ocfs2_error(osb->sb, + "Invalid chain list: cl_count %u " + "exceeds max %u", + le16_to_cpu(cl->cl_count), max_cl_count); + status = -EIO; + goto bail; + } + status = ocfs2_reserve_clusters_with_limit(osb, le16_to_cpu(cl->cl_cpg), max_block, flags, &ac); base-commit: 36c254515dc6592c44db77b84908358979dd6b50 -- 2.34.1

1 day, 5 hours

2
1
0 0

[PATCH v6 05/14] reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime

by Tommaso Merciai

The driver was disabling the USB2 PHY clock immediately after register initialization in probe() and after each reset operation. This left the PHY unclocked even though it must remain active for USB functionality. The behavior appeared to work only when another driver (e.g., USB controller) had already enabled the clock, making operation unreliable and hardware-dependent. In configurations where this driver is the sole clock user, USB functionality would fail. Fix this by: - Enabling the clock once in probe() via pm_runtime_resume_and_get() - Removing all pm_runtime_put() calls from assert/deassert/status - Registering a devm cleanup action to release the clock at removal - Removed rzv2h_usbphy_assert_helper() and its call in rzv2h_usb2phy_reset_probe() This ensures the PHY clock remains enabled for the entire device lifetime, preventing instability and aligning with hardware requirements. Cc: stable(a)vger.kernel.org Fixes: e3911d7f865b ("reset: Add USB2PHY port reset driver for Renesas RZ/V2H(P)") Signed-off-by: Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> --- v5->v6: - No changes v4->v5: - No changes. v3->v4: - No changes. v2->v3: - Added missing Cc: stable(a)vger.kernel.org - Improved commit body describing the removal of rzv2h_usbphy_assert_helper() from rzv2h_usb2phy_reset_probe(). v1->v2: - Improve commit body and commit msg - Added Fixes tag - Dropped unnecessary rzv2h_usbphy_assert_helper() function drivers/reset/reset-rzv2h-usb2phy.c | 64 ++++++++--------------------- 1 file changed, 18 insertions(+), 46 deletions(-) diff --git a/drivers/reset/reset-rzv2h-usb2phy.c b/drivers/reset/reset-rzv2h-usb2phy.c index ae643575b067..5bdd39274612 100644 --- a/drivers/reset/reset-rzv2h-usb2phy.c +++ b/drivers/reset/reset-rzv2h-usb2phy.c @@ -49,9 +49,10 @@ static inline struct rzv2h_usb2phy_reset_priv return container_of(rcdev, struct rzv2h_usb2phy_reset_priv, rcdev); } -/* This function must be called only after pm_runtime_resume_and_get() has been called */ -static void rzv2h_usbphy_assert_helper(struct rzv2h_usb2phy_reset_priv *priv) +static int rzv2h_usbphy_reset_assert(struct reset_controller_dev *rcdev, + unsigned long id) { + struct rzv2h_usb2phy_reset_priv *priv = rzv2h_usbphy_rcdev_to_priv(rcdev); const struct rzv2h_usb2phy_reset_of_data *data = priv->data; scoped_guard(spinlock, &priv->lock) { @@ -60,24 +61,6 @@ static void rzv2h_usbphy_assert_helper(struct rzv2h_usb2phy_reset_priv *priv) } usleep_range(11, 20); -} - -static int rzv2h_usbphy_reset_assert(struct reset_controller_dev *rcdev, - unsigned long id) -{ - struct rzv2h_usb2phy_reset_priv *priv = rzv2h_usbphy_rcdev_to_priv(rcdev); - struct device *dev = priv->dev; - int ret; - - ret = pm_runtime_resume_and_get(dev); - if (ret) { - dev_err(dev, "pm_runtime_resume_and_get failed\n"); - return ret; - } - - rzv2h_usbphy_assert_helper(priv); - - pm_runtime_put(dev); return 0; } @@ -87,14 +70,6 @@ static int rzv2h_usbphy_reset_deassert(struct reset_controller_dev *rcdev, { struct rzv2h_usb2phy_reset_priv *priv = rzv2h_usbphy_rcdev_to_priv(rcdev); const struct rzv2h_usb2phy_reset_of_data *data = priv->data; - struct device *dev = priv->dev; - int ret; - - ret = pm_runtime_resume_and_get(dev); - if (ret) { - dev_err(dev, "pm_runtime_resume_and_get failed\n"); - return ret; - } scoped_guard(spinlock, &priv->lock) { writel(data->reset_deassert_val, priv->base + data->reset_reg); @@ -102,8 +77,6 @@ static int rzv2h_usbphy_reset_deassert(struct reset_controller_dev *rcdev, writel(data->reset_release_val, priv->base + data->reset_reg); } - pm_runtime_put(dev); - return 0; } @@ -111,20 +84,10 @@ static int rzv2h_usbphy_reset_status(struct reset_controller_dev *rcdev, unsigned long id) { struct rzv2h_usb2phy_reset_priv *priv = rzv2h_usbphy_rcdev_to_priv(rcdev); - struct device *dev = priv->dev; - int ret; u32 reg; - ret = pm_runtime_resume_and_get(dev); - if (ret) { - dev_err(dev, "pm_runtime_resume_and_get failed\n"); - return ret; - } - reg = readl(priv->base + priv->data->reset_reg); - pm_runtime_put(dev); - return (reg & priv->data->reset_status_bits) == priv->data->reset_status_bits; } @@ -141,6 +104,11 @@ static int rzv2h_usb2phy_reset_of_xlate(struct reset_controller_dev *rcdev, return 0; } +static void rzv2h_usb2phy_reset_pm_runtime_put(void *data) +{ + pm_runtime_put(data); +} + static int rzv2h_usb2phy_reset_probe(struct platform_device *pdev) { const struct rzv2h_usb2phy_reset_of_data *data; @@ -175,14 +143,14 @@ static int rzv2h_usb2phy_reset_probe(struct platform_device *pdev) if (error) return dev_err_probe(dev, error, "pm_runtime_resume_and_get failed\n"); + error = devm_add_action_or_reset(dev, rzv2h_usb2phy_reset_pm_runtime_put, + dev); + if (error) + return dev_err_probe(dev, error, "unable to register cleanup action\n"); + for (unsigned int i = 0; i < data->init_val_count; i++) writel(data->init_vals[i].val, priv->base + data->init_vals[i].reg); - /* keep usb2phy in asserted state */ - rzv2h_usbphy_assert_helper(priv); - - pm_runtime_put(dev); - priv->rcdev.ops = &rzv2h_usbphy_reset_ops; priv->rcdev.of_reset_n_cells = 0; priv->rcdev.nr_resets = 1; @@ -190,7 +158,11 @@ static int rzv2h_usb2phy_reset_probe(struct platform_device *pdev) priv->rcdev.of_node = dev->of_node; priv->rcdev.dev = dev; - return devm_reset_controller_register(dev, &priv->rcdev); + error = devm_reset_controller_register(dev, &priv->rcdev); + if (error) + return dev_err_probe(dev, error, "could not register reset controller\n"); + + return 0; } /* -- 2.43.0

1 day, 7 hours

1
0
0 0

[PATCH] arm64: dts: rockchip: fix unit-address for RK3588 NPU's core1 and core2's IOMMU

by Quentin Schulz

From: Quentin Schulz <quentin.schulz(a)cherry.de> The Device Tree specification specifies[1] that """ Each node in the devicetree is named according to the following convention: node-name@unit-address [...] The unit-address must match the first address specified in the reg property of the node. """ The first address in the reg property is fdaXa000 and not fdaX9000. This is likely a copy-paste error as the IOMMU for core0 has two entries in the reg property, the first one being fdab9000 and the second fdaba000. Let's fix this oversight to match what the spec is expecting. [1] https://github.com/devicetree-org/devicetree-specification/releases/downloa… 2.2.1 Node Names Fixes: a31dfc060a74 ("arm64: dts: rockchip: Add nodes for NPU and its MMU to rk3588-base") Cc: stable(a)vger.kernel.org Signed-off-by: Quentin Schulz <quentin.schulz(a)cherry.de> --- arch/arm64/boot/dts/rockchip/rk3588-base.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi index 2a79217930206..7ab12d1054a73 100644 --- a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi +++ b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi @@ -1200,7 +1200,7 @@ rknn_core_1: npu@fdac0000 { status = "disabled"; }; - rknn_mmu_1: iommu@fdac9000 { + rknn_mmu_1: iommu@fdaca000 { compatible = "rockchip,rk3588-iommu", "rockchip,rk3568-iommu"; reg = <0x0 0xfdaca000 0x0 0x100>; interrupts = <GIC_SPI 111 IRQ_TYPE_LEVEL_HIGH 0>; @@ -1230,7 +1230,7 @@ rknn_core_2: npu@fdad0000 { status = "disabled"; }; - rknn_mmu_2: iommu@fdad9000 { + rknn_mmu_2: iommu@fdada000 { compatible = "rockchip,rk3588-iommu", "rockchip,rk3568-iommu"; reg = <0x0 0xfdada000 0x0 0x100>; interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH 0>; --- base-commit: a619746d25c8adafe294777cc98c47a09759b3ed change-id: 20251215-npu-dt-node-address-7bfeab42dae9 Best regards, -- Quentin Schulz <quentin.schulz(a)cherry.de>

1 day, 7 hours

2
1
0 0

[PATCH v2 4/6] Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported"

by Niklas Cassel

This reverts commit ba4a2e2317b9faeca9193ed6d3193ddc3cf2aba3. While this fake hotplugging was a nice idea, it has shown that this feature does not handle PCIe switches correctly: pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43 pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44 pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45 pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46 pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46 pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41]) pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46 During the initial scan, PCI core doesn't see the switch and since the Root Port is not hot plug capable, the secondary bus number gets assigned as the subordinate bus number. This means, the PCI core assumes that only one bus will appear behind the Root Port since the Root Port is not hot plug capable. This works perfectly fine for PCIe endpoints connected to the Root Port, since they don't extend the bus. However, if a PCIe switch is connected, then there is a problem when the downstream busses starts showing up and the PCI core doesn't extend the subordinate bus number after initial scan during boot. The long term plan is to migrate this driver to the pwrctrl framework, once it adds proper support for powering up and enumerating PCIe switches. Cc: stable(a)vger.kernel.org Suggested-by: Manivannan Sadhasivam <mani(a)kernel.org> Acked-by: Shawn Lin <shawn.lin(a)rock-chips.com> Tested-by: Shawn Lin <shawn.lin(a)rock-chips.com> Signed-off-by: Niklas Cassel <cassel(a)kernel.org> --- drivers/pci/controller/dwc/pcie-qcom.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c index e87ec6779d44..c5fcb87972e9 100644 --- a/drivers/pci/controller/dwc/pcie-qcom.c +++ b/drivers/pci/controller/dwc/pcie-qcom.c @@ -136,7 +136,6 @@ /* PARF_INT_ALL_{STATUS/CLEAR/MASK} register fields */ #define PARF_INT_ALL_LINK_UP BIT(13) -#define PARF_INT_MSI_DEV_0_7 GENMASK(30, 23) /* PARF_NO_SNOOP_OVERRIDE register fields */ #define WR_NO_SNOOP_OVERRIDE_EN BIT(1) @@ -1982,8 +1981,7 @@ static int qcom_pcie_probe(struct platform_device *pdev) goto err_host_deinit; } - writel_relaxed(PARF_INT_ALL_LINK_UP | PARF_INT_MSI_DEV_0_7, - pcie->parf + PARF_INT_ALL_MASK); + writel_relaxed(PARF_INT_ALL_LINK_UP, pcie->parf + PARF_INT_ALL_MASK); } qcom_pcie_icc_opp_update(pcie); -- 2.52.0

1 day, 9 hours

3
3
0 0

[PATCH v2 5/6] Revert "PCI: qcom: Enumerate endpoints based on Link up event in 'global_irq' interrupt"

by Niklas Cassel

This reverts commit 4581403f67929d02c197cb187c4e1e811c9e762a. While this fake hotplugging was a nice idea, it has shown that this feature does not handle PCIe switches correctly: pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43 pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44 pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45 pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46 pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46 pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41]) pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46 During the initial scan, PCI core doesn't see the switch and since the Root Port is not hot plug capable, the secondary bus number gets assigned as the subordinate bus number. This means, the PCI core assumes that only one bus will appear behind the Root Port since the Root Port is not hot plug capable. This works perfectly fine for PCIe endpoints connected to the Root Port, since they don't extend the bus. However, if a PCIe switch is connected, then there is a problem when the downstream busses starts showing up and the PCI core doesn't extend the subordinate bus number after initial scan during boot. The long term plan is to migrate this driver to the pwrctrl framework, once it adds proper support for powering up and enumerating PCIe switches. Cc: stable(a)vger.kernel.org Suggested-by: Manivannan Sadhasivam <mani(a)kernel.org> Acked-by: Shawn Lin <shawn.lin(a)rock-chips.com> Tested-by: Shawn Lin <shawn.lin(a)rock-chips.com> Signed-off-by: Niklas Cassel <cassel(a)kernel.org> --- drivers/pci/controller/dwc/pcie-qcom.c | 58 +------------------------- 1 file changed, 1 insertion(+), 57 deletions(-) diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c index c5fcb87972e9..13e6c334e10d 100644 --- a/drivers/pci/controller/dwc/pcie-qcom.c +++ b/drivers/pci/controller/dwc/pcie-qcom.c @@ -55,9 +55,6 @@ #define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1a8 #define PARF_Q2A_FLUSH 0x1ac #define PARF_LTSSM 0x1b0 -#define PARF_INT_ALL_STATUS 0x224 -#define PARF_INT_ALL_CLEAR 0x228 -#define PARF_INT_ALL_MASK 0x22c #define PARF_SID_OFFSET 0x234 #define PARF_BDF_TRANSLATE_CFG 0x24c #define PARF_DBI_BASE_ADDR_V2 0x350 @@ -134,9 +131,6 @@ /* PARF_LTSSM register fields */ #define LTSSM_EN BIT(8) -/* PARF_INT_ALL_{STATUS/CLEAR/MASK} register fields */ -#define PARF_INT_ALL_LINK_UP BIT(13) - /* PARF_NO_SNOOP_OVERRIDE register fields */ #define WR_NO_SNOOP_OVERRIDE_EN BIT(1) #define RD_NO_SNOOP_OVERRIDE_EN BIT(3) @@ -1635,32 +1629,6 @@ static void qcom_pcie_init_debugfs(struct qcom_pcie *pcie) qcom_pcie_link_transition_count); } -static irqreturn_t qcom_pcie_global_irq_thread(int irq, void *data) -{ - struct qcom_pcie *pcie = data; - struct dw_pcie_rp *pp = &pcie->pci->pp; - struct device *dev = pcie->pci->dev; - u32 status = readl_relaxed(pcie->parf + PARF_INT_ALL_STATUS); - - writel_relaxed(status, pcie->parf + PARF_INT_ALL_CLEAR); - - if (FIELD_GET(PARF_INT_ALL_LINK_UP, status)) { - msleep(PCIE_RESET_CONFIG_WAIT_MS); - dev_dbg(dev, "Received Link up event. Starting enumeration!\n"); - /* Rescan the bus to enumerate endpoint devices */ - pci_lock_rescan_remove(); - pci_rescan_bus(pp->bridge->bus); - pci_unlock_rescan_remove(); - - qcom_pcie_icc_opp_update(pcie); - } else { - dev_WARN_ONCE(dev, 1, "Received unknown event. INT_STATUS: 0x%08x\n", - status); - } - - return IRQ_HANDLED; -} - static void qcom_pci_free_msi(void *ptr) { struct dw_pcie_rp *pp = (struct dw_pcie_rp *)ptr; @@ -1805,8 +1773,7 @@ static int qcom_pcie_probe(struct platform_device *pdev) struct dw_pcie_rp *pp; struct resource *res; struct dw_pcie *pci; - int ret, irq; - char *name; + int ret; pcie_cfg = of_device_get_match_data(dev); if (!pcie_cfg) { @@ -1963,27 +1930,6 @@ static int qcom_pcie_probe(struct platform_device *pdev) goto err_phy_exit; } - name = devm_kasprintf(dev, GFP_KERNEL, "qcom_pcie_global_irq%d", - pci_domain_nr(pp->bridge->bus)); - if (!name) { - ret = -ENOMEM; - goto err_host_deinit; - } - - irq = platform_get_irq_byname_optional(pdev, "global"); - if (irq > 0) { - ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, - qcom_pcie_global_irq_thread, - IRQF_ONESHOT, name, pcie); - if (ret) { - dev_err_probe(&pdev->dev, ret, - "Failed to request Global IRQ\n"); - goto err_host_deinit; - } - - writel_relaxed(PARF_INT_ALL_LINK_UP, pcie->parf + PARF_INT_ALL_MASK); - } - qcom_pcie_icc_opp_update(pcie); if (pcie->mhi) @@ -1991,8 +1937,6 @@ static int qcom_pcie_probe(struct platform_device *pdev) return 0; -err_host_deinit: - dw_pcie_host_deinit(pp); err_phy_exit: list_for_each_entry_safe(port, tmp, &pcie->ports, list) { phy_exit(port->phy); -- 2.52.0

1 day, 9 hours

3
3
0 0

[PATCH V4 1/8] mm/slab: use unsigned long for orig_size to ensure proper metadata align

by Harry Yoo

When both KASAN and SLAB_STORE_USER are enabled, accesses to struct kasan_alloc_meta fields can be misaligned on 64-bit architectures. This occurs because orig_size is currently defined as unsigned int, which only guarantees 4-byte alignment. When struct kasan_alloc_meta is placed after orig_size, it may end up at a 4-byte boundary rather than the required 8-byte boundary on 64-bit systems. Note that 64-bit architectures without HAVE_EFFICIENT_UNALIGNED_ACCESS are assumed to require 64-bit accesses to be 64-bit aligned. See HAVE_64BIT_ALIGNED_ACCESS and commit adab66b71abf ("Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"") for more details. Change orig_size from unsigned int to unsigned long to ensure proper alignment for any subsequent metadata. This should not waste additional memory because kmalloc objects are already aligned to at least ARCH_KMALLOC_MINALIGN. Suggested-by: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> Cc: stable(a)vger.kernel.org Fixes: 6edf2576a6cc ("mm/slub: enable debugging memory wasting of kmalloc") Signed-off-by: Harry Yoo <harry.yoo(a)oracle.com> --- mm/slub.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index ad71f01571f0..1c747435a6ab 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -857,7 +857,7 @@ static inline bool slab_update_freelist(struct kmem_cache *s, struct slab *slab, * request size in the meta data area, for better debug and sanity check. */ static inline void set_orig_size(struct kmem_cache *s, - void *object, unsigned int orig_size) + void *object, unsigned long orig_size) { void *p = kasan_reset_tag(object); @@ -867,10 +867,10 @@ static inline void set_orig_size(struct kmem_cache *s, p += get_info_end(s); p += sizeof(struct track) * 2; - *(unsigned int *)p = orig_size; + *(unsigned long *)p = orig_size; } -static inline unsigned int get_orig_size(struct kmem_cache *s, void *object) +static inline unsigned long get_orig_size(struct kmem_cache *s, void *object) { void *p = kasan_reset_tag(object); @@ -883,7 +883,7 @@ static inline unsigned int get_orig_size(struct kmem_cache *s, void *object) p += get_info_end(s); p += sizeof(struct track) * 2; - return *(unsigned int *)p; + return *(unsigned long *)p; } #ifdef CONFIG_SLUB_DEBUG @@ -1198,7 +1198,7 @@ static void print_trailer(struct kmem_cache *s, struct slab *slab, u8 *p) off += 2 * sizeof(struct track); if (slub_debug_orig_size(s)) - off += sizeof(unsigned int); + off += sizeof(unsigned long); off += kasan_metadata_size(s, false); @@ -1394,7 +1394,7 @@ static int check_pad_bytes(struct kmem_cache *s, struct slab *slab, u8 *p) off += 2 * sizeof(struct track); if (s->flags & SLAB_KMALLOC) - off += sizeof(unsigned int); + off += sizeof(unsigned long); } off += kasan_metadata_size(s, false); @@ -7949,7 +7949,7 @@ static int calculate_sizes(struct kmem_cache_args *args, struct kmem_cache *s) /* Save the original kmalloc request size */ if (flags & SLAB_KMALLOC) - size += sizeof(unsigned int); + size += sizeof(unsigned long); } #endif -- 2.43.0

1 day, 9 hours

1
0
0 0

[PATCH v2 4/4] mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather

by David Hildenbrand (Red Hat)

As reported, ever since commit 1013af4f585f ("mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race") we can end up in some situations where we perform so many IPI broadcasts when unsharing hugetlb PMD page tables that it severely regresses some workloads. In particular, when we fork()+exit(), or when we munmap() a large area backed by many shared PMD tables, we perform one IPI broadcast per unshared PMD table. There are two optimizations to be had: (1) When we process (unshare) multiple such PMD tables, such as during exit(), it is sufficient to send a single IPI broadcast (as long as we respect locking rules) instead of one per PMD table. Locking prevents that any of these PMD tables could get reuse before we drop the lock. (2) When we are not the last sharer (> 2 users including us), there is no need to send the IPI broadcast. The shared PMD tables cannot become exclusive (fully unshared) before an IPI will be broadcasted by the last sharer. Concurrent GUP-fast could walk into a PMD table just before we unshared it. It could then succeed in grabbing a page from the shared page table even after munmap() etc succeeded (and supressed an IPI). But there is not difference compared to GUP-fast just sleeping for a while after grabbing the page and re-enabling IRQs. Most importantly, GUP-fast will never walk into page tables that are no-longer shared, because the last sharer will issue an IPI broadcast. (if ever required, checking whether the PUD changed in GUP-fast after grabbing the page like we do in the PTE case could handle this) So let's rework PMD sharing TLB flushing + IPI sync to use the mmu_gather infrastructure so we can implement these optimizations and demystify the code at least a bit. Extend the mmu_gather infrastructure to be able to deal with our special hugetlb PMD table sharing implementation. We'll consolidate the handling for (full) unsharing of PMD tables in tlb_unshare_pmd_ptdesc() and tlb_flush_unshared_tables(), and track in "struct mmu_gather" whether we had (full) unsharing of PMD tables. Because locking is very special (concurrent unsharing+reuse must be prevented), we disallow deferring flushing to tlb_finish_mmu() and instead require an explicit earlier call to tlb_flush_unshared_tables(). From hugetlb code, we call huge_pmd_unshare_flush() where we make sure that the expected lock protecting us from concurrent unsharing+reuse is still held. Check with a VM_WARN_ON_ONCE() in tlb_finish_mmu() that tlb_flush_unshared_tables() was properly called earlier. Document it all properly. Notes about tlb_remove_table_sync_one() interaction with unsharing: There are two fairly tricky things: (1) tlb_remove_table_sync_one() is a NOP on architectures without CONFIG_MMU_GATHER_RCU_TABLE_FREE. Here, the assumption is that the previous TLB flush would send an IPI to all relevant CPUs. Careful: some architectures like x86 only send IPIs to all relevant CPUs when tlb->freed_tables is set. The relevant architectures should be selecting MMU_GATHER_RCU_TABLE_FREE, but x86 might not do that in stable kernels and it might have been problematic before this patch. Also, the arch flushing behavior (independent of IPIs) is different when tlb->freed_tables is set. Do we have to enlighten them to also take care of tlb->unshared_tables? So far we didn't care, so hopefully we are fine. Of course, we could be setting tlb->freed_tables as well, but that might then unnecessarily flush too much, because the semantics of tlb->freed_tables are a bit fuzzy. This patch changes nothing in this regard. (2) tlb_remove_table_sync_one() is not a NOP on architectures with CONFIG_MMU_GATHER_RCU_TABLE_FREE that actually don't need a sync. Take x86 as an example: in the common case (!pv, !X86_FEATURE_INVLPGB) we still issue IPIs during TLB flushes and don't actually need the second tlb_remove_table_sync_one(). This optimized can be implemented on top of this, by checking e.g., in tlb_remove_table_sync_one() whether we really need IPIs. But as described in (1), it really must honor tlb->freed_tables then to send IPIs to all relevant CPUs. Further note that the ptdesc_pmd_pts_dec() in huge_pmd_share() is not a concern, as we are holding the i_mmap_lock the whole time, preventing concurrent unsharing. That ptdesc_pmd_pts_dec() usage will be removed separately as a cleanup later. There are plenty more cleanups to be had, but they have to wait until this is fixed. Fixes: 1013af4f585f ("mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race") Reported-by: Uschakow, Stanislav" <suschako(a)amazon.de> Closes: https://lore.kernel.org/all/4d3878531c76479d9f8ca9789dc6485d@amazon.de/ Tested-by: Laurence Oberman <loberman(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: David Hildenbrand (Red Hat) <david(a)kernel.org> --- include/asm-generic/tlb.h | 74 ++++++++++++++++++++++- include/linux/hugetlb.h | 19 +++--- mm/hugetlb.c | 121 ++++++++++++++++++++++---------------- mm/mmu_gather.c | 7 +++ mm/mprotect.c | 2 +- mm/rmap.c | 25 +++++--- 6 files changed, 179 insertions(+), 69 deletions(-) diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h index 1fff717cae510..706416babb3d6 100644 --- a/include/asm-generic/tlb.h +++ b/include/asm-generic/tlb.h @@ -364,6 +364,20 @@ struct mmu_gather { unsigned int vma_huge : 1; unsigned int vma_pfn : 1; + /* + * Did we unshare (unmap) any shared page tables? For now only + * used for hugetlb PMD table sharing. + */ + unsigned int unshared_tables : 1; + + /* + * Did we unshare any page tables such that they are now exclusive + * and could get reused+modified by the new owner? When setting this + * flag, "unshared_tables" will be set as well. For now only used + * for hugetlb PMD table sharing. + */ + unsigned int fully_unshared_tables : 1; + unsigned int batch_count; #ifndef CONFIG_MMU_GATHER_NO_GATHER @@ -400,6 +414,7 @@ static inline void __tlb_reset_range(struct mmu_gather *tlb) tlb->cleared_pmds = 0; tlb->cleared_puds = 0; tlb->cleared_p4ds = 0; + tlb->unshared_tables = 0; /* * Do not reset mmu_gather::vma_* fields here, we do not * call into tlb_start_vma() again to set them if there is an @@ -484,7 +499,7 @@ static inline void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb) * these bits. */ if (!(tlb->freed_tables || tlb->cleared_ptes || tlb->cleared_pmds || - tlb->cleared_puds || tlb->cleared_p4ds)) + tlb->cleared_puds || tlb->cleared_p4ds || tlb->unshared_tables)) return; tlb_flush(tlb); @@ -773,6 +788,63 @@ static inline bool huge_pmd_needs_flush(pmd_t oldpmd, pmd_t newpmd) } #endif +#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING +static inline void tlb_unshare_pmd_ptdesc(struct mmu_gather *tlb, struct ptdesc *pt, + unsigned long addr) +{ + /* + * The caller must make sure that concurrent unsharing + exclusive + * reuse is impossible until tlb_flush_unshared_tables() was called. + */ + VM_WARN_ON_ONCE(!ptdesc_pmd_is_shared(pt)); + ptdesc_pmd_pts_dec(pt); + + /* Clearing a PUD pointing at a PMD table with PMD leaves. */ + tlb_flush_pmd_range(tlb, addr & PUD_MASK, PUD_SIZE); + + /* + * If the page table is now exclusively owned, we fully unshared + * a page table. + */ + if (!ptdesc_pmd_is_shared(pt)) + tlb->fully_unshared_tables = true; + tlb->unshared_tables = true; +} + +static inline void tlb_flush_unshared_tables(struct mmu_gather *tlb) +{ + /* + * As soon as the caller drops locks to allow for reuse of + * previously-shared tables, these tables could get modified and + * even reused outside of hugetlb context, so we have to make sure that + * any page table walkers (incl. TLB, GUP-fast) are aware of that + * change. + * + * Even if we are not fully unsharing a PMD table, we must + * flush the TLB for the unsharer now. + */ + if (tlb->unshared_tables) + tlb_flush_mmu_tlbonly(tlb); + + /* + * Similarly, we must make sure that concurrent GUP-fast will not + * walk previously-shared page tables that are getting modified+reused + * elsewhere. So broadcast an IPI to wait for any concurrent GUP-fast. + * + * We only perform this when we are the last sharer of a page table, + * as the IPI will reach all CPUs: any GUP-fast. + * + * Note that on configs where tlb_remove_table_sync_one() is a NOP, + * the expectation is that the tlb_flush_mmu_tlbonly() would have issued + * required IPIs already for us. + */ + if (tlb->fully_unshared_tables) { + tlb_remove_table_sync_one(); + tlb->fully_unshared_tables = false; + } +} +#endif /* CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING */ + #endif /* CONFIG_MMU */ #endif /* _ASM_GENERIC__TLB_H */ diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 03c8725efa289..63b248c6bfd47 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -240,8 +240,9 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma, pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, unsigned long sz); unsigned long hugetlb_mask_last_page(struct hstate *h); -int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep); +int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long addr, pte_t *ptep); +void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma); void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end); @@ -271,7 +272,7 @@ void hugetlb_vma_unlock_write(struct vm_area_struct *vma); int hugetlb_vma_trylock_write(struct vm_area_struct *vma); void hugetlb_vma_assert_locked(struct vm_area_struct *vma); void hugetlb_vma_lock_release(struct kref *kref); -long hugetlb_change_protection(struct vm_area_struct *vma, +long hugetlb_change_protection(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long address, unsigned long end, pgprot_t newprot, unsigned long cp_flags); void hugetlb_unshare_all_pmds(struct vm_area_struct *vma); @@ -300,13 +301,17 @@ static inline struct address_space *hugetlb_folio_mapping_lock_write( return NULL; } -static inline int huge_pmd_unshare(struct mm_struct *mm, - struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) +static inline int huge_pmd_unshare(struct mmu_gather *tlb, + struct vm_area_struct *vma, unsigned long addr, pte_t *ptep) { return 0; } +static inline void huge_pmd_unshare_flush(struct mmu_gather *tlb, + struct vm_area_struct *vma) +{ +} + static inline void adjust_range_if_pmd_sharing_possible( struct vm_area_struct *vma, unsigned long *start, unsigned long *end) @@ -432,7 +437,7 @@ static inline void move_hugetlb_state(struct folio *old_folio, { } -static inline long hugetlb_change_protection( +static inline long hugetlb_change_protection(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long address, unsigned long end, pgprot_t newprot, unsigned long cp_flags) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 3c77cdef12a32..7fef0b94b5d1e 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5096,8 +5096,9 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, unsigned long last_addr_mask; pte_t *src_pte, *dst_pte; struct mmu_notifier_range range; - bool shared_pmd = false; + struct mmu_gather tlb; + tlb_gather_mmu(&tlb, vma->vm_mm); mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, mm, old_addr, old_end); adjust_range_if_pmd_sharing_possible(vma, &range.start, &range.end); @@ -5122,12 +5123,12 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, if (huge_pte_none(huge_ptep_get(mm, old_addr, src_pte))) continue; - if (huge_pmd_unshare(mm, vma, old_addr, src_pte)) { - shared_pmd = true; + if (huge_pmd_unshare(&tlb, vma, old_addr, src_pte)) { old_addr |= last_addr_mask; new_addr |= last_addr_mask; continue; } + tlb_remove_huge_tlb_entry(h, &tlb, src_pte, old_addr); dst_pte = huge_pte_alloc(mm, new_vma, new_addr, sz); if (!dst_pte) @@ -5136,13 +5137,13 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, move_huge_pte(vma, old_addr, new_addr, src_pte, dst_pte, sz); } - if (shared_pmd) - flush_hugetlb_tlb_range(vma, range.start, range.end); - else - flush_hugetlb_tlb_range(vma, old_end - len, old_end); + tlb_flush_mmu_tlbonly(&tlb); + huge_pmd_unshare_flush(&tlb, vma); + mmu_notifier_invalidate_range_end(&range); i_mmap_unlock_write(mapping); hugetlb_vma_unlock_write(vma); + tlb_finish_mmu(&tlb); return len + old_addr - old_end; } @@ -5161,7 +5162,6 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long sz = huge_page_size(h); bool adjust_reservation; unsigned long last_addr_mask; - bool force_flush = false; WARN_ON(!is_vm_hugetlb_page(vma)); BUG_ON(start & ~huge_page_mask(h)); @@ -5184,10 +5184,8 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, } ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, vma, address, ptep)) { + if (huge_pmd_unshare(tlb, vma, address, ptep)) { spin_unlock(ptl); - tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE); - force_flush = true; address |= last_addr_mask; continue; } @@ -5303,14 +5301,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, } tlb_end_vma(tlb, vma); - /* - * There is nothing protecting a previously-shared page table that we - * unshared through huge_pmd_unshare() from getting freed after we - * release i_mmap_rwsem, so flush the TLB now. If huge_pmd_unshare() - * succeeded, flush the range corresponding to the pud. - */ - if (force_flush) - tlb_flush_mmu_tlbonly(tlb); + huge_pmd_unshare_flush(tlb, vma); } void __hugetlb_zap_begin(struct vm_area_struct *vma, @@ -6399,7 +6390,7 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_pte, } #endif /* CONFIG_USERFAULTFD */ -long hugetlb_change_protection(struct vm_area_struct *vma, +long hugetlb_change_protection(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long address, unsigned long end, pgprot_t newprot, unsigned long cp_flags) { @@ -6409,7 +6400,6 @@ long hugetlb_change_protection(struct vm_area_struct *vma, pte_t pte; struct hstate *h = hstate_vma(vma); long pages = 0, psize = huge_page_size(h); - bool shared_pmd = false; struct mmu_notifier_range range; unsigned long last_addr_mask; bool uffd_wp = cp_flags & MM_CP_UFFD_WP; @@ -6452,7 +6442,7 @@ long hugetlb_change_protection(struct vm_area_struct *vma, } } ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, vma, address, ptep)) { + if (huge_pmd_unshare(tlb, vma, address, ptep)) { /* * When uffd-wp is enabled on the vma, unshare * shouldn't happen at all. Warn about it if it @@ -6461,7 +6451,6 @@ long hugetlb_change_protection(struct vm_area_struct *vma, WARN_ON_ONCE(uffd_wp || uffd_wp_resolve); pages++; spin_unlock(ptl); - shared_pmd = true; address |= last_addr_mask; continue; } @@ -6522,22 +6511,16 @@ long hugetlb_change_protection(struct vm_area_struct *vma, pte = huge_pte_clear_uffd_wp(pte); huge_ptep_modify_prot_commit(vma, address, ptep, old_pte, pte); pages++; + tlb_remove_huge_tlb_entry(h, tlb, ptep, address); } next: spin_unlock(ptl); cond_resched(); } - /* - * There is nothing protecting a previously-shared page table that we - * unshared through huge_pmd_unshare() from getting freed after we - * release i_mmap_rwsem, so flush the TLB now. If huge_pmd_unshare() - * succeeded, flush the range corresponding to the pud. - */ - if (shared_pmd) - flush_hugetlb_tlb_range(vma, range.start, range.end); - else - flush_hugetlb_tlb_range(vma, start, end); + + tlb_flush_mmu_tlbonly(tlb); + huge_pmd_unshare_flush(tlb, vma); /* * No need to call mmu_notifier_arch_invalidate_secondary_tlbs() we are * downgrading page table protection not changing it to point to a new @@ -6904,18 +6887,27 @@ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, return pte; } -/* - * unmap huge page backed by shared pte. +/** + * huge_pmd_unshare - Unmap a pmd table if it is shared by multiple users + * @tlb: the current mmu_gather. + * @vma: the vma covering the pmd table. + * @addr: the address we are trying to unshare. + * @ptep: pointer into the (pmd) page table. + * + * Called with the page table lock held, the i_mmap_rwsem held in write mode + * and the hugetlb vma lock held in write mode. * - * Called with page table lock held. + * Note: The caller must call huge_pmd_unshare_flush() before dropping the + * i_mmap_rwsem. * - * returns: 1 successfully unmapped a shared pte page - * 0 the underlying pte page is not shared, or it is the last user + * Returns: 1 if it was a shared PMD table and it got unmapped, or 0 if it + * was not a shared PMD table. */ -int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) +int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long addr, pte_t *ptep) { unsigned long sz = huge_page_size(hstate_vma(vma)); + struct mm_struct *mm = vma->vm_mm; pgd_t *pgd = pgd_offset(mm, addr); p4d_t *p4d = p4d_offset(pgd, addr); pud_t *pud = pud_offset(p4d, addr); @@ -6927,18 +6919,36 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, i_mmap_assert_write_locked(vma->vm_file->f_mapping); hugetlb_vma_assert_locked(vma); pud_clear(pud); - /* - * Once our caller drops the rmap lock, some other process might be - * using this page table as a normal, non-hugetlb page table. - * Wait for pending gup_fast() in other threads to finish before letting - * that happen. - */ - tlb_remove_table_sync_one(); - ptdesc_pmd_pts_dec(virt_to_ptdesc(ptep)); + + tlb_unshare_pmd_ptdesc(tlb, virt_to_ptdesc(ptep), addr); + mm_dec_nr_pmds(mm); return 1; } +/* + * huge_pmd_unshare_flush - Complete a sequence of huge_pmd_unshare() calls + * @tlb: the current mmu_gather. + * @vma: the vma covering the pmd table. + * + * Perform necessary TLB flushes or IPI broadcasts to synchronize PMD table + * unsharing with concurrent page table walkers. + * + * This function must be called after a sequence of huge_pmd_unshare() + * calls while still holding the i_mmap_rwsem. + */ +void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma) +{ + /* + * We must synchronize page table unsharing such that nobody will + * try reusing a previously-shared page table while it might still + * be in use by previous sharers (TLB, GUP_fast). + */ + i_mmap_assert_write_locked(vma->vm_file->f_mapping); + + tlb_flush_unshared_tables(tlb); +} + #else /* !CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING */ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, @@ -6947,12 +6957,16 @@ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, return NULL; } -int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) +int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long addr, pte_t *ptep) { return 0; } +void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma) +{ +} + void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end) { @@ -7219,6 +7233,7 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, unsigned long sz = huge_page_size(h); struct mm_struct *mm = vma->vm_mm; struct mmu_notifier_range range; + struct mmu_gather tlb; unsigned long address; spinlock_t *ptl; pte_t *ptep; @@ -7229,6 +7244,7 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, if (start >= end) return; + tlb_gather_mmu(&tlb, mm); flush_cache_range(vma, start, end); /* * No need to call adjust_range_if_pmd_sharing_possible(), because @@ -7248,10 +7264,10 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, if (!ptep) continue; ptl = huge_pte_lock(h, mm, ptep); - huge_pmd_unshare(mm, vma, address, ptep); + huge_pmd_unshare(&tlb, vma, address, ptep); spin_unlock(ptl); } - flush_hugetlb_tlb_range(vma, start, end); + huge_pmd_unshare_flush(&tlb, vma); if (take_locks) { i_mmap_unlock_write(vma->vm_file->f_mapping); hugetlb_vma_unlock_write(vma); @@ -7261,6 +7277,7 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, * Documentation/mm/mmu_notifier.rst. */ mmu_notifier_invalidate_range_end(&range); + tlb_finish_mmu(&tlb); } /* diff --git a/mm/mmu_gather.c b/mm/mmu_gather.c index 247e3f9db6c7a..030a162a263ba 100644 --- a/mm/mmu_gather.c +++ b/mm/mmu_gather.c @@ -426,6 +426,7 @@ static void __tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, #endif tlb->vma_pfn = 0; + tlb->fully_unshared_tables = 0; __tlb_reset_range(tlb); inc_tlb_flush_pending(tlb->mm); } @@ -468,6 +469,12 @@ void tlb_gather_mmu_fullmm(struct mmu_gather *tlb, struct mm_struct *mm) */ void tlb_finish_mmu(struct mmu_gather *tlb) { + /* + * We expect an earlier huge_pmd_unshare_flush() call to sort this out, + * due to complicated locking requirements with page table unsharing. + */ + VM_WARN_ON_ONCE(tlb->fully_unshared_tables); + /* * If there are parallel threads are doing PTE changes on same range * under non-exclusive lock (e.g., mmap_lock read-side) but defer TLB diff --git a/mm/mprotect.c b/mm/mprotect.c index 283889e4f1cec..5c330e817129e 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -652,7 +652,7 @@ long change_protection(struct mmu_gather *tlb, #endif if (is_vm_hugetlb_page(vma)) - pages = hugetlb_change_protection(vma, start, end, newprot, + pages = hugetlb_change_protection(tlb, vma, start, end, newprot, cp_flags); else pages = change_protection_range(tlb, vma, start, end, newprot, diff --git a/mm/rmap.c b/mm/rmap.c index 748f48727a162..d6799afe11147 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -76,7 +76,7 @@ #include <linux/mm_inline.h> #include <linux/oom.h> -#include <asm/tlbflush.h> +#include <asm/tlb.h> #define CREATE_TRACE_POINTS #include <trace/events/migrate.h> @@ -2008,13 +2008,17 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma, * if unsuccessful. */ if (!anon) { + struct mmu_gather tlb; + VM_BUG_ON(!(flags & TTU_RMAP_LOCKED)); if (!hugetlb_vma_trylock_write(vma)) goto walk_abort; - if (huge_pmd_unshare(mm, vma, address, pvmw.pte)) { + + tlb_gather_mmu(&tlb, mm); + if (huge_pmd_unshare(&tlb, vma, address, pvmw.pte)) { hugetlb_vma_unlock_write(vma); - flush_tlb_range(vma, - range.start, range.end); + huge_pmd_unshare_flush(&tlb, vma); + tlb_finish_mmu(&tlb); /* * The PMD table was unmapped, * consequently unmapping the folio. @@ -2022,6 +2026,7 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma, goto walk_done; } hugetlb_vma_unlock_write(vma); + tlb_finish_mmu(&tlb); } pteval = huge_ptep_clear_flush(vma, address, pvmw.pte); if (pte_dirty(pteval)) @@ -2398,17 +2403,20 @@ static bool try_to_migrate_one(struct folio *folio, struct vm_area_struct *vma, * fail if unsuccessful. */ if (!anon) { + struct mmu_gather tlb; + VM_BUG_ON(!(flags & TTU_RMAP_LOCKED)); if (!hugetlb_vma_trylock_write(vma)) { page_vma_mapped_walk_done(&pvmw); ret = false; break; } - if (huge_pmd_unshare(mm, vma, address, pvmw.pte)) { - hugetlb_vma_unlock_write(vma); - flush_tlb_range(vma, - range.start, range.end); + tlb_gather_mmu(&tlb, mm); + if (huge_pmd_unshare(&tlb, vma, address, pvmw.pte)) { + hugetlb_vma_unlock_write(vma); + huge_pmd_unshare_flush(&tlb, vma); + tlb_finish_mmu(&tlb); /* * The PMD table was unmapped, * consequently unmapping the folio. @@ -2417,6 +2425,7 @@ static bool try_to_migrate_one(struct folio *folio, struct vm_area_struct *vma, break; } hugetlb_vma_unlock_write(vma); + tlb_finish_mmu(&tlb); } /* Nuke the hugetlb page table entry */ pteval = huge_ptep_clear_flush(vma, address, pvmw.pte); -- 2.52.0

1 day, 10 hours

3
7
0 0

Re: [PATCH v2] net: usb: sr9700: fix incorrect command used to write single register

by Andrew Lunn

On Sun, Dec 21, 2025 at 03:42:58PM -0800, Ethan Nelson-Moore wrote: > Hi, Andrew, > > The other two are correct because they intend to write multiple registers - > they are used with a length parameter. Please don't top post. How finished do you think this driver is? Are there likely to be more instances of SR_WR_REG/SR_WR_REGS added in the future? If so, it might make sense to change the code to make this sort of error less likely. SR_WR_MULTIPLE_REG and SR_WR_ONE_REG? Andrew

1 day, 11 hours

1
0
0 0

[PATCH v2 6/6] Revert "PCI: dwc: Don't wait for link up if driver can detect Link Up event"

by Niklas Cassel

This reverts commit 8d3bf19f1b585a3cc0027f508b64c33484db8d0d. While this fake hotplugging was a nice idea, it has shown that this feature does not handle PCIe switches correctly: pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43 pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44 pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45 pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46 pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46 pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41]) pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46 During the initial scan, PCI core doesn't see the switch and since the Root Port is not hot plug capable, the secondary bus number gets assigned as the subordinate bus number. This means, the PCI core assumes that only one bus will appear behind the Root Port since the Root Port is not hot plug capable. This works perfectly fine for PCIe endpoints connected to the Root Port, since they don't extend the bus. However, if a PCIe switch is connected, then there is a problem when the downstream busses starts showing up and the PCI core doesn't extend the subordinate bus number after initial scan during boot. The long term plan is to migrate this driver to the pwrctrl framework, once it adds proper support for powering up and enumerating PCIe switches. Cc: stable(a)vger.kernel.org Suggested-by: Manivannan Sadhasivam <mani(a)kernel.org> Acked-by: Shawn Lin <shawn.lin(a)rock-chips.com> Tested-by: Shawn Lin <shawn.lin(a)rock-chips.com> Signed-off-by: Niklas Cassel <cassel(a)kernel.org> --- drivers/pci/controller/dwc/pcie-designware-host.c | 10 ++-------- drivers/pci/controller/dwc/pcie-designware.h | 1 - 2 files changed, 2 insertions(+), 9 deletions(-) diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c index 8c41b90a1db1..06c02fcc76c8 100644 --- a/drivers/pci/controller/dwc/pcie-designware-host.c +++ b/drivers/pci/controller/dwc/pcie-designware-host.c @@ -665,14 +665,8 @@ int dw_pcie_host_init(struct dw_pcie_rp *pp) goto err_remove_edma; } - /* - * Note: Skip the link up delay only when a Link Up IRQ is present. - * If there is no Link Up IRQ, we should not bypass the delay - * because that would require users to manually rescan for devices. - */ - if (!pp->use_linkup_irq) - /* Ignore errors, the link may come up later */ - dw_pcie_wait_for_link(pci); + /* Ignore errors, the link may come up later */ + dw_pcie_wait_for_link(pci); ret = pci_host_probe(bridge); if (ret) diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h index fc9cf8ce8629..a3a3f6e89a81 100644 --- a/drivers/pci/controller/dwc/pcie-designware.h +++ b/drivers/pci/controller/dwc/pcie-designware.h @@ -438,7 +438,6 @@ struct dw_pcie_rp { bool use_atu_msg; int msg_atu_index; struct resource *msg_res; - bool use_linkup_irq; struct pci_eq_presets presets; struct pci_config_window *cfg; bool ecam_enabled; -- 2.52.0

1 day, 14 hours

1
0
0 0

[PATCH v2 3/6] Revert "PCI: qcom: Don't wait for link if we can detect Link Up"

by Niklas Cassel

This reverts commit 36971d6c5a9a134c15760ae9fd13c6d5f9a36abb. While this fake hotplugging was a nice idea, it has shown that this feature does not handle PCIe switches correctly: pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43 pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44 pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45 pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46 pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46 pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41]) pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46 During the initial scan, PCI core doesn't see the switch and since the Root Port is not hot plug capable, the secondary bus number gets assigned as the subordinate bus number. This means, the PCI core assumes that only one bus will appear behind the Root Port since the Root Port is not hot plug capable. This works perfectly fine for PCIe endpoints connected to the Root Port, since they don't extend the bus. However, if a PCIe switch is connected, then there is a problem when the downstream busses starts showing up and the PCI core doesn't extend the subordinate bus number after initial scan during boot. The long term plan is to migrate this driver to the pwrctrl framework, once it adds proper support for powering up and enumerating PCIe switches. Cc: stable(a)vger.kernel.org Suggested-by: Manivannan Sadhasivam <mani(a)kernel.org> Acked-by: Shawn Lin <shawn.lin(a)rock-chips.com> Tested-by: Shawn Lin <shawn.lin(a)rock-chips.com> Signed-off-by: Niklas Cassel <cassel(a)kernel.org> --- drivers/pci/controller/dwc/pcie-qcom.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c index 60373fe1362f..e87ec6779d44 100644 --- a/drivers/pci/controller/dwc/pcie-qcom.c +++ b/drivers/pci/controller/dwc/pcie-qcom.c @@ -1958,10 +1958,6 @@ static int qcom_pcie_probe(struct platform_device *pdev) platform_set_drvdata(pdev, pcie); - irq = platform_get_irq_byname_optional(pdev, "global"); - if (irq > 0) - pp->use_linkup_irq = true; - ret = dw_pcie_host_init(pp); if (ret) { dev_err(dev, "cannot initialize host\n"); @@ -1975,6 +1971,7 @@ static int qcom_pcie_probe(struct platform_device *pdev) goto err_host_deinit; } + irq = platform_get_irq_byname_optional(pdev, "global"); if (irq > 0) { ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, qcom_pcie_global_irq_thread, -- 2.52.0

1 day, 14 hours

1
0
0 0

[PATCH v2 2/6] Revert "PCI: dw-rockchip: Enumerate endpoints based on dll_link_up IRQ"

by Niklas Cassel

This reverts commit 0e0b45ab5d770a748487ba0ae8f77d1fb0f0de3e. While this fake hotplugging was a nice idea, it has shown that this feature does not handle PCIe switches correctly: pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43 pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44 pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45 pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46 pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46 pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41]) pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46 During the initial scan, PCI core doesn't see the switch and since the Root Port is not hot plug capable, the secondary bus number gets assigned as the subordinate bus number. This means, the PCI core assumes that only one bus will appear behind the Root Port since the Root Port is not hot plug capable. This works perfectly fine for PCIe endpoints connected to the Root Port, since they don't extend the bus. However, if a PCIe switch is connected, then there is a problem when the downstream busses starts showing up and the PCI core doesn't extend the subordinate bus number after initial scan during boot. The long term plan is to migrate this driver to the pwrctrl framework, once it adds proper support for powering up and enumerating PCIe switches. Cc: stable(a)vger.kernel.org Suggested-by: Manivannan Sadhasivam <mani(a)kernel.org> Acked-by: Shawn Lin <shawn.lin(a)rock-chips.com> Tested-by: Shawn Lin <shawn.lin(a)rock-chips.com> Signed-off-by: Niklas Cassel <cassel(a)kernel.org> --- drivers/pci/controller/dwc/pcie-dw-rockchip.c | 59 +------------------ 1 file changed, 3 insertions(+), 56 deletions(-) diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c index ca808d8f7975..352f513ebf03 100644 --- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c +++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c @@ -508,34 +508,6 @@ static const struct dw_pcie_ops dw_pcie_ops = { .get_ltssm = rockchip_pcie_get_ltssm, }; -static irqreturn_t rockchip_pcie_rc_sys_irq_thread(int irq, void *arg) -{ - struct rockchip_pcie *rockchip = arg; - struct dw_pcie *pci = &rockchip->pci; - struct dw_pcie_rp *pp = &pci->pp; - struct device *dev = pci->dev; - u32 reg; - - reg = rockchip_pcie_readl_apb(rockchip, PCIE_CLIENT_INTR_STATUS_MISC); - rockchip_pcie_writel_apb(rockchip, reg, PCIE_CLIENT_INTR_STATUS_MISC); - - dev_dbg(dev, "PCIE_CLIENT_INTR_STATUS_MISC: %#x\n", reg); - dev_dbg(dev, "LTSSM_STATUS: %#x\n", rockchip_pcie_get_ltssm_reg(rockchip)); - - if (reg & PCIE_RDLH_LINK_UP_CHGED) { - if (rockchip_pcie_link_up(pci)) { - msleep(PCIE_RESET_CONFIG_WAIT_MS); - dev_dbg(dev, "Received Link up event. Starting enumeration!\n"); - /* Rescan the bus to enumerate endpoint devices */ - pci_lock_rescan_remove(); - pci_rescan_bus(pp->bridge->bus); - pci_unlock_rescan_remove(); - } - } - - return IRQ_HANDLED; -} - static irqreturn_t rockchip_pcie_ep_sys_irq_thread(int irq, void *arg) { struct rockchip_pcie *rockchip = arg; @@ -568,29 +540,14 @@ static irqreturn_t rockchip_pcie_ep_sys_irq_thread(int irq, void *arg) return IRQ_HANDLED; } -static int rockchip_pcie_configure_rc(struct platform_device *pdev, - struct rockchip_pcie *rockchip) +static int rockchip_pcie_configure_rc(struct rockchip_pcie *rockchip) { - struct device *dev = &pdev->dev; struct dw_pcie_rp *pp; - int irq, ret; u32 val; if (!IS_ENABLED(CONFIG_PCIE_ROCKCHIP_DW_HOST)) return -ENODEV; - irq = platform_get_irq_byname(pdev, "sys"); - if (irq < 0) - return irq; - - ret = devm_request_threaded_irq(dev, irq, NULL, - rockchip_pcie_rc_sys_irq_thread, - IRQF_ONESHOT, "pcie-sys-rc", rockchip); - if (ret) { - dev_err(dev, "failed to request PCIe sys IRQ\n"); - return ret; - } - /* LTSSM enable control mode */ val = FIELD_PREP_WM16(PCIE_LTSSM_ENABLE_ENHANCE, 1); rockchip_pcie_writel_apb(rockchip, val, PCIE_CLIENT_HOT_RESET_CTRL); @@ -602,17 +559,7 @@ static int rockchip_pcie_configure_rc(struct platform_device *pdev, pp = &rockchip->pci.pp; pp->ops = &rockchip_pcie_host_ops; - ret = dw_pcie_host_init(pp); - if (ret) { - dev_err(dev, "failed to initialize host\n"); - return ret; - } - - /* unmask DLL up/down indicator */ - val = FIELD_PREP_WM16(PCIE_RDLH_LINK_UP_CHGED, 0); - rockchip_pcie_writel_apb(rockchip, val, PCIE_CLIENT_INTR_MASK_MISC); - - return ret; + return dw_pcie_host_init(pp); } static int rockchip_pcie_configure_ep(struct platform_device *pdev, @@ -731,7 +678,7 @@ static int rockchip_pcie_probe(struct platform_device *pdev) switch (data->mode) { case DW_PCIE_RC_TYPE: - ret = rockchip_pcie_configure_rc(pdev, rockchip); + ret = rockchip_pcie_configure_rc(rockchip); if (ret) goto deinit_clk; break; -- 2.52.0

1 day, 14 hours

1
0
0 0

[PATCH v2 1/6] Revert "PCI: dw-rockchip: Don't wait for link since we can detect Link Up"

by Niklas Cassel

This reverts commit ec9fd499b9c60a187ac8d6414c3c343c77d32e42. While this fake hotplugging was a nice idea, it has shown that this feature does not handle PCIe switches correctly: pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43 pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44 pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45 pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46 pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41]) pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46 pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41]) pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46 During the initial scan, PCI core doesn't see the switch and since the Root Port is not hot plug capable, the secondary bus number gets assigned as the subordinate bus number. This means, the PCI core assumes that only one bus will appear behind the Root Port since the Root Port is not hot plug capable. This works perfectly fine for PCIe endpoints connected to the Root Port, since they don't extend the bus. However, if a PCIe switch is connected, then there is a problem when the downstream busses starts showing up and the PCI core doesn't extend the subordinate bus number after initial scan during boot. The long term plan is to migrate this driver to the pwrctrl framework, once it adds proper support for powering up and enumerating PCIe switches. Cc: stable(a)vger.kernel.org Suggested-by: Manivannan Sadhasivam <mani(a)kernel.org> Acked-by: Shawn Lin <shawn.lin(a)rock-chips.com> Tested-by: Shawn Lin <shawn.lin(a)rock-chips.com> Signed-off-by: Niklas Cassel <cassel(a)kernel.org> --- drivers/pci/controller/dwc/pcie-dw-rockchip.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c index 8c1c92208802..ca808d8f7975 100644 --- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c +++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c @@ -601,7 +601,6 @@ static int rockchip_pcie_configure_rc(struct platform_device *pdev, pp = &rockchip->pci.pp; pp->ops = &rockchip_pcie_host_ops; - pp->use_linkup_irq = true; ret = dw_pcie_host_init(pp); if (ret) { -- 2.52.0

1 day, 14 hours

1
0
0 0

[PATCH] clockevents: add a error handling in tick_broadcast_init_sysfs()

by Haoxiang Li

If device_register() fails, call put_device() to drop the device reference. Fixes: 501f867064e9 ("clockevents: Provide sysfs interface") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- kernel/time/clockevents.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c index a59bc75ab7c5..94e223cf9c74 100644 --- a/kernel/time/clockevents.c +++ b/kernel/time/clockevents.c @@ -733,8 +733,12 @@ static __init int tick_broadcast_init_sysfs(void) { int err = device_register(&tick_bc_dev); - if (!err) - err = device_create_file(&tick_bc_dev, &dev_attr_current_device); + if (err) { + put_deivce(&tick_bc_dev); + return err; + } + + err = device_create_file(&tick_bc_dev, &dev_attr_current_device); return err; } #else -- 2.25.1

1 day, 14 hours

3
6
0 0

[PATCH] powerpc/pseries/cmm: fix the error handling in cmm_sysfs_register()

by Haoxiang Li

If device_register() fails, put_device() should be called to drop the device reference. Thus add put_device() after subsys_unregister label and change device_unregister() to device_del() in fail label. Found by code review. Fixes: 6c9d29095264 ("power: cmm - convert sysdev_class to a regular subsystem") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- arch/powerpc/platforms/pseries/cmm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/platforms/pseries/cmm.c b/arch/powerpc/platforms/pseries/cmm.c index 4cbbe2ee58ab..0666d3300bdb 100644 --- a/arch/powerpc/platforms/pseries/cmm.c +++ b/arch/powerpc/platforms/pseries/cmm.c @@ -419,8 +419,9 @@ static int cmm_sysfs_register(struct device *dev) fail: while (--i >= 0) device_remove_file(dev, cmm_attrs[i]); - device_unregister(dev); + device_del(dev); subsys_unregister: + put_device(dev); bus_unregister(&cmm_subsys); return rc; } -- 2.25.1

1 day, 14 hours

2
1
0 0

[PATCH] dmaengine: fix a reference leak in __dma_async_device_channel_register()

by Haoxiang Li

After device_register() is called, put_device() is required to drop the device reference. In this case, put_device() -> chan_dev_release() will finally release chan->dev. Thus there is no need to call kfree again to release the chan->dev. Found by code review. Fixes: d2fb0a043838 ("dmaengine: break out channel registration") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- drivers/dma/dmaengine.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index ca13cd39330b..9d7cea1d6e91 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -1071,6 +1071,7 @@ static int __dma_async_device_channel_register(struct dma_device *device, const char *name) { int rc; + bool dev_registered = false; chan->local = alloc_percpu(typeof(*chan->local)); if (!chan->local) @@ -1102,6 +1103,7 @@ static int __dma_async_device_channel_register(struct dma_device *device, else dev_set_name(&chan->dev->device, "%s", name); rc = device_register(&chan->dev->device); + dev_registered = true; if (rc) goto err_out_ida; chan->client_count = 0; @@ -1112,7 +1114,10 @@ static int __dma_async_device_channel_register(struct dma_device *device, err_out_ida: ida_free(&device->chan_ida, chan->chan_id); err_free_dev: - kfree(chan->dev); + if (dev_registered) + put_device(&chan->dev->device); + else + kfree(chan->dev); err_free_local: free_percpu(chan->local); chan->local = NULL; -- 2.25.1

1 day, 16 hours

1
0
0 0

[PATCH 0/2] LoongArch: KVM: fix "unreliable stack" issue

by Xianglai Li

When starting multi-core loongarch virtualization on loongarch physical machine, loading livepatch on the physical machine will cause an error similar to the following: [ 411.686289] livepatch: klp_try_switch_task: CPU 31/KVM:3116 has an unreliable stack The specific test steps are as follows: 1.Start a multi-core virtual machine on a physical machine 2.Enter the following command on the physical machine to turn on the debug switch: echo "file kernel/livepatch/transition.c +p" > /sys/kernel/debug/\ dynamic_debug/control 3.Load livepatch: modprobe livepatch-sample Through the above steps, similar prints can be viewed in dmesg. The reason for this issue is that the code of the kvm_exc_entry function was copied in the function kvm_loongarch_env_init. When the cpu needs to execute kvm_exc_entry, it will switch to the copied address for execution. The new address of the kvm_exc_entry function cannot be recognized in ORC, which eventually leads to the arch_stack_walk_reliable function returning an error and printing an exception message. To solve the above problems, we directly compile the switch.S file into the kernel instead of the module. In this way, the function kvm_exc_entry will no longer need to be copied. Cc: Huacai Chen <chenhuacai(a)kernel.org> Cc: WANG Xuerui <kernel(a)xen0n.name> Cc: Tianrui Zhao <zhaotianrui(a)loongson.cn> Cc: Bibo Mao <maobibo(a)loongson.cn> Cc: Charlie Jenkins <charlie(a)rivosinc.com> Cc: Xianglai Li <lixianglai(a)loongson.cn> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Xianglai Li (2): LoongArch: KVM: Compile the switch.S file directly into the kernel LoongArch: KVM: fix "unreliable stack" issue arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 16 ++++++++++ arch/loongarch/include/asm/kvm_host.h | 5 +-- arch/loongarch/include/asm/kvm_vcpu.h | 20 ++++++------ arch/loongarch/kvm/Makefile | 2 +- arch/loongarch/kvm/main.c | 35 ++------------------- arch/loongarch/kvm/switch.S | 24 +++++++++++--- 7 files changed, 51 insertions(+), 53 deletions(-) base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8 -- 2.39.1

1 day, 17 hours

3
6
0 0

[PATCH 6.1.y] spi: cadence-qspi: fix pointer reference in runtime PM hooks

by Zhaoyang Li

From: Théo Lebrun <theo.lebrun(a)bootlin.com> [ Upstream commit 32ce3bb57b6b402de2aec1012511e7ac4e7449dc ] dev_get_drvdata() gets used to acquire the pointer to cqspi and the SPI controller. Neither embed the other; this lead to memory corruption. On a given platform (Mobileye EyeQ5) the memory corruption is hidden inside cqspi->f_pdata. Also, this uninitialised memory is used as a mutex (ctlr->bus_lock_mutex) by spi_controller_suspend(). Fixes: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations") Reviewed-by: Dhruva Gole <d-gole(a)ti.com> Signed-off-by: Théo Lebrun <theo.lebrun(a)bootlin.com> Link: https://msgid.link/r/20240222-cdns-qspi-pm-fix-v4-1-6b6af8bcbf59@bootlin.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Zhaoyang Li <lizy04(a)hust.edu.cn> --- drivers/spi/spi-cadence-quadspi.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c index 42861bc45073..02c5f00c8a57 100644 --- a/drivers/spi/spi-cadence-quadspi.c +++ b/drivers/spi/spi-cadence-quadspi.c @@ -1775,10 +1775,9 @@ static int cqspi_remove(struct platform_device *pdev) static int cqspi_suspend(struct device *dev) { struct cqspi_st *cqspi = dev_get_drvdata(dev); - struct spi_master *master = dev_get_drvdata(dev); int ret; - ret = spi_master_suspend(master); + ret = spi_master_suspend(cqspi->master); cqspi_controller_enable(cqspi, 0); clk_disable_unprepare(cqspi->clk); @@ -1789,7 +1788,6 @@ static int cqspi_suspend(struct device *dev) static int cqspi_resume(struct device *dev) { struct cqspi_st *cqspi = dev_get_drvdata(dev); - struct spi_master *master = dev_get_drvdata(dev); clk_prepare_enable(cqspi->clk); cqspi_wait_idle(cqspi); @@ -1798,7 +1796,7 @@ static int cqspi_resume(struct device *dev) cqspi->current_cs = -1; cqspi->sclk = 0; - return spi_master_resume(master); + return spi_master_resume(cqspi->master); } static DEFINE_SIMPLE_DEV_PM_OPS(cqspi_dev_pm_ops, cqspi_suspend, cqspi_resume); -- 2.25.1

1 day, 17 hours

3
3
0 0

[PATCHv3 1/2] kernel/kexec: Change the prototype of kimage_map_segment()

by Pingfan Liu

The kexec segment index will be required to extract the corresponding information for that segment in kimage_map_segment(). Additionally, kexec_segment already holds the kexec relocation destination address and size. Therefore, the prototype of kimage_map_segment() can be changed. Fixes: 07d24902977e ("kexec: enable CMA based contiguous allocation") Signed-off-by: Pingfan Liu <piliu(a)redhat.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Baoquan He <bhe(a)redhat.com> Cc: Mimi Zohar <zohar(a)linux.ibm.com> Cc: Roberto Sassu <roberto.sassu(a)huawei.com> Cc: Alexander Graf <graf(a)amazon.com> Cc: Steven Chen <chenste(a)linux.microsoft.com> Cc: linux-kernel(a)vger.kernel.org Cc: <stable(a)vger.kernel.org> To: kexec(a)lists.infradead.org To: linux-integrity(a)vger.kernel.org --- include/linux/kexec.h | 4 ++-- kernel/kexec_core.c | 9 ++++++--- security/integrity/ima/ima_kexec.c | 4 +--- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/include/linux/kexec.h b/include/linux/kexec.h index ff7e231b0485..8a22bc9b8c6c 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -530,7 +530,7 @@ extern bool kexec_file_dbg_print; #define kexec_dprintk(fmt, arg...) \ do { if (kexec_file_dbg_print) pr_info(fmt, ##arg); } while (0) -extern void *kimage_map_segment(struct kimage *image, unsigned long addr, unsigned long size); +extern void *kimage_map_segment(struct kimage *image, int idx); extern void kimage_unmap_segment(void *buffer); #else /* !CONFIG_KEXEC_CORE */ struct pt_regs; @@ -540,7 +540,7 @@ static inline void __crash_kexec(struct pt_regs *regs) { } static inline void crash_kexec(struct pt_regs *regs) { } static inline int kexec_should_crash(struct task_struct *p) { return 0; } static inline int kexec_crash_loaded(void) { return 0; } -static inline void *kimage_map_segment(struct kimage *image, unsigned long addr, unsigned long size) +static inline void *kimage_map_segment(struct kimage *image, int idx) { return NULL; } static inline void kimage_unmap_segment(void *buffer) { } #define kexec_in_progress false diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index 0f92acdd354d..1a79c5b18d8f 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -953,17 +953,20 @@ int kimage_load_segment(struct kimage *image, int idx) return result; } -void *kimage_map_segment(struct kimage *image, - unsigned long addr, unsigned long size) +void *kimage_map_segment(struct kimage *image, int idx) { + unsigned long addr, size, eaddr; unsigned long src_page_addr, dest_page_addr = 0; - unsigned long eaddr = addr + size; kimage_entry_t *ptr, entry; struct page **src_pages; unsigned int npages; void *vaddr = NULL; int i; + addr = image->segment[idx].mem; + size = image->segment[idx].memsz; + eaddr = addr + size; + /* * Collect the source pages and map them in a contiguous VA range. */ diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c index 7362f68f2d8b..5beb69edd12f 100644 --- a/security/integrity/ima/ima_kexec.c +++ b/security/integrity/ima/ima_kexec.c @@ -250,9 +250,7 @@ void ima_kexec_post_load(struct kimage *image) if (!image->ima_buffer_addr) return; - ima_kexec_buffer = kimage_map_segment(image, - image->ima_buffer_addr, - image->ima_buffer_size); + ima_kexec_buffer = kimage_map_segment(image, image->ima_segment_index); if (!ima_kexec_buffer) { pr_err("Could not map measurements buffer.\n"); return; -- 2.49.0

1 day, 18 hours

2
2
0 0

RE: Patch "cpufreq: dt-platdev: Add JH7110S SOC to the allowlist" has been added to the 6.6-stable tree

by Hal Feng

> On 19.12.25 20:34, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > cpufreq: dt-platdev: Add JH7110S SOC to the allowlist > > to the 6.6-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable- > queue.git;a=summary > > The filename of the patch is: > cpufreq-dt-platdev-add-jh7110s-soc-to-the-allowlist.patch > and it can be found in the queue-6.6 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, please let > <stable(a)vger.kernel.org> know about it. As series [1] is accepted, this patch will be not needed and will be reverted in the mainline. [1] https://lore.kernel.org/all/20251212211934.135602-1-e@freeshell.de/ So we should not add it to the stable tree. Thanks. Best regards, Hal > > > > commit 62295dd3b326acf42f033124c4a48278b71b53a4 > Author: Hal Feng <hal.feng(a)starfivetech.com> > Date: Thu Oct 16 16:00:48 2025 +0800 > > cpufreq: dt-platdev: Add JH7110S SOC to the allowlist > > [ Upstream commit 6e7970cab51d01b8f7c56f120486c571c22e1b80 ] > > Add the compatible strings for supporting the generic > cpufreq driver on the StarFive JH7110S SoC. > > Signed-off-by: Hal Feng <hal.feng(a)starfivetech.com> > Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> > Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq- > dt-platdev.c > index c58c1defd7458..8b53388280d73 100644 > --- a/drivers/cpufreq/cpufreq-dt-platdev.c > +++ b/drivers/cpufreq/cpufreq-dt-platdev.c > @@ -87,6 +87,7 @@ static const struct of_device_id allowlist[] __initconst = { > { .compatible = "st-ericsson,u9540", }, > > { .compatible = "starfive,jh7110", }, > + { .compatible = "starfive,jh7110s", }, > > { .compatible = "ti,omap2", }, > { .compatible = "ti,omap4", },

1 day, 19 hours

1
0
0 0

[PATCH net v3] net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()

by Xiaolei Wang

In the non-RT kernel, local_bh_disable() merely disables preemption, whereas it maps to an actual spin lock in the RT kernel. Consequently, when attempting to refill RX buffers via netdev_alloc_skb() in macb_mac_link_up(), a deadlock scenario arises as follows: WARNING: possible circular locking dependency detected 6.18.0-08691-g2061f18ad76e #39 Not tainted ------------------------------------------------------ kworker/0:0/8 is trying to acquire lock: ffff00080369bbe0 (&bp->lock){+.+.}-{3:3}, at: macb_start_xmit+0x808/0xb7c but task is already holding lock: ffff000803698e58 (&queue->tx_ptr_lock){+...}-{3:3}, at: macb_start_xmit +0x148/0xb7c which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&queue->tx_ptr_lock){+...}-{3:3}: rt_spin_lock+0x50/0x1f0 macb_start_xmit+0x148/0xb7c dev_hard_start_xmit+0x94/0x284 sch_direct_xmit+0x8c/0x37c __dev_queue_xmit+0x708/0x1120 neigh_resolve_output+0x148/0x28c ip6_finish_output2+0x2c0/0xb2c __ip6_finish_output+0x114/0x308 ip6_output+0xc4/0x4a4 mld_sendpack+0x220/0x68c mld_ifc_work+0x2a8/0x4f4 process_one_work+0x20c/0x5f8 worker_thread+0x1b0/0x35c kthread+0x144/0x200 ret_from_fork+0x10/0x20 -> #2 (_xmit_ETHER#2){+...}-{3:3}: rt_spin_lock+0x50/0x1f0 sch_direct_xmit+0x11c/0x37c __dev_queue_xmit+0x708/0x1120 neigh_resolve_output+0x148/0x28c ip6_finish_output2+0x2c0/0xb2c __ip6_finish_output+0x114/0x308 ip6_output+0xc4/0x4a4 mld_sendpack+0x220/0x68c mld_ifc_work+0x2a8/0x4f4 process_one_work+0x20c/0x5f8 worker_thread+0x1b0/0x35c kthread+0x144/0x200 ret_from_fork+0x10/0x20 -> #1 ((softirq_ctrl.lock)){+.+.}-{3:3}: lock_release+0x250/0x348 __local_bh_enable_ip+0x7c/0x240 __netdev_alloc_skb+0x1b4/0x1d8 gem_rx_refill+0xdc/0x240 gem_init_rings+0xb4/0x108 macb_mac_link_up+0x9c/0x2b4 phylink_resolve+0x170/0x614 process_one_work+0x20c/0x5f8 worker_thread+0x1b0/0x35c kthread+0x144/0x200 ret_from_fork+0x10/0x20 -> #0 (&bp->lock){+.+.}-{3:3}: __lock_acquire+0x15a8/0x2084 lock_acquire+0x1cc/0x350 rt_spin_lock+0x50/0x1f0 macb_start_xmit+0x808/0xb7c dev_hard_start_xmit+0x94/0x284 sch_direct_xmit+0x8c/0x37c __dev_queue_xmit+0x708/0x1120 neigh_resolve_output+0x148/0x28c ip6_finish_output2+0x2c0/0xb2c __ip6_finish_output+0x114/0x308 ip6_output+0xc4/0x4a4 mld_sendpack+0x220/0x68c mld_ifc_work+0x2a8/0x4f4 process_one_work+0x20c/0x5f8 worker_thread+0x1b0/0x35c kthread+0x144/0x200 ret_from_fork+0x10/0x20 other info that might help us debug this: Chain exists of: &bp->lock --> _xmit_ETHER#2 --> &queue->tx_ptr_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&queue->tx_ptr_lock); lock(_xmit_ETHER#2); lock(&queue->tx_ptr_lock); lock(&bp->lock); *** DEADLOCK *** Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0xa0/0xf0 dump_stack+0x18/0x24 print_circular_bug+0x28c/0x370 check_noncircular+0x198/0x1ac __lock_acquire+0x15a8/0x2084 lock_acquire+0x1cc/0x350 rt_spin_lock+0x50/0x1f0 macb_start_xmit+0x808/0xb7c dev_hard_start_xmit+0x94/0x284 sch_direct_xmit+0x8c/0x37c __dev_queue_xmit+0x708/0x1120 neigh_resolve_output+0x148/0x28c ip6_finish_output2+0x2c0/0xb2c __ip6_finish_output+0x114/0x308 ip6_output+0xc4/0x4a4 mld_sendpack+0x220/0x68c mld_ifc_work+0x2a8/0x4f4 process_one_work+0x20c/0x5f8 worker_thread+0x1b0/0x35c kthread+0x144/0x200 ret_from_fork+0x10/0x20 Notably, invoking the mog_init_rings() callback upon link establishment is unnecessary. Instead, we can exclusively call mog_init_rings() within the ndo_open() callback. This adjustment resolves the deadlock issue. Furthermore, since MACB_CAPS_MACB_IS_EMAC cases do not use mog_init_rings() when opening the network interface via at91ether_open(), moving mog_init_rings() to macb_open() also eliminates the MACB_CAPS_MACB_IS_EMAC check. Fixes: 633e98a711ac ("net: macb: use resolved link config in mac_link_up()") Cc: stable(a)vger.kernel.org Suggested-by: Kevin Hao <kexin.hao(a)windriver.com> Signed-off-by: Xiaolei Wang <xiaolei.wang(a)windriver.com> --- V1: https://patchwork.kernel.org/project/netdevbpf/patch/20251128103647.351259-… V2: Update the correct lock dependency chain and add the Fix tag. V3: update commit log, Add full deadlock log added explanations: because MACB_CAPS_MACB_IS_EMAC cases do not use mog_init_rings(), we don't need the MACB_CAPS_MACB_IS_EMAC check when moving mog_init_rings() to macb_open(). drivers/net/ethernet/cadence/macb_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c index ca2386b83473..064fccdcf699 100644 --- a/drivers/net/ethernet/cadence/macb_main.c +++ b/drivers/net/ethernet/cadence/macb_main.c @@ -744,7 +744,6 @@ static void macb_mac_link_up(struct phylink_config *config, /* Initialize rings & buffers as clearing MACB_BIT(TE) in link down * cleared the pipeline and control registers. */ - bp->macbgem_ops.mog_init_rings(bp); macb_init_buffers(bp); for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) @@ -2991,6 +2990,8 @@ static int macb_open(struct net_device *dev) goto pm_exit; } + bp->macbgem_ops.mog_init_rings(bp); + for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { napi_enable(&queue->napi_rx); napi_enable(&queue->napi_tx); -- 2.43.0

1 day, 19 hours

1
0
0 0

RE: Patch "cpufreq: dt-platdev: Add JH7110S SOC to the allowlist" has been added to the 6.12-stable tree

by Hal Feng

> On 19.12.25 20:33, Sasha Levin wrote: > > This is a note to let you know that I've just added the patch titled > > cpufreq: dt-platdev: Add JH7110S SOC to the allowlist > > to the 6.12-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable- > queue.git;a=summary > > The filename of the patch is: > cpufreq-dt-platdev-add-jh7110s-soc-to-the-allowlist.patch > and it can be found in the queue-6.12 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, please let > <stable(a)vger.kernel.org> know about it. As series [1] is accepted, this patch will be not needed and will be reverted in the mainline. [1] https://lore.kernel.org/all/20251212211934.135602-1-e@freeshell.de/ So we should not add it to the stable tree. Thanks. Best regards, Hal > > > > commit fb0dfa5be2ce8716ed8a7a6c8ffb8d36f5e03541 > Author: Hal Feng <hal.feng(a)starfivetech.com> > Date: Thu Oct 16 16:00:48 2025 +0800 > > cpufreq: dt-platdev: Add JH7110S SOC to the allowlist > > [ Upstream commit 6e7970cab51d01b8f7c56f120486c571c22e1b80 ] > > Add the compatible strings for supporting the generic > cpufreq driver on the StarFive JH7110S SoC. > > Signed-off-by: Hal Feng <hal.feng(a)starfivetech.com> > Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> > Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq- > dt-platdev.c > index 67bac12d4d55b..dbd73cd0cf535 100644 > --- a/drivers/cpufreq/cpufreq-dt-platdev.c > +++ b/drivers/cpufreq/cpufreq-dt-platdev.c > @@ -87,6 +87,7 @@ static const struct of_device_id allowlist[] __initconst = { > { .compatible = "st-ericsson,u9540", }, > > { .compatible = "starfive,jh7110", }, > + { .compatible = "starfive,jh7110s", }, > > { .compatible = "ti,omap2", }, > { .compatible = "ti,omap4", },

1 day, 19 hours

1
0
0 0

RE: Patch "cpufreq: dt-platdev: Add JH7110S SOC to the allowlist" has been added to the 6.18-stable tree

by Hal Feng

> On 19.12.25 20:31, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > cpufreq: dt-platdev: Add JH7110S SOC to the allowlist > > to the 6.18-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable- > queue.git;a=summary > > The filename of the patch is: > cpufreq-dt-platdev-add-jh7110s-soc-to-the-allowlist.patch > and it can be found in the queue-6.18 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, please let > <stable(a)vger.kernel.org> know about it. As series [1] is accepted, this patch will be not needed and will be reverted in the mainline. [1] https://lore.kernel.org/all/20251212211934.135602-1-e@freeshell.de/ So we should not add it to the stable tree. Thanks. Best regards, Hal > > > > commit f922a9b37397e7db449e3fa61c33c542ad783f87 > Author: Hal Feng <hal.feng(a)starfivetech.com> > Date: Thu Oct 16 16:00:48 2025 +0800 > > cpufreq: dt-platdev: Add JH7110S SOC to the allowlist > > [ Upstream commit 6e7970cab51d01b8f7c56f120486c571c22e1b80 ] > > Add the compatible strings for supporting the generic > cpufreq driver on the StarFive JH7110S SoC. > > Signed-off-by: Hal Feng <hal.feng(a)starfivetech.com> > Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> > Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq- > dt-platdev.c > index cd1816a12bb99..dc11b62399ad5 100644 > --- a/drivers/cpufreq/cpufreq-dt-platdev.c > +++ b/drivers/cpufreq/cpufreq-dt-platdev.c > @@ -87,6 +87,7 @@ static const struct of_device_id allowlist[] __initconst = { > { .compatible = "st-ericsson,u9540", }, > > { .compatible = "starfive,jh7110", }, > + { .compatible = "starfive,jh7110s", }, > > { .compatible = "ti,omap2", }, > { .compatible = "ti,omap4", },

1 day, 19 hours

1
0
0 0

ARMv7 Linux + Rust doesn't boot when compiling with only LLVM=1

by Rudraksha Gupta

Hello all, I have the following problem: https://gitlab.postmarketos.org/postmarketOS/pmbootstrap/-/issues/2635 In short, what is happening is the following: - The kernel boots and outputs via UART when I build the kernel with the following: make LLVM=1 ARCH="$arm" CC="${CC:-gcc}" - The kernel doesn't boot and there is no output via UART when I build the kernel with the following: make LLVM=1 ARCH="$arm" The only difference being: CC="${CC:-gcc}". Is this expected? I think this was present in the Linux kernel ever since Rust was enabled for ARMv7, and I never encountered it because postmarketOS was originally building the first way. Thanks, Rudraksha

1 day, 21 hours

5
11
0 0

[PATCH v2] net: usb: sr9700: fix incorrect command used to write single register

by Ethan Nelson-Moore

This fixes the device failing to initialize with "error reading MAC address" for me, probably because the incorrect write of NCR_RST to SR_NCR is not actually resetting the device. Fixes: c9b37458e95629b1d1171457afdcc1bf1eb7881d ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support") Cc: stable(a)vger.kernel.org Signed-off-by: Ethan Nelson-Moore <enelsonmoore(a)gmail.com> --- drivers/net/usb/sr9700.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c index 091bc2aca7e8..5d97e95a17b0 100644 --- a/drivers/net/usb/sr9700.c +++ b/drivers/net/usb/sr9700.c @@ -52,7 +52,7 @@ static int sr_read_reg(struct usbnet *dev, u8 reg, u8 *value) static int sr_write_reg(struct usbnet *dev, u8 reg, u8 value) { - return usbnet_write_cmd(dev, SR_WR_REGS, SR_REQ_WR_REG, + return usbnet_write_cmd(dev, SR_WR_REG, SR_REQ_WR_REG, value, reg, NULL, 0); } @@ -65,7 +65,7 @@ static void sr_write_async(struct usbnet *dev, u8 reg, u16 length, static void sr_write_reg_async(struct usbnet *dev, u8 reg, u8 value) { - usbnet_write_cmd_async(dev, SR_WR_REGS, SR_REQ_WR_REG, + usbnet_write_cmd_async(dev, SR_WR_REG, SR_REQ_WR_REG, value, reg, NULL, 0); } -- 2.43.0

1 day, 21 hours

2
2
0 0

[PATCH v1 3/5] mm: Take into account mm_cid size for mm_struct static definitions

by Mathieu Desnoyers

Both init_mm and efi_mm static definitions need to make room for the 2 mm_cid cpumasks. This fixes possible out-of-bounds accesses to init_mm and efi_mm. Fixes: af7f588d8f73 ("sched: Introduce per-memory-map concurrency ID") Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Mark Brown <broonie(a)kernel.org> Cc: stable(a)vger.kernel.org Cc: linux-mm(a)kvack.org --- include/linux/mm_types.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 1531df8cda52..aefa64db3499 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -1368,7 +1368,7 @@ extern struct mm_struct init_mm; #define MM_STRUCT_FLEXIBLE_ARRAY_INIT \ { \ - [0 ... sizeof(cpumask_t)-1] = 0 \ + [0 ... sizeof(cpumask_t) + MM_CID_STATIC_SIZE - 1] = 0 \ } /* Pointer magic because the dynamic array size confuses some compilers. */ @@ -1500,7 +1500,7 @@ static inline int mm_alloc_cid_noprof(struct mm_struct *mm, struct task_struct * mm_init_cid(mm, p); return 0; } -#define mm_alloc_cid(...) alloc_hooks(mm_alloc_cid_noprof(__VA_ARGS__)) +# define mm_alloc_cid(...) alloc_hooks(mm_alloc_cid_noprof(__VA_ARGS__)) static inline void mm_destroy_cid(struct mm_struct *mm) { @@ -1514,6 +1514,8 @@ static inline unsigned int mm_cid_size(void) return cpumask_size() + bitmap_size(num_possible_cpus()); } +/* Use NR_CPUS as worse case for static allocation. */ +# define MM_CID_STATIC_SIZE (2 * sizeof(cpumask_t)) #else /* CONFIG_SCHED_MM_CID */ static inline void mm_init_cid(struct mm_struct *mm, struct task_struct *p) { } static inline int mm_alloc_cid(struct mm_struct *mm, struct task_struct *p) { return 0; } @@ -1522,6 +1524,7 @@ static inline unsigned int mm_cid_size(void) { return 0; } +# define MM_CID_STATIC_SIZE 0 #endif /* CONFIG_SCHED_MM_CID */ struct mmu_gather; -- 2.39.5

1 day, 21 hours

1
0
0 0

[PATCH v1 1/5] mm: Add missing static initializer for init_mm::mm_cid.lock

by Mathieu Desnoyers

Initialize the mm_cid.lock struct member of init_mm. Fixes: 8cea569ca785 ("sched/mmcid: Use proper data structures") Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Cc: linux-mm(a)kvack.org --- mm/init-mm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/init-mm.c b/mm/init-mm.c index 4600e7605cab..a514f8ce47e3 100644 --- a/mm/init-mm.c +++ b/mm/init-mm.c @@ -44,6 +44,9 @@ struct mm_struct init_mm = { .mm_lock_seq = SEQCNT_ZERO(init_mm.mm_lock_seq), #endif .user_ns = &init_user_ns, +#ifdef CONFIG_SCHED_MM_CID + .mm_cid.lock = __RAW_SPIN_LOCK_UNLOCKED(init_mm.mm_cid.lock), +#endif .cpu_bitmap = CPU_BITS_NONE, INIT_MM_CONTEXT(init_mm) }; -- 2.39.5

1 day, 21 hours

1
0
0 0

[PATCH] iio: imu: inv_icm45600: fix temperature offset reporting

by Jean-Baptiste Maneyrol via B4 Relay

From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> Correct temperature computation is (raw + offset) * scale and not apply scale and offset afterward. Fix temperature offset reporting to the correct value and update commentaries for the new computation. Fixes: 27e072bc34d1 ("iio: imu: inv_icm45600: add IMU IIO gyroscope device") Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> Cc: stable(a)vger.kernel.org --- drivers/iio/imu/inv_icm45600/inv_icm45600_core.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/iio/imu/inv_icm45600/inv_icm45600_core.c b/drivers/iio/imu/inv_icm45600/inv_icm45600_core.c index ab1cb7b9dba435a3280e50ab77cd16e903c7816c..25bd9757a594d0180d7f53b49f959a49a50c64a9 100644 --- a/drivers/iio/imu/inv_icm45600/inv_icm45600_core.c +++ b/drivers/iio/imu/inv_icm45600/inv_icm45600_core.c @@ -960,16 +960,17 @@ int inv_icm45600_temp_read_raw(struct iio_dev *indio_dev, return IIO_VAL_INT; /* * T°C = (temp / 128) + 25 - * Tm°C = 1000 * ((temp * 100 / 12800) + 25) - * scale: 100000 / 13248 = 7.8125 - * offset: 25000 + * Tm°C = ((temp + 25 * 128) / 128)) * 1000 + * Tm°C = (temp + 3200) * (1000 / 128) + * scale: 1000 / 128 = 7.8125 + * offset: 3200 */ case IIO_CHAN_INFO_SCALE: *val = 7; *val2 = 812500; return IIO_VAL_INT_PLUS_MICRO; case IIO_CHAN_INFO_OFFSET: - *val = 25000; + *val = 3200; return IIO_VAL_INT; default: return -EINVAL; --- base-commit: a7b10f0963c651a6406d958a5f64b9c5594f84da change-id: 20251218-inv-icm45600-fix-temperature-offset-reporting-190a09adfdad Best regards, -- Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com>

2 days, 2 hours

2
1
0 0

[PATCH] iio: adc: exynos_adc: fix OF populate on driver rebind

by Johan Hovold

Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes. Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound. Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") Cc: stable(a)vger.kernel.org # 3.16 Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/iio/adc/exynos_adc.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/drivers/iio/adc/exynos_adc.c b/drivers/iio/adc/exynos_adc.c index 1484adff00df..f2400897818c 100644 --- a/drivers/iio/adc/exynos_adc.c +++ b/drivers/iio/adc/exynos_adc.c @@ -540,15 +540,6 @@ static const struct iio_chan_spec exynos_adc_iio_channels[] = { ADC_CHANNEL(9, "adc9"), }; -static int exynos_adc_remove_devices(struct device *dev, void *c) -{ - struct platform_device *pdev = to_platform_device(dev); - - platform_device_unregister(pdev); - - return 0; -} - static int exynos_adc_probe(struct platform_device *pdev) { struct exynos_adc *info = NULL; @@ -660,8 +651,7 @@ static int exynos_adc_probe(struct platform_device *pdev) return 0; err_of_populate: - device_for_each_child(&indio_dev->dev, NULL, - exynos_adc_remove_devices); + of_platform_depopulate(&indio_dev->dev); iio_device_unregister(indio_dev); err_irq: free_irq(info->irq, info); @@ -681,8 +671,7 @@ static void exynos_adc_remove(struct platform_device *pdev) struct iio_dev *indio_dev = platform_get_drvdata(pdev); struct exynos_adc *info = iio_priv(indio_dev); - device_for_each_child(&indio_dev->dev, NULL, - exynos_adc_remove_devices); + of_platform_depopulate(&indio_dev->dev); iio_device_unregister(indio_dev); free_irq(info->irq, info); if (info->data->exit_hw) -- 2.51.2

2 days, 4 hours

3
2
0 0

[PATCH] fbdev: Use device_create_with_groups() to fix sysfs groups registration race

by Hans de Goede

The fbdev sysfs attributes are registered after sending the uevent for the device creation, leaving a race window where e.g. udev rules may not be able to access the sysfs attributes because the registration is not done yet. Fix this by switching to device_create_with_groups(). This also results in a nice cleanup. After switching to device_create_with_groups() all that is left of fb_init_device() is setting the drvdata and that can be passed to device_create[_with_groups]() too. After which fb_init_device() can be completely removed. Dropping fb_init_device() + fb_cleanup_device() in turn allows removing fb_info.class_flag as they were the only user of this field. Fixes: 5fc830d6aca1 ("fbdev: Register sysfs groups through device_add_group") Cc: stable(a)vger.kernel.org Cc: Shixiong Ou <oushixiong(a)kylinos.cn> Signed-off-by: Hans de Goede <johannes.goede(a)oss.qualcomm.com> --- Note the fixes tag is technically wrong. This race has existed forever. The commit I picked for the fixes tag is a dependency of this change not the commit introducing the race. I don't believe that backporting this back any further is useful which is why I went with this commit. --- drivers/video/fbdev/core/fbsysfs.c | 36 +++--------------------------- include/linux/fb.h | 1 - 2 files changed, 3 insertions(+), 34 deletions(-) diff --git a/drivers/video/fbdev/core/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c index b8344c40073b..baa2bae0fb5b 100644 --- a/drivers/video/fbdev/core/fbsysfs.c +++ b/drivers/video/fbdev/core/fbsysfs.c @@ -12,8 +12,6 @@ #include "fb_internal.h" -#define FB_SYSFS_FLAG_ATTR 1 - static int activate(struct fb_info *fb_info, struct fb_var_screeninfo *var) { int err; @@ -451,33 +449,7 @@ static struct attribute *fb_device_attrs[] = { NULL, }; -static const struct attribute_group fb_device_attr_group = { - .attrs = fb_device_attrs, -}; - -static int fb_init_device(struct fb_info *fb_info) -{ - int ret; - - dev_set_drvdata(fb_info->dev, fb_info); - - fb_info->class_flag |= FB_SYSFS_FLAG_ATTR; - - ret = device_add_group(fb_info->dev, &fb_device_attr_group); - if (ret) - fb_info->class_flag &= ~FB_SYSFS_FLAG_ATTR; - - return 0; -} - -static void fb_cleanup_device(struct fb_info *fb_info) -{ - if (fb_info->class_flag & FB_SYSFS_FLAG_ATTR) { - device_remove_group(fb_info->dev, &fb_device_attr_group); - - fb_info->class_flag &= ~FB_SYSFS_FLAG_ATTR; - } -} +ATTRIBUTE_GROUPS(fb_device); int fb_device_create(struct fb_info *fb_info) { @@ -485,14 +457,13 @@ int fb_device_create(struct fb_info *fb_info) dev_t devt = MKDEV(FB_MAJOR, node); int ret; - fb_info->dev = device_create(fb_class, fb_info->device, devt, NULL, "fb%d", node); + fb_info->dev = device_create_with_groups(fb_class, fb_info->device, devt, fb_info, + fb_device_groups, "fb%d", node); if (IS_ERR(fb_info->dev)) { /* Not fatal */ ret = PTR_ERR(fb_info->dev); pr_warn("Unable to create device for framebuffer %d; error %d\n", node, ret); fb_info->dev = NULL; - } else { - fb_init_device(fb_info); } return 0; @@ -505,7 +476,6 @@ void fb_device_destroy(struct fb_info *fb_info) if (!fb_info->dev) return; - fb_cleanup_device(fb_info); device_destroy(fb_class, devt); fb_info->dev = NULL; } diff --git a/include/linux/fb.h b/include/linux/fb.h index 05cc251035da..c3302d513546 100644 --- a/include/linux/fb.h +++ b/include/linux/fb.h @@ -497,7 +497,6 @@ struct fb_info { #if defined(CONFIG_FB_DEVICE) struct device *dev; /* This is this fb device */ #endif - int class_flag; /* private sysfs flags */ #ifdef CONFIG_FB_TILEBLITTING struct fb_tile_ops *tileops; /* Tile Blitting */ #endif -- 2.52.0

2 days, 4 hours

1
0
0 0

LDI Show 2025 Attendee List

by Audrey Roberts

Hi Exhibitor, Hope you had a successful experience at LDI Show 2025 (Dec 3–9, Las Vegas). We have access to a verified list of 16,594 attendees and 312 exhibitors across the live events, lighting, audio, staging, and production-technology sectors. This includes lighting designers, audio engineers, production managers, AV integrators, stage/rigging technicians, venue operations heads, broadcast specialists, and other key live-event decision-makers. Don’t miss the opportunity to connect with high-quality prospects after the event. If interested, kindly reply “Send Pricing” to receive the details. Best regards, Audrey Roberts Senior Market Analyst To opt-out, reply “Not Interested”.

2 days, 4 hours

1
0
0 0

[PATCH v2] erofs: fix unexpected EIO under memory pressure

by Junbeom Yeom

erofs readahead could fail with ENOMEM under the memory pressure because it tries to alloc_page with GFP_NOWAIT | GFP_NORETRY, while GFP_KERNEL for a regular read. And if readahead fails (with non-uptodate folios), the original request will then fall back to synchronous read, and `.read_folio()` should return appropriate errnos. However, in scenarios where readahead and read operations compete, read operation could return an unintended EIO because of an incorrect error propagation. To resolve this, this patch modifies the behavior so that, when the PCL is for read(which means pcl.besteffort is true), it attempts actual decompression instead of propagating the privios error except initial EIO. - Page size: 4K - The original size of FileA: 16K - Compress-ratio per PCL: 50% (Uncompressed 8K -> Compressed 4K) [page0, page1] [page2, page3] [PCL0]---------[PCL1] - functions declaration: . pread(fd, buf, count, offset) . readahead(fd, offset, count) - Thread A tries to read the last 4K - Thread B tries to do readahead 8K from 4K - RA, besteffort == false - R, besteffort == true <process A> <process B> pread(FileA, buf, 4K, 12K) do readahead(page3) // failed with ENOMEM wait_lock(page3) if (!uptodate(page3)) goto do_read readahead(FileA, 4K, 8K) // Here create PCL-chain like below: // [null, page1] [page2, null] // [PCL0:RA]-----[PCL1:RA] ... do read(page3) // found [PCL1:RA] and add page3 into it, // and then, change PCL1 from RA to R ... // Now, PCL-chain is as below: // [null, page1] [page2, page3] // [PCL0:RA]-----[PCL1:R] // try to decompress PCL-chain... z_erofs_decompress_queue err = 0; // failed with ENOMEM, so page 1 // only for RA will not be uptodated. // it's okay. err = decompress([PCL0:RA], err) // However, ENOMEM propagated to next // PCL, even though PCL is not only // for RA but also for R. As a result, // it just failed with ENOMEM without // trying any decompression, so page2 // and page3 will not be uptodated. ** BUG HERE ** --> err = decompress([PCL1:R], err) return err as ENOMEM ... wait_lock(page3) if (!uptodate(page3)) return EIO <-- Return an unexpected EIO! ... Fixes: 2349d2fa02db ("erofs: sunset unneeded NOFAILs") Cc: stable(a)vger.kernel.org Reviewed-by: Jaewook Kim <jw5454.kim(a)samsung.com> Reviewed-by: Sungjong Seo <sj1557.seo(a)samsung.com> Signed-off-by: Junbeom Yeom <junbeom.yeom(a)samsung.com> --- v2: - If disk I/Os are successful, handle to decompress each pcluster. fs/erofs/zdata.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c index 27b1f44d10ce..70e1597dec8a 100644 --- a/fs/erofs/zdata.c +++ b/fs/erofs/zdata.c @@ -1262,7 +1262,7 @@ static int z_erofs_parse_in_bvecs(struct z_erofs_backend *be, bool *overlapped) return err; } -static int z_erofs_decompress_pcluster(struct z_erofs_backend *be, int err) +static int z_erofs_decompress_pcluster(struct z_erofs_backend *be, bool eio) { struct erofs_sb_info *const sbi = EROFS_SB(be->sb); struct z_erofs_pcluster *pcl = be->pcl; @@ -1270,7 +1270,7 @@ static int z_erofs_decompress_pcluster(struct z_erofs_backend *be, int err) const struct z_erofs_decompressor *alg = z_erofs_decomp[pcl->algorithmformat]; bool try_free = true; - int i, j, jtop, err2; + int i, j, jtop, err2, err = eio ? -EIO : 0; struct page *page; bool overlapped; const char *reason; @@ -1413,12 +1413,12 @@ static int z_erofs_decompress_queue(const struct z_erofs_decompressqueue *io, .pcl = io->head, }; struct z_erofs_pcluster *next; - int err = io->eio ? -EIO : 0; + int err = 0; for (; be.pcl != Z_EROFS_PCLUSTER_TAIL; be.pcl = next) { DBG_BUGON(!be.pcl); next = READ_ONCE(be.pcl->next); - err = z_erofs_decompress_pcluster(&be, err) ?: err; + err = z_erofs_decompress_pcluster(&be, io->eio) ?: err; } return err; } -- 2.34.1

2 days, 5 hours

2
1
0 0

Re: [PATCH] net: usb: sr9700: fix incorrect command used to write single register

by kernel test robot

Hi, Thanks for your patch. FYI: kernel test robot notices the stable kernel rule is not satisfied. The check is based on https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html#opt… Rule: add the tag "Cc: stable(a)vger.kernel.org" in the sign-off area to have the patch automatically included in the stable tree. Subject: [PATCH] net: usb: sr9700: fix incorrect command used to write single register Link: https://lore.kernel.org/stable/20251221072732.41426-1-enelsonmoore%40gmail.… -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

2 days, 13 hours

1
0
0 0

[PATCH] mfd: qcom-pm8xxx: fix OF populate on driver rebind

by Johan Hovold

Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes. Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound. Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") Cc: stable(a)vger.kernel.org # 3.16 Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/mfd/qcom-pm8xxx.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/mfd/qcom-pm8xxx.c b/drivers/mfd/qcom-pm8xxx.c index 1149f7102a36..0cf374c015ce 100644 --- a/drivers/mfd/qcom-pm8xxx.c +++ b/drivers/mfd/qcom-pm8xxx.c @@ -577,17 +577,11 @@ static int pm8xxx_probe(struct platform_device *pdev) return rc; } -static int pm8xxx_remove_child(struct device *dev, void *unused) -{ - platform_device_unregister(to_platform_device(dev)); - return 0; -} - static void pm8xxx_remove(struct platform_device *pdev) { struct pm_irq_chip *chip = platform_get_drvdata(pdev); - device_for_each_child(&pdev->dev, NULL, pm8xxx_remove_child); + of_platform_depopulate(&pdev->dev); irq_domain_remove(chip->irqdomain); } -- 2.51.2

2 days, 16 hours

3
2
0 0

+ fix-amdgpu-failure-with-periodic-signal.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: AMDGPU: fix failure with periodic signal has been added to the -mm mm-hotfixes-unstable branch. Its filename is fix-amdgpu-failure-with-periodic-signal.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Mikulas Patocka <mpatocka(a)redhat.com> Subject: AMDGPU: fix failure with periodic signal Date: Fri, 7 Nov 2025 18:48:01 +0100 (CET) If a process sets up a timer that periodically sends a signal in short intervals and if it uses OpenCL on AMDGPU at the same time, we get random errors. Sometimes, probing the OpenCL device fails (strace shows that open("/dev/kfd") failed with -EINTR). Sometimes we get the message "amdgpu: init_user_pages: Failed to register MMU notifier: -4" in the syslog. The bug can be reproduced with this program: http://www.jikos.cz/~mikulas/testcases/opencl/opencl-bug-small.c The root cause for these failures is in the function mm_take_all_locks. This function fails with -EINTR if there is pending signal. The -EINTR is propagated up the call stack to userspace and userspace fails if it gets this error. There is the following call chain: kfd_open -> kfd_create_process -> create_process -> mmu_notifier_get -> mmu_notifier_get_locked -> __mmu_notifier_register -> mm_take_all_locks -> "return -EINTR" If the failure happens in init_user_pages, there is the following call chain: init_user_pages -> amdgpu_hmm_register -> mmu_interval_notifier_insert -> mmu_notifier_register -> __mmu_notifier_register -> mm_take_all_locks -> "return -EINTR" In order to fix these failures, this commit changes signal_pending(current) to fatal_signal_pending(current) in mm_take_all_locks, so that it is interrupted only if the signal is actually killing the process. Also, this commit skips pr_err in init_user_pages if the process is being killed - in this situation, there was no error and so we don't want to report it in the syslog. I'm submitting this patch for the stable kernels, because this bug may cause random failures in any OpenCL code. Link: https://lkml.kernel.org/r/6f16b618-26fc-3031-abe8-65c2090262e7@redhat.com Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: Alexander Deucher <alexander.deucher(a)amd.com> Cc: Christan K��nig <christian.koenig(a)amd.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: "Liam R. Howlett" <Liam.Howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Jann Horn <jannh(a)google.com> Cc: Pedro Falcato <pfalcato(a)suse.de> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 9 +++++++-- mm/vma.c | 8 ++++---- 2 files changed, 11 insertions(+), 6 deletions(-) --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c~fix-amdgpu-failure-with-periodic-signal +++ a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c @@ -1070,8 +1070,13 @@ static int init_user_pages(struct kgd_me ret = amdgpu_hmm_register(bo, user_addr); if (ret) { - pr_err("%s: Failed to register MMU notifier: %d\n", - __func__, ret); + /* + * If we got EINTR because the process was killed, don't report + * it, because no error happened. + */ + if (!(fatal_signal_pending(current) && ret == -EINTR)) + pr_err("%s: Failed to register MMU notifier: %d\n", + __func__, ret); goto out; } --- a/mm/vma.c~fix-amdgpu-failure-with-periodic-signal +++ a/mm/vma.c @@ -2166,14 +2166,14 @@ int mm_take_all_locks(struct mm_struct * * is reached. */ for_each_vma(vmi, vma) { - if (signal_pending(current)) + if (fatal_signal_pending(current)) goto out_unlock; vma_start_write(vma); } vma_iter_init(&vmi, mm, 0); for_each_vma(vmi, vma) { - if (signal_pending(current)) + if (fatal_signal_pending(current)) goto out_unlock; if (vma->vm_file && vma->vm_file->f_mapping && is_vm_hugetlb_page(vma)) @@ -2182,7 +2182,7 @@ int mm_take_all_locks(struct mm_struct * vma_iter_init(&vmi, mm, 0); for_each_vma(vmi, vma) { - if (signal_pending(current)) + if (fatal_signal_pending(current)) goto out_unlock; if (vma->vm_file && vma->vm_file->f_mapping && !is_vm_hugetlb_page(vma)) @@ -2191,7 +2191,7 @@ int mm_take_all_locks(struct mm_struct * vma_iter_init(&vmi, mm, 0); for_each_vma(vmi, vma) { - if (signal_pending(current)) + if (fatal_signal_pending(current)) goto out_unlock; if (vma->anon_vma) list_for_each_entry(avc, &vma->anon_vma_chain, same_vma) _ Patches currently in -mm which might be from mpatocka(a)redhat.com are fix-amdgpu-failure-with-periodic-signal.patch

2 days, 20 hours

1
0
0 0

+ mm-page_owner-fix-memory-leak-in-page_owner_stack_fops-release.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm/page_owner: fix memory leak in page_owner_stack_fops->release() has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-page_owner-fix-memory-leak-in-page_owner_stack_fops-release.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Ran Xiaokai <ran.xiaokai(a)zte.com.cn> Subject: mm/page_owner: fix memory leak in page_owner_stack_fops->release() Date: Fri, 19 Dec 2025 07:42:32 +0000 The page_owner_stack_fops->open() callback invokes seq_open_private(), therefore its corresponding ->release() callback must call seq_release_private(). Otherwise it will cause a memory leak of struct stack_print_ctx. Link: https://lkml.kernel.org/r/20251219074232.136482-1-ranxiaokai627@163.com Fixes: 765973a098037 ("mm,page_owner: display all stacks and their count") Signed-off-by: Ran Xiaokai <ran.xiaokai(a)zte.com.cn> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: Andrey Konovalov <andreyknvl(a)gmail.com> Cc: Brendan Jackman <jackmanb(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Marco Elver <elver(a)google.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Zi Yan <ziy(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/page_owner.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/page_owner.c~mm-page_owner-fix-memory-leak-in-page_owner_stack_fops-release +++ a/mm/page_owner.c @@ -952,7 +952,7 @@ static const struct file_operations page .open = page_owner_stack_open, .read = seq_read, .llseek = seq_lseek, - .release = seq_release, + .release = seq_release_private, }; static int page_owner_threshold_get(void *data, u64 *val) _ Patches currently in -mm which might be from ran.xiaokai(a)zte.com.cn are mm-page_owner-fix-memory-leak-in-page_owner_stack_fops-release.patch

2 days, 22 hours

1
0
0 0

+ mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm/memory-failure: fix missing ->mf_stats count in hugetlb poison has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Jane Chu <jane.chu(a)oracle.com> Subject: mm/memory-failure: fix missing ->mf_stats count in hugetlb poison Date: Fri, 19 Dec 2025 12:15:58 -0700 When a newly poisoned subpage ends up in an already poisoned hugetlb folio, 'num_poisoned_pages' is incremented, but the per node ->mf_stats is not. Fix the inconsistency by designating action_result() to update them both. While at it, define __get_huge_page_for_hwpoison() return values in terms of symbol names for better readibility. Also rename folio_set_hugetlb_hwpoison() to hugetlb_update_hwpoison() since the function does more than the conventional bit setting and the fact three possible return values are expected. Link: https://lkml.kernel.org/r/20251219191559.2962716-1-jane.chu@oracle.com Fixes: 18f41fa616ee4 ("mm: memory-failure: bump memory failure stats to pglist_data") Signed-off-by: Jane Chu <jane.chu(a)oracle.com> Cc: "David Hildenbrand (Red Hat)" <david(a)kernel.org> Cc: David Rientjes <rientjes(a)google.com> Cc: Jiaqi Yan <jiaqiyan(a)google.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Miaohe Lin <linmiaohe(a)huawei.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: William Roche <william.roche(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memory-failure.c | 56 ++++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 23 deletions(-) --- a/mm/memory-failure.c~mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison +++ a/mm/memory-failure.c @@ -1883,12 +1883,18 @@ static unsigned long __folio_free_raw_hw return count; } -static int folio_set_hugetlb_hwpoison(struct folio *folio, struct page *page) +#define MF_HUGETLB_ALREADY_POISONED 3 /* already poisoned */ +#define MF_HUGETLB_ACC_EXISTING_POISON 4 /* accessed existing poisoned page */ +/* + * Set hugetlb folio as hwpoisoned, update folio private raw hwpoison list + * to keep track of the poisoned pages. + */ +static int hugetlb_update_hwpoison(struct folio *folio, struct page *page) { struct llist_head *head; struct raw_hwp_page *raw_hwp; struct raw_hwp_page *p; - int ret = folio_test_set_hwpoison(folio) ? -EHWPOISON : 0; + int ret = folio_test_set_hwpoison(folio) ? MF_HUGETLB_ALREADY_POISONED : 0; /* * Once the hwpoison hugepage has lost reliable raw error info, @@ -1896,20 +1902,18 @@ static int folio_set_hugetlb_hwpoison(st * so skip to add additional raw error info. */ if (folio_test_hugetlb_raw_hwp_unreliable(folio)) - return -EHWPOISON; + return MF_HUGETLB_ALREADY_POISONED; + head = raw_hwp_list_head(folio); llist_for_each_entry(p, head->first, node) { if (p->page == page) - return -EHWPOISON; + return MF_HUGETLB_ACC_EXISTING_POISON; } raw_hwp = kmalloc(sizeof(struct raw_hwp_page), GFP_ATOMIC); if (raw_hwp) { raw_hwp->page = page; llist_add(&raw_hwp->node, head); - /* the first error event will be counted in action_result(). */ - if (ret) - num_poisoned_pages_inc(page_to_pfn(page)); } else { /* * Failed to save raw error info. We no longer trace all @@ -1955,32 +1959,30 @@ void folio_clear_hugetlb_hwpoison(struct folio_free_raw_hwp(folio, true); } +#define MF_HUGETLB_FREED 0 /* freed hugepage */ +#define MF_HUGETLB_IN_USED 1 /* in-use hugepage */ +#define MF_NOT_HUGETLB 2 /* not a hugepage */ + /* * Called from hugetlb code with hugetlb_lock held. - * - * Return values: - * 0 - free hugepage - * 1 - in-use hugepage - * 2 - not a hugepage - * -EBUSY - the hugepage is busy (try to retry) - * -EHWPOISON - the hugepage is already hwpoisoned */ int __get_huge_page_for_hwpoison(unsigned long pfn, int flags, bool *migratable_cleared) { struct page *page = pfn_to_page(pfn); struct folio *folio = page_folio(page); - int ret = 2; /* fallback to normal page handling */ + int ret = MF_NOT_HUGETLB; bool count_increased = false; + int rc; if (!folio_test_hugetlb(folio)) goto out; if (flags & MF_COUNT_INCREASED) { - ret = 1; + ret = MF_HUGETLB_IN_USED; count_increased = true; } else if (folio_test_hugetlb_freed(folio)) { - ret = 0; + ret = MF_HUGETLB_FREED; } else if (folio_test_hugetlb_migratable(folio)) { ret = folio_try_get(folio); if (ret) @@ -1991,8 +1993,9 @@ int __get_huge_page_for_hwpoison(unsigne goto out; } - if (folio_set_hugetlb_hwpoison(folio, page)) { - ret = -EHWPOISON; + rc = hugetlb_update_hwpoison(folio, page); + if (rc >= MF_HUGETLB_ALREADY_POISONED) { + ret = rc; goto out; } @@ -2029,22 +2032,29 @@ static int try_memory_failure_hugetlb(un *hugetlb = 1; retry: res = get_huge_page_for_hwpoison(pfn, flags, &migratable_cleared); - if (res == 2) { /* fallback to normal page handling */ + switch (res) { + case MF_NOT_HUGETLB: /* fallback to normal page handling */ *hugetlb = 0; return 0; - } else if (res == -EHWPOISON) { + case MF_HUGETLB_ALREADY_POISONED: + case MF_HUGETLB_ACC_EXISTING_POISON: if (flags & MF_ACTION_REQUIRED) { folio = page_folio(p); res = kill_accessing_process(current, folio_pfn(folio), flags); } - action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); + if (res == MF_HUGETLB_ALREADY_POISONED) + action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); + else + action_result(pfn, MF_MSG_HUGE, MF_FAILED); return res; - } else if (res == -EBUSY) { + case -EBUSY: if (!(flags & MF_NO_RETRY)) { flags |= MF_NO_RETRY; goto retry; } return action_result(pfn, MF_MSG_GET_HWPOISON, MF_IGNORED); + default: + break; } folio = page_folio(p); _ Patches currently in -mm which might be from jane.chu(a)oracle.com are mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison.patch

2 days, 22 hours

1
0
0 0

[PATCH] PNP: add put_device() in pnpbios_init()

by Haoxiang Li

If pnp_register_protocol() fails, call put_device() to drop the device reference. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- drivers/pnp/pnpbios/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/pnp/pnpbios/core.c b/drivers/pnp/pnpbios/core.c index f7e86ae9f72f..997e0153d6e3 100644 --- a/drivers/pnp/pnpbios/core.c +++ b/drivers/pnp/pnpbios/core.c @@ -538,6 +538,7 @@ static int __init pnpbios_init(void) /* register with the pnp layer */ ret = pnp_register_protocol(&pnpbios_protocol); if (ret) { + put_device(&pnpbios_protocol.dev) printk(KERN_ERR "PnPBIOS: Unable to register driver. Aborting.\n"); return ret; -- 2.25.1

2 days, 23 hours

3
3
0 0

[PATCH 0/2] block/blk-mq: fix RT kernel performance regressions

by Ionut Nechita (WindRiver)

From: Ionut Nechita <ionut.nechita(a)windriver.com> This series addresses two critical performance regressions in the block layer multiqueue (blk-mq) subsystem when running on PREEMPT_RT kernels. On RT kernels, regular spinlocks are converted to sleeping rt_mutex locks, which can cause severe performance degradation in the I/O hot path. This series converts two problematic locking patterns to prevent IRQ threads from sleeping during I/O operations. Testing on MegaRAID 12GSAS controller with 8 MSI-X vectors shows: - v6.6.52-rt (before regression): 640 MB/s sequential read - v6.6.64-rt (regression introduced): 153 MB/s (-76% regression) - v6.6.68-rt with queue_lock fix only: 640 MB/s (performance restored) - v6.6.69-rt with both fixes: expected similar or better performance The first patch replaces queue_lock with memory barriers in the I/O completion hot path, eliminating the contention that caused IRQ threads to sleep. The second patch converts the global blk_mq_cpuhp_lock from mutex to raw_spinlock to prevent sleeping during CPU hotplug operations. Both conversions are safe because the protected code paths only perform fast, non-blocking operations (memory barriers, list/hlist manipulation, flag checks). Ionut Nechita (2): block/blk-mq: fix RT kernel regression with queue_lock in hot path block/blk-mq: convert blk_mq_cpuhp_lock to raw_spinlock for RT block/blk-mq.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) -- 2.52.0

3 days

3
5
0 0

[PATCH v2] net: dsa: Fix error handling in dsa_port_parse_of

by Ma Ke

When of_find_net_device_by_node() successfully acquires a reference to a network device but the subsequent call to dsa_port_parse_cpu() fails, dsa_port_parse_of() returns without releasing the reference count on the network device. of_find_net_device_by_node() increments the reference count of the returned structure, which should be balanced with a corresponding put_device() when the reference is no longer needed. Found by code review. Cc: stable(a)vger.kernel.org Fixes: deff710703d8 ("net: dsa: Allow default tag protocol to be overridden from DT") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- Changes in v2: - simplified the patch as suggestions; - modified the Fixes tag as suggestions. --- net/dsa/dsa.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c index a20efabe778f..31b409a47491 100644 --- a/net/dsa/dsa.c +++ b/net/dsa/dsa.c @@ -1247,6 +1247,7 @@ static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn) struct device_node *ethernet = of_parse_phandle(dn, "ethernet", 0); const char *name = of_get_property(dn, "label", NULL); bool link = of_property_read_bool(dn, "link"); + int err = 0; dp->dn = dn; @@ -1260,7 +1261,11 @@ static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn) return -EPROBE_DEFER; user_protocol = of_get_property(dn, "dsa-tag-protocol", NULL); - return dsa_port_parse_cpu(dp, conduit, user_protocol); + err = dsa_port_parse_cpu(dp, conduit, user_protocol); + if (err) + put_device(conduit); + + return err; } if (link) -- 2.17.1

3 days, 4 hours

4
6
0 0

[PATCH] scsi: be2iscsi: fix a memory leak in beiscsi_boot_get_sinfo()

by Haoxiang Li

If nonemb_cmd->va fails to be allocated, call free_mcc_wrb() to restore the impact caused by alloc_mcc_wrb(). Fixes: 50a4b824be9e ("scsi: be2iscsi: Fix to make boot discovery non-blocking") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- drivers/scsi/be2iscsi/be_mgmt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/be2iscsi/be_mgmt.c b/drivers/scsi/be2iscsi/be_mgmt.c index 4e899ec1477d..b1cba986f0fb 100644 --- a/drivers/scsi/be2iscsi/be_mgmt.c +++ b/drivers/scsi/be2iscsi/be_mgmt.c @@ -1025,6 +1025,7 @@ unsigned int beiscsi_boot_get_sinfo(struct beiscsi_hba *phba) &nonemb_cmd->dma, GFP_KERNEL); if (!nonemb_cmd->va) { + free_mcc_wrb(ctrl, tag); mutex_unlock(&ctrl->mbox_lock); return 0; } -- 2.25.1

3 days, 4 hours

2
1
0 0

[PATCH] iommu/io-pgtable-arm: fix size_t signedness bug in unmap path

by Chaitanya Kulkarni

__arm_lpae_unmap() returns size_t but was returning -ENOENT (negative error code) when encountering an unmapped PTE. Since size_t is unsigned, -ENOENT (typically -2) becomes a huge positive value (0xFFFFFFFFFFFFFFFE on 64-bit systems). This corrupted value propagates through the call chain: __arm_lpae_unmap() returns -ENOENT as size_t -> arm_lpae_unmap_pages() returns it -> __iommu_unmap() adds it to iova address -> iommu_pgsize() triggers BUG_ON due to corrupted iova This can cause IOVA address overflow in __iommu_unmap() loop and trigger BUG_ON in iommu_pgsize() from invalid address alignment. Fix by returning 0 instead of -ENOENT. The WARN_ON already signals the error condition, and returning 0 (meaning "nothing unmapped") is the correct semantic for size_t return type. This matches the behavior of other io-pgtable implementations (io-pgtable-arm-v7s, io-pgtable-dart) which return 0 on error conditions. Fixes: 3318f7b5cefb ("iommu/io-pgtable-arm: Add quirk to quiet WARN_ON()") Cc: stable(a)vger.kernel.org Signed-off-by: Chaitanya Kulkarni <ckulkarnilinux(a)gmail.com> --- drivers/iommu/io-pgtable-arm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index e6626004b323..05d63fe92e43 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -637,7 +637,7 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, pte = READ_ONCE(*ptep); if (!pte) { WARN_ON(!(data->iop.cfg.quirks & IO_PGTABLE_QUIRK_NO_WARN)); - return -ENOENT; + return 0; } /* If the size matches this level, we're in the right place */ -- 2.40.0

3 days, 6 hours

2
1
0 0

[PATCH] sh: dma-sysfs: add missing put_device() in dma_create_sysfs_files()

by Haoxiang Li

If device_register() fails, call put_device() to drop the device reference. Also, call device_unregister() if device_create_file() fails. Found by code review. Fixes: dc6876a288cc ("sh: dma - convert sysdev_class to a regular subsystem") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- arch/sh/drivers/dma/dma-sysfs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/sh/drivers/dma/dma-sysfs.c b/arch/sh/drivers/dma/dma-sysfs.c index 9f666280d80c..5695fd0a0cd7 100644 --- a/arch/sh/drivers/dma/dma-sysfs.c +++ b/arch/sh/drivers/dma/dma-sysfs.c @@ -134,8 +134,10 @@ int dma_create_sysfs_files(struct dma_channel *chan, struct dma_info *info) dev->bus = &dma_subsys; ret = device_register(dev); - if (ret) + if (ret) { + put_device(dev); return ret; + } ret |= device_create_file(dev, &dev_attr_dev_id); ret |= device_create_file(dev, &dev_attr_count); @@ -145,6 +147,7 @@ int dma_create_sysfs_files(struct dma_channel *chan, struct dma_info *info) if (unlikely(ret)) { dev_err(&info->pdev->dev, "Failed creating attrs\n"); + device_unregister(dev); return ret; } -- 2.25.1

3 days, 6 hours

3
2
0 0

[PATCH v2] drm/amdgpu: don't attach the tlb fence for SI

by Hans de Goede

From: Alex Deucher <alexander.deucher(a)amd.com> commit eb296c09805ee37dd4ea520a7fb3ec157c31090f upstream. SI hardware doesn't support pasids, user mode queues, or KIQ/MES so there is no need for this. Doing so results in a segfault as these callbacks are non-existent for SI. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4744 Fixes: b4a7f4e7ad2b ("drm/amdgpu: attach tlb fence to the PTs update") Reviewed-by: Timur Kristóf <timur.kristof(a)gmail.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 820b3d376e8a102c6aeab737ec6edebbbb710e04) Signed-off-by: Hans de Goede <johannes.goede(a)oss.qualcomm.com> --- Changes in v2 stable submission: - Correct the Fixes: tag hash which is wrong in the original upstream commit eb296c09805e ("drm/amdgpu: don't attach the tlb fence for SI") --- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c index 676e24fb8864..cdcafde3c71a 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c @@ -1066,7 +1066,9 @@ amdgpu_vm_tlb_flush(struct amdgpu_vm_update_params *params, } /* Prepare a TLB flush fence to be attached to PTs */ - if (!params->unlocked) { + if (!params->unlocked && + /* SI doesn't support pasid or KIQ/MES */ + params->adev->family > AMDGPU_FAMILY_SI) { amdgpu_vm_tlb_fence_create(params->adev, vm, fence); /* Makes sure no PD/PT is freed before the flush */ -- 2.52.0

3 days, 7 hours

1
0
0 0

[PATCH 2/2] block/blk-mq: convert blk_mq_cpuhp_lock to raw_spinlock for RT

by Ionut Nechita (WindRiver)

From: Ionut Nechita <ionut.nechita(a)windriver.com> Commit 58bf93580fec ("blk-mq: move cpuhp callback registering out of q->sysfs_lock") introduced a global mutex blk_mq_cpuhp_lock to avoid lockdep warnings between sysfs_lock and CPU hotplug lock. On RT kernels (CONFIG_PREEMPT_RT), regular mutexes are converted to rt_mutex (sleeping locks). When block layer operations need to acquire blk_mq_cpuhp_lock, IRQ threads processing I/O completions may sleep, causing additional contention on top of the queue_lock issue from commit 679b1874eba7 ("block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding"). Test case (MegaRAID 12GSAS with 8 MSI-X vectors on RT kernel): - v6.6.68-rt with queue_lock fix: 640 MB/s (queue_lock fixed) - v6.6.69-rt: still exhibits contention due to cpuhp_lock mutex The functions protected by blk_mq_cpuhp_lock only perform fast, non-sleeping operations: - hlist_unhashed() checks - cpuhp_state_add_instance_nocalls() - just hlist manipulation - cpuhp_state_remove_instance_nocalls() - just hlist manipulation - INIT_HLIST_NODE() initialization The _nocalls variants do not invoke state callbacks and only manipulate data structures, making them safe to call under raw_spinlock. Convert blk_mq_cpuhp_lock from mutex to raw_spinlock to prevent it from becoming a sleeping lock in RT kernel. This eliminates the contention bottleneck while maintaining the lockdep fix's original intent. Fixes: 58bf93580fec ("blk-mq: move cpuhp callback registering out of q->sysfs_lock") Cc: stable(a)vger.kernel.org Signed-off-by: Ionut Nechita <ionut.nechita(a)windriver.com> --- block/blk-mq.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 5fb8da4958d0..3982e24b1081 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -43,7 +43,7 @@ static DEFINE_PER_CPU(struct llist_head, blk_cpu_done); static DEFINE_PER_CPU(call_single_data_t, blk_cpu_csd); -static DEFINE_MUTEX(blk_mq_cpuhp_lock); +static DEFINE_RAW_SPINLOCK(blk_mq_cpuhp_lock); static void blk_mq_insert_request(struct request *rq, blk_insert_t flags); static void blk_mq_request_bypass_insert(struct request *rq, @@ -3641,9 +3641,9 @@ static void __blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx) static void blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx) { - mutex_lock(&blk_mq_cpuhp_lock); + raw_spin_lock(&blk_mq_cpuhp_lock); __blk_mq_remove_cpuhp(hctx); - mutex_unlock(&blk_mq_cpuhp_lock); + raw_spin_unlock(&blk_mq_cpuhp_lock); } static void __blk_mq_add_cpuhp(struct blk_mq_hw_ctx *hctx) @@ -3683,9 +3683,9 @@ static void blk_mq_remove_hw_queues_cpuhp(struct request_queue *q) list_splice_init(&q->unused_hctx_list, &hctx_list); spin_unlock(&q->unused_hctx_lock); - mutex_lock(&blk_mq_cpuhp_lock); + raw_spin_lock(&blk_mq_cpuhp_lock); __blk_mq_remove_cpuhp_list(&hctx_list); - mutex_unlock(&blk_mq_cpuhp_lock); + raw_spin_unlock(&blk_mq_cpuhp_lock); spin_lock(&q->unused_hctx_lock); list_splice(&hctx_list, &q->unused_hctx_list); @@ -3702,10 +3702,10 @@ static void blk_mq_add_hw_queues_cpuhp(struct request_queue *q) struct blk_mq_hw_ctx *hctx; unsigned long i; - mutex_lock(&blk_mq_cpuhp_lock); + raw_spin_lock(&blk_mq_cpuhp_lock); queue_for_each_hw_ctx(q, hctx, i) __blk_mq_add_cpuhp(hctx); - mutex_unlock(&blk_mq_cpuhp_lock); + raw_spin_unlock(&blk_mq_cpuhp_lock); } /* -- 2.52.0

3 days, 10 hours

1
0
0 0

[PATCH 1/2] block/blk-mq: fix RT kernel regression with queue_lock in hot path

by Ionut Nechita (WindRiver)

From: Ionut Nechita <ionut.nechita(a)windriver.com> Commit 679b1874eba7 ("block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding") introduced queue_lock acquisition in blk_mq_run_hw_queue() to synchronize QUEUE_FLAG_QUIESCED checks. On RT kernels (CONFIG_PREEMPT_RT), regular spinlocks are converted to rt_mutex (sleeping locks). When multiple MSI-X IRQ threads process I/O completions concurrently, they contend on queue_lock in the hot path, causing all IRQ threads to enter D (uninterruptible sleep) state. This serializes interrupt processing completely. Test case (MegaRAID 12GSAS with 8 MSI-X vectors on RT kernel): - Good (v6.6.52-rt): 640 MB/s sequential read - Bad (v6.6.64-rt): 153 MB/s sequential read (-76% regression) - 6-8 out of 8 MSI-X IRQ threads stuck in D-state waiting on queue_lock The original commit message mentioned memory barriers as an alternative approach. Use full memory barriers (smp_mb) instead of queue_lock to provide the same ordering guarantees without sleeping in RT kernel. Memory barriers ensure proper synchronization: - CPU0 either sees QUEUE_FLAG_QUIESCED cleared, OR - CPU1 sees dispatch list/sw queue bitmap updates This maintains correctness while avoiding lock contention that causes RT kernel IRQ threads to sleep in the I/O completion path. Fixes: 679b1874eba7 ("block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding") Cc: stable(a)vger.kernel.org Signed-off-by: Ionut Nechita <ionut.nechita(a)windriver.com> --- block/blk-mq.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 5da948b07058..5fb8da4958d0 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2292,22 +2292,19 @@ void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async) might_sleep_if(!async && hctx->flags & BLK_MQ_F_BLOCKING); + /* + * First lockless check to avoid unnecessary overhead. + * Memory barrier below synchronizes with blk_mq_unquiesce_queue(). + */ need_run = blk_mq_hw_queue_need_run(hctx); if (!need_run) { - unsigned long flags; - - /* - * Synchronize with blk_mq_unquiesce_queue(), because we check - * if hw queue is quiesced locklessly above, we need the use - * ->queue_lock to make sure we see the up-to-date status to - * not miss rerunning the hw queue. - */ - spin_lock_irqsave(&hctx->queue->queue_lock, flags); + /* Synchronize with blk_mq_unquiesce_queue() */ + smp_mb(); need_run = blk_mq_hw_queue_need_run(hctx); - spin_unlock_irqrestore(&hctx->queue->queue_lock, flags); - if (!need_run) return; + /* Ensure dispatch list/sw queue updates visible before execution */ + smp_mb(); } if (async || !cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask)) { -- 2.52.0

3 days, 10 hours

1
0
0 0

[PATCH 6.17.y] net: openvswitch: fix middle attribute validation in push_nsh() action

by Adrian Yip

From: Ilya Maximets <i.maximets(a)ovn.org> [ Upstream commit 5ace7ef87f059d68b5f50837ef3e8a1a4870c36e ] The push_nsh() action structure looks like this: OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...)) The outermost OVS_ACTION_ATTR_PUSH_NSH attribute is OK'ed by the nla_for_each_nested() inside __ovs_nla_copy_actions(). The innermost OVS_NSH_KEY_ATTR_BASE/MD1/MD2 are OK'ed by the nla_for_each_nested() inside nsh_key_put_from_nlattr(). But nothing checks if the attribute in the middle is OK. We don't even check that this attribute is the OVS_KEY_ATTR_NSH. We just do a double unwrap with a pair of nla_data() calls - first time directly while calling validate_push_nsh() and the second time as part of the nla_for_each_nested() macro, which isn't safe, potentially causing invalid memory access if the size of this attribute is incorrect. The failure may not be noticed during validation due to larger netlink buffer, but cause trouble later during action execution where the buffer is allocated exactly to the size: BUG: KASAN: slab-out-of-bounds in nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch] Read of size 184 at addr ffff88816459a634 by task a.out/22624 CPU: 8 UID: 0 PID: 22624 6.18.0-rc7+ #115 PREEMPT(voluntary) Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x2c/0x390 kasan_report+0xdd/0x110 kasan_check_range+0x35/0x1b0 __asan_memcpy+0x20/0x60 nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch] push_nsh+0x82/0x120 [openvswitch] do_execute_actions+0x1405/0x2840 [openvswitch] ovs_execute_actions+0xd5/0x3b0 [openvswitch] ovs_packet_cmd_execute+0x949/0xdb0 [openvswitch] genl_family_rcv_msg_doit+0x1d6/0x2b0 genl_family_rcv_msg+0x336/0x580 genl_rcv_msg+0x9f/0x130 netlink_rcv_skb+0x11f/0x370 genl_rcv+0x24/0x40 netlink_unicast+0x73e/0xaa0 netlink_sendmsg+0x744/0xbf0 __sys_sendto+0x3d6/0x450 do_syscall_64+0x79/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Let's add some checks that the attribute is properly sized and it's the only one attribute inside the action. Technically, there is no real reason for OVS_KEY_ATTR_NSH to be there, as we know that we're pushing an NSH header already, it just creates extra nesting, but that's how uAPI works today. So, keeping as it is. Fixes: b2d0f5d5dc53 ("openvswitch: enable NSH support") Reported-by: Junvy Yang <zhuque(a)tencent.com> Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Acked-by: Eelco Chaudron <echaudro(a)redhat.com> Reviewed-by: Aaron Conole <aconole(a)redhat.com> Link: https://patch.msgid.link/20251204105334.900379-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> (cherry picked from commit 5ace7ef87f059d68b5f50837ef3e8a1a4870c36e) Signed-off-by: Adrian Yip <adrian.ytw(a)gmail.com> --- net/openvswitch/flow_netlink.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index 1cb4f97335d8..2d536901309e 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -2802,13 +2802,20 @@ static int validate_and_copy_set_tun(const struct nlattr *attr, return err; } -static bool validate_push_nsh(const struct nlattr *attr, bool log) +static bool validate_push_nsh(const struct nlattr *a, bool log) { + struct nlattr *nsh_key = nla_data(a); struct sw_flow_match match; struct sw_flow_key key; + /* There must be one and only one NSH header. */ + if (!nla_ok(nsh_key, nla_len(a)) || + nla_total_size(nla_len(nsh_key)) != nla_len(a) || + nla_type(nsh_key) != OVS_KEY_ATTR_NSH) + return false; + ovs_match_init(&match, &key, true, NULL); - return !nsh_key_put_from_nlattr(attr, &match, false, true, log); + return !nsh_key_put_from_nlattr(nsh_key, &match, false, true, log); } /* Return false if there are any non-masked bits set. @@ -3389,7 +3396,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, return -EINVAL; } mac_proto = MAC_PROTO_NONE; - if (!validate_push_nsh(nla_data(a), log)) + if (!validate_push_nsh(a, log)) return -EINVAL; break; -- 2.52.0

3 days, 11 hours

1
0
0 0

[PATCH 6.12.y] net: openvswitch: fix middle attribute validation in push_nsh() action

by Adrian Yip

From: Ilya Maximets <i.maximets(a)ovn.org> [ Upstream commit 5ace7ef87f059d68b5f50837ef3e8a1a4870c36e ] The push_nsh() action structure looks like this: OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...)) The outermost OVS_ACTION_ATTR_PUSH_NSH attribute is OK'ed by the nla_for_each_nested() inside __ovs_nla_copy_actions(). The innermost OVS_NSH_KEY_ATTR_BASE/MD1/MD2 are OK'ed by the nla_for_each_nested() inside nsh_key_put_from_nlattr(). But nothing checks if the attribute in the middle is OK. We don't even check that this attribute is the OVS_KEY_ATTR_NSH. We just do a double unwrap with a pair of nla_data() calls - first time directly while calling validate_push_nsh() and the second time as part of the nla_for_each_nested() macro, which isn't safe, potentially causing invalid memory access if the size of this attribute is incorrect. The failure may not be noticed during validation due to larger netlink buffer, but cause trouble later during action execution where the buffer is allocated exactly to the size: BUG: KASAN: slab-out-of-bounds in nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch] Read of size 184 at addr ffff88816459a634 by task a.out/22624 CPU: 8 UID: 0 PID: 22624 6.18.0-rc7+ #115 PREEMPT(voluntary) Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x2c/0x390 kasan_report+0xdd/0x110 kasan_check_range+0x35/0x1b0 __asan_memcpy+0x20/0x60 nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch] push_nsh+0x82/0x120 [openvswitch] do_execute_actions+0x1405/0x2840 [openvswitch] ovs_execute_actions+0xd5/0x3b0 [openvswitch] ovs_packet_cmd_execute+0x949/0xdb0 [openvswitch] genl_family_rcv_msg_doit+0x1d6/0x2b0 genl_family_rcv_msg+0x336/0x580 genl_rcv_msg+0x9f/0x130 netlink_rcv_skb+0x11f/0x370 genl_rcv+0x24/0x40 netlink_unicast+0x73e/0xaa0 netlink_sendmsg+0x744/0xbf0 __sys_sendto+0x3d6/0x450 do_syscall_64+0x79/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Let's add some checks that the attribute is properly sized and it's the only one attribute inside the action. Technically, there is no real reason for OVS_KEY_ATTR_NSH to be there, as we know that we're pushing an NSH header already, it just creates extra nesting, but that's how uAPI works today. So, keeping as it is. Fixes: b2d0f5d5dc53 ("openvswitch: enable NSH support") Reported-by: Junvy Yang <zhuque(a)tencent.com> Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Acked-by: Eelco Chaudron <echaudro(a)redhat.com> Reviewed-by: Aaron Conole <aconole(a)redhat.com> Link: https://patch.msgid.link/20251204105334.900379-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> (cherry picked from commit 5ace7ef87f059d68b5f50837ef3e8a1a4870c36e) Signed-off-by: Adrian Yip <adrian.ytw(a)gmail.com> --- net/openvswitch/flow_netlink.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index e3359e15aa2e..7d5490ea23e1 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -2802,13 +2802,20 @@ static int validate_and_copy_set_tun(const struct nlattr *attr, return err; } -static bool validate_push_nsh(const struct nlattr *attr, bool log) +static bool validate_push_nsh(const struct nlattr *a, bool log) { + struct nlattr *nsh_key = nla_data(a); struct sw_flow_match match; struct sw_flow_key key; + /* There must be one and only one NSH header. */ + if (!nla_ok(nsh_key, nla_len(a)) || + nla_total_size(nla_len(nsh_key)) != nla_len(a) || + nla_type(nsh_key) != OVS_KEY_ATTR_NSH) + return false; + ovs_match_init(&match, &key, true, NULL); - return !nsh_key_put_from_nlattr(attr, &match, false, true, log); + return !nsh_key_put_from_nlattr(nsh_key, &match, false, true, log); } /* Return false if there are any non-masked bits set. @@ -3388,7 +3395,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, return -EINVAL; } mac_proto = MAC_PROTO_NONE; - if (!validate_push_nsh(nla_data(a), log)) + if (!validate_push_nsh(a, log)) return -EINVAL; break; -- 2.52.0

3 days, 12 hours

1
0
0 0

[PATCH] Revert "clk: qcom: cpu-8996: simplify the cpu_clk_notifier_cb"

by Christopher Obbard

This reverts commit b3b274bc9d3d7307308aeaf75f70731765ac999a. On the DragonBoard 820c (which uses APQ8096/MSM8996) this change causes the CPUs to downclock to roughly half speed under sustained load. The regression is visible both during boot and when running CPU stress workloads such as stress-ng: the CPUs initially ramp up to the expected frequency, then drop to a lower OPP even though the system is clearly CPU-bound. Bisecting points to this commit and reverting it restores the expected behaviour on the DragonBoard 820c - the CPUs track the cpufreq policy and run at full performance under load. The exact interaction with the ACD is not yet fully understood and we would like to keep ACD in use to avoid possible SoC reliability issues. Until we have a better fix that preserves ACD while avoiding this performance regression, revert the bisected patch to restore the previous behaviour. Fixes: b3b274bc9d3d ("clk: qcom: cpu-8996: simplify the cpu_clk_notifier_cb") Cc: stable(a)vger.kernel.org # v6.3+ Link: https://lore.kernel.org/linux-arm-msm/20230113120544.59320-8-dmitry.baryshk… Cc: Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> Signed-off-by: Christopher Obbard <christopher.obbard(a)linaro.org> --- Hi all, This series contains a single revert for a regression affecting the APQ8096/MSM8996 (DragonBoard 820c). The commit being reverted, b3b274bc9d3d ("clk: qcom: cpu-8996: simplify the cpu_clk_notifier_cb"), introduces a significant performance issue where the CPUs downclock to ~50% of their expected frequency under sustained load. The problem is reproducible both at boot and when running CPU-bound workloads such as stress-ng. Bisecting the issue pointed directly to this commit and reverting it restores correct cpufreq behaviour. The root cause appears to be related to the interaction between the simplified notifier callback and ACD (Adaptive Clock Distribution). Since we would prefer to keep ACD enabled for SoC reliability reasons, a revert is the safest option until a proper fix is identified. Full details are included in the commit message. Feedback & suggestions welcome. Cheers! Christopher Obbard --- drivers/clk/qcom/clk-cpu-8996.c | 30 +++++++++++------------------- 1 file changed, 11 insertions(+), 19 deletions(-) diff --git a/drivers/clk/qcom/clk-cpu-8996.c b/drivers/clk/qcom/clk-cpu-8996.c index 21d13c0841ed..028476931747 100644 --- a/drivers/clk/qcom/clk-cpu-8996.c +++ b/drivers/clk/qcom/clk-cpu-8996.c @@ -547,35 +547,27 @@ static int cpu_clk_notifier_cb(struct notifier_block *nb, unsigned long event, { struct clk_cpu_8996_pmux *cpuclk = to_clk_cpu_8996_pmux_nb(nb); struct clk_notifier_data *cnd = data; + int ret; switch (event) { case PRE_RATE_CHANGE: + ret = clk_cpu_8996_pmux_set_parent(&cpuclk->clkr.hw, ALT_INDEX); qcom_cpu_clk_msm8996_acd_init(cpuclk->clkr.regmap); - - /* - * Avoid overvolting. clk_core_set_rate_nolock() walks from top - * to bottom, so it will change the rate of the PLL before - * chaging the parent of PMUX. This can result in pmux getting - * clocked twice the expected rate. - * - * Manually switch to PLL/2 here. - */ - if (cnd->new_rate < DIV_2_THRESHOLD && - cnd->old_rate > DIV_2_THRESHOLD) - clk_cpu_8996_pmux_set_parent(&cpuclk->clkr.hw, SMUX_INDEX); - break; - case ABORT_RATE_CHANGE: - /* Revert manual change */ - if (cnd->new_rate < DIV_2_THRESHOLD && - cnd->old_rate > DIV_2_THRESHOLD) - clk_cpu_8996_pmux_set_parent(&cpuclk->clkr.hw, ACD_INDEX); + case POST_RATE_CHANGE: + if (cnd->new_rate < DIV_2_THRESHOLD) + ret = clk_cpu_8996_pmux_set_parent(&cpuclk->clkr.hw, + SMUX_INDEX); + else + ret = clk_cpu_8996_pmux_set_parent(&cpuclk->clkr.hw, + ACD_INDEX); break; default: + ret = 0; break; } - return NOTIFY_OK; + return notifier_from_errno(ret); }; static int qcom_cpu_clk_msm8996_driver_probe(struct platform_device *pdev) --- base-commit: c17e270dfb342a782d69c4a7c4c32980455afd9c change-id: 20251202-wip-obbardc-qcom-msm8096-clk-cpu-fix-downclock-b7561da4cb95 Best regards, -- Christopher Obbard <christopher.obbard(a)linaro.org>

3 days, 19 hours

3
9
0 0

[PATCH] block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova

by Chaitanya Kulkarni

When dma_iova_link() fails partway through mapping a request's bvec list, the function breaks out of the loop without cleaning up the already-mapped portions. Similarly, if dma_iova_sync() fails after all segments are linked, no cleanup is performed. This leaves the IOVA state partially mapped. The completion path (via dma_iova_destroy() or nvme_unmap_data()) then attempts to unmap the full expected size, but only a partial size was actually mapped. Fix by adding an out_unlink error path that calls dma_iova_destroy() to clean up any partial mapping before returning failure. The dma_iova_destroy() function handles both partial unlink and IOVA space freeing, and correctly handles the case where mapped_len is zero (first dma_iova_link() failed) by just freeing the IOVA allocation. This ensures that when an error occurs: 1. All partially-mapped IOVA ranges are properly unmapped 2. The IOVA address space is freed 3. The completion path won't attempt to unmap non-existent mappings Fixes: 858299dc6160 ("block: add scatterlist-less DMA mapping helpers") Cc: stable(a)vger.kernel.org Signed-off-by: Chaitanya Kulkarni <ckulkarnilinux(a)gmail.com> --- Hi Leon, Your last email is not accessible to me. Updated the patch description to explain dma_iova_destroy(). Please let me know for any issues you want me to fix before I send. -ck --- block/blk-mq-dma.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/block/blk-mq-dma.c b/block/blk-mq-dma.c index fb018fffffdc..feead1934301 100644 --- a/block/blk-mq-dma.c +++ b/block/blk-mq-dma.c @@ -126,17 +126,20 @@ static bool blk_rq_dma_map_iova(struct request *req, struct device *dma_dev, error = dma_iova_link(dma_dev, state, vec->paddr, mapped, vec->len, dir, attrs); if (error) - break; + goto out_unlink; mapped += vec->len; } while (blk_map_iter_next(req, &iter->iter, vec)); error = dma_iova_sync(dma_dev, state, 0, mapped); - if (error) { - iter->status = errno_to_blk_status(error); - return false; - } + if (error) + goto out_unlink; return true; + +out_unlink: + dma_iova_destroy(dma_dev, state, mapped, dir, attrs); + iter->status = errno_to_blk_status(error); + return false; } static inline void blk_rq_map_iter_init(struct request *rq, -- 2.40.0

3 days, 21 hours

1
0
0 0

[PATCH] parisc: kernel: replace kfree() with put_device() in create_tree_node()

by Haoxiang Li

If device_register() fails, put_device() is the correct way to drop the device reference. Found by code review. Fixes: 1070c9655b90 ("[PA-RISC] Fix must_check warnings in drivers.c") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- arch/parisc/kernel/drivers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c index 8d23fe42b0ce..809e3c171ad5 100644 --- a/arch/parisc/kernel/drivers.c +++ b/arch/parisc/kernel/drivers.c @@ -435,7 +435,7 @@ static struct parisc_device * __init create_tree_node(char id, dev->dev.dma_mask = &dev->dma_mask; dev->dev.coherent_dma_mask = dev->dma_mask; if (device_register(&dev->dev)) { - kfree(dev); + put_device(&dev->dev); return NULL; } -- 2.25.1

3 days, 22 hours

2
1
0 0

[PATCH 1/2] drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare

by Lyude Paul

For a while, I've been seeing a strange issue where some (usually not all) of the display DMA channels will suddenly hang, particularly when there is a visible cursor on the screen that is being frequently updated, and especially when said cursor happens to go between two screens. While this brings back lovely memories of fixing Intel Skylake bugs, I would quite like to fix it :). It turns out the problem that's happening here is that we're managing to reach nv50_head_flush_set() in our atomic commit path without actually holding nv50_disp->mutex. This means that cursor updates happening in parallel (along with any other atomic updates that need to use the core channel) will race with eachother, which eventually causes us to corrupt the pushbuffer - leading to a plethora of various GSP errors, usually: nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003 nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001 nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001 The reason this is happening is because generally we check whether we need to set nv50_atom->lock_core at the end of nv50_head_atomic_check(). However, curs507a_prepare is called from the fb_prepare callback, which happens after the atomic check phase. As a result, this can lead to commits that both touch the core channel but also don't grab nv50_disp->mutex. So, fix this by making sure that we set nv50_atom->lock_core in cus507a_prepare(). Signed-off-by: Lyude Paul <lyude(a)redhat.com> Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files") Cc: <stable(a)vger.kernel.org> # v4.18+ --- drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c index a95ee5dcc2e39..1a889139cb053 100644 --- a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c +++ b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c @@ -84,6 +84,7 @@ curs507a_prepare(struct nv50_wndw *wndw, struct nv50_head_atom *asyh, asyh->curs.handle = handle; asyh->curs.offset = offset; asyh->set.curs = asyh->curs.visible; + nv50_atom(asyh->state.state)->lock_core = true; } } -- 2.52.0

3 days, 23 hours

1
0
0 0

[PATCH] media: imagination: Fix value clamping in calculate_qp_tables

by Thorsten Blum

The local variable 'val' was never clamped to 1 or 255 because the return value of clamp() was not used. Fix this by assigning the clamped value back to 'val'. Cc: stable(a)vger.kernel.org Fixes: a1e294045885 ("media: imagination: Add E5010 JPEG Encoder driver") Signed-off-by: Thorsten Blum <thorsten.blum(a)linux.dev> --- drivers/media/platform/imagination/e5010-jpeg-enc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/imagination/e5010-jpeg-enc.c b/drivers/media/platform/imagination/e5010-jpeg-enc.c index c4e0097cb8b7..a36a2acc896c 100644 --- a/drivers/media/platform/imagination/e5010-jpeg-enc.c +++ b/drivers/media/platform/imagination/e5010-jpeg-enc.c @@ -175,12 +175,12 @@ static void calculate_qp_tables(struct e5010_context *ctx) long long delta = v4l2_jpeg_ref_table_chroma_qt[i] * contrast + luminosity; int val = (int)(v4l2_jpeg_ref_table_chroma_qt[i] + delta); - clamp(val, 1, 255); + val = clamp(val, 1, 255); ctx->chroma_qp[i] = quality == -50 ? 1 : val; delta = v4l2_jpeg_ref_table_luma_qt[i] * contrast + luminosity; val = (int)(v4l2_jpeg_ref_table_luma_qt[i] + delta); - clamp(val, 1, 255); + val = clamp(val, 1, 255); ctx->luma_qp[i] = quality == -50 ? 1 : val; } -- Thorsten Blum <thorsten.blum(a)linux.dev> GPG: 1D60 735E 8AEF 3BE4 73B6 9D84 7336 78FD 8DFE EAD4

3 days, 23 hours

1
1
0 0

[PATCH v2] mm/memory-failure: fix missing ->mf_stats count in hugetlb poison

by Jane Chu

When a newly poisoned subpage ends up in an already poisoned hugetlb folio, 'num_poisoned_pages' is incremented, but the per node ->mf_stats is not. Fix the inconsistency by designating action_result() to update them both. While at it, define __get_huge_page_for_hwpoison() return values in terms of symbol names for better readibility. Also rename folio_set_hugetlb_hwpoison() to hugetlb_update_hwpoison() since the function does more than the conventional bit setting and the fact three possible return values are expected. Fixes: 18f41fa616ee4 ("mm: memory-failure: bump memory failure stats to pglist_data") Cc: <stable(a)vger.kernel.org> Signed-off-by: Jane Chu <jane.chu(a)oracle.com> --- v1 -> v2: adapted David and Liam's comment, define __get_huge_page_for_hwpoison() return values in terms of symbol names instead of naked integers for better readibility. #define instead of enum is used since the function has footprint outside MF, just try to limit the MF specifics local. also renamed folio_set_hugetlb_hwpoison() to hugetlb_update_hwpoison() since the function does more than the conventional bit setting and the fact three possible return values are expected. --- mm/memory-failure.c | 56 ++++++++++++++++++++++++++------------------- 1 file changed, 33 insertions(+), 23 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 3edebb0cda30..3eb9d23a4ad0 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1873,12 +1873,18 @@ static unsigned long __folio_free_raw_hwp(struct folio *folio, bool move_flag) return count; } -static int folio_set_hugetlb_hwpoison(struct folio *folio, struct page *page) +#define MF_HUGETLB_ALREADY_POISONED 3 /* already poisoned */ +#define MF_HUGETLB_ACC_EXISTING_POISON 4 /* accessed existing poisoned page */ +/* + * Set hugetlb folio as hwpoisoned, update folio private raw hwpoison list + * to keep track of the poisoned pages. + */ +static int hugetlb_update_hwpoison(struct folio *folio, struct page *page) { struct llist_head *head; struct raw_hwp_page *raw_hwp; struct raw_hwp_page *p; - int ret = folio_test_set_hwpoison(folio) ? -EHWPOISON : 0; + int ret = folio_test_set_hwpoison(folio) ? MF_HUGETLB_ALREADY_POISONED : 0; /* * Once the hwpoison hugepage has lost reliable raw error info, @@ -1886,20 +1892,18 @@ static int folio_set_hugetlb_hwpoison(struct folio *folio, struct page *page) * so skip to add additional raw error info. */ if (folio_test_hugetlb_raw_hwp_unreliable(folio)) - return -EHWPOISON; + return MF_HUGETLB_ALREADY_POISONED; + head = raw_hwp_list_head(folio); llist_for_each_entry(p, head->first, node) { if (p->page == page) - return -EHWPOISON; + return MF_HUGETLB_ACC_EXISTING_POISON; } raw_hwp = kmalloc(sizeof(struct raw_hwp_page), GFP_ATOMIC); if (raw_hwp) { raw_hwp->page = page; llist_add(&raw_hwp->node, head); - /* the first error event will be counted in action_result(). */ - if (ret) - num_poisoned_pages_inc(page_to_pfn(page)); } else { /* * Failed to save raw error info. We no longer trace all @@ -1945,32 +1949,30 @@ void folio_clear_hugetlb_hwpoison(struct folio *folio) folio_free_raw_hwp(folio, true); } +#define MF_HUGETLB_FREED 0 /* freed hugepage */ +#define MF_HUGETLB_IN_USED 1 /* in-use hugepage */ +#define MF_NOT_HUGETLB 2 /* not a hugepage */ + /* * Called from hugetlb code with hugetlb_lock held. - * - * Return values: - * 0 - free hugepage - * 1 - in-use hugepage - * 2 - not a hugepage - * -EBUSY - the hugepage is busy (try to retry) - * -EHWPOISON - the hugepage is already hwpoisoned */ int __get_huge_page_for_hwpoison(unsigned long pfn, int flags, bool *migratable_cleared) { struct page *page = pfn_to_page(pfn); struct folio *folio = page_folio(page); - int ret = 2; /* fallback to normal page handling */ + int ret = MF_NOT_HUGETLB; bool count_increased = false; + int rc; if (!folio_test_hugetlb(folio)) goto out; if (flags & MF_COUNT_INCREASED) { - ret = 1; + ret = MF_HUGETLB_IN_USED; count_increased = true; } else if (folio_test_hugetlb_freed(folio)) { - ret = 0; + ret = MF_HUGETLB_FREED; } else if (folio_test_hugetlb_migratable(folio)) { ret = folio_try_get(folio); if (ret) @@ -1981,8 +1983,9 @@ int __get_huge_page_for_hwpoison(unsigned long pfn, int flags, goto out; } - if (folio_set_hugetlb_hwpoison(folio, page)) { - ret = -EHWPOISON; + rc = hugetlb_update_hwpoison(folio, page); + if (rc >= MF_HUGETLB_ALREADY_POISONED) { + ret = rc; goto out; } @@ -2019,22 +2022,29 @@ static int try_memory_failure_hugetlb(unsigned long pfn, int flags, int *hugetlb *hugetlb = 1; retry: res = get_huge_page_for_hwpoison(pfn, flags, &migratable_cleared); - if (res == 2) { /* fallback to normal page handling */ + switch (res) { + case MF_NOT_HUGETLB: /* fallback to normal page handling */ *hugetlb = 0; return 0; - } else if (res == -EHWPOISON) { + case MF_HUGETLB_ALREADY_POISONED: + case MF_HUGETLB_ACC_EXISTING_POISON: if (flags & MF_ACTION_REQUIRED) { folio = page_folio(p); res = kill_accessing_process(current, folio_pfn(folio), flags); } - action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); + if (res == MF_HUGETLB_ALREADY_POISONED) + action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); + else + action_result(pfn, MF_MSG_HUGE, MF_FAILED); return res; - } else if (res == -EBUSY) { + case -EBUSY: if (!(flags & MF_NO_RETRY)) { flags |= MF_NO_RETRY; goto retry; } return action_result(pfn, MF_MSG_GET_HWPOISON, MF_IGNORED); + default: + break; } folio = page_folio(p); -- 2.43.5

4 days, 1 hour

1
0
0 0

[PATCH 02/23] PCI: Rewrite bridge window head alignment function

by Ilpo Järvinen

The calculation of bridge window head alignment is done by calculate_mem_align() [*]. With the default bridge window alignment, it is used for both head and tail alignment. The selected head alignment does not always result in tight-fitting resources (gap at d4f00000-d4ffffff): d4800000-dbffffff : PCI Bus 0000:06 d4800000-d48fffff : PCI Bus 0000:07 d4800000-d4803fff : 0000:07:00.0 d4800000-d4803fff : nvme d4900000-d49fffff : PCI Bus 0000:0a d4900000-d490ffff : 0000:0a:00.0 d4900000-d490ffff : r8169 d4910000-d4913fff : 0000:0a:00.0 d4a00000-d4cfffff : PCI Bus 0000:0b d4a00000-d4bfffff : 0000:0b:00.0 d4a00000-d4bfffff : 0000:0b:00.0 d4c00000-d4c07fff : 0000:0b:00.0 d4d00000-d4dfffff : PCI Bus 0000:15 d4d00000-d4d07fff : 0000:15:00.0 d4d00000-d4d07fff : xhci-hcd d4e00000-d4efffff : PCI Bus 0000:16 d4e00000-d4e7ffff : 0000:16:00.0 d4e80000-d4e803ff : 0000:16:00.0 d4e80000-d4e803ff : ahci d5000000-dbffffff : PCI Bus 0000:0c This has not been caused problems (for years) with the default bridge window tail alignment that grossly over-estimates the required tail alignment leaving more tail room than necessary. With the introduction of relaxed tail alignment that leaves no extra tail room whatsoever, any gaps will immediately turn into assignment failures. Introduce head alignment calculation that ensures no gaps are left and apply the new approach when using relaxed alignment. We may want to consider using it for the normal alignment eventually, but as the first step, solve only the problem with the relaxed tail alignment. ([*] I don't understand the algorithm in calculate_mem_align().) Fixes: 5d0a8965aea9 ("[PATCH] 2.5.14: New PCI allocation code (alpha, arm, parisc) [2/2]") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220775 Reported-by: Malte Schröder <malte+lkml(a)tnxip.de> Tested-by: Malte Schröder <malte+lkml(a)tnxip.de> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Cc: stable(a)vger.kernel.org --- Little annoyingly, there's difference in what aligns array contains between the legacy alignment approach (which I dare not to touch as I really don't understand what the algorithm tries to do) and this new head aligment algorithm, both consuming stack space. After making the new approach the only available approach in the follow-up patch, only one array remains (however, that follow-up change is also somewhat riskier when it comes to regressions). That being said, the new head alignment could work with the same aligns array as the legacy approach, it just won't necessarily produce an optimal (the smallest possible) head alignment when if (r_size <= align) condition is used. Just let me know if that approach is preferred (to save some stack space). --- drivers/pci/setup-bus.c | 53 ++++++++++++++++++++++++++++++++++------- 1 file changed, 44 insertions(+), 9 deletions(-) diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c index 4b918ff4d2d8..80e5a8fc62e7 100644 --- a/drivers/pci/setup-bus.c +++ b/drivers/pci/setup-bus.c @@ -1228,6 +1228,45 @@ static inline resource_size_t calculate_mem_align(resource_size_t *aligns, return min_align; } +/* + * Calculate bridge window head alignment that leaves no gaps in between + * resources. + */ +static resource_size_t calculate_head_align(resource_size_t *aligns, + int max_order) +{ + resource_size_t head_align = 1; + resource_size_t remainder = 0; + int order; + + /* Take the largest alignment as the starting point. */ + head_align <<= max_order + __ffs(SZ_1M); + + for (order = max_order - 1; order >= 0; order--) { + resource_size_t align1 = 1; + + align1 <<= order + __ffs(SZ_1M); + + /* + * Account smaller resources with alignment < max_order that + * could be used to fill head room if alignment less than + * max_order is used. + */ + remainder += aligns[order]; + + /* + * Test if head fill is enough to satisfy the alignment of + * the larger resources after reducing the alignment. + */ + while ((head_align > align1) && (remainder >= head_align / 2)) { + head_align /= 2; + remainder -= head_align; + } + } + + return head_align; +} + /** * pbus_upstream_space_available - Check no upstream resource limits allocation * @bus: The bus @@ -1315,13 +1354,13 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type, { struct pci_dev *dev; resource_size_t min_align, win_align, align, size, size0, size1 = 0; - resource_size_t aligns[28]; /* Alignments from 1MB to 128TB */ + resource_size_t aligns[28] = {}; /* Alignments from 1MB to 128TB */ + resource_size_t aligns2[28] = {};/* Alignments from 1MB to 128TB */ int order, max_order; struct resource *b_res = pbus_select_window_for_type(bus, type); resource_size_t children_add_size = 0; resource_size_t children_add_align = 0; resource_size_t add_align = 0; - resource_size_t relaxed_align; resource_size_t old_size; if (!b_res) @@ -1331,7 +1370,6 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type, if (b_res->parent) return; - memset(aligns, 0, sizeof(aligns)); max_order = 0; size = 0; @@ -1382,6 +1420,7 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type, */ if (r_size <= align) aligns[order] += align; + aligns2[order] += align; if (order > max_order) max_order = order; @@ -1406,9 +1445,7 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type, if (bus->self && size0 && !pbus_upstream_space_available(bus, b_res, size0, min_align)) { - relaxed_align = 1ULL << (max_order + __ffs(SZ_1M)); - relaxed_align = max(relaxed_align, win_align); - min_align = min(min_align, relaxed_align); + min_align = calculate_head_align(aligns2, max_order); size0 = calculate_memsize(size, min_size, 0, 0, old_size, win_align); resource_set_range(b_res, min_align, size0); pci_info(bus->self, "bridge window %pR to %pR requires relaxed alignment rules\n", @@ -1422,9 +1459,7 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type, if (bus->self && size1 && !pbus_upstream_space_available(bus, b_res, size1, add_align)) { - relaxed_align = 1ULL << (max_order + __ffs(SZ_1M)); - relaxed_align = max(relaxed_align, win_align); - min_align = min(min_align, relaxed_align); + min_align = calculate_head_align(aligns2, max_order); size1 = calculate_memsize(size, min_size, add_size, children_add_size, old_size, win_align); pci_info(bus->self, -- 2.39.5

4 days, 3 hours

1
0
0 0

[PATCH 01/23] PCI: Fix bridge window alignment with optional resources

by Ilpo Järvinen

pbus_size_mem() has two alignments, one for required resources in min_align and another in add_align that takes account optional resources. The add_align is applied to the bridge window through the realloc_head list. It can happen, however, that add_align is larger than min_align but calculated size1 and size0 are equal due to extra tailroom (e.g., hotplug reservation, tail alignment), and therefore no entry is created to the realloc_head list. Without the bridge appearing in the realloc head, add_align is lost when pbus_size_mem() returns. The problem is visible in this log for 0000:05:00.0 which lacks add_size ... add_align ... line that would indicate it was added into the realloc_head list: pci 0000:05:00.0: PCI bridge to [bus 06-16] ... pci 0000:06:00.0: bridge window [mem 0x00100000-0x001fffff] to [bus 07] requires relaxed alignment rules pci 0000:06:06.0: bridge window [mem 0x00100000-0x001fffff] to [bus 0a] requires relaxed alignment rules pci 0000:06:07.0: bridge window [mem 0x00100000-0x003fffff] to [bus 0b] requires relaxed alignment rules pci 0000:06:08.0: bridge window [mem 0x00800000-0x00ffffff 64bit pref] to [bus 0c-14] requires relaxed alignment rules pci 0000:06:08.0: bridge window [mem 0x01000000-0x057fffff] to [bus 0c-14] requires relaxed alignment rules pci 0000:06:08.0: bridge window [mem 0x01000000-0x057fffff] to [bus 0c-14] requires relaxed alignment rules pci 0000:06:08.0: bridge window [mem 0x01000000-0x057fffff] to [bus 0c-14] add_size 100000 add_align 1000000 pci 0000:06:0c.0: bridge window [mem 0x00100000-0x001fffff] to [bus 15] requires relaxed alignment rules pci 0000:06:0d.0: bridge window [mem 0x00100000-0x001fffff] to [bus 16] requires relaxed alignment rules pci 0000:06:0d.0: bridge window [mem 0x00100000-0x001fffff] to [bus 16] requires relaxed alignment rules pci 0000:05:00.0: bridge window [mem 0xd4800000-0xd97fffff]: assigned pci 0000:05:00.0: bridge window [mem 0x1060000000-0x10607fffff 64bit pref]: assigned pci 0000:06:08.0: bridge window [mem size 0x04900000]: can't assign; no space pci 0000:06:08.0: bridge window [mem size 0x04900000]: failed to assign While this bug itself seems old, it has likely become more visible after the relaxed tail alignment that does not grossly overestimate the size needed for the bridge window. Make sure add_align > min_align too results in adding an entry into the realloc head list. In addition, add handling to the cases where add_size is zero while only alignment differs. Fixes: d74b9027a4da ("PCI: Consider additional PF's IOV BAR alignment in sizing and assigning") Reported-by: Malte Schröder <malte+lkml(a)tnxip.de> Tested-by: Malte Schröder <malte+lkml(a)tnxip.de> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Cc: stable(a)vger.kernel.org --- drivers/pci/setup-bus.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c index 6e90f46f52af..4b918ff4d2d8 100644 --- a/drivers/pci/setup-bus.c +++ b/drivers/pci/setup-bus.c @@ -14,6 +14,7 @@ * tighter packing. Prefetchable range support. */ +#include <linux/align.h> #include <linux/bitops.h> #include <linux/bug.h> #include <linux/init.h> @@ -456,7 +457,7 @@ static void reassign_resources_sorted(struct list_head *realloc_head, "%s %pR: ignoring failure in optional allocation\n", res_name, res); } - } else if (add_size > 0) { + } else if (add_size > 0 || !IS_ALIGNED(res->start, align)) { res->flags |= add_res->flags & (IORESOURCE_STARTALIGN|IORESOURCE_SIZEALIGN); if (pci_reassign_resource(dev, idx, add_size, align)) @@ -1442,12 +1443,13 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type, resource_set_range(b_res, min_align, size0); b_res->flags |= IORESOURCE_STARTALIGN; - if (bus->self && size1 > size0 && realloc_head) { + if (bus->self && realloc_head && (size1 > size0 || add_align > min_align)) { b_res->flags &= ~IORESOURCE_DISABLED; - add_to_list(realloc_head, bus->self, b_res, size1-size0, add_align); + add_size = size1 > size0 ? size1 - size0 : 0; + add_to_list(realloc_head, bus->self, b_res, add_size, add_align); pci_info(bus->self, "bridge window %pR to %pR add_size %llx add_align %llx\n", b_res, &bus->busn_res, - (unsigned long long) (size1 - size0), + (unsigned long long) add_size, (unsigned long long) add_align); } } -- 2.39.5

4 days, 3 hours

1
0
0 0

[regression 5.10.y] Libvirt can no longer delete macvtap devices after backport of a6cec0bcd342 ("net: rtnetlink: add bulk delete support flag") to 5.10.y series (Debian 11)

by Salvatore Bonaccorso

Hi all, Roland Schwarzkopf reported to the Debian mailing list a problem which he encountered once updating in Debian from 5.10.244 to 5.10.247. The report is quoted below and found in https://lists.debian.org/debian-kernel/2025/12/msg00223.html Roland did bisect the changes between 5.10.244 to 5.10.247 and found that the issue is introduced with 1550f3673972 ("net: rtnetlink: add bulk delete support flag") which is the backport to the 5.10.y series. On Thu, Dec 18, 2025 at 02:59:55PM +0100, Roland Schwarzkopf wrote: > Hi Salvatore, > > On 12/17/25 20:28, Salvatore Bonaccorso wrote: > > Hi Roland, > > > > I'm CC'ing Ben Hutchings directly as well as he takes care of the > > Debian LTS kernel updates. Idellly we make this as well a proper bug > > for easier tracking. > > > > On Wed, Dec 17, 2025 at 01:35:54PM +0100, Roland Schwarzkopf wrote: > > > Hi there, > > > > > > after upgrading to the latest kernel on Debian 11 > > > (linux-image-5.10.0-37-amd64) I have an issue using libvirt with qemu/kvm > > > virtual machines and macvtap networking. When a machine is shut down, > > > libvirt can not delete the corresponding macvtap device. Thus, starting the > > > machine again is not possible. After manually removing the macvtap device > > > using `ip link delete` the vm can be started again. > > > > > > In the journal the following message is shown: > > > > > > Dec 17 13:19:27 iblis libvirtd[535]: error destroying network device macvtap0: Operation not supported > > > > > > After downgrading the kernel to linux-image-5.10.0-36-amd64, the problem > > > disappears. I tested this on a fresh minimal install of Debian 11 - to > > > exclude that anything else on my production machines is causing this issue. > > > > > > Since the older kernel does not have this issue, I assume this is related to > > > the kernel and not to libvirt? > > > > > > I tried to check for bug reports of the kernel package, but the bug tracker > > > finds no reports and even states that the package does not exist (I used the > > > "Bug reports" link on > > > https://packages.debian.org/bullseye/linux-image-5.10.0-37-amd64). This left > > > me a bit puzzled. Since I don't have experience with the debian bug > > > reporting process, I had no other idea than writing to this list. > > You would need to search for inhttps://bugs.debian.org/src:linux , > > but that said I'm not aware of any bug reports in that direction. > > > > Would you be in the position of bisecting the problem as you can say > > that 5.10.244 is good and 5.10.247 is bad and regressed? If you can do > > that that would involve compiling a couple of kernels to narrow down > > where the problem is introduced: > > > > git clone --single-branch -b linux-5.10.yhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-st… > > cd linux-stable > > git checkout v5.10.244 > > cp /boot/config-$(uname -r) .config > > yes '' | make localmodconfig > > make savedefconfig > > mv defconfig arch/x86/configs/my_defconfig > > > > # test 5.10.244 to ensure this is "good" > > make my_defconfig > > make -j $(nproc) bindeb-pkg > > ... install the resulting .deb package and confirm it successfully boots / problem does not exist > > > > # test 5.10.247 to ensure this is "bad" > > git checkout v5.10.247 > > make my_defconfig > > make -j $(nproc) bindeb-pkg > > ... install the resulting .deb package and confirm it fails to boot / problem exists > > > > With that confirmed, the bisection can start: > > > > git bisect start > > git bisect good v5.10.244 > > git bisect bad v5.10.247 > > > > In each bisection step git checks out a state between the oldest > > known-bad and the newest known-good commit. In each step test using: > > > > make my_defconfig > > make -j $(nproc) bindeb-pkg > > ... install, try to boot / verify if problem exists > > > > and if the problem is hit run: > > > > git bisect bad > > > > and if the problem doesn't trigger run: > > > > git bisect good > > > > . Please pay attention to always select the just built kernel for > > booting, it won't always be the default kernel picked up by grub. > > > > Iterate until git announces to have identified the first bad commit. > > > > Then provide the output of > > > > git bisect log > > > > In the course of the bisection you might have to uninstall previous > > kernels again to not exhaust the disk space in /boot. Also in the end > > uninstall all self-built kernels again. > > I just did my first bisection \o/ (sorry) > > Here are the results: > > git bisect start > # bad: [f964b940099f9982d723d4c77988d4b0dda9c165] Linux 5.10.247 > git bisect bad f964b940099f9982d723d4c77988d4b0dda9c165 > # good: [863b76df7d1e327979946a2d3893479c3275bfa4] Linux 5.10.244 > git bisect good f52ee6ea810273e527a5d319e5f400be8c8424c1 > # good: [dc9fdb7586b90e33c766eac52b6f3d1c9ec365a1] net: usb: lan78xx: Add error handling to lan78xx_init_mac_address > git bisect good dc9fdb7586b90e33c766eac52b6f3d1c9ec365a1 > # bad: [2272d5757ce5d3fb416d9f2497b015678eb85c0d] phy: cadence: cdns-dphy: Enable lower resolutions in dphy > git bisect bad 2272d5757ce5d3fb416d9f2497b015678eb85c0d > # bad: [547539f08b9e3629ce68479889813e58c8087e70] ALSA: usb-audio: fix control pipe direction > git bisect bad 547539f08b9e3629ce68479889813e58c8087e70 > # bad: [3509c748e79435d09e730673c8c100b7f0ebc87c] most: usb: hdm_probe: Fix calling put_device() before device initialization > git bisect bad 3509c748e79435d09e730673c8c100b7f0ebc87c > # bad: [a6ebcafc2f5ff7f0d1ce0c6dc38ac09a16a56ec0] net: add ndo_fdb_del_bulk > git bisect bad a6ebcafc2f5ff7f0d1ce0c6dc38ac09a16a56ec0 > # good: [b8a72692aa42b7dcd179a96b90bc2763ac74576a] hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() > git bisect good b8a72692aa42b7dcd179a96b90bc2763ac74576a > # good: [2b42a595863556b394bd702d46f4a9d0d2985aaa] m68k: bitops: Fix find_*_bit() signatures > git bisect good 2b42a595863556b394bd702d46f4a9d0d2985aaa > # good: [9d9f7d71d46cff3491a443a3cf452cecf87d51ef] net: rtnetlink: use BIT for flag values > git bisect good 9d9f7d71d46cff3491a443a3cf452cecf87d51ef > # bad: [1550f3673972c5cfba714135f8bf26784e6f2b0f] net: rtnetlink: add bulk delete support flag > git bisect bad 1550f3673972c5cfba714135f8bf26784e6f2b0f > # good: [c8879afa24169e504f78c9ca43a4d0d7397049eb] net: netlink: add NLM_F_BULK delete request modifier > git bisect good c8879afa24169e504f78c9ca43a4d0d7397049eb > # first bad commit: [1550f3673972c5cfba714135f8bf26784e6f2b0f] net: rtnetlink: add bulk delete support flag > > Is there anything else I can do to help? Is there soemthing missing? Roland I think it would be helpful if you can test as well more recent stable series versions to confirm if the issue is present there as well or not, which might indicate a 5.10.y specific backporting problem. #regzbot introduced: 1550f3673972c5cfba714135f8bf26784e6f2b0f Regards, Salvatore

4 days, 3 hours

3
2
0 0

[PATCH] drm/fsl-dcu: fix clock reference leak in fsl_tcon_init error path

by Miaoqian Lin

In fsl_tcon_init(), when of_clk_get_by_name() succeeds but clk_prepare_enable() fails, the function jumps to err_node_put label without releasing the clock reference obtained. This causes a clock reference leak. Fix by calling clk_put() that properly releases the clock reference. Found via static analysis and code review. Fixes: fb127b7943c9 ("drm/fsl-dcu: add TCON driver") Cc: stable(a)vger.kernel.org Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> --- drivers/gpu/drm/fsl-dcu/fsl_tcon.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/fsl-dcu/fsl_tcon.c b/drivers/gpu/drm/fsl-dcu/fsl_tcon.c index 49bbd00c77ae..b7ba90814b0e 100644 --- a/drivers/gpu/drm/fsl-dcu/fsl_tcon.c +++ b/drivers/gpu/drm/fsl-dcu/fsl_tcon.c @@ -86,7 +86,7 @@ struct fsl_tcon *fsl_tcon_init(struct device *dev) ret = clk_prepare_enable(tcon->ipg_clk); if (ret) { dev_err(dev, "Couldn't enable the TCON clock\n"); - goto err_node_put; + goto err_clk_put; } of_node_put(np); @@ -94,6 +94,8 @@ struct fsl_tcon *fsl_tcon_init(struct device *dev) return tcon; +err_clk_put: + clk_put(tcon->ipg_clk); err_node_put: of_node_put(np); return NULL; -- 2.25.1

4 days, 5 hours

1
0
0 0

[PATCH] enclosure: fix a api misuse in enclosure_register()

by Haoxiang Li

If device_register() fails, put_device() is the correct way to drop the device reference. Found by code review. Fixes: ee959b00c335 ("SCSI: convert struct class_device to struct device") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- drivers/misc/enclosure.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c index ca4c420e4a2f..f7f72856d697 100644 --- a/drivers/misc/enclosure.c +++ b/drivers/misc/enclosure.c @@ -149,7 +149,7 @@ enclosure_register(struct device *dev, const char *name, int components, err: put_device(edev->edev.parent); - kfree(edev); + put_device(&edev->edev); return ERR_PTR(err); } EXPORT_SYMBOL_GPL(enclosure_register); -- 2.25.1

4 days, 6 hours

1
0
0 0

[PATCH v3 0/8] ASoC: SOF: ipoc4: Support for generic bytes controls

by Peter Ujfalusi

Hi, Changes since v2: - correct the fixes tag for the second path Changes since v1: - correct SHAs for fixes tags - add Cc stable tag We support bytes control type for set and get, but these are module specific controls and there is no way to handle notifications from them in a generic way. Each control have module specific param_id and this param_id is only valid in the module's scope, other modules might use the same id for different functions for example. This series will add a new generic control type, similar to the existing ones for ENUM and SWITCH, which can be used to create bytes controls which can send notifications from firmware on change. The new param_id is 202 and the sof_ipc4_control_msg_payload is updated to describe bytes payload also. On set, the payload must include the sof_ipc4_control_msg_payload struct with the control's ID and data size, followed by the data. On get, the kernel needs to send the sof_ipc4_control_msg_payload struct along with the LARGE_CONFIG_GET message as payload with the ID of the control that needs to be retrieved. The raw data is received back without additional header. A notification might contain data, in this case the num_elems reflects the size in bytes, or without data. If no data is received then the control is marked as dirty and on read the kernel will refresh the data from firmware. The series includes mandatory fixes for existing code and adds support for sending payload with LARGE_CONFIG_GET when the param_id is either generic ENUM, SWITCH or BYTES control. Regards, Peter --- Peter Ujfalusi (8): ASoC: SOF: ipc4-control: If there is no data do not send bytes update ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data ASoC: SOF: ipc4-control: Keep the payload size up to date ASoC: SOF: ipc4-topology: Set initial param_id for bytes control type ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET ASoC: SOF: ipc4: Add definition for generic bytes control ASoC: SOF: ipc4-control: Add support for generic bytes control sound/soc/sof/ipc4-control.c | 197 ++++++++++++++++++++++++++++++---- sound/soc/sof/ipc4-topology.c | 36 +++++-- sound/soc/sof/ipc4-topology.h | 9 +- sound/soc/sof/ipc4.c | 45 +++++++- 4 files changed, 252 insertions(+), 35 deletions(-) -- 2.52.0

4 days, 6 hours

2
9
0 0

[PATCH v2 0/8] ASoC: SOF: ipoc4: Support for generic bytes controls

by Peter Ujfalusi

Hi, Changes since v1: - correct SHAs for fixes tags - add Cc stable tag We support bytes control type for set and get, but these are module specific controls and there is no way to handle notifications from them in a generic way. Each control have module specific param_id and this param_id is only valid in the module's scope, other modules might use the same id for different functions for example. This series will add a new generic control type, similar to the existing ones for ENUM and SWITCH, which can be used to create bytes controls which can send notifications from firmware on change. The new param_id is 202 and the sof_ipc4_control_msg_payload is updated to describe bytes payload also. On set, the payload must include the sof_ipc4_control_msg_payload struct with the control's ID and data size, followed by the data. On get, the kernel needs to send the sof_ipc4_control_msg_payload struct along with the LARGE_CONFIG_GET message as payload with the ID of the control that needs to be retrieved. The raw data is received back without additional header. A notification might contain data, in this case the num_elems reflects the size in bytes, or without data. If no data is received then the control is marked as dirty and on read the kernel will refresh the data from firmware. The series includes mandatory fixes for existing code and adds support for sending payload with LARGE_CONFIG_GET when the param_id is either generic ENUM, SWITCH or BYTES control. Regards, Peter --- Peter Ujfalusi (8): ASoC: SOF: ipc4-control: If there is no data do not send bytes update ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data ASoC: SOF: ipc4-control: Keep the payload size up to date ASoC: SOF: ipc4-topology: Set initial param_id for bytes control type ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET ASoC: SOF: ipc4: Add definition for generic bytes control ASoC: SOF: ipc4-control: Add support for generic bytes control sound/soc/sof/ipc4-control.c | 197 ++++++++++++++++++++++++++++++---- sound/soc/sof/ipc4-topology.c | 36 +++++-- sound/soc/sof/ipc4-topology.h | 9 +- sound/soc/sof/ipc4.c | 45 +++++++- 4 files changed, 252 insertions(+), 35 deletions(-) -- 2.52.0

4 days, 6 hours

3
12
0 0

[PATCH] drm/amdgpu: don't attach the tlb fence for SI

by Hans de Goede

From: Alex Deucher <alexander.deucher(a)amd.com> commit eb296c09805ee37dd4ea520a7fb3ec157c31090f upstream. SI hardware doesn't support pasids, user mode queues, or KIQ/MES so there is no need for this. Doing so results in a segfault as these callbacks are non-existent for SI. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4744 Fixes: f3854e04b708 ("drm/amdgpu: attach tlb fence to the PTs update") Reviewed-by: Timur Kristóf <timur.kristof(a)gmail.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Hans de Goede <johannes.goede(a)oss.qualcomm.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c index 676e24fb8864..cdcafde3c71a 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c @@ -1066,7 +1066,9 @@ amdgpu_vm_tlb_flush(struct amdgpu_vm_update_params *params, } /* Prepare a TLB flush fence to be attached to PTs */ - if (!params->unlocked) { + if (!params->unlocked && + /* SI doesn't support pasid or KIQ/MES */ + params->adev->family > AMDGPU_FAMILY_SI) { amdgpu_vm_tlb_fence_create(params->adev, vm, fence); /* Makes sure no PD/PT is freed before the flush */ -- 2.52.0

4 days, 7 hours

3
5
0 0

[PATCH 5/5] drm/tests: shmem: Hold reservation lock around purge

by Thomas Zimmermann

Acquire and release the GEM object's reservation lock around calls to the object's purge operation. The tests use drm_gem_shmem_purge_locked(), which led to errors such as show below. [ 58.709128] WARNING: CPU: 1 PID: 1354 at drivers/gpu/drm/drm_gem_shmem_helper.c:515 drm_gem_shmem_purge_locked+0x51c/0x740 Only export the new helper drm_gem_shmem_purge() for Kunit tests. This is not an interface for regular drivers. Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Fixes: 954907f7147d ("drm/shmem-helper: Refactor locked/unlocked functions") Cc: dri-devel(a)lists.freedesktop.org Cc: <stable(a)vger.kernel.org> # v6.16+ --- drivers/gpu/drm/drm_gem_shmem_helper.c | 15 +++++++++++++++ drivers/gpu/drm/tests/drm_gem_shmem_test.c | 4 +++- include/drm/drm_gem_shmem_helper.h | 1 + 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index 4ffcf6ed46f5..dfc24392cb61 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -939,6 +939,21 @@ int drm_gem_shmem_madvise(struct drm_gem_shmem_object *shmem, int madv) return ret; } EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_madvise); + +int drm_gem_shmem_purge(struct drm_gem_shmem_object *shmem) +{ + struct drm_gem_object *obj = &shmem->base; + int ret; + + ret = dma_resv_lock_interruptible(obj->resv, NULL); + if (ret) + return ret; + drm_gem_shmem_purge_locked(shmem); + dma_resv_unlock(obj->resv); + + return 0; +} +EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_purge); #endif MODULE_DESCRIPTION("DRM SHMEM memory-management helpers"); diff --git a/drivers/gpu/drm/tests/drm_gem_shmem_test.c b/drivers/gpu/drm/tests/drm_gem_shmem_test.c index d639848e3c8e..4b459f21acfd 100644 --- a/drivers/gpu/drm/tests/drm_gem_shmem_test.c +++ b/drivers/gpu/drm/tests/drm_gem_shmem_test.c @@ -340,7 +340,9 @@ static void drm_gem_shmem_test_purge(struct kunit *test) ret = drm_gem_shmem_is_purgeable(shmem); KUNIT_EXPECT_TRUE(test, ret); - drm_gem_shmem_purge_locked(shmem); + ret = drm_gem_shmem_purge(shmem); + KUNIT_ASSERT_EQ(test, ret, 0); + KUNIT_EXPECT_NULL(test, shmem->pages); KUNIT_EXPECT_NULL(test, shmem->sgt); KUNIT_EXPECT_EQ(test, shmem->madv, -1); diff --git a/include/drm/drm_gem_shmem_helper.h b/include/drm/drm_gem_shmem_helper.h index 3dd93e2df709..8d56970d7eed 100644 --- a/include/drm/drm_gem_shmem_helper.h +++ b/include/drm/drm_gem_shmem_helper.h @@ -311,6 +311,7 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev, int drm_gem_shmem_vmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map); void drm_gem_shmem_vunmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map); int drm_gem_shmem_madvise(struct drm_gem_shmem_object *shmem, int madv); +int drm_gem_shmem_purge(struct drm_gem_shmem_object *shmem); #endif #endif /* __DRM_GEM_SHMEM_HELPER_H__ */ -- 2.52.0

4 days, 7 hours

2
1
0 0

[PATCH 4/5] drm/tests: shmem: Hold reservation lock around madvise

by Thomas Zimmermann

Acquire and release the GEM object's reservation lock around calls to the object's madvide operation. The tests use drm_gem_shmem_madvise_locked(), which led to errors such as show below. [ 58.339389] WARNING: CPU: 1 PID: 1352 at drivers/gpu/drm/drm_gem_shmem_helper.c:499 drm_gem_shmem_madvise_locked+0xde/0x140 Only export the new helper drm_gem_shmem_madvise() for Kunit tests. This is not an interface for regular drivers. Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Fixes: 954907f7147d ("drm/shmem-helper: Refactor locked/unlocked functions") Cc: dri-devel(a)lists.freedesktop.org Cc: <stable(a)vger.kernel.org> # v6.16+ --- drivers/gpu/drm/drm_gem_shmem_helper.c | 15 +++++++++++++++ drivers/gpu/drm/tests/drm_gem_shmem_test.c | 8 ++++---- include/drm/drm_gem_shmem_helper.h | 1 + 3 files changed, 20 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index 06ef4e5adb7d..4ffcf6ed46f5 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -924,6 +924,21 @@ void drm_gem_shmem_vunmap(struct drm_gem_shmem_object *shmem, struct iosys_map * dma_resv_unlock(obj->resv); } EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_vunmap); + +int drm_gem_shmem_madvise(struct drm_gem_shmem_object *shmem, int madv) +{ + struct drm_gem_object *obj = &shmem->base; + int ret; + + ret = dma_resv_lock_interruptible(obj->resv, NULL); + if (ret) + return ret; + ret = drm_gem_shmem_madvise_locked(shmem, madv); + dma_resv_unlock(obj->resv); + + return ret; +} +EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_madvise); #endif MODULE_DESCRIPTION("DRM SHMEM memory-management helpers"); diff --git a/drivers/gpu/drm/tests/drm_gem_shmem_test.c b/drivers/gpu/drm/tests/drm_gem_shmem_test.c index 3e7c6f20fbcc..d639848e3c8e 100644 --- a/drivers/gpu/drm/tests/drm_gem_shmem_test.c +++ b/drivers/gpu/drm/tests/drm_gem_shmem_test.c @@ -292,17 +292,17 @@ static void drm_gem_shmem_test_madvise(struct kunit *test) ret = kunit_add_action_or_reset(test, drm_gem_shmem_free_wrapper, shmem); KUNIT_ASSERT_EQ(test, ret, 0); - ret = drm_gem_shmem_madvise_locked(shmem, 1); + ret = drm_gem_shmem_madvise(shmem, 1); KUNIT_EXPECT_TRUE(test, ret); KUNIT_ASSERT_EQ(test, shmem->madv, 1); /* Set madv to a negative value */ - ret = drm_gem_shmem_madvise_locked(shmem, -1); + ret = drm_gem_shmem_madvise(shmem, -1); KUNIT_EXPECT_FALSE(test, ret); KUNIT_ASSERT_EQ(test, shmem->madv, -1); /* Check that madv cannot be set back to a positive value */ - ret = drm_gem_shmem_madvise_locked(shmem, 0); + ret = drm_gem_shmem_madvise(shmem, 0); KUNIT_EXPECT_FALSE(test, ret); KUNIT_ASSERT_EQ(test, shmem->madv, -1); } @@ -330,7 +330,7 @@ static void drm_gem_shmem_test_purge(struct kunit *test) ret = drm_gem_shmem_is_purgeable(shmem); KUNIT_EXPECT_FALSE(test, ret); - ret = drm_gem_shmem_madvise_locked(shmem, 1); + ret = drm_gem_shmem_madvise(shmem, 1); KUNIT_EXPECT_TRUE(test, ret); /* The scatter/gather table will be freed by drm_gem_shmem_free */ diff --git a/include/drm/drm_gem_shmem_helper.h b/include/drm/drm_gem_shmem_helper.h index 6924ee226655..3dd93e2df709 100644 --- a/include/drm/drm_gem_shmem_helper.h +++ b/include/drm/drm_gem_shmem_helper.h @@ -310,6 +310,7 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev, #if IS_ENABLED(CONFIG_KUNIT) int drm_gem_shmem_vmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map); void drm_gem_shmem_vunmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map); +int drm_gem_shmem_madvise(struct drm_gem_shmem_object *shmem, int madv); #endif #endif /* __DRM_GEM_SHMEM_HELPER_H__ */ -- 2.52.0

4 days, 7 hours

2
1
0 0

[PATCH 3/5] drm/tests: shmem: Hold reservation lock around vmap/vunmap

by Thomas Zimmermann

Acquire and release the GEM object's reservation lock around vmap and vunmap operations. The tests use vmap_locked, which led to errors such as show below. [ 122.292030] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:390 drm_gem_shmem_vmap_locked+0x3a3/0x6f0 [ 122.468066] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:293 drm_gem_shmem_pin_locked+0x1fe/0x350 [ 122.563504] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:234 drm_gem_shmem_get_pages_locked+0x23c/0x370 [ 122.662248] WARNING: CPU: 2 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:452 drm_gem_shmem_vunmap_locked+0x101/0x330 Only export the new vmap/vunmap helpers for Kunit tests. These are not interfaces for regular drivers. Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Fixes: 954907f7147d ("drm/shmem-helper: Refactor locked/unlocked functions") Cc: dri-devel(a)lists.freedesktop.org Cc: <stable(a)vger.kernel.org> # v6.16+ --- drivers/gpu/drm/drm_gem_shmem_helper.c | 33 ++++++++++++++++++++++ drivers/gpu/drm/tests/drm_gem_shmem_test.c | 6 ++-- include/drm/drm_gem_shmem_helper.h | 9 ++++++ 3 files changed, 46 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index dc94a27710e5..06ef4e5adb7d 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -15,6 +15,8 @@ #include <asm/set_memory.h> #endif +#include <kunit/visibility.h> + #include <drm/drm.h> #include <drm/drm_device.h> #include <drm/drm_drv.h> @@ -893,6 +895,37 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev, } EXPORT_SYMBOL_GPL(drm_gem_shmem_prime_import_no_map); +/* + * Kunit helpers + */ + +#if IS_ENABLED(CONFIG_KUNIT) +int drm_gem_shmem_vmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map) +{ + struct drm_gem_object *obj = &shmem->base; + int ret; + + ret = dma_resv_lock_interruptible(obj->resv, NULL); + if (ret) + return ret; + ret = drm_gem_shmem_vmap_locked(shmem, map); + dma_resv_unlock(obj->resv); + + return ret; +} +EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_vmap); + +void drm_gem_shmem_vunmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map) +{ + struct drm_gem_object *obj = &shmem->base; + + dma_resv_lock_interruptible(obj->resv, NULL); + drm_gem_shmem_vunmap_locked(shmem, map); + dma_resv_unlock(obj->resv); +} +EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_vunmap); +#endif + MODULE_DESCRIPTION("DRM SHMEM memory-management helpers"); MODULE_IMPORT_NS("DMA_BUF"); MODULE_LICENSE("GPL v2"); diff --git a/drivers/gpu/drm/tests/drm_gem_shmem_test.c b/drivers/gpu/drm/tests/drm_gem_shmem_test.c index 1d50bab51ef3..3e7c6f20fbcc 100644 --- a/drivers/gpu/drm/tests/drm_gem_shmem_test.c +++ b/drivers/gpu/drm/tests/drm_gem_shmem_test.c @@ -19,6 +19,8 @@ #include <drm/drm_gem_shmem_helper.h> #include <drm/drm_kunit_helpers.h> +MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING"); + #define TEST_SIZE SZ_1M #define TEST_BYTE 0xae @@ -176,7 +178,7 @@ static void drm_gem_shmem_test_vmap(struct kunit *test) ret = kunit_add_action_or_reset(test, drm_gem_shmem_free_wrapper, shmem); KUNIT_ASSERT_EQ(test, ret, 0); - ret = drm_gem_shmem_vmap_locked(shmem, &map); + ret = drm_gem_shmem_vmap(shmem, &map); KUNIT_ASSERT_EQ(test, ret, 0); KUNIT_ASSERT_NOT_NULL(test, shmem->vaddr); KUNIT_ASSERT_FALSE(test, iosys_map_is_null(&map)); @@ -186,7 +188,7 @@ static void drm_gem_shmem_test_vmap(struct kunit *test) for (i = 0; i < TEST_SIZE; i++) KUNIT_EXPECT_EQ(test, iosys_map_rd(&map, i, u8), TEST_BYTE); - drm_gem_shmem_vunmap_locked(shmem, &map); + drm_gem_shmem_vunmap(shmem, &map); KUNIT_EXPECT_NULL(test, shmem->vaddr); KUNIT_EXPECT_EQ(test, refcount_read(&shmem->vmap_use_count), 0); } diff --git a/include/drm/drm_gem_shmem_helper.h b/include/drm/drm_gem_shmem_helper.h index 589f7bfe7506..6924ee226655 100644 --- a/include/drm/drm_gem_shmem_helper.h +++ b/include/drm/drm_gem_shmem_helper.h @@ -303,4 +303,13 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev, .gem_prime_import = drm_gem_shmem_prime_import_no_map, \ .dumb_create = drm_gem_shmem_dumb_create +/* + * Kunit helpers + */ + +#if IS_ENABLED(CONFIG_KUNIT) +int drm_gem_shmem_vmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map); +void drm_gem_shmem_vunmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map); +#endif + #endif /* __DRM_GEM_SHMEM_HELPER_H__ */ -- 2.52.0

4 days, 8 hours

2
1
0 0

[PATCH 2/5] drm/tests: shmem: Add clean-up action to unpin pages

by Thomas Zimmermann

Automatically unpin pages on cleanup. The test currently fails with the error [ 58.246263] drm-kunit-mock-device drm_gem_shmem_test_get_sg_table.drm-kunit-mock-device: [drm] drm_WARN_ON(refcount_read(&shmem->pages_pin_count)) while cleaning up the GEM object. The pin count has to be zero at this point. Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Fixes: d586b535f144 ("drm/shmem-helper: Add and use pages_pin_count") Cc: dri-devel(a)lists.freedesktop.org Cc: <stable(a)vger.kernel.org> # v6.16+ --- drivers/gpu/drm/tests/drm_gem_shmem_test.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/tests/drm_gem_shmem_test.c b/drivers/gpu/drm/tests/drm_gem_shmem_test.c index 872881ec9c30..1d50bab51ef3 100644 --- a/drivers/gpu/drm/tests/drm_gem_shmem_test.c +++ b/drivers/gpu/drm/tests/drm_gem_shmem_test.c @@ -34,6 +34,9 @@ KUNIT_DEFINE_ACTION_WRAPPER(sg_free_table_wrapper, sg_free_table, KUNIT_DEFINE_ACTION_WRAPPER(drm_gem_shmem_free_wrapper, drm_gem_shmem_free, struct drm_gem_shmem_object *); +KUNIT_DEFINE_ACTION_WRAPPER(drm_gem_shmem_unpin_wrapper, drm_gem_shmem_unpin, + struct drm_gem_shmem_object *); + /* * Test creating a shmem GEM object backed by shmem buffer. The test * case succeeds if the GEM object is successfully allocated with the @@ -212,6 +215,9 @@ static void drm_gem_shmem_test_get_sg_table(struct kunit *test) ret = drm_gem_shmem_pin(shmem); KUNIT_ASSERT_EQ(test, ret, 0); + ret = kunit_add_action_or_reset(test, drm_gem_shmem_unpin_wrapper, shmem); + KUNIT_ASSERT_EQ(test, ret, 0); + sgt = drm_gem_shmem_get_sg_table(shmem); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, sgt); KUNIT_EXPECT_NULL(test, shmem->sgt); -- 2.52.0

4 days, 8 hours

2
1
0 0

[PATCH 1/5] drm/tests: shmem: Swap names of export tests

by Thomas Zimmermann

GEM SHMEM has 2 helpers for exporting S/G tables. Swap the names of the rsp. tests, so that each matches the helper it tests. Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Fixes: 93032ae634d4 ("drm/test: add a test suite for GEM objects backed by shmem") Cc: dri-devel(a)lists.freedesktop.org Cc: <stable(a)vger.kernel.org> # v6.8+ --- drivers/gpu/drm/tests/drm_gem_shmem_test.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/tests/drm_gem_shmem_test.c b/drivers/gpu/drm/tests/drm_gem_shmem_test.c index 68f2c3162354..872881ec9c30 100644 --- a/drivers/gpu/drm/tests/drm_gem_shmem_test.c +++ b/drivers/gpu/drm/tests/drm_gem_shmem_test.c @@ -194,7 +194,7 @@ static void drm_gem_shmem_test_vmap(struct kunit *test) * scatter/gather table large enough to accommodate the backing memory * is successfully exported. */ -static void drm_gem_shmem_test_get_pages_sgt(struct kunit *test) +static void drm_gem_shmem_test_get_sg_table(struct kunit *test) { struct drm_device *drm_dev = test->priv; struct drm_gem_shmem_object *shmem; @@ -236,7 +236,7 @@ static void drm_gem_shmem_test_get_pages_sgt(struct kunit *test) * backing pages are pinned and a scatter/gather table large enough to * accommodate the backing memory is successfully exported. */ -static void drm_gem_shmem_test_get_sg_table(struct kunit *test) +static void drm_gem_shmem_test_get_pages_sgt(struct kunit *test) { struct drm_device *drm_dev = test->priv; struct drm_gem_shmem_object *shmem; @@ -366,8 +366,8 @@ static struct kunit_case drm_gem_shmem_test_cases[] = { KUNIT_CASE(drm_gem_shmem_test_obj_create_private), KUNIT_CASE(drm_gem_shmem_test_pin_pages), KUNIT_CASE(drm_gem_shmem_test_vmap), - KUNIT_CASE(drm_gem_shmem_test_get_pages_sgt), KUNIT_CASE(drm_gem_shmem_test_get_sg_table), + KUNIT_CASE(drm_gem_shmem_test_get_pages_sgt), KUNIT_CASE(drm_gem_shmem_test_madvise), KUNIT_CASE(drm_gem_shmem_test_purge), {} -- 2.52.0

4 days, 8 hours

2
1
0 0

[PATCH v2 RESEND] coresight: etm-perf: Fix reference count leak in etm_setup_aux

by Ma Ke

In etm_setup_aux(), when a user sink is obtained via coresight_get_sink_by_id(), it increments the reference count of the sink device. However, if the sink is used in path building, the path holds a reference, but the initial reference from coresight_get_sink_by_id() is not released, causing a reference count leak. We should release the initial reference after the path is built. Found by code review. Cc: stable(a)vger.kernel.org Fixes: 0e6c20517596 ("coresight: etm-perf: Allow an event to use different sinks") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- Changes in v2: - modified the patch as suggestions. --- drivers/hwtracing/coresight/coresight-etm-perf.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c index 17afa0f4cdee..56d012ab6d3a 100644 --- a/drivers/hwtracing/coresight/coresight-etm-perf.c +++ b/drivers/hwtracing/coresight/coresight-etm-perf.c @@ -454,6 +454,11 @@ static void *etm_setup_aux(struct perf_event *event, void **pages, goto err; out: + if (user_sink) { + put_device(&user_sink->dev); + user_sink = NULL; + } + return event_data; err: -- 2.17.1

4 days, 8 hours

5
9
0 0

[PATCH v6 03/24] drm/pagemap, drm/xe: Ensure that the devmem allocation is idle before use

by Thomas Hellström

In situations where no system memory is migrated to devmem, and in upcoming patches where another GPU is performing the migration to the newly allocated devmem buffer, there is nothing to ensure any ongoing clear to the devmem allocation or async eviction from the devmem allocation is complete. Address that by passing a struct dma_fence down to the copy functions, and ensure it is waited for before migration is marked complete. v3: - New patch. v4: - Update the logic used for determining when to wait for the pre_migrate_fence. - Update the logic used for determining when to warn for the pre_migrate_fence since the scheduler fences apparently can signal out-of-order. v5: - Fix a UAF (CI) - Remove references to source P2P migration (Himal) - Put the pre_migrate_fence after migration. v6: - Pipeline the pre_migrate_fence dependency (Matt Brost) Fixes: c5b3eb5a906c ("drm/xe: Add GPUSVM device memory copy vfunc functions") Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: <stable(a)vger.kernel.org> # v6.15+ Signed-off-by: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Reviewed-by: Matthew Brost <matthew.brost(a)intel.com> --- drivers/gpu/drm/drm_pagemap.c | 17 +++++++++--- drivers/gpu/drm/xe/xe_migrate.c | 25 +++++++++++++---- drivers/gpu/drm/xe/xe_migrate.h | 6 ++-- drivers/gpu/drm/xe/xe_svm.c | 49 +++++++++++++++++++++++++-------- include/drm/drm_pagemap.h | 17 ++++++++++-- 5 files changed, 88 insertions(+), 26 deletions(-) diff --git a/drivers/gpu/drm/drm_pagemap.c b/drivers/gpu/drm/drm_pagemap.c index 4cf8f54e5a27..ac3832f85190 100644 --- a/drivers/gpu/drm/drm_pagemap.c +++ b/drivers/gpu/drm/drm_pagemap.c @@ -3,6 +3,7 @@ * Copyright © 2024-2025 Intel Corporation */ +#include <linux/dma-fence.h> #include <linux/dma-mapping.h> #include <linux/migrate.h> #include <linux/pagemap.h> @@ -408,10 +409,14 @@ int drm_pagemap_migrate_to_devmem(struct drm_pagemap_devmem *devmem_allocation, drm_pagemap_get_devmem_page(page, zdd); } - err = ops->copy_to_devmem(pages, pagemap_addr, npages); + err = ops->copy_to_devmem(pages, pagemap_addr, npages, + devmem_allocation->pre_migrate_fence); if (err) goto err_finalize; + dma_fence_put(devmem_allocation->pre_migrate_fence); + devmem_allocation->pre_migrate_fence = NULL; + /* Upon success bind devmem allocation to range and zdd */ devmem_allocation->timeslice_expiration = get_jiffies_64() + msecs_to_jiffies(timeslice_ms); @@ -596,7 +601,7 @@ int drm_pagemap_evict_to_ram(struct drm_pagemap_devmem *devmem_allocation) for (i = 0; i < npages; ++i) pages[i] = migrate_pfn_to_page(src[i]); - err = ops->copy_to_ram(pages, pagemap_addr, npages); + err = ops->copy_to_ram(pages, pagemap_addr, npages, NULL); if (err) goto err_finalize; @@ -719,7 +724,7 @@ static int __drm_pagemap_migrate_to_ram(struct vm_area_struct *vas, for (i = 0; i < npages; ++i) pages[i] = migrate_pfn_to_page(migrate.src[i]); - err = ops->copy_to_ram(pages, pagemap_addr, npages); + err = ops->copy_to_ram(pages, pagemap_addr, npages, NULL); if (err) goto err_finalize; @@ -800,11 +805,14 @@ EXPORT_SYMBOL_GPL(drm_pagemap_pagemap_ops_get); * @ops: Pointer to the operations structure for GPU SVM device memory * @dpagemap: The struct drm_pagemap we're allocating from. * @size: Size of device memory allocation + * @pre_migrate_fence: Fence to wait for or pipeline behind before migration starts. + * (May be NULL). */ void drm_pagemap_devmem_init(struct drm_pagemap_devmem *devmem_allocation, struct device *dev, struct mm_struct *mm, const struct drm_pagemap_devmem_ops *ops, - struct drm_pagemap *dpagemap, size_t size) + struct drm_pagemap *dpagemap, size_t size, + struct dma_fence *pre_migrate_fence) { init_completion(&devmem_allocation->detached); devmem_allocation->dev = dev; @@ -812,6 +820,7 @@ void drm_pagemap_devmem_init(struct drm_pagemap_devmem *devmem_allocation, devmem_allocation->ops = ops; devmem_allocation->dpagemap = dpagemap; devmem_allocation->size = size; + devmem_allocation->pre_migrate_fence = pre_migrate_fence; } EXPORT_SYMBOL_GPL(drm_pagemap_devmem_init); diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c index f3b66b55acfb..284b575346ee 100644 --- a/drivers/gpu/drm/xe/xe_migrate.c +++ b/drivers/gpu/drm/xe/xe_migrate.c @@ -2113,6 +2113,7 @@ static struct dma_fence *xe_migrate_vram(struct xe_migrate *m, unsigned long sram_offset, struct drm_pagemap_addr *sram_addr, u64 vram_addr, + struct dma_fence *deps, const enum xe_migrate_copy_dir dir) { struct xe_gt *gt = m->tile->primary_gt; @@ -2201,6 +2202,14 @@ static struct dma_fence *xe_migrate_vram(struct xe_migrate *m, xe_sched_job_add_migrate_flush(job, MI_INVALIDATE_TLB); + if (deps && !dma_fence_is_signaled(deps)) { + dma_fence_get(deps); + err = drm_sched_job_add_dependency(&job->drm, deps); + if (err) + dma_fence_wait(deps, false); + err = 0; + } + mutex_lock(&m->job_mutex); xe_sched_job_arm(job); fence = dma_fence_get(&job->drm.s_fence->finished); @@ -2226,6 +2235,8 @@ static struct dma_fence *xe_migrate_vram(struct xe_migrate *m, * @npages: Number of pages to migrate. * @src_addr: Array of DMA information (source of migrate) * @dst_addr: Device physical address of VRAM (destination of migrate) + * @deps: struct dma_fence representing the dependencies that need + * to be signaled before migration. * * Copy from an array dma addresses to a VRAM device physical address * @@ -2235,10 +2246,11 @@ static struct dma_fence *xe_migrate_vram(struct xe_migrate *m, struct dma_fence *xe_migrate_to_vram(struct xe_migrate *m, unsigned long npages, struct drm_pagemap_addr *src_addr, - u64 dst_addr) + u64 dst_addr, + struct dma_fence *deps) { return xe_migrate_vram(m, npages * PAGE_SIZE, 0, src_addr, dst_addr, - XE_MIGRATE_COPY_TO_VRAM); + deps, XE_MIGRATE_COPY_TO_VRAM); } /** @@ -2247,6 +2259,8 @@ struct dma_fence *xe_migrate_to_vram(struct xe_migrate *m, * @npages: Number of pages to migrate. * @src_addr: Device physical address of VRAM (source of migrate) * @dst_addr: Array of DMA information (destination of migrate) + * @deps: struct dma_fence representing the dependencies that need + * to be signaled before migration. * * Copy from a VRAM device physical address to an array dma addresses * @@ -2256,10 +2270,11 @@ struct dma_fence *xe_migrate_to_vram(struct xe_migrate *m, struct dma_fence *xe_migrate_from_vram(struct xe_migrate *m, unsigned long npages, u64 src_addr, - struct drm_pagemap_addr *dst_addr) + struct drm_pagemap_addr *dst_addr, + struct dma_fence *deps) { return xe_migrate_vram(m, npages * PAGE_SIZE, 0, dst_addr, src_addr, - XE_MIGRATE_COPY_TO_SRAM); + deps, XE_MIGRATE_COPY_TO_SRAM); } static void xe_migrate_dma_unmap(struct xe_device *xe, @@ -2435,7 +2450,7 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo, __fence = xe_migrate_vram(m, current_bytes, (unsigned long)buf & ~PAGE_MASK, &pagemap_addr[current_page], - vram_addr, write ? + vram_addr, NULL, write ? XE_MIGRATE_COPY_TO_VRAM : XE_MIGRATE_COPY_TO_SRAM); if (IS_ERR(__fence)) { diff --git a/drivers/gpu/drm/xe/xe_migrate.h b/drivers/gpu/drm/xe/xe_migrate.h index 464c05dde1ba..1522afb37dcf 100644 --- a/drivers/gpu/drm/xe/xe_migrate.h +++ b/drivers/gpu/drm/xe/xe_migrate.h @@ -116,12 +116,14 @@ int xe_migrate_init(struct xe_migrate *m); struct dma_fence *xe_migrate_to_vram(struct xe_migrate *m, unsigned long npages, struct drm_pagemap_addr *src_addr, - u64 dst_addr); + u64 dst_addr, + struct dma_fence *deps); struct dma_fence *xe_migrate_from_vram(struct xe_migrate *m, unsigned long npages, u64 src_addr, - struct drm_pagemap_addr *dst_addr); + struct drm_pagemap_addr *dst_addr, + struct dma_fence *deps); struct dma_fence *xe_migrate_copy(struct xe_migrate *m, struct xe_bo *src_bo, diff --git a/drivers/gpu/drm/xe/xe_svm.c b/drivers/gpu/drm/xe/xe_svm.c index bab8e6cbe53d..14a027b3ee6b 100644 --- a/drivers/gpu/drm/xe/xe_svm.c +++ b/drivers/gpu/drm/xe/xe_svm.c @@ -472,7 +472,8 @@ static void xe_svm_copy_us_stats_incr(struct xe_gt *gt, static int xe_svm_copy(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages, const enum xe_svm_copy_dir dir) + unsigned long npages, const enum xe_svm_copy_dir dir, + struct dma_fence *pre_migrate_fence) { struct xe_vram_region *vr = NULL; struct xe_gt *gt = NULL; @@ -561,7 +562,8 @@ static int xe_svm_copy(struct page **pages, __fence = xe_migrate_from_vram(vr->migrate, i - pos + incr, vram_addr, - &pagemap_addr[pos]); + &pagemap_addr[pos], + pre_migrate_fence); } else { vm_dbg(&xe->drm, "COPY TO VRAM - 0x%016llx -> 0x%016llx, NPAGES=%ld", @@ -570,13 +572,14 @@ static int xe_svm_copy(struct page **pages, __fence = xe_migrate_to_vram(vr->migrate, i - pos + incr, &pagemap_addr[pos], - vram_addr); + vram_addr, + pre_migrate_fence); } if (IS_ERR(__fence)) { err = PTR_ERR(__fence); goto err_out; } - + pre_migrate_fence = NULL; dma_fence_put(fence); fence = __fence; } @@ -599,20 +602,22 @@ static int xe_svm_copy(struct page **pages, vram_addr, (u64)pagemap_addr[pos].addr, 1); __fence = xe_migrate_from_vram(vr->migrate, 1, vram_addr, - &pagemap_addr[pos]); + &pagemap_addr[pos], + pre_migrate_fence); } else { vm_dbg(&xe->drm, "COPY TO VRAM - 0x%016llx -> 0x%016llx, NPAGES=%d", (u64)pagemap_addr[pos].addr, vram_addr, 1); __fence = xe_migrate_to_vram(vr->migrate, 1, &pagemap_addr[pos], - vram_addr); + vram_addr, + pre_migrate_fence); } if (IS_ERR(__fence)) { err = PTR_ERR(__fence); goto err_out; } - + pre_migrate_fence = NULL; dma_fence_put(fence); fence = __fence; } @@ -625,6 +630,8 @@ static int xe_svm_copy(struct page **pages, dma_fence_wait(fence, false); dma_fence_put(fence); } + if (pre_migrate_fence) + dma_fence_wait(pre_migrate_fence, false); /* * XXX: We can't derive the GT here (or anywhere in this functions, but @@ -641,16 +648,20 @@ static int xe_svm_copy(struct page **pages, static int xe_svm_copy_to_devmem(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages) + unsigned long npages, + struct dma_fence *pre_migrate_fence) { - return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_VRAM); + return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_VRAM, + pre_migrate_fence); } static int xe_svm_copy_to_ram(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages) + unsigned long npages, + struct dma_fence *pre_migrate_fence) { - return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_SRAM); + return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_SRAM, + pre_migrate_fence); } static struct xe_bo *to_xe_bo(struct drm_pagemap_devmem *devmem_allocation) @@ -663,6 +674,7 @@ static void xe_svm_devmem_release(struct drm_pagemap_devmem *devmem_allocation) struct xe_bo *bo = to_xe_bo(devmem_allocation); struct xe_device *xe = xe_bo_device(bo); + dma_fence_put(devmem_allocation->pre_migrate_fence); xe_bo_put_async(bo); xe_pm_runtime_put(xe); } @@ -857,6 +869,7 @@ static int xe_drm_pagemap_populate_mm(struct drm_pagemap *dpagemap, unsigned long timeslice_ms) { struct xe_vram_region *vr = container_of(dpagemap, typeof(*vr), dpagemap); + struct dma_fence *pre_migrate_fence = NULL; struct xe_device *xe = vr->xe; struct device *dev = xe->drm.dev; struct drm_buddy_block *block; @@ -883,8 +896,20 @@ static int xe_drm_pagemap_populate_mm(struct drm_pagemap *dpagemap, break; } + /* Ensure that any clearing or async eviction will complete before migration. */ + if (!dma_resv_test_signaled(bo->ttm.base.resv, DMA_RESV_USAGE_KERNEL)) { + err = dma_resv_get_singleton(bo->ttm.base.resv, DMA_RESV_USAGE_KERNEL, + &pre_migrate_fence); + if (err) + dma_resv_wait_timeout(bo->ttm.base.resv, DMA_RESV_USAGE_KERNEL, + false, MAX_SCHEDULE_TIMEOUT); + else if (pre_migrate_fence) + dma_fence_enable_sw_signaling(pre_migrate_fence); + } + drm_pagemap_devmem_init(&bo->devmem_allocation, dev, mm, - &dpagemap_devmem_ops, dpagemap, end - start); + &dpagemap_devmem_ops, dpagemap, end - start, + pre_migrate_fence); blocks = &to_xe_ttm_vram_mgr_resource(bo->ttm.resource)->blocks; list_for_each_entry(block, blocks, link) diff --git a/include/drm/drm_pagemap.h b/include/drm/drm_pagemap.h index f6e7e234c089..70a7991f784f 100644 --- a/include/drm/drm_pagemap.h +++ b/include/drm/drm_pagemap.h @@ -8,6 +8,7 @@ #define NR_PAGES(order) (1U << (order)) +struct dma_fence; struct drm_pagemap; struct drm_pagemap_zdd; struct device; @@ -174,6 +175,8 @@ struct drm_pagemap_devmem_ops { * @pages: Pointer to array of device memory pages (destination) * @pagemap_addr: Pointer to array of DMA information (source) * @npages: Number of pages to copy + * @pre_migrate_fence: dma-fence to wait for before migration start. + * May be NULL. * * Copy pages to device memory. If the order of a @pagemap_addr entry * is greater than 0, the entry is populated but subsequent entries @@ -183,13 +186,16 @@ struct drm_pagemap_devmem_ops { */ int (*copy_to_devmem)(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages); + unsigned long npages, + struct dma_fence *pre_migrate_fence); /** * @copy_to_ram: Copy to system RAM (required for migration) * @pages: Pointer to array of device memory pages (source) * @pagemap_addr: Pointer to array of DMA information (destination) * @npages: Number of pages to copy + * @pre_migrate_fence: dma-fence to wait for before migration start. + * May be NULL. * * Copy pages to system RAM. If the order of a @pagemap_addr entry * is greater than 0, the entry is populated but subsequent entries @@ -199,7 +205,8 @@ struct drm_pagemap_devmem_ops { */ int (*copy_to_ram)(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages); + unsigned long npages, + struct dma_fence *pre_migrate_fence); }; /** @@ -212,6 +219,8 @@ struct drm_pagemap_devmem_ops { * @dpagemap: The struct drm_pagemap of the pages this allocation belongs to. * @size: Size of device memory allocation * @timeslice_expiration: Timeslice expiration in jiffies + * @pre_migrate_fence: Fence to wait for or pipeline behind before migration starts. + * (May be NULL). */ struct drm_pagemap_devmem { struct device *dev; @@ -221,6 +230,7 @@ struct drm_pagemap_devmem { struct drm_pagemap *dpagemap; size_t size; u64 timeslice_expiration; + struct dma_fence *pre_migrate_fence; }; int drm_pagemap_migrate_to_devmem(struct drm_pagemap_devmem *devmem_allocation, @@ -238,7 +248,8 @@ struct drm_pagemap *drm_pagemap_page_to_dpagemap(struct page *page); void drm_pagemap_devmem_init(struct drm_pagemap_devmem *devmem_allocation, struct device *dev, struct mm_struct *mm, const struct drm_pagemap_devmem_ops *ops, - struct drm_pagemap *dpagemap, size_t size); + struct drm_pagemap *dpagemap, size_t size, + struct dma_fence *pre_migrate_fence); int drm_pagemap_populate_mm(struct drm_pagemap *dpagemap, unsigned long start, unsigned long end, -- 2.51.1

4 days, 9 hours

1
0
0 0

[PATCH v6 01/24] drm/xe/svm: Fix a debug printout

by Thomas Hellström

Avoid spamming the log with drm_info(). Use drm_dbg() instead. Fixes: cc795e041034 ("drm/xe/svm: Make xe_svm_range_needs_migrate_to_vram() public") Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> Cc: <stable(a)vger.kernel.org> # v6.17+ Signed-off-by: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> --- drivers/gpu/drm/xe/xe_svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xe/xe_svm.c b/drivers/gpu/drm/xe/xe_svm.c index 93550c7c84ac..bab8e6cbe53d 100644 --- a/drivers/gpu/drm/xe/xe_svm.c +++ b/drivers/gpu/drm/xe/xe_svm.c @@ -937,7 +937,7 @@ bool xe_svm_range_needs_migrate_to_vram(struct xe_svm_range *range, struct xe_vm xe_assert(vm->xe, IS_DGFX(vm->xe)); if (xe_svm_range_in_vram(range)) { - drm_info(&vm->xe->drm, "Range is already in VRAM\n"); + drm_dbg(&vm->xe->drm, "Range is already in VRAM\n"); return false; } -- 2.51.1

4 days, 9 hours

1
0
0 0

[PATCH 6.12 1/1] sched/rt: Fix race in push_rt_task

by Rajani Kantha

From: Harshit Agarwal <harshit(a)nutanix.com> [ Upstream commit 690e47d1403e90b7f2366f03b52ed3304194c793 ] Overview ======== When a CPU chooses to call push_rt_task and picks a task to push to another CPU's runqueue then it will call find_lock_lowest_rq method which would take a double lock on both CPUs' runqueues. If one of the locks aren't readily available, it may lead to dropping the current runqueue lock and reacquiring both the locks at once. During this window it is possible that the task is already migrated and is running on some other CPU. These cases are already handled. However, if the task is migrated and has already been executed and another CPU is now trying to wake it up (ttwu) such that it is queued again on the runqeue (on_rq is 1) and also if the task was run by the same CPU, then the current checks will pass even though the task was migrated out and is no longer in the pushable tasks list. Crashes ======= This bug resulted in quite a few flavors of crashes triggering kernel panics with various crash signatures such as assert failures, page faults, null pointer dereferences, and queue corruption errors all coming from scheduler itself. Some of the crashes: -> kernel BUG at kernel/sched/rt.c:1616! BUG_ON(idx >= MAX_RT_PRIO) Call Trace: ? __die_body+0x1a/0x60 ? die+0x2a/0x50 ? do_trap+0x85/0x100 ? pick_next_task_rt+0x6e/0x1d0 ? do_error_trap+0x64/0xa0 ? pick_next_task_rt+0x6e/0x1d0 ? exc_invalid_op+0x4c/0x60 ? pick_next_task_rt+0x6e/0x1d0 ? asm_exc_invalid_op+0x12/0x20 ? pick_next_task_rt+0x6e/0x1d0 __schedule+0x5cb/0x790 ? update_ts_time_stats+0x55/0x70 schedule_idle+0x1e/0x40 do_idle+0x15e/0x200 cpu_startup_entry+0x19/0x20 start_secondary+0x117/0x160 secondary_startup_64_no_verify+0xb0/0xbb -> BUG: kernel NULL pointer dereference, address: 00000000000000c0 Call Trace: ? __die_body+0x1a/0x60 ? no_context+0x183/0x350 ? __warn+0x8a/0xe0 ? exc_page_fault+0x3d6/0x520 ? asm_exc_page_fault+0x1e/0x30 ? pick_next_task_rt+0xb5/0x1d0 ? pick_next_task_rt+0x8c/0x1d0 __schedule+0x583/0x7e0 ? update_ts_time_stats+0x55/0x70 schedule_idle+0x1e/0x40 do_idle+0x15e/0x200 cpu_startup_entry+0x19/0x20 start_secondary+0x117/0x160 secondary_startup_64_no_verify+0xb0/0xbb -> BUG: unable to handle page fault for address: ffff9464daea5900 kernel BUG at kernel/sched/rt.c:1861! BUG_ON(rq->cpu != task_cpu(p)) -> kernel BUG at kernel/sched/rt.c:1055! BUG_ON(!rq->nr_running) Call Trace: ? __die_body+0x1a/0x60 ? die+0x2a/0x50 ? do_trap+0x85/0x100 ? dequeue_top_rt_rq+0xa2/0xb0 ? do_error_trap+0x64/0xa0 ? dequeue_top_rt_rq+0xa2/0xb0 ? exc_invalid_op+0x4c/0x60 ? dequeue_top_rt_rq+0xa2/0xb0 ? asm_exc_invalid_op+0x12/0x20 ? dequeue_top_rt_rq+0xa2/0xb0 dequeue_rt_entity+0x1f/0x70 dequeue_task_rt+0x2d/0x70 __schedule+0x1a8/0x7e0 ? blk_finish_plug+0x25/0x40 schedule+0x3c/0xb0 futex_wait_queue_me+0xb6/0x120 futex_wait+0xd9/0x240 do_futex+0x344/0xa90 ? get_mm_exe_file+0x30/0x60 ? audit_exe_compare+0x58/0x70 ? audit_filter_rules.constprop.26+0x65e/0x1220 __x64_sys_futex+0x148/0x1f0 do_syscall_64+0x30/0x80 entry_SYSCALL_64_after_hwframe+0x62/0xc7 -> BUG: unable to handle page fault for address: ffff8cf3608bc2c0 Call Trace: ? __die_body+0x1a/0x60 ? no_context+0x183/0x350 ? spurious_kernel_fault+0x171/0x1c0 ? exc_page_fault+0x3b6/0x520 ? plist_check_list+0x15/0x40 ? plist_check_list+0x2e/0x40 ? asm_exc_page_fault+0x1e/0x30 ? _cond_resched+0x15/0x30 ? futex_wait_queue_me+0xc8/0x120 ? futex_wait+0xd9/0x240 ? try_to_wake_up+0x1b8/0x490 ? futex_wake+0x78/0x160 ? do_futex+0xcd/0xa90 ? plist_check_list+0x15/0x40 ? plist_check_list+0x2e/0x40 ? plist_del+0x6a/0xd0 ? plist_check_list+0x15/0x40 ? plist_check_list+0x2e/0x40 ? dequeue_pushable_task+0x20/0x70 ? __schedule+0x382/0x7e0 ? asm_sysvec_reschedule_ipi+0xa/0x20 ? schedule+0x3c/0xb0 ? exit_to_user_mode_prepare+0x9e/0x150 ? irqentry_exit_to_user_mode+0x5/0x30 ? asm_sysvec_reschedule_ipi+0x12/0x20 Above are some of the common examples of the crashes that were observed due to this issue. Details ======= Let's look at the following scenario to understand this race. 1) CPU A enters push_rt_task a) CPU A has chosen next_task = task p. b) CPU A calls find_lock_lowest_rq(Task p, CPU Z’s rq). c) CPU A identifies CPU X as a destination CPU (X < Z). d) CPU A enters double_lock_balance(CPU Z’s rq, CPU X’s rq). e) Since X is lower than Z, CPU A unlocks CPU Z’s rq. Someone else has locked CPU X’s rq, and thus, CPU A must wait. 2) At CPU Z a) Previous task has completed execution and thus, CPU Z enters schedule, locks its own rq after CPU A releases it. b) CPU Z dequeues previous task and begins executing task p. c) CPU Z unlocks its rq. d) Task p yields the CPU (ex. by doing IO or waiting to acquire a lock) which triggers the schedule function on CPU Z. e) CPU Z enters schedule again, locks its own rq, and dequeues task p. f) As part of dequeue, it sets p.on_rq = 0 and unlocks its rq. 3) At CPU B a) CPU B enters try_to_wake_up with input task p. b) Since CPU Z dequeued task p, p.on_rq = 0, and CPU B updates B.state = WAKING. c) CPU B via select_task_rq determines CPU Y as the target CPU. 4) The race a) CPU A acquires CPU X’s lock and relocks CPU Z. b) CPU A reads task p.cpu = Z and incorrectly concludes task p is still on CPU Z. c) CPU A failed to notice task p had been dequeued from CPU Z while CPU A was waiting for locks in double_lock_balance. If CPU A knew that task p had been dequeued, it would return NULL forcing push_rt_task to give up the task p's migration. d) CPU B updates task p.cpu = Y and calls ttwu_queue. e) CPU B locks Ys rq. CPU B enqueues task p onto Y and sets task p.on_rq = 1. f) CPU B unlocks CPU Y, triggering memory synchronization. g) CPU A reads task p.on_rq = 1, cementing its assumption that task p has not migrated. h) CPU A decides to migrate p to CPU X. This leads to A dequeuing p from Y's queue and various crashes down the line. Solution ======== The solution here is fairly simple. After obtaining the lock (at 4a), the check is enhanced to make sure that the task is still at the head of the pushable tasks list. If not, then it is anyway not suitable for being pushed out. Testing ======= The fix is tested on a cluster of 3 nodes, where the panics due to this are hit every couple of days. A fix similar to this was deployed on such cluster and was stable for more than 30 days. Co-developed-by: Jon Kohler <jon(a)nutanix.com> Signed-off-by: Jon Kohler <jon(a)nutanix.com> Co-developed-by: Gauri Patwardhan <gauri.patwardhan(a)nutanix.com> Signed-off-by: Gauri Patwardhan <gauri.patwardhan(a)nutanix.com> Co-developed-by: Rahul Chunduru <rahul.chunduru(a)nutanix.com> Signed-off-by: Rahul Chunduru <rahul.chunduru(a)nutanix.com> Signed-off-by: Harshit Agarwal <harshit(a)nutanix.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> Reviewed-by: Phil Auld <pauld(a)redhat.com> Tested-by: Will Ton <william.ton(a)nutanix.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20250225180553.167995-1-harshit@nutanix.com Signed-off-by: Rajani Kantha <681739313(a)139.com> --- kernel/sched/rt.c | 52 +++++++++++++++++++++++------------------------ 1 file changed, 25 insertions(+), 27 deletions(-) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 6ad6717084ed..c437a1502623 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -1895,6 +1895,26 @@ static int find_lowest_rq(struct task_struct *task) return -1; } +static struct task_struct *pick_next_pushable_task(struct rq *rq) +{ + struct task_struct *p; + + if (!has_pushable_tasks(rq)) + return NULL; + + p = plist_first_entry(&rq->rt.pushable_tasks, + struct task_struct, pushable_tasks); + + BUG_ON(rq->cpu != task_cpu(p)); + BUG_ON(task_current(rq, p)); + BUG_ON(p->nr_cpus_allowed <= 1); + + BUG_ON(!task_on_rq_queued(p)); + BUG_ON(!rt_task(p)); + + return p; +} + /* Will lock the rq it finds */ static struct rq *find_lock_lowest_rq(struct task_struct *task, struct rq *rq) { @@ -1925,18 +1945,16 @@ static struct rq *find_lock_lowest_rq(struct task_struct *task, struct rq *rq) /* * We had to unlock the run queue. In * the mean time, task could have - * migrated already or had its affinity changed. - * Also make sure that it wasn't scheduled on its rq. + * migrated already or had its affinity changed, + * therefore check if the task is still at the + * head of the pushable tasks list. * It is possible the task was scheduled, set * "migrate_disabled" and then got preempted, so we must * check the task migration disable flag here too. */ - if (unlikely(task_rq(task) != rq || + if (unlikely(is_migration_disabled(task) || !cpumask_test_cpu(lowest_rq->cpu, &task->cpus_mask) || - task_on_cpu(rq, task) || - !rt_task(task) || - is_migration_disabled(task) || - !task_on_rq_queued(task))) { + task != pick_next_pushable_task(rq))) { double_unlock_balance(rq, lowest_rq); lowest_rq = NULL; @@ -1956,26 +1974,6 @@ static struct rq *find_lock_lowest_rq(struct task_struct *task, struct rq *rq) return lowest_rq; } -static struct task_struct *pick_next_pushable_task(struct rq *rq) -{ - struct task_struct *p; - - if (!has_pushable_tasks(rq)) - return NULL; - - p = plist_first_entry(&rq->rt.pushable_tasks, - struct task_struct, pushable_tasks); - - BUG_ON(rq->cpu != task_cpu(p)); - BUG_ON(task_current(rq, p)); - BUG_ON(p->nr_cpus_allowed <= 1); - - BUG_ON(!task_on_rq_queued(p)); - BUG_ON(!rt_task(p)); - - return p; -} - /* * If the current CPU has more than one RT task, see if the non * running task can migrate over to a CPU that is running a task -- 2.17.1

4 days, 9 hours

1
1
0 0

[PATCH] mfd: omap-usb-host: fix OF populate on driver rebind

by Johan Hovold

Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes. Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound. Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") Cc: stable(a)vger.kernel.org # 3.16 Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/mfd/omap-usb-host.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c index a77b6fc790f2..4d29a6e2ed87 100644 --- a/drivers/mfd/omap-usb-host.c +++ b/drivers/mfd/omap-usb-host.c @@ -819,8 +819,10 @@ static void usbhs_omap_remove(struct platform_device *pdev) { pm_runtime_disable(&pdev->dev); - /* remove children */ - device_for_each_child(&pdev->dev, NULL, usbhs_omap_remove_child); + if (pdev->dev.of_node) + of_platform_depopulate(&pdev->dev); + else + device_for_each_child(&pdev->dev, NULL, usbhs_omap_remove_child); } static const struct dev_pm_ops usbhsomap_dev_pm_ops = { -- 2.51.2

4 days, 9 hours

1
0
0 0

[PATCH] bus: omap-ocp2scp: fix OF populate on driver rebind

by Johan Hovold

Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes. Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound. Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") Cc: stable(a)vger.kernel.org # 3.16 Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/bus/omap-ocp2scp.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/drivers/bus/omap-ocp2scp.c b/drivers/bus/omap-ocp2scp.c index e4dfda7b3b10..eee5ad191ea9 100644 --- a/drivers/bus/omap-ocp2scp.c +++ b/drivers/bus/omap-ocp2scp.c @@ -17,15 +17,6 @@ #define OCP2SCP_TIMING 0x18 #define SYNC2_MASK 0xf -static int ocp2scp_remove_devices(struct device *dev, void *c) -{ - struct platform_device *pdev = to_platform_device(dev); - - platform_device_unregister(pdev); - - return 0; -} - static int omap_ocp2scp_probe(struct platform_device *pdev) { int ret; @@ -79,7 +70,7 @@ static int omap_ocp2scp_probe(struct platform_device *pdev) pm_runtime_disable(&pdev->dev); err0: - device_for_each_child(&pdev->dev, NULL, ocp2scp_remove_devices); + of_platform_depopulate(&pdev->dev); return ret; } @@ -87,7 +78,7 @@ static int omap_ocp2scp_probe(struct platform_device *pdev) static void omap_ocp2scp_remove(struct platform_device *pdev) { pm_runtime_disable(&pdev->dev); - device_for_each_child(&pdev->dev, NULL, ocp2scp_remove_devices); + of_platform_depopulate(&pdev->dev); } #ifdef CONFIG_OF -- 2.51.2

4 days, 10 hours

1
0
0 0

[PATCH v2 0/2] net: qrtr: Drop the MHI 'auto_queue' feature

by Manivannan Sadhasivam via B4 Relay

Hi, This series intends to fix the race between the MHI stack and the MHI client drivers due to the MHI 'auto_queue' feature. As it turns out often, the best way to fix an issue in a feature is to drop the feature itself and this series does exactly that. There is no real benefit in having the 'auto_queue' feature in the MHI stack, other than saving a few lines of code in the client drivers. Since the QRTR is the only client driver which makes use of this feature, this series reworks the QRTR driver to manage the buffer on its own. Testing ======= Tested on Qcom X1E based Lenovo Thinkpad T14s laptop with WLAN device. Merge Strategy ============== Since this series modifies many subsystem drivers, I'd like to get acks from relevant subsystem maintainers and take the series through MHI tree. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> --- Changes in v2: - Used mhi_get_free_desc_count() to queue the buffers - Collected tags - Link to v1: https://lore.kernel.org/r/20251217-qrtr-fix-v1-0-f6142a3ec9d8@oss.qualcomm.… --- Manivannan Sadhasivam (2): net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels bus: mhi: host: Drop the auto_queue support drivers/accel/qaic/mhi_controller.c | 44 ------------------- drivers/bus/mhi/host/init.c | 10 ----- drivers/bus/mhi/host/internal.h | 3 -- drivers/bus/mhi/host/main.c | 81 +---------------------------------- drivers/bus/mhi/host/pci_generic.c | 20 +-------- drivers/net/wireless/ath/ath11k/mhi.c | 4 -- drivers/net/wireless/ath/ath12k/mhi.c | 4 -- include/linux/mhi.h | 14 ------ net/qrtr/mhi.c | 69 ++++++++++++++++++++++++----- 9 files changed, 62 insertions(+), 187 deletions(-) --- base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8 change-id: 20251217-qrtr-fix-c058251d8d1a Best regards, -- Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com>

4 days, 10 hours

3
3
0 0

[PATCH net] gve: defer interrupt enabling until NAPI registration

by Harshitha Ramamurthy

From: Ankit Garg <nktgrg(a)google.com> Currently, interrupts are automatically enabled immediately upon request. This allows interrupt to fire before the associated NAPI context is fully initialized and cause failures like below: [ 0.946369] Call Trace: [ 0.946369] <IRQ> [ 0.946369] __napi_poll+0x2a/0x1e0 [ 0.946369] net_rx_action+0x2f9/0x3f0 [ 0.946369] handle_softirqs+0xd6/0x2c0 [ 0.946369] ? handle_edge_irq+0xc1/0x1b0 [ 0.946369] __irq_exit_rcu+0xc3/0xe0 [ 0.946369] common_interrupt+0x81/0xa0 [ 0.946369] </IRQ> [ 0.946369] <TASK> [ 0.946369] asm_common_interrupt+0x22/0x40 [ 0.946369] RIP: 0010:pv_native_safe_halt+0xb/0x10 Use the `IRQF_NO_AUTOEN` flag when requesting interrupts to prevent auto enablement and explicitly enable the interrupt in NAPI initialization path (and disable it during NAPI teardown). This ensures that interrupt lifecycle is strictly coupled with readiness of NAPI context. Cc: stable(a)vger.kernel.org Fixes: 1dfc2e46117e ("gve: Refactor napi add and remove functions") Signed-off-by: Ankit Garg <nktgrg(a)google.com> Reviewed-by: Jordan Rhee <jordanrhee(a)google.com> Reviewed-by: Joshua Washington <joshwash(a)google.com> Signed-off-by: Harshitha Ramamurthy <hramamurthy(a)google.com> --- drivers/net/ethernet/google/gve/gve_main.c | 2 +- drivers/net/ethernet/google/gve/gve_utils.c | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c index 5a74760..96adbbe 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -558,7 +558,7 @@ static int gve_alloc_notify_blocks(struct gve_priv *priv) block->priv = priv; err = request_irq(priv->msix_vectors[msix_idx].vector, gve_is_gqi(priv) ? gve_intr : gve_intr_dqo, - 0, block->name, block); + IRQF_NO_AUTOEN, block->name, block); if (err) { dev_err(&priv->pdev->dev, "Failed to receive msix vector %d\n", i); diff --git a/drivers/net/ethernet/google/gve/gve_utils.c b/drivers/net/ethernet/google/gve/gve_utils.c index ace9b86..b53b7fc 100644 --- a/drivers/net/ethernet/google/gve/gve_utils.c +++ b/drivers/net/ethernet/google/gve/gve_utils.c @@ -112,11 +112,13 @@ void gve_add_napi(struct gve_priv *priv, int ntfy_idx, netif_napi_add_locked(priv->dev, &block->napi, gve_poll); netif_napi_set_irq_locked(&block->napi, block->irq); + enable_irq(block->irq); } void gve_remove_napi(struct gve_priv *priv, int ntfy_idx) { struct gve_notify_block *block = &priv->ntfy_blocks[ntfy_idx]; + disable_irq(block->irq); netif_napi_del_locked(&block->napi); } -- 2.52.0.322.g1dd061c0dc-goog

4 days, 10 hours

1
0
0 0

[PATCH 6.12.y 0/3] arm64: Early system register initialization fixes

by Wei-Lin Chang

Hi, This series is a v6.12-only backport (based on v6.12.62) of fixes for system register initialization issues affecting protected KVM on arm64. This affects some contemporary and upcoming hardware which will run the v6.12.y stable kernel, or something derived from it, such as the Android common kernel. The FEAT_E2H0 patches fix code introduced after v6.6, and so only need to be backported to v6.12. The SCTLR_EL1 patch fixes code introduced in v5.11, but practically speaking only affects recent hardware which is unlikely to run something older than v6.12. Note: Marc Zyngier performed the initial backport, which I have rebased and tested, hence both of our sign-offs being added to the tags from the upstream commits. I have tested the backport and observed they solve the problems as expected. Ahmed Genidi (1): KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() Marc Zyngier (1): arm64: Revamp HCR_EL2.E2H RES1 detection Mark Rutland (1): KVM: arm64: Initialize HCR_EL2.E2H early arch/arm64/include/asm/el2_setup.h | 57 +++++++++++++++++++++++++--- arch/arm64/kernel/head.S | 22 ++--------- arch/arm64/kvm/hyp/nvhe/hyp-init.S | 10 +++-- arch/arm64/kvm/hyp/nvhe/psci-relay.c | 3 ++ 4 files changed, 65 insertions(+), 27 deletions(-) -- 2.43.0

4 days, 10 hours

2
4
0 0

[PATCH 6.18 000/614] 6.18.2-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.2 release. There are 614 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.2-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.2-rc1 Junrui Luo <moonafterrain(a)outlook.com> ALSA: wavefront: Fix integer overflow in sample size validation Junrui Luo <moonafterrain(a)outlook.com> ALSA: wavefront: Clear substream pointers on close Denis Arefev <arefev(a)swemel.ru> ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() Antheas Kapenekakis <lkml(a)antheas.dev> ALSA: hda/tas2781: fix speaker id retrieval for multiple probes Antheas Kapenekakis <lkml(a)antheas.dev> ALSA: hda/realtek: Add match for ASUS Xbox Ally projects Junrui Luo <moonafterrain(a)outlook.com> ALSA: dice: fix buffer overflow in detect_stream_formats() Sven Peter <sven(a)kernel.org> usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required Duoming Zhou <duoming(a)zju.edu.cn> usb: typec: ucsi: fix use-after-free caused by uec->work Diogo Ivo <diogo.ivo(a)tecnico.ulisboa.pt> usb: phy: Initialize struct usb_phy list_head Duoming Zhou <duoming(a)zju.edu.cn> usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe() Haotien Hsu <haotienh(a)nvidia.com> usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> efi/cper: Adjust infopfx size to accept an extra space Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> efi/cper: Add a new helper function to print bitmasks Evan Li <evan.li(a)linux.alibaba.com> perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common() Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: fix memory leak in ocfs2_merge_rec_left() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> cpu: Make atomic hotplug callbacks run with interrupts disabled on UP Dan Carpenter <dan.carpenter(a)linaro.org> irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() Thaumy Cheng <thaumy.love(a)gmail.com> perf/core: Fix missing read event generation on task exit Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Fix an error handler crash Duoming Zhou <duoming(a)zju.edu.cn> scsi: imm: Fix use-after-free bug caused by unfinished delayed work Haotian Zhang <vulab(a)iscas.ac.cn> dm log-writes: Add missing set_freezable() for freezable kthread Alexey Simakov <bigalex934(a)gmail.com> dm-raid: fix possible NULL dereference with undefined raid type Hemalatha Pinnamreddy <hemalatha.pinnamreddy2(a)amd.com> ASoC: amd: acp: update tdm channels for specific DAI Mohamed Khalfella <mkhalfella(a)purestorage.com> block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian(a)intel.com> drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation Jani Nikula <jani.nikula(a)intel.com> drm/{i915, xe}/fbdev: deduplicate struct drm_mode_fb_cmd2 init Jani Nikula <jani.nikula(a)intel.com> drm/{i915, xe}/fbdev: pass struct drm_device to intel_fbdev_fb_alloc() Jani Nikula <jani.nikula(a)intel.com> drm/i915/fbdev: make intel_framebuffer_create() error return handling explicit Jani Nikula <jani.nikula(a)intel.com> drm/xe/fbdev: use the same 64-byte stride alignment as i915 Liyuan Pang <pangliyuan1(a)huawei.com> ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() Junrui Luo <moonafterrain(a)outlook.com> ALSA: firewire-motu: add bounds check in put_user loop for DSP events Javier Martinez Canillas <javierm(a)redhat.com> regulator: spacemit: Align input supply name with the DT binding Nuno Sá <nuno.sa(a)analog.com> rtc: max31335: Fix ignored return value in set_alarm Haotian Zhang <vulab(a)iscas.ac.cn> rtc: gamecube: Check the return value of ioremap() Xiaogang Chen <xiaogang.chen(a)amd.com> drm/amdkfd: Use huge page size to check split svm range alignment Andres J Rosa <andyrosa(a)gmail.com> ALSA: uapi: Fix typo in asound.h comment Dave Kleikamp <dave.kleikamp(a)oracle.com> dma/pool: eliminate alloc_pages warning in atomic_pool_expand Troy Mitchell <troy.mitchell(a)linux.spacemit.com> i2c: spacemit: fix detect issue Kathara Sasikumar <katharasasikumar007(a)gmail.com> docs: hwmon: fix link to g762 devicetree binding Arnd Bergmann <arnd(a)arndb.de> gpio: tb10x: fix OF_GPIO dependency Mike Snitzer <snitzer(a)kernel.org> nfs/localio: remove 61 byte hole from needless ____cacheline_aligned Mike Snitzer <snitzer(a)hammerspace.com> nfs/localio: remove alignment size checking in nfs_is_local_dio_possible David Howells <dhowells(a)redhat.com> cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 David Howells <dhowells(a)redhat.com> cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1 René Rebe <rene(a)exactco.de> drm/nouveau: fix circular dep oops from vendored i2c encoder Madhur Kumar <madhurkumar004(a)gmail.com> drm/nouveau: refactor deprecated strcpy Junrui Luo <moonafterrain(a)outlook.com> ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events Mark Brown <broonie(a)kernel.org> regulator: fixed: Rely on the core freeing the enable GPIO Dan Carpenter <dan.carpenter(a)linaro.org> drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() Caleb Sander Mateos <csander(a)purestorage.com> io_uring/kbuf: use READ_ONCE() for userspace-mapped memory Israel Rukshin <israelr(a)nvidia.com> nvme-auth: use kvfree() for memory allocated with kvcalloc() Shaurya Rane <ssrane_b23(a)ee.vjti.ac.in> block: fix memory leak in __blkdev_issue_zero_pages shechenglong <shechenglong(a)xfusion.com> block: fix comment for op_is_zone_mgmt() to include RESET_ALL Arnd Bergmann <arnd(a)arndb.de> drm/panel: novatek-nt35560: avoid on-stack device structure Cong Zhang <cong.zhang(a)oss.qualcomm.com> blk-mq: Abort suspend when wakeup events are pending Daeho Jeong <daehojeong(a)google.com> f2fs: revert summary entry count from 2048 to 512 in 16kb block support Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: ak5558: Disable regulator when error happens Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: ak4458: Disable regulator when error happens Hemalatha Pinnamreddy <hemalatha.pinnamreddy2(a)amd.com> ASoC: amd: acp: Audio is not resuming after s0ix Haotian Zhang <vulab(a)iscas.ac.cn> ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() Anton Khirnov <anton(a)khirnov.net> platform/x86: asus-wmi: use brightness_set_blocking() for kbd led Armin Wolf <W_Armin(a)gmx.de> fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Fix inheritance of the block sizes when automounting Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags Trond Myklebust <trond.myklebust(a)hammerspace.com> Revert "nfs: ignore SB_RDONLY when mounting nfs" Trond Myklebust <trond.myklebust(a)hammerspace.com> Revert "nfs: clear SB_RDONLY before getting superblock" Trond Myklebust <trond.myklebust(a)hammerspace.com> Revert "nfs: ignore SB_RDONLY when remounting nfs" Akash Goel <akash.goel(a)arm.com> drm/panthor: Prevent potential UAF in group creation Jonathan Curley <jcurley(a)purestorage.com> NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Initialise verifiers for visible dentries in nfs_atomic_open() Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Initialise verifiers for visible dentries in readdir and lookup Armin Wolf <W_Armin(a)gmx.de> fs/nls: Fix utf16 to utf8 conversion Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Avoid changing nlink when file removes and attribute updates race Abel Vesa <abel.vesa(a)linaro.org> kbuild: install-extmod-build: Properly fix CC expansion when ccache is used Haotian Zhang <vulab(a)iscas.ac.cn> rtc: amlogic-a4: fix double free caused by devm Daeho Jeong <daehojeong(a)google.com> f2fs: maintain one time GC mode is enabled during whole zoned GC cycle Xi Pardee <xi.pardee(a)linux.intel.com> platform/x86:intel/pmc: Update Arrow Lake telemetry GUID John Stultz <jstultz(a)google.com> sched/core: Fix psi_dequeue() for Proxy Execution xupengbo <xupengbo(a)oppo.com> sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out Eric Sandeen <sandeen(a)redhat.com> 9p: fix cache/debug options printing in v9fs_show_options Abdun Nihaal <nihaal(a)cse.iitm.ac.in> fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() Ian Rogers <irogers(a)google.com> perf stat: Allow no events to open if this is a "--null" run Haotian Zhang <vulab(a)iscas.ac.cn> pinctrl: single: Fix incorrect type for error return variable Ian Rogers <irogers(a)google.com> perf hist: In init, ensure mem_info is put on error paths Ian Rogers <irogers(a)google.com> perf kvm: Fix debug assertion Namhyung Kim <namhyung(a)kernel.org> perf tools: Fix split kallsyms DSO counting Namhyung Kim <namhyung(a)kernel.org> perf tools: Mark split kallsyms DSOs as loaded Namjae Jeon <linkinjeon(a)kernel.org> exfat: fix divide-by-zero in exfat_allocate_bitmap Shuhao Fu <sfual(a)cse.ust.hk> exfat: fix refcount leak in exfat_find Namhyung Kim <namhyung(a)kernel.org> perf jitdump: Add sym/str-tables to build-ID generation Xiang Mei <xmei5(a)asu.edu> net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: xrs700x: reject unsupported HSR configurations Xiaoliang Yang <xiaoliang.yang_1(a)nxp.com> net: hsr: create an API to get hsr port type Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: fix BCM5325/65 ARL entry VIDs Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: add support for bcm63xx ARL entry format Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: fix CPU port unicast ARL entries for BCM5325/65 Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: use same ARL search result offset for BCM5325/65 Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: add support for 5389/5397/5398 ARL entry format Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: move ARL entry functions into ops struct Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: split reading search entry into their own functions Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: provide accessors for accessing ARL_SRCH_CTL Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: move writing ARL entries into their own functions Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: move reading ARL entries into their own function Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: b53_arl_read{,25}(): use the entry for comparision Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: fix extracting VID from entry for BCM5325/65 Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: fix VLAN_ID_IDX write size for BCM5325/65 Christophe Leroy (CS GROUP) <chleroy(a)kernel.org> um: Disable KASAN_INLINE when STATIC_LINK is selected Stefan Metzmacher <metze(a)samba.org> smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall() Stefan Metzmacher <metze(a)samba.org> smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler() Stefan Metzmacher <metze(a)samba.org> smb: smbdirect: introduce SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}() Stefan Metzmacher <metze(a)samba.org> smb: smbdirect: introduce SMBDIRECT_DEBUG_ERR_PTR() helper Johan Hovold <johan(a)kernel.org> clk: keystone: fix compile testing Yu Kuai <yukuai(a)fnnas.com> md/raid5: fix IO hang when array is broken with IO inflight Alexandru Gagniuc <mr.nuke.me(a)gmail.com> remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs Kumar Kartikeya Dwivedi <memxor(a)gmail.com> rqspinlock: Use trylock fallback when per-CPU rqnode is busy Kumar Kartikeya Dwivedi <memxor(a)gmail.com> rqspinlock: Enclose lock/unlock within lock entry acquisitions Ivan Stepchenko <sid(a)itb.spb.ru> mtd: lpddr_cmds: fix signed shifts in lpddr_cmds Breno Leitao <leitao(a)debian.org> net: netpoll: initialize work queue before error checks Hangbin Liu <liuhangbin(a)gmail.com> selftests: bonding: add delay before each xvlan_over_bond connectivity check Robert Marko <robimarko(a)gmail.com> net: phy: aquantia: check for NVMEM deferral Mickaël Salaün <mic(a)digikod.net> landlock: Fix handling of disconnected directories Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Use RCU for error/request triggers to avoid circular locking Dev Jain <dev.jain(a)arm.com> arm64/pageattr: Propagate return value from __change_memory_common Tianchu Chen <flynnnchen(a)tencent.com> spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Haotian Zhang <vulab(a)iscas.ac.cn> mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> net: stmmac: fix rx limit check in stmmac_rx_zc() Antoine Tenart <atenart(a)kernel.org> net: vxlan: prevent NULL deref in vxlan_xmit_one Michal Schmidt <mschmidt(a)redhat.com> iavf: Implement settime64 with -EOPNOTSUPP Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nft_connlimit: update the count if add was skipped Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nf_conncount: rework API to use sk_buff directly Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: check for maximum number of encapsulations in bridge vlan Ilias Stamatis <ilstam(a)amazon.com> Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" Chen-Yu Tsai <wenst(a)chromium.org> arm64: dts: mediatek: mt8195: Fix address range for JPEG decoder core 1 sparkhuang <huangshaobo3(a)xiaomi.com> regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex Marek Szyprowski <m.szyprowski(a)samsung.com> ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend Marek Szyprowski <m.szyprowski(a)samsung.com> ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend Marek Szyprowski <m.szyprowski(a)samsung.com> ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend Marek Szyprowski <m.szyprowski(a)samsung.com> ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend Marek Szyprowski <m.szyprowski(a)samsung.com> soc: samsung: exynos-pmu: Fix structure initialization Mikhail Kshevetskiy <mikhail.kshevetskiy(a)iopsys.eu> spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: catpt: Fix error path in hw_params() Michael S. Tsirkin <mst(a)redhat.com> virtio: clean up features qword/dword terms Alok Tiwari <alok.a.tiwari(a)oracle.com> vdpa/pds: use %pe for ERR_PTR() in event handler registration Mike Christie <michael.christie(a)oracle.com> vhost: Fix kthread worker cgroup failure handling Alok Tiwari <alok.a.tiwari(a)oracle.com> vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues Michael S. Tsirkin <mst(a)redhat.com> virtio: fix map ops comment Michael S. Tsirkin <mst(a)redhat.com> virtio: fix virtqueue_set_affinity() docs Michael S. Tsirkin <mst(a)redhat.com> virtio: standardize Returns documentation style Michael S. Tsirkin <mst(a)redhat.com> virtio: fix grammar in virtio_map_ops docs Michael S. Tsirkin <mst(a)redhat.com> virtio: fix grammar in virtio_queue_info docs Michael S. Tsirkin <mst(a)redhat.com> virtio: fix whitespace in virtio_config_ops Michael S. Tsirkin <mst(a)redhat.com> virtio: fix typo in virtio_device_ready() comment Kriish Sharma <kriish.sharma2006(a)gmail.com> virtio: fix kernel-doc for mapping/free_coherent functions Alok Tiwari <alok.a.tiwari(a)oracle.com> virtio_vdpa: fix misleading return in void function Guenter Roeck <linux(a)roeck-us.net> of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node Willem de Bruijn <willemb(a)google.com> selftests/net: packetdrill: pass send_omit_free to MSG_ZEROCOPY tests Yongjian Sun <sunyongjian1(a)huawei.com> ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation Edward Adam Davis <eadavis(a)qq.com> bpf: Fix exclusive map memory leak Matthieu Buffet <matthieu(a)buffet.re> selftests/landlock: Fix makefile header list Kevin Brodsky <kevin.brodsky(a)arm.com> ublk: prevent invalid access with DEBUG René Rebe <rene(a)exactco.de> ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 Haotian Zhang <vulab(a)iscas.ac.cn> hwmon: sy7636a: Fix regulator_enable resource leak on error path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: assign AID to uuid in topology for SPX mode Dan Carpenter <dan.carpenter(a)linaro.org> drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() Will Rosenberg <whrosenb(a)asu.edu> kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> misc: rp1: Fix an error handling path in rp1_probe() Christoph Hellwig <hch(a)lst.de> fs: lift the FMODE_NOCMTIME check into file_update_time_flags Christoph Hellwig <hch(a)lst.de> fs: refactor file timestamp update logic Haotian Zhang <vulab(a)iscas.ac.cn> greybus: gb-beagleplay: Fix timeout handling in bootloader functions Alexandre Courbot <acourbot(a)nvidia.com> firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_xcvr: clear the channel status control memory Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Prevent recursive memory reclaim Jaroslav Kysela <perex(a)perex.cz> ASoC: nau8325: add missing build config Jaroslav Kysela <perex(a)perex.cz> ASoC: nau8325: use simple i2c probe function Johan Hovold <johan(a)kernel.org> clocksource/drivers/nxp-stm: Prevent driver unbind Johan Hovold <johan(a)kernel.org> clocksource/drivers/nxp-stm: Fix section mismatches Johan Hovold <johan(a)kernel.org> clocksource/drivers/nxp-pit: Prevent driver unbind Johan Hovold <johan(a)kernel.org> clocksource/drivers/arm_arch_timer_mmio: Prevent driver unbind Johan Hovold <johan(a)kernel.org> clocksource/drivers/stm: Fix double deregistration on probe failure Haotian Zhang <vulab(a)iscas.ac.cn> clocksource/drivers/ralink: Fix resource leaks in init error path Akash Goel <akash.goel(a)arm.com> drm/panthor: Avoid adding of kernel BOs to extobj list Guillaume La Roque <glaroque(a)baylibre.com> arm64: dts: amlogic: meson-g12b: Fix L2 cache reference for S922X CPUs Jijun Wang <jijun.wang(a)intel.com> RDMA/irdma: Fix SRQ shadow area address initialization Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Remove doorbell elision logic Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+ Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY Anil Samal <anil.samal(a)intel.com> RDMA/irdma: Add missing mutex destroy Krzysztof Czurylo <krzysztof.czurylo(a)intel.com> RDMA/irdma: Fix SIGBUS in AEQ destroy Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2 Krzysztof Czurylo <krzysztof.czurylo(a)intel.com> RDMA/irdma: Fix data race in irdma_free_pble Krzysztof Czurylo <krzysztof.czurylo(a)intel.com> RDMA/irdma: Fix data race in irdma_sc_ccq_arm Stephan Gerhold <stephan.gerhold(a)linaro.org> iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal Randy Dunlap <rdunlap(a)infradead.org> backlight: lp855x: Fix lp855x.h kernel-doc warnings Luca Ceresoli <luca.ceresoli(a)bootlin.com> backlight: led-bl: Add devlink to supplier LEDs Ria Thomas <ria.thomas(a)morsemicro.com> wifi: ieee80211: correct FILS status codes Christoph Hellwig <hch(a)lst.de> iomap: allocate s_dio_done_wq for async reads as well Christoph Hellwig <hch(a)lst.de> iomap: always run error completions in user context David Gow <davidgow(a)google.com> um: Don't rename vmap to kernel_vmap Timur Tabi <ttabi(a)nvidia.com> drm/nouveau: restrict the flush page to a 32-bit address Shawn Lin <shawn.lin(a)rock-chips.com> PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition Filipe Manana <fdmanana(a)suse.com> btrfs: fix leaf leak in an error path in btrfs_del_items() Qu Wenruo <wqu(a)suse.com> btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() Boris Burkov <boris(a)bur.io> btrfs: fix racy bitfield write in btrfs_clear_space_info_full() Miquel Sabaté Solà <mssola(a)mssola.com> btrfs: fix double free of qgroup record after failure to add delayed ref head Alan Maguire <alan.maguire(a)oracle.com> selftests/bpf: Allow selftests to build with older xxd Alan Maguire <alan.maguire(a)oracle.com> bpftool: Allow bpftool to build with openssl < 3 Ryan Huang <tzukui(a)google.com> iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables Jianglei Nie <niejianglei2021(a)163.com> staging: fbtft: core: fix potential memory leak in fbtft_probe_common() Dinh Nguyen <dinguyen(a)kernel.org> firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc Zilin Guan <zilin(a)seu.edu.cn> mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: skip deflink accounting for offchannel links Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: Move mt76_abort_scan out of mt76_reset_device() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event() Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: fix EMI rings for RRO Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart() Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: fix MLO set key and group key issues Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: fix MLD group index assignment Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: set link_valid field when initializing wcid Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: fix teardown command for an MLD peer Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv() Howard Hsu <howard-yh.hsu(a)mediatek.com> wifi: mt76: mt7996: fix implicit beamforming support for mt7992 StanleyYP Wang <StanleyYP.Wang(a)mediatek.com> wifi: mt76: mt7996: fix max nss value when getting rx chainmask Fedor Pchelkin <pchelkin(a)ispras.ru> Revert "wifi: mt76: mt792x: improve monitor interface handling" Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx Felix Fietkau <nbd(a)nbd.name> wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() Shenghao Ding <shenghao-ding(a)ti.com> ASoC: tas2781: correct the wrong period Baojun Xu <baojun.xu(a)ti.com> ASoC: tas2781: Correct the wrong chip ID for reset variable check Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ahash - Zero positive err value in ahash_update_finish Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ahash - Fix crypto_ahash_import with partial block data Selvin Xavier <selvin.xavier(a)broadcom.com> RDMA/bnxt_re: Pass correct flag for dma mr creation Selvin Xavier <selvin.xavier(a)broadcom.com> RDMA/bnxt_re: Fix the inline size for GenP7 devices Gao Xiang <xiang(a)kernel.org> erofs: limit the level of fs stacking for file-backed mounts Gao Xiang <xiang(a)kernel.org> erofs: correct FSDAX detection Fangyu Yu <fangyu.yu(a)linux.alibaba.com> RISC-V: KVM: Fix guest page fault within HLV* instructions Pengjie Zhang <zhangpengjie2(a)huawei.com> PM / devfreq: hisi: Fix potential UAF in OPP handling Haotian Zhang <vulab(a)iscas.ac.cn> crypto: ccree - Correctly handle return of sg_nents_for_len Haotian Zhang <vulab(a)iscas.ac.cn> crypto: starfive - Correctly handle return of sg_nents_for_len Martin Teichmann <martin.teichmann(a)xfel.eu> bpf: properly verify tail call behavior Xing Guo <higuoxing(a)gmail.com> selftests/bpf: Update test_tag to use sha256 Matt Bobrowski <mattbobrowski(a)google.com> selftests/bpf: Improve reliability of test_perf_branches_no_hw() Matt Bobrowski <mattbobrowski(a)google.com> selftests/bpf: skip test_perf_branches_hw() on unsupported platforms Dan Carpenter <dan.carpenter(a)linaro.org> regulator: pca9450: Fix error code in probe() Gopi Krishna Menon <krishnagopi487(a)gmail.com> usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE Jisheng Zhang <jszhang(a)kernel.org> usb: dwc2: fix hang during suspend if set as peripheral Jisheng Zhang <jszhang(a)kernel.org> usb: dwc2: fix hang during shutdown if set as peripheral Oliver Neukum <oneukum(a)suse.com> usb: chaoskey: fix locking for O_NONBLOCK Zhao Yipeng <zhaoyipeng5(a)huawei.com> ima: Handle error code returned by ima_filter_rule_match() Ivan Pravdin <ipravdin.official(a)gmail.com> rtla: Fix -a overriding -t argument Tomas Glozar <tglozar(a)redhat.com> rtla/tests: Fix osnoise test calling timerlat Tomas Glozar <tglozar(a)redhat.com> rtla/tests: Extend action tests to 5s Jason Tian <jason(a)os.amperecomputing.com> RAS: Report all ARM processor CPER information to userspace Seungjin Bae <eeodqql09(a)gmail.com> wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() Charles Mirabile <cmirabil(a)redhat.com> clk: spacemit: Set clk_hw_onecell_data::num before using flex array Chen Ridong <chenridong(a)huawei.com> cpuset: Treat cpusets in attaching as populated Alexander Dahl <ada(a)thorsis.com> net: phy: adin1100: Fix software power-down ready condition Matt Bobrowski <mattbobrowski(a)google.com> selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Fix missing dash in HIDE DisCo property Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode Xiaolei Wang <xiaolei.wang(a)windriver.com> phy: freescale: Initialize priv->lock Shawn Lin <shawn.lin(a)rock-chips.com> phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562 Shawn Lin <shawn.lin(a)rock-chips.com> phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3528 Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() Fenglin Wu <fenglin.wu(a)oss.qualcomm.com> leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM Yuntao Wang <yuntao.wang(a)linux.dev> of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho() Yuntao Wang <yuntao.wang(a)linux.dev> of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range() Yuntao Wang <yuntao.wang(a)linux.dev> of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr() Yuntao Wang <yuntao.wang(a)linux.dev> of/fdt: Consolidate duplicate code into helper functions Haotian Zhang <vulab(a)iscas.ac.cn> mfd: mt6358-irq: Fix missing irq_domain_remove() in error path Haotian Zhang <vulab(a)iscas.ac.cn> mfd: mt6397-irq: Fix missing irq_domain_remove() in error path Tomas Glozar <tglozar(a)redhat.com> tools/rtla: Fix --on-threshold always triggering Costa Shulyupin <costa.shul(a)redhat.com> tools/rtla: Fix unassigned nr_cpus Chien Wong <m(a)xv97.com> wifi: mac80211: fix CMAC functions not handling errors Aashish Sharma <aashish(a)aashishsharma.net> iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb Vineeth Pillai (Google) <vineeth(a)bitbyteword.org> iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD Vladimir Oltean <vladimir.oltean(a)nxp.com> net: phy: realtek: create rtl8211f_config_rgmii_delay() Zilin Guan <zilin(a)seu.edu.cn> scsi: qla2xxx: Fix improper freeing of purex item Shawn Lin <shawn.lin(a)rock-chips.com> scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> pwm: bcm2835: Make sure the channel is enabled after pwm_request() Leo Yan <leo.yan(a)arm.com> perf arm_spe: Fix memset subclass in operation Fernando Fernandez Mancera <fmancera(a)suse.de> ipv6: clear RA flags when adding a static route Longbin Li <looong.bin(a)gmail.com> spi: sophgo: Fix incorrect use of bus width value macros Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Improve MX rail fallback in RPMH vote init Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Fix the gemnoc workaround Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Flush LRZ cache before PT switch Jay Liu <jay.liu(a)mediatek.com> drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue Edward Adam Davis <eadavis(a)qq.com> fs/ntfs3: Prevent memory leaks in add sub record Edward Adam Davis <eadavis(a)qq.com> fs/ntfs3: out1 also needs to put mi Ovidiu Panait <ovidiu.panait.rb(a)renesas.com> net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit Pu Lehui <pulehui(a)huawei.com> bpf: Fix invalid prog->stats access when update_effective_progs fails Inochi Amaoto <inochiama(a)gmail.com> net: stmmac: dwmac-sophgo: Add phy interface filter Inochi Amaoto <inochiama(a)gmail.com> net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() Christian Bruel <christian.bruel(a)foss.st.com> PCI: stm32: Fix EP page_size alignment Christian Bruel <christian.bruel(a)foss.st.com> PCI: stm32: Fix LTSSM EP race with start link Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> drm/msm/a2xx: stop over-complaining about the legacy firmware Huiwen He <hehuiwen(a)kylinos.cn> drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos() Huiwen He <hehuiwen(a)kylinos.cn> drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs() Guenter Roeck <linux(a)roeck-us.net> block/blk-throttle: Fix throttle slice time for SSDs Alexander Stein <alexander.stein(a)ew.tq-group.com> arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name Sergey Bashirov <sergeybashirov(a)gmail.com> NFSD/blocklayout: Fix minlength check in proc_layoutget Al Viro <viro(a)zeniv.linux.org.uk> tracefs: fix a leak in eventfs_create_events_dir() Al Viro <viro(a)zeniv.linux.org.uk> fuse_ctl_add_conn(): fix nlink breakage in case of early failure Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: core: Clean up device correctly on iio_device_alloc() failure Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: core: add missing mutex_destroy in iio_dev_release() Haotian Zhang <vulab(a)iscas.ac.cn> watchdog: starfive: Fix resource leak in probe error path Haotian Zhang <vulab(a)iscas.ac.cn> watchdog: wdat_wdt: Fix ACPI table leak in probe function Nuno Das Neves <nunodasneves(a)linux.microsoft.com> mshv: Fix create memory region overlap check Nuno Das Neves <nunodasneves(a)linux.microsoft.com> mshv: Fix deposit memory in MSHV_ROOT_HVCALL Martin KaFai Lau <martin.lau(a)kernel.org> bpf: Check skb->transport_header is set in bpf_skb_check_mtu Alexei Starovoitov <ast(a)kernel.org> selftests/bpf: Fix failure paths in send_signal test Menglong Dong <menglong8.dong(a)gmail.com> bpf: Handle return value of ftrace_set_filter_ip in register_fentry Sahil Chandna <chandna.sahil(a)gmail.com> bpf: Prevent nesting overflow in bpf_try_get_buffers Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> kbuild: don't enable CC_CAN_LINK if the dummy program generates warnings Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> PCI: Prevent resource tree corruption when BAR resize fails Aaron Kling <webgeek1234(a)gmail.com> soc/tegra: fuse: speedo-tegra210: Update speedo IDs Rene Rebe <rene(a)exactco.de> ps3disk: use memcpy_{from,to}_bvec index Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype Praveen Talari <praveen.talari(a)oss.qualcomm.com> arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> pwm: Simplify printf to emit chip->npwm in $debugfs/pwm Aleksei Nikiforov <aleksei.nikiforov(a)linux.ibm.com> s390/fpu: Fix false-positive kmsan report in fpu_vstl() Zilin Guan <zilin(a)seu.edu.cn> crypto: iaa - Fix incorrect return value in save_iaa_wq() Ian Rogers <irogers(a)google.com> perf vendor metrics s390: Avoid has_event(INSTRUCTIONS) FUKAUMI Naoki <naoki(a)radxa.com> arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C FUKAUMI Naoki <naoki(a)radxa.com> arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A FUKAUMI Naoki <naoki(a)radxa.com> arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> soc: renesas: rz-sysc: Populate readable_reg/writeable_reg in regmap config Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> soc: renesas: r9a09g056-sys: Populate max_register Siddharth Vadapalli <s-vadapalli(a)ti.com> PCI: keystone: Exit ks_pcie_probe() for invalid mode Leon Hwang <leon.hwang(a)linux.dev> bpf: Free special fields when update [lru_,]percpu_hash maps Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix deadlock between context destroy and job timeout Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Clear mailbox interrupt register during channel creation Chaitanya S Prakash <chaitanyas.prakash(a)arm.com> arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors Haotian Zhang <vulab(a)iscas.ac.cn> leds: netxbig: Fix GPIO descriptor leak in error paths Haotian Zhang <vulab(a)iscas.ac.cn> scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls Tony Battersby <tonyb(a)cybernetics.com> scsi: qla2xxx: Clear cmds after chip reset Haotian Zhang <vulab(a)iscas.ac.cn> ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: use correct endian in ocfs2_dinode_has_extents Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> lib/vsprintf: Check pointer before dereferencing in time_and_date() Haotian Zhang <vulab(a)iscas.ac.cn> clk: renesas: r9a06g032: Fix memory leak in error path Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> clk: renesas: r9a09g077: Propagate rate changes to parent clocks Jayesh Choudhary <j-choudhary(a)ti.com> drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook Jayesh Choudhary <j-choudhary(a)ti.com> drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features Namhyung Kim <namhyung(a)kernel.org> perf tools: Fix missing feature check for inherit + SAMPLE_READ Leo Yan <leo.yan(a)arm.com> coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF Leo Yan <leo.yan(a)arm.com> coresight: etm4x: Add context synchronization before enabling trace Leo Yan <leo.yan(a)arm.com> coresight: etm4x: Correct polling IDLE bit Leo Yan <leo.yan(a)arm.com> coresight: etm3x: Always set tracer's device mode on target CPU Leo Yan <leo.yan(a)arm.com> coresight: etm4x: Always set tracer's device mode on target CPU Leo Yan <leo.yan(a)arm.com> coresight: Change device mode to atomic type Bartlomiej Kubik <kubik.bartlomiej(a)gmail.com> fs/ntfs3: Initialize allocated memory before use David Wei <dw(a)davidwei.uk> io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock David Wei <dw(a)davidwei.uk> net: export netdev_get_by_index_lock() Zheng Qixing <zhengqixing(a)huawei.com> nbd: defer config unlock in nbd_genl_connect Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() Long Li <leo.lilong(a)huawei.com> macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/32: Fix unpaired stwcx. on interrupt exit Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: Fix size calculation for hot-removed memory ranges Gautham R. Shenoy <gautham.shenoy(a)amd.com> cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs Li Nan <linan122(a)huawei.com> md: init bioset in mddev_init Li Nan <linan122(a)huawei.com> md: delete md_redundancy_group when array is becoming inactive Bean Huo <beanhuo(a)micron.com> scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() Akash Goel <akash.goel(a)arm.com> drm/panthor: Fix potential memleak of vma structure Edward Adam Davis <eadavis(a)qq.com> ntfs3: init run lock for extend inode Carl Worth <carl(a)os.amperecomputing.com> coresight: tmc: add the handle of the event to the path Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties Ma Ke <make24(a)iscas.ac.cn> RDMA/rtrs: server: Fix error handling in get_or_create_srv Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> dt-bindings: PCI: amlogic: Fix the register name of the DBI region Rodrigo Gobbi <rodrigo.gobbi.7(a)gmail.com> iio: imu: bmi270: fix dev_err_probe error msg Johan Hovold <johan(a)kernel.org> staging: most: remove broken i2c driver Mike McGowen <mike.mcgowen(a)microchip.com> scsi: smartpqi: Fix device resources accessed after device removal Haotian Zhang <vulab(a)iscas.ac.cn> scsi: stex: Fix reboot_notifier leak in probe error path Zheng Qixing <zhengqixing(a)huawei.com> nbd: defer config put in recv_work Xiao Ni <xni(a)redhat.com> md: avoid repeated calls to del_gendisk Yun Zhou <yun.zhou(a)windriver.com> md: fix rcu protection in md_wakeup_thread Xiao Ni <xni(a)redhat.com> md: delete mddev kobj before deleting gendisk kobj Gabor Juhos <j4g8y7(a)gmail.com> regulator: core: disable supply if enabling main regulator fails Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Correct large PEBS flag check Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86: Fix NULL event access and potential PEBS record loss Pavel Begunkov <asml.silence(a)gmail.com> io_uring: use WRITE_ONCE for user shared memory FUKAUMI Naoki <naoki(a)radxa.com> arm64: dts: rockchip: Fix USB Type-C host mode for Radxa ROCK 5B+/5T Dan Carpenter <dan.carpenter(a)linaro.org> hfs: fix potential use after free in hfs_correct_next_unused_CNID() Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix dma_fence leak when job is canceled Zhang Yi <yi.zhang(a)huawei.com> ext4: correct the checking of quota files before moving extents Manish Dharanenthiran <manish.dharanenthiran(a)oss.qualcomm.com> wifi: ath12k: Fix timeout error during beacon stats retrieval Haotian Zhang <vulab(a)iscas.ac.cn> mfd: da9055: Fix missing regmap_del_irq_chip() in error path Namhyung Kim <namhyung(a)kernel.org> perf annotate: Fix build with NO_SLANG=1 Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw89: usb: fix leak in rtw89_usb_write_port() Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler() Wang Liang <wangliang74(a)huawei.com> locktorture: Fix memory leak in param_set_cpumask() Usama Arif <usamaarif642(a)gmail.com> efi/libstub: Fix page table access in 5-level to 4-level paging transition Usama Arif <usamaarif642(a)gmail.com> x86/boot: Fix page table access in 5-level to 4-level paging transition Xiaoqi Zhuang <xiaoqi.zhuang(a)oss.qualcomm.com> coresight: ETR: Fix ETR buffer use-after-free issue Niklas Cassel <cassel(a)kernel.org> arm64: tegra: Add pinctrl definitions for pcie-ep nodes Peter Zijlstra <peterz(a)infradead.org> entry,unwind/deferred: Fix unwind_reset_info() placement Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible Yegor Yefremov <yegorslists(a)googlemail.com> ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels Geert Uytterhoeven <geert+renesas(a)glider.be> ARM: dts: am33xx: Add missing serial console speed Alan Maguire <alan.maguire(a)oracle.com> libbpf: Fix parsing of multi-split BTF Vishwaroop A <va(a)nvidia.com> spi: tegra210-quad: Fix timeout handling Matthew Brost <matthew.brost(a)intel.com> drm/xe: Enforce correct user fence signaling order using Christian Brauner <brauner(a)kernel.org> cleanup: fix scoped_class() Songtang Liu <liusongtang(a)bytedance.com> iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show Christian Brauner <brauner(a)kernel.org> ns: initialize ns_list_node for initial namespaces Christian Brauner <brauner(a)kernel.org> ns: add NS_COMMON_INIT() Thomas Richard (TI.com) <thomas.richard(a)bootlin.com> firmware: ti_sci: Set IO Isolation only if the firmware is capable Boris Brezillon <boris.brezillon(a)collabora.com> drm/panthor: Fix UAF on kernel BO VA nodes Ketil Johnsen <ketil.johnsen(a)arm.com> drm/panthor: Fix race with suspend during unplug Ketil Johnsen <ketil.johnsen(a)arm.com> drm/panthor: Fix UAF race between device unplug and FW event processing Boris Brezillon <boris.brezillon(a)collabora.com> drm/panthor: Fix group_free_queue() for partially initialized queues Boris Brezillon <boris.brezillon(a)collabora.com> drm/panthor: Handle errors returned by drm_sched_entity_init() Tingmao Wang <m(a)maowtm.org> fs/9p: Don't open remote file with APPEND mode when writeback cache is used Mike Christie <michael.christie(a)oracle.com> scsi: target: Fix LUN/device R/W and total command stats Bart Van Assche <bvanassche(a)acm.org> scsi: target: Do not write NUL characters into ASCII configfs output Ahelenia Ziemiańska <nabijaczleweli(a)nabijaczleweli.xyz> power: supply: apm_power: only unset own apm_get_power_status Val Packett <val(a)packett.cool> power: supply: qcom_battmgr: support disabling charge control Val Packett <val(a)packett.cool> power: supply: qcom_battmgr: clamp charge control thresholds Ivan Abramov <i.abramov(a)mt-integration.ru> power: supply: wm831x: Check wm831x_set_bits() return value Murad Masimov <m.masimov(a)mt-integration.ru> power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() Ivan Abramov <i.abramov(a)mt-integration.ru> power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() Ivan Abramov <i.abramov(a)mt-integration.ru> power: supply: max17040: Check iio_read_channel_processed() return code Ivan Abramov <i.abramov(a)mt-integration.ru> power: supply: cw2015: Check devm_delayed_work_autocancel() return code Haotian Zhang <vulab(a)iscas.ac.cn> power: supply: rt5033_charger: Fix device node reference leaks Frederic Weisbecker <frederic(a)kernel.org> timers/migration: Fix imbalanced NUMA trees Frederic Weisbecker <frederic(a)kernel.org> timers/migration: Remove locking on group connection Frederic Weisbecker <frederic(a)kernel.org> timers/migration: Convert "while" loops to use "for" Taniya Das <taniya.das(a)oss.qualcomm.com> clk: qcom: tcsrcc-glymur: Update register offsets for clock refs Shuai Xue <xueshuai(a)linux.alibaba.com> perf record: skip synthesize event when open evsel failed Namhyung Kim <namhyung(a)kernel.org> perf lock contention: Load kernel map before lookup Geert Uytterhoeven <geert+renesas(a)glider.be> drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() Christian Brauner <brauner(a)kernel.org> cgroup: add cgroup namespace to tree after owner is set Marek Vasut <marek.vasut+renesas(a)mailbox.org> arm64: dts: renesas: sparrow-hawk: Fix full-size DP connector node name and labels Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: debugfs: Fix incorrect error handling for NULL path Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix incorrect command state for timed out job Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS Rameshkumar Sundaram <rameshkumar.sundaram(a)oss.qualcomm.com> wifi: ath12k: unassign arvif on scan vdev create failure Rameshkumar Sundaram <rameshkumar.sundaram(a)oss.qualcomm.com> wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create() Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath12k: fix error handling in creating hardware group Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath12k: fix reusing m3 memory Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() Jacob Keller <jacob.e.keller(a)intel.com> docs: kdoc: fix duplicate section warning message Arnd Bergmann <arnd(a)arndb.de> random: use offstack cpumask when necessary Stanley Chu <yschu(a)nuvoton.com> i3c: master: svc: Prevent incomplete IBI transaction Frank Li <Frank.Li(a)nxp.com> i3c: fix refcount inconsistency in i3c_master_register Aniket Limaye <a-limaye(a)ti.com> arm64: dts: ti: k3-j784s4: Fix I2C pinmux pull configuration Christian Brauner <brauner(a)kernel.org> pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info Christian Brauner <brauner(a)kernel.org> pidfs: add missing PIDFD_INFO_SIZE_VER1 Tomasz Rusinowicz <tomasz.rusinowicz(a)intel.com> accel/ivpu: Fix race condition when unbinding BOs Danilo Krummrich <dakr(a)kernel.org> drm: nova: select NOVA_CORE Haotian Zhang <vulab(a)iscas.ac.cn> pinctrl: stm32: fix hwspinlock resource leak in probe function Haotian Zhang <vulab(a)iscas.ac.cn> soc: qcom: smem: fix hwspinlock resource leak in probe error paths Taniya Das <taniya.das(a)oss.qualcomm.com> clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops Benjamin Berg <benjamin.berg(a)intel.com> tools/nolibc/dirent: avoid errno in readdir_r Benjamin Berg <benjamin.berg(a)intel.com> tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set Maciej Falkowski <maciej.falkowski(a)linux.intel.com> accel/ivpu: Remove skip of dma unmap for imported buffers Tengda Wu <wutengda(a)huaweicloud.com> x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() Marek Vasut <marek.vasut+renesas(a)mailbox.org> drm/rcar-du: dsi: Fix missing parameter in RXSETR_...EN macros Peter Zijlstra <peterz(a)infradead.org> task_work: Fix NMI race condition Zhang Rui <rui.zhang(a)intel.com> perf/x86/intel/cstate: Remove PC3 support from LunarLake Arnaud Lecomte <contact(a)arnaud-lcm.com> bpf: Fix stackmap overflow check in __bpf_get_stackid() Arnaud Lecomte <contact(a)arnaud-lcm.com> bpf: Refactor stack map trace depth calculation into helper function Haotian Zhang <vulab(a)iscas.ac.cn> mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove Aryan Srivastava <aryan.srivastava(a)alliedtelesis.co.nz> mtd: nand: relax ECC parameter validation check Aryan Srivastava <aryan.srivastava(a)alliedtelesis.co.nz> Revert "mtd: rawnand: marvell: fix layouts" Li Qiang <liqiang01(a)kylinos.cn> wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/userq: fix SDMA and compute validation Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: add userq object va track helpers Wolfram Sang <wsa+renesas(a)sang-engineering.com> ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties Wolfram Sang <wsa+renesas(a)sang-engineering.com> ARM: dts: renesas: gose: Remove superfluous port property Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rxe: Fix null deref on srq->rq.queue after resize failure Loic Poulain <loic.poulain(a)oss.qualcomm.com> arm64: dts: qcom: qcm2290: Fix camss register prop ordering Kuniyuki Iwashima <kuniyu(a)google.com> sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Fix PTP for VSC8574 and VSC8572 Michal Suchanek <msuchanek(a)suse.de> perf hwmon_pmu: Fix uninitialized variable warning Eric Gonçalves <ghatto404(a)gmail.com> arm64: dts: qcom: sm8250-samsung-common: correct reserved pins Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> arm64: dts: qcom: sdm845-starqltechn: Fix i2c-gpio node name Pengyu Luo <mitltlatltl(a)gmail.com> arm64: dts: qcom: sc8280xp: Fix shifted GPI DMA channels Val Packett <val(a)packett.cool> arm64: dts: qcom: x1-dell-thena: remove dp data-lanes Val Packett <val(a)packett.cool> arm64: dts: qcom: x1-dell-thena: Add missing pinctrl for eDP HPD Alexander Martinz <amartinz(a)shiftphones.com> arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory Krishna Chaitanya Chundru <krishna.chundru(a)oss.qualcomm.com> arm64: dts: qcom: sm8750-mtp: move PCIe GPIOs to pcieport0 node Neil Armstrong <neil.armstrong(a)linaro.org> arm64: dts: qcom: sm8650: set ufs as dma coherent Luca Weiss <luca.weiss(a)fairphone.com> arm64: dts: qcom: qcm6490-fairphone-fp5: Add supplies to simple-fb node Gergo Koteles <soyer(a)irl.hu> arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider Dzmitry Sankouski <dsankouski(a)gmail.com> arm64: dts: qcom: sdm845-starqltechn: fix max77705 interrupts Dzmitry Sankouski <dsankouski(a)gmail.com> arm64: dts: qcom: sdm845-starqltechn: remove (address|size)-cells Willy Tarreau <w(a)1wt.eu> tools/nolibc: x86: fix section mismatch caused by asm "mem*" functions Krishna Kurapati <krishna.kurapati(a)oss.qualcomm.com> arm64: dts: qcom: lemans: Add missing quirk for HS only USB controller Krishna Kurapati <krishna.kurapati(a)oss.qualcomm.com> arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller Krishna Kurapati <krishna.kurapati(a)oss.qualcomm.com> arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller Peng Fan <peng.fan(a)nxp.com> firmware: imx: scu-irq: fix OF node leak in Randolph Sapp <rs(a)ti.com> arm64: dts: ti: k3-am62p: Fix memory ranges for GPU Bhanu Seshu Kumar Valluri <bhanuseshukumar(a)gmail.com> PCI: endpoint: pci-epf-test: Fix sleeping function being called from atomic context Thomas Richard <thomas.richard(a)bootlin.com> leds: upboard: Fix module alias Przemek Kitszel <przemyslaw.kitszel(a)intel.com> ice: remove duplicate call to ice_deinit_hw() on error paths Przemek Kitszel <przemyslaw.kitszel(a)intel.com> ice: move ice_deinit_dev() to the end of deinit paths Przemek Kitszel <przemyslaw.kitszel(a)intel.com> ice: extract ice_init_dev() from ice_init() Przemek Kitszel <przemyslaw.kitszel(a)intel.com> ice: move ice_init_pf() out of ice_init_dev() Przemek Kitszel <przemyslaw.kitszel(a)intel.com> ice: move udp_tunnel_nic and misc IRQ setup into ice_init_pf() Przemek Kitszel <przemyslaw.kitszel(a)intel.com> ice: ice_init_pf: destroy mutexes and xarrays on memory alloc failure Przemek Kitszel <przemyslaw.kitszel(a)intel.com> ice: move ice_init_interrupt_scheme() prior ice_init_pf() Przemek Kitszel <przemyslaw.kitszel(a)intel.com> ice: move service task start out of ice_init_pf() Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix uninitialized return value Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath12k: restore register window after global reset Len Brown <len.brown(a)intel.com> tools/power turbostat: Regression fix Uncore MHz printed in hex Heiko Carstens <hca(a)linux.ibm.com> s390/ap: Don't leak debug feature files if AP instructions are not available Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Move the ufshcd_enable_intr() declaration Heiko Carstens <hca(a)linux.ibm.com> s390/smp: Fix fallback CPU detection Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath11k: fix peer HE MCS assignment Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath11k: fix VHT MCS assignment nieweiqiang <nieweiqiang(a)huawei.com> crypto: hisilicon/qm - restore original qos values Thorsten Blum <thorsten.blum(a)linux.dev> crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Haotian Zhang <vulab(a)iscas.ac.cn> soc: qcom: gsbi: fix double disable caused by devm Luca Weiss <luca.weiss(a)fairphone.com> clk: qcom: camcc-sm7150: Fix PLL config of PLL2 Luca Weiss <luca.weiss(a)fairphone.com> clk: qcom: camcc-sm6350: Fix PLL config of PLL2 Luo Jie <quic_luoj(a)quicinc.com> clk: qcom: gcc-ipq5424: Correct the icc_first_node_id Taniya Das <taniya.das(a)oss.qualcomm.com> clk: qcom: gcc-glymur: Update the halt check flags for pipe clocks Taniya Das <taniya.das(a)oss.qualcomm.com> clk: qcom: gcc-sm8750: Add a new frequency for sdcc2 clock Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> clk: qcom: rpmh: Define RPMH_IPA_CLK on QCS615 Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other Sherry Sun <sherry.sun(a)nxp.com> tty: serial: imx: Only configure the wake register when device is set as wakeup source Li Qiang <liqiang01(a)kylinos.cn> uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe Geert Uytterhoeven <geert+renesas(a)glider.be> PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 Peter Griffin <peter.griffin(a)linaro.org> arm64: dts: exynos: gs101: fix sysreg_apm reg property Peter Griffin <peter.griffin(a)linaro.org> arm64: dts: exynos: gs101: fix clock module unit reg sizes Tianyou Li <tianyou.li(a)intel.com> perf annotate: Check return value of evsel__get_arch() properly Joy Zou <joy.zou(a)nxp.com> arm64: dts: imx95-15x15-evk: add fan-supply property for pwm-fan Tim Harvey <tharvey(a)gateworks.com> arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 Tim Harvey <tharvey(a)gateworks.com> arm64: dts: imx8mp-venice-gw702x: remove off-board uart Tim Harvey <tharvey(a)gateworks.com> arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl Tim Harvey <tharvey(a)gateworks.com> arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props Daniel Borkmann <daniel(a)iogearbox.net> bpf: Do not let BPF test infra emit invalid GSO types to stack Bart Van Assche <bvanassche(a)acm.org> block/mq-deadline: Switch back to a single dispatch list Bart Van Assche <bvanassche(a)acm.org> block/mq-deadline: Introduce dd_start_request() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> PCI: sg2042: Fix a reference count issue in sg2042_pcie_remove() T Pratham <t-pratham(a)ti.com> crypto: aead - Fix reqsize handling Ian Rogers <irogers(a)google.com> perf parse-events: Make X modifier more respectful of groups Randy Dunlap <rdunlap(a)infradead.org> firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> arm64: dts: qcom: ipq5424: correct the TF-A reserved memory to 512K Sidharth Seela <sidharthseela(a)gmail.com> ntfs3: Fix uninit buffer allocated by __getname() Raphael Pinsonneault-Thibeault <rpthibeault(a)gmail.com> ntfs3: fix uninit memory after failed mi_read in mi_format_new Herbert Xu <herbert(a)gondor.apana.org.au> crypto: authenc - Correctly pass EINPROGRESS back up to the caller Johan Hovold <johan(a)kernel.org> irqchip: Pass platform device to platform drivers Johan Hovold <johan(a)kernel.org> irqchip: Drop leftover brackets Johan Hovold <johan(a)kernel.org> irqchip/qcom-irq-combiner: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/starfive-jh8100: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/renesas-rzg2l: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/imx-mu-msi: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/irq-brcmstb-l2: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/irq-bcm7120-l2: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/irq-bcm7038-l1: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/bcm2712-mip: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/bcm2712-mip: Fix OF node reference imbalance Fernand Sieber <sieberf(a)amazon.com> sched/fair: Forfeit vruntime on yield Pradeep Kumar Chitrapu <quic_pradeepc(a)quicinc.com> wifi: ath12k: fix TX and RX MCS rate configurations in HE mode Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath12k: fix VHT MCS assignment Sarika Sharma <sarika.sharma(a)oss.qualcomm.com> wifi: ath12k: Fix MSDU buffer types handling in RX error path Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath11k: restore register window after global reset Kang Yang <kang.yang(a)oss.qualcomm.com> wifi: ath10k: move recovery check logic into a new work Danilo Krummrich <dakr(a)kernel.org> gpu: nova-core: gsp: do not unwrap() SGEntry Danilo Krummrich <dakr(a)kernel.org> gpu: nova-core: gsp: remove useless conversion Ian Rogers <irogers(a)google.com> perf parse-events: Fix legacy cache events if event is duplicated in a PMU Wludzik, Jozef <jozef.wludzik(a)intel.com> accel/ivpu: Fix race condition when mapping dmabuf Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix weak symbol detection Dylan Hatch <dylanbhatch(a)google.com> objtool: Fix standalone --hacks=jump_label Peng Fan <peng.fan(a)nxp.com> remoteproc: imx_rproc: Fix runtime PM cleanup and improve remove path Mavroudis Chatzilazaridis <mavchatz(a)protonmail.com> HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() Cyrille Pitchen <cyrille.pitchen(a)microchip.com> drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() Marek Vasut <marek.vasut+renesas(a)mailbox.org> clk: renesas: cpg-mssr: Read back reset registers to assure values latched Marek Vasut <marek.vasut+renesas(a)mailbox.org> clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback Biju Das <biju.das.jz(a)bp.renesas.com> pinctrl: renesas: rzg2l: Fix PMC restore Roberto Sassu <roberto.sassu(a)huawei.com> ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook Abel Vesa <abel.vesa(a)linaro.org> pinctrl: qcom: glymur: Fix the gpio and egpio pin functions Abel Vesa <abel.vesa(a)linaro.org> pinctrl: qcom: glymur: Drop unnecessary platform data from match table Ian Rogers <irogers(a)google.com> perf bpf_counter: Fix opening of "any"(-1) CPU events Seungjin Bae <eeodqql09(a)gmail.com> USB: Fix descriptor count when handling invalid MBIM extended descriptor Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> tools/nolibc: handle NULL wstatus argument to waitpid() Mykyta Yatsenko <yatsenko(a)meta.com> bpf: Fix handling maps with no BTF and non-constant offsets for the bpf_wq Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Fix sleepable context for async callbacks Siddharth Chintamaneni <sidchintamaneni(a)gmail.com> bpf: Cleanup unused func args in rqspinlock implementation Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/vgem-fence: Fix potential deadlock on release Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Fix DCT active percent format Jacek Lawrynowicz <jacek.lawrynowicz(a)linux.intel.com> accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() Jacek Lawrynowicz <jacek.lawrynowicz(a)linux.intel.com> accel/ivpu: Rework bind/unbind of imported buffers Guido Günther <agx(a)sigxcpu.org> drm/panel: visionox-rm69299: Don't clear all mode flags Guido Günther <agx(a)sigxcpu.org> drm/panel: visionox-rm69299: Fix clock frequency for SHIFT6mq Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Call dma_buf_vmap_unlocked() for imported object Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array() Mainak Sen <msen(a)nvidia.com> gpu: host1x: Fix race in syncpt alloc/free Konstantin Andreev <andreev(a)swemel.ru> smack: fix bug: setting task label silently ignores input garbage Konstantin Andreev <andreev(a)swemel.ru> smack: fix bug: unprivileged task can create labels Konstantin Andreev <andreev(a)swemel.ru> smack: fix bug: invalid label of unix socket file Konstantin Andreev <andreev(a)swemel.ru> smack: always "instantiate" inode in smack_inode_init_security() Konstantin Andreev <andreev(a)swemel.ru> smack: deduplicate xattr setting in smack_inode_init_security() Konstantin Andreev <andreev(a)swemel.ru> smack: deduplicate "does access rule request transmutation" Konstantin Andreev <andreev(a)swemel.ru> smack: fix bug: SMACK64TRANSMUTE set on non-directory ------------- Diffstat: Documentation/admin-guide/LSM/Smack.rst | 16 +- .../devicetree/bindings/pci/amlogic,axg-pcie.yaml | 6 +- Documentation/hwmon/g762.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/renesas/r8a7793-gose.dts | 1 - .../arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts | 2 - arch/arm/boot/dts/samsung/exynos4210-i9100.dts | 1 + arch/arm/boot/dts/samsung/exynos4210-trats.dts | 1 + .../boot/dts/samsung/exynos4210-universal_c210.dts | 1 + arch/arm/boot/dts/samsung/exynos4412-midas.dtsi | 1 + .../dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi | 8 +- arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi | 2 +- arch/arm/boot/dts/ti/omap/am335x-boneblue.dts | 2 +- arch/arm/boot/dts/ti/omap/am335x-chiliboard.dts | 2 +- arch/arm/boot/dts/ti/omap/am335x-evm.dts | 2 +- arch/arm/boot/dts/ti/omap/am335x-evmsk.dts | 2 +- arch/arm/boot/dts/ti/omap/am335x-guardian.dts | 2 +- arch/arm/boot/dts/ti/omap/am335x-icev2.dts | 2 +- arch/arm/boot/dts/ti/omap/am335x-myirtech-myd.dts | 2 +- .../boot/dts/ti/omap/am335x-netcom-plus-2xx.dts | 8 +- .../arm/boot/dts/ti/omap/am335x-osd3358-sm-red.dts | 2 +- arch/arm/boot/dts/ti/omap/am335x-pdu001.dts | 2 +- arch/arm/boot/dts/ti/omap/am335x-pocketbeagle.dts | 2 +- arch/arm/boot/dts/ti/omap/am335x-sl50.dts | 2 +- arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts | 2 +- arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 +- arch/arm/include/asm/word-at-a-time.h | 10 +- arch/arm64/boot/dts/amlogic/meson-g12b.dtsi | 4 +- arch/arm64/boot/dts/exynos/google/gs101.dtsi | 18 +- .../boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 - .../boot/dts/freescale/imx8mp-venice-gw702x.dtsi | 51 --- .../boot/dts/freescale/imx8mp-venice-gw72xx.dtsi | 11 - arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts | 1 + .../arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi | 4 +- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 +- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 61 ++++ arch/arm64/boot/dts/qcom/ipq5424.dtsi | 2 +- arch/arm64/boot/dts/qcom/lemans.dtsi | 1 + arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 + arch/arm64/boot/dts/qcom/qcm2290.dtsi | 10 +- arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts | 2 + arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts | 5 + arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 2 +- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 170 +++++----- .../arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 4 +- .../boot/dts/qcom/sdm845-samsung-starqltechn.dts | 16 +- .../arm64/boot/dts/qcom/sm8250-samsung-common.dtsi | 3 +- arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 + arch/arm64/boot/dts/qcom/sm8750-mtp.dts | 6 +- arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 5 +- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 12 +- .../boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 6 +- arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts | 1 + .../boot/dts/rockchip/rk3588-rock-5b-5bp-5t.dtsi | 4 +- .../boot/dts/rockchip/rk3588-rock-5b-plus.dts | 5 + arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts | 4 + arch/arm64/boot/dts/rockchip/rk3588-rock-5t.dts | 4 + arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 15 +- arch/arm64/boot/dts/ti/k3-am62p.dtsi | 2 +- arch/arm64/boot/dts/ti/k3-am69-sk.dts | 8 +- .../boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi | 4 +- arch/arm64/mm/mmu.c | 214 +++++++----- arch/arm64/mm/pageattr.c | 5 +- arch/powerpc/kernel/entry_32.S | 10 +- arch/powerpc/kexec/ranges.c | 2 +- arch/powerpc/mm/book3s64/hash_utils.c | 10 +- arch/powerpc/mm/ptdump/hashpagetable.c | 6 + arch/riscv/kvm/vcpu_insn.c | 22 ++ arch/s390/include/asm/fpu-insn.h | 3 + arch/s390/kernel/smp.c | 1 + arch/um/Kconfig | 1 + arch/um/Makefile | 12 +- arch/um/include/asm/kasan.h | 4 - arch/x86/boot/compressed/pgtable_64.c | 11 +- arch/x86/events/core.c | 5 +- arch/x86/events/intel/core.c | 7 +- arch/x86/events/intel/cstate.c | 3 +- arch/x86/kernel/dumpstack.c | 23 +- block/blk-lib.c | 6 +- block/blk-mq.c | 35 +- block/blk-throttle.c | 9 +- block/mq-deadline.c | 129 ++++--- crypto/aead.c | 1 + crypto/ahash.c | 18 +- crypto/asymmetric_keys/asymmetric_type.c | 12 +- crypto/authenc.c | 75 +++-- drivers/accel/amdxdna/aie2_ctx.c | 22 +- drivers/accel/amdxdna/aie2_pci.c | 10 +- drivers/accel/amdxdna/amdxdna_ctx.c | 1 + drivers/accel/amdxdna/amdxdna_ctx.h | 1 + drivers/accel/amdxdna/amdxdna_gem.c | 47 ++- drivers/accel/amdxdna/amdxdna_mailbox.c | 1 + drivers/accel/ivpu/ivpu_gem.c | 97 ++++-- drivers/accel/ivpu/ivpu_gem.h | 2 +- drivers/accel/ivpu/ivpu_hw_btrs.c | 2 +- drivers/accel/ivpu/ivpu_hw_btrs.h | 2 +- drivers/accel/ivpu/ivpu_job.c | 6 +- drivers/accel/ivpu/ivpu_pm.c | 9 +- drivers/acpi/apei/ghes.c | 27 +- drivers/acpi/processor_core.c | 2 +- drivers/acpi/property.c | 1 + drivers/base/firmware_loader/Kconfig | 2 +- drivers/block/nbd.c | 5 +- drivers/block/ps3disk.c | 4 + drivers/block/ublk_drv.c | 4 +- drivers/char/random.c | 19 +- drivers/clk/Makefile | 3 +- drivers/clk/qcom/camcc-sm6350.c | 13 +- drivers/clk/qcom/camcc-sm7150.c | 6 +- drivers/clk/qcom/camcc-sm8550.c | 10 + drivers/clk/qcom/clk-rpmh.c | 1 + drivers/clk/qcom/gcc-glymur.c | 24 +- drivers/clk/qcom/gcc-ipq5424.c | 3 +- drivers/clk/qcom/gcc-qcs615.c | 6 +- drivers/clk/qcom/gcc-sm8750.c | 1 + drivers/clk/qcom/tcsrcc-glymur.c | 54 +-- drivers/clk/renesas/r9a06g032-clocks.c | 6 +- drivers/clk/renesas/r9a09g077-cpg.c | 4 +- drivers/clk/renesas/renesas-cpg-mssr.c | 57 ++-- drivers/clk/spacemit/ccu-k1.c | 4 +- drivers/clocksource/arm_arch_timer_mmio.c | 2 + drivers/clocksource/timer-nxp-pit.c | 3 +- drivers/clocksource/timer-nxp-stm.c | 23 +- drivers/clocksource/timer-ralink.c | 11 +- drivers/cpufreq/amd-pstate.c | 2 +- drivers/crypto/ccree/cc_buffer_mgr.c | 6 +- drivers/crypto/hisilicon/qm.c | 14 +- drivers/crypto/intel/iaa/iaa_crypto_main.c | 2 +- drivers/crypto/starfive/jh7110-hash.c | 6 +- drivers/devfreq/hisi_uncore_freq.c | 3 +- drivers/firmware/efi/cper-arm.c | 52 ++- drivers/firmware/efi/cper.c | 60 ++++ drivers/firmware/efi/libstub/x86-5lvl.c | 4 +- drivers/firmware/imx/imx-scu-irq.c | 4 +- drivers/firmware/stratix10-svc.c | 1 + drivers/firmware/ti_sci.c | 21 +- drivers/firmware/ti_sci.h | 2 + drivers/gpio/Kconfig | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 44 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 12 +- drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 31 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 46 ++- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +- drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 27 +- drivers/gpu/drm/drm_plane.c | 8 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 43 ++- drivers/gpu/drm/i915/display/intel_fbdev_fb.c | 42 +-- drivers/gpu/drm/i915/display/intel_fbdev_fb.h | 8 +- drivers/gpu/drm/imagination/pvr_device.c | 2 +- drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 +- drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 34 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 10 +- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h | 6 - drivers/gpu/drm/msm/msm_gpu.c | 21 +- .../gpu/drm/nouveau/dispnv04/nouveau_i2c_encoder.c | 20 -- .../drm/nouveau/include/dispnv04/i2c/encoder_i2c.h | 19 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 6 +- drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c | 2 +- drivers/gpu/drm/nova/Kconfig | 1 + drivers/gpu/drm/panel/panel-novatek-nt35560.c | 8 +- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 4 +- drivers/gpu/drm/panthor/panthor_device.c | 4 +- drivers/gpu/drm/panthor/panthor_gem.c | 20 +- drivers/gpu/drm/panthor/panthor_mmu.c | 18 +- drivers/gpu/drm/panthor/panthor_sched.c | 25 +- .../gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 4 +- drivers/gpu/drm/tidss/tidss_dispc.c | 93 +++-- drivers/gpu/drm/tidss/tidss_dispc.h | 3 - drivers/gpu/drm/tidss/tidss_drv.h | 2 + drivers/gpu/drm/tidss/tidss_oldi.c | 22 ++ drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 32 +- drivers/gpu/drm/xe/xe_exec_queue.c | 3 + drivers/gpu/host1x/syncpt.c | 4 +- drivers/gpu/nova-core/firmware/gsp.rs | 8 +- drivers/greybus/gb-beagleplay.c | 12 +- drivers/hid/hid-logitech-hidpp.c | 9 +- drivers/hv/mshv_root_main.c | 89 +++-- drivers/hwmon/sy7636a-hwmon.c | 7 +- drivers/hwtracing/coresight/coresight-etm-perf.c | 1 + drivers/hwtracing/coresight/coresight-etm3x-core.c | 59 ++-- drivers/hwtracing/coresight/coresight-etm4x-core.c | 103 ++++-- drivers/hwtracing/coresight/coresight-etm4x.h | 3 - drivers/hwtracing/coresight/coresight-tmc-etr.c | 10 +- drivers/i2c/busses/i2c-k1.c | 19 +- drivers/i3c/master.c | 8 +- drivers/i3c/master/svc-i3c-master.c | 22 +- drivers/iio/imu/bmi270/bmi270_spi.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 +- drivers/iio/industrialio-core.c | 17 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 +- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 +- drivers/infiniband/hw/bnxt_re/qplib_sp.h | 2 +- drivers/infiniband/hw/irdma/cm.c | 2 +- drivers/infiniband/hw/irdma/ctrl.c | 6 +- drivers/infiniband/hw/irdma/icrdma_if.c | 6 +- drivers/infiniband/hw/irdma/ig3rdma_if.c | 4 + drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/pble.c | 6 +- drivers/infiniband/hw/irdma/puda.c | 1 - drivers/infiniband/hw/irdma/uk.c | 31 +- drivers/infiniband/hw/irdma/user.h | 1 - drivers/infiniband/hw/irdma/verbs.c | 24 +- drivers/infiniband/hw/irdma/verbs.h | 3 +- drivers/infiniband/sw/rxe/rxe_srq.c | 7 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- drivers/interconnect/debugfs-client.c | 7 +- drivers/interconnect/qcom/msm8996.c | 1 + drivers/iommu/amd/debugfs.c | 2 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 +- drivers/iommu/intel/Kconfig | 2 +- drivers/iommu/intel/iommu.h | 2 +- drivers/irqchip/irq-bcm2712-mip.c | 11 +- drivers/irqchip/irq-bcm7038-l1.c | 11 +- drivers/irqchip/irq-bcm7120-l2.c | 31 +- drivers/irqchip/irq-brcmstb-l2.c | 25 +- drivers/irqchip/irq-imx-mu-msi.c | 28 +- drivers/irqchip/irq-mchp-eic.c | 7 +- drivers/irqchip/irq-meson-gpio.c | 5 +- drivers/irqchip/irq-qcom-mpm.c | 6 +- drivers/irqchip/irq-renesas-rzg2l.c | 37 +- drivers/irqchip/irq-renesas-rzv2h.c | 32 +- drivers/irqchip/irq-starfive-jh8100-intc.c | 6 +- drivers/irqchip/irqchip.c | 10 +- drivers/irqchip/qcom-irq-combiner.c | 2 +- drivers/irqchip/qcom-pdc.c | 5 +- drivers/leds/leds-netxbig.c | 36 +- drivers/leds/leds-upboard.c | 2 +- drivers/leds/rgb/leds-qcom-lpg.c | 4 +- drivers/macintosh/mac_hid.c | 3 +- drivers/md/dm-log-writes.c | 1 + drivers/md/dm-raid.c | 2 + drivers/md/md.c | 92 ++--- drivers/md/md.h | 9 +- drivers/md/raid5.c | 6 +- drivers/mfd/da9055-core.c | 1 + drivers/mfd/mt6358-irq.c | 1 + drivers/mfd/mt6397-irq.c | 1 + drivers/misc/rp1/rp1_pci.c | 3 + drivers/mtd/lpddr/lpddr_cmds.c | 8 +- drivers/mtd/nand/raw/lpc32xx_slc.c | 2 + drivers/mtd/nand/raw/marvell_nand.c | 13 +- drivers/mtd/nand/raw/nand_base.c | 13 +- drivers/mtd/nand/raw/renesas-nand-controller.c | 5 +- drivers/net/dsa/b53/b53_common.c | 331 ++++++++++++------ drivers/net/dsa/b53/b53_priv.h | 111 +++++- drivers/net/dsa/b53/b53_regs.h | 41 ++- drivers/net/dsa/xrs700x/xrs700x.c | 11 + drivers/net/ethernet/intel/iavf/iavf_ptp.c | 7 + drivers/net/ethernet/intel/ice/devlink/devlink.c | 21 +- drivers/net/ethernet/intel/ice/ice.h | 4 + drivers/net/ethernet/intel/ice/ice_common.c | 3 + drivers/net/ethernet/intel/ice/ice_main.c | 169 +++++----- drivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c | 20 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c | 3 +- drivers/net/phy/adin1100.c | 2 +- drivers/net/phy/aquantia/aquantia_firmware.c | 2 +- drivers/net/phy/mscc/mscc_main.c | 6 +- drivers/net/phy/phy-core.c | 43 +++ drivers/net/phy/realtek/realtek_main.c | 65 ++-- drivers/net/vxlan/vxlan_core.c | 18 +- drivers/net/wireless/ath/ath10k/core.c | 20 +- drivers/net/wireless/ath/ath10k/core.h | 2 +- drivers/net/wireless/ath/ath10k/mac.c | 2 +- drivers/net/wireless/ath/ath11k/mac.c | 8 +- drivers/net/wireless/ath/ath11k/pci.c | 20 +- drivers/net/wireless/ath/ath11k/wmi.c | 20 +- drivers/net/wireless/ath/ath11k/wmi.h | 2 + drivers/net/wireless/ath/ath12k/core.c | 24 +- drivers/net/wireless/ath/ath12k/core.h | 1 - drivers/net/wireless/ath/ath12k/dp_rx.c | 70 +++- drivers/net/wireless/ath/ath12k/hal_rx.c | 10 +- drivers/net/wireless/ath/ath12k/mac.c | 28 +- drivers/net/wireless/ath/ath12k/pci.c | 20 +- drivers/net/wireless/ath/ath12k/qmi.c | 11 +- drivers/net/wireless/ath/ath12k/qmi.h | 5 +- drivers/net/wireless/ath/ath12k/wmi.c | 23 +- drivers/net/wireless/ath/ath12k/wmi.h | 2 + drivers/net/wireless/ath/ath12k/wow.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/d3.c | 4 + drivers/net/wireless/mediatek/mt76/mac80211.c | 2 - drivers/net/wireless/mediatek/mt76/mt76.h | 9 + drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 + drivers/net/wireless/mediatek/mt76/mt792x_core.c | 1 - drivers/net/wireless/mediatek/mt76/mt7996/dma.c | 15 +- drivers/net/wireless/mediatek/mt76/mt7996/init.c | 19 +- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 18 +- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 115 ++++--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 69 ++-- drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 1 + drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +- drivers/net/wireless/mediatek/mt76/wed.c | 10 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 27 +- drivers/net/wireless/realtek/rtw89/usb.c | 13 +- drivers/net/wireless/st/cw1200/bh.c | 6 +- drivers/nvme/host/auth.c | 2 +- drivers/of/fdt.c | 85 +++-- drivers/of/of_kunit_helpers.c | 5 +- drivers/pci/controller/Kconfig | 7 +- drivers/pci/controller/cadence/pcie-sg2042.c | 3 - drivers/pci/controller/dwc/pci-keystone.c | 2 + drivers/pci/controller/dwc/pcie-designware.h | 2 +- drivers/pci/controller/dwc/pcie-stm32-ep.c | 41 +-- drivers/pci/endpoint/functions/pci-epf-test.c | 5 +- drivers/pci/setup-bus.c | 5 + drivers/phy/freescale/phy-fsl-imx8qm-hsio.c | 5 +- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 20 +- drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 15 + drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 27 +- drivers/pinctrl/pinctrl-single.c | 7 +- drivers/pinctrl/qcom/pinctrl-glymur.c | 6 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 6 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- drivers/platform/x86/asus-wmi.c | 8 +- drivers/platform/x86/intel/pmc/core.h | 2 +- drivers/power/supply/apm_power.c | 3 +- drivers/power/supply/cw2015_battery.c | 8 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/power/supply/qcom_battmgr.c | 26 +- drivers/power/supply/rt5033_charger.c | 2 + drivers/power/supply/rt9467-charger.c | 6 +- drivers/power/supply/wm831x_power.c | 10 +- drivers/pwm/core.c | 5 +- drivers/pwm/pwm-bcm2835.c | 28 +- drivers/ras/ras.c | 40 ++- drivers/regulator/core.c | 37 +- drivers/regulator/fixed.c | 11 +- drivers/regulator/pca9450-regulator.c | 7 +- drivers/regulator/spacemit-p1.c | 4 +- drivers/remoteproc/imx_rproc.c | 9 +- drivers/remoteproc/qcom_q6v5_wcss.c | 8 +- drivers/rtc/rtc-amlogic-a4.c | 4 - drivers/rtc/rtc-gamecube.c | 4 + drivers/rtc/rtc-max31335.c | 6 +- drivers/s390/crypto/ap_bus.c | 8 +- drivers/scsi/imm.c | 1 + drivers/scsi/qla2xxx/qla_nvme.c | 2 +- drivers/scsi/qla2xxx/qla_os.c | 20 +- drivers/scsi/qla2xxx/qla_target.c | 5 +- drivers/scsi/qla2xxx/qla_target.h | 1 + drivers/scsi/sim710.c | 2 + drivers/scsi/smartpqi/smartpqi_init.c | 19 ++ drivers/scsi/stex.c | 1 + drivers/soc/qcom/qcom_gsbi.c | 8 - drivers/soc/qcom/smem.c | 3 +- drivers/soc/renesas/r9a08g045-sysc.c | 69 ++++ drivers/soc/renesas/r9a09g047-sys.c | 79 +++++ drivers/soc/renesas/r9a09g056-sys.c | 69 ++++ drivers/soc/renesas/r9a09g057-sys.c | 101 ++++++ drivers/soc/renesas/rz-sysc.c | 2 + drivers/soc/renesas/rz-sysc.h | 4 + drivers/soc/samsung/exynos-pmu.c | 7 +- drivers/soc/tegra/fuse/speedo-tegra210.c | 58 +++- drivers/spi/spi-airoha-snfi.c | 25 +- drivers/spi/spi-ch341.c | 2 +- drivers/spi/spi-sg2044-nor.c | 4 +- drivers/spi/spi-tegra210-quad.c | 22 +- drivers/staging/fbtft/fbtft-core.c | 4 +- drivers/staging/most/Kconfig | 2 - drivers/staging/most/Makefile | 1 - drivers/staging/most/i2c/Kconfig | 13 - drivers/staging/most/i2c/Makefile | 4 - drivers/staging/most/i2c/i2c.c | 374 --------------------- drivers/target/target_core_configfs.c | 1 - drivers/target/target_core_stat.c | 24 +- drivers/tty/serial/imx.c | 14 + drivers/ufs/core/ufshcd-priv.h | 2 + drivers/ufs/core/ufshcd.c | 27 +- drivers/ufs/host/ufs-rockchip.c | 19 +- drivers/uio/uio_fsl_elbc_gpcm.c | 7 + drivers/usb/core/message.c | 2 +- drivers/usb/dwc2/platform.c | 17 +- drivers/usb/dwc3/host.c | 5 +- drivers/usb/gadget/legacy/raw_gadget.c | 3 + drivers/usb/gadget/udc/tegra-xudc.c | 6 - drivers/usb/misc/chaoskey.c | 16 +- drivers/usb/phy/phy.c | 4 + drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 2 + drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +- drivers/vdpa/pds/vdpa_dev.c | 2 +- drivers/vfio/pci/vfio_pci_core.c | 68 ++-- drivers/vfio/pci/vfio_pci_intrs.c | 52 +-- drivers/vfio/pci/vfio_pci_priv.h | 4 + drivers/vhost/net.c | 12 +- drivers/vhost/vhost.c | 4 +- drivers/video/backlight/led_bl.c | 13 + drivers/video/fbdev/ssd1307fb.c | 4 +- drivers/virtio/virtio.c | 12 +- drivers/virtio/virtio_debug.c | 10 +- drivers/virtio/virtio_pci_modern_dev.c | 6 +- drivers/virtio/virtio_ring.c | 7 +- drivers/virtio/virtio_vdpa.c | 2 +- drivers/watchdog/starfive-wdt.c | 4 +- drivers/watchdog/wdat_wdt.c | 64 ++-- fs/9p/v9fs.c | 4 +- fs/9p/vfs_file.c | 11 +- fs/9p/vfs_inode.c | 3 +- fs/9p/vfs_inode_dotl.c | 2 +- fs/btrfs/block-group.c | 6 +- fs/btrfs/ctree.c | 2 +- fs/btrfs/delayed-ref.c | 43 ++- fs/btrfs/scrub.c | 2 +- fs/btrfs/space-info.c | 22 +- fs/btrfs/space-info.h | 6 +- fs/erofs/super.c | 38 ++- fs/exfat/balloc.c | 2 +- fs/exfat/namei.c | 20 +- fs/ext4/mballoc.c | 49 ++- fs/ext4/move_extent.c | 2 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/gc.c | 132 +++++--- fs/f2fs/recovery.c | 2 +- fs/f2fs/segment.c | 38 ++- fs/f2fs/segment.h | 8 +- fs/f2fs/super.c | 14 + fs/f2fs/sysfs.c | 7 + fs/fuse/control.c | 19 +- fs/gfs2/glock.c | 5 +- fs/gfs2/inode.c | 15 + fs/gfs2/inode.h | 1 + fs/gfs2/ops_fstype.c | 2 +- fs/hfs/catalog.c | 2 +- fs/inode.c | 58 ++-- fs/iomap/direct-io.c | 23 +- fs/kernfs/dir.c | 5 +- fs/nfs/client.c | 21 +- fs/nfs/dir.c | 27 +- fs/nfs/internal.h | 3 +- fs/nfs/localio.c | 4 +- fs/nfs/namespace.c | 11 +- fs/nfs/nfs4client.c | 18 +- fs/nfs/nfs4proc.c | 27 +- fs/nfs/pnfs.c | 1 + fs/nfs/super.c | 33 +- fs/nfsd/blocklayout.c | 4 +- fs/nls/nls_base.c | 27 +- fs/ntfs3/frecord.c | 8 +- fs/ntfs3/fsntfs.c | 9 +- fs/ntfs3/inode.c | 7 +- fs/ocfs2/alloc.c | 1 - fs/ocfs2/inode.c | 10 +- fs/ocfs2/move_extents.c | 8 +- fs/pidfs.c | 2 + fs/smb/client/cifssmb.c | 2 +- fs/smb/client/smb2pdu.c | 2 +- fs/smb/client/smbdirect.c | 28 +- fs/smb/common/smbdirect/smbdirect_socket.h | 51 +++ fs/smb/server/transport_rdma.c | 40 ++- fs/tracefs/event_inode.c | 3 +- include/asm-generic/mshyperv.h | 17 +- include/asm-generic/rqspinlock.h | 60 ++-- include/linux/blk_types.h | 5 +- include/linux/cleanup.h | 15 +- include/linux/coresight.h | 35 +- include/linux/cper.h | 12 +- include/linux/f2fs_fs.h | 5 +- include/linux/filter.h | 12 +- include/linux/firmware/qcom/qcom_tzmem.h | 15 +- include/linux/ieee80211.h | 4 +- include/linux/if_hsr.h | 9 + include/linux/irq-entry-common.h | 2 +- include/linux/irqchip.h | 8 +- include/linux/netdevice.h | 1 + include/linux/nfs_fs_sb.h | 5 + include/linux/ns_common.h | 11 + include/linux/of_fdt.h | 9 + include/linux/phy.h | 3 + include/linux/platform_data/lp855x.h | 4 +- include/linux/ras.h | 16 +- include/linux/soc/mediatek/mtk_wed.h | 1 + include/linux/vfio_pci_core.h | 10 +- include/linux/virtio.h | 2 +- include/linux/virtio_config.h | 24 +- include/linux/virtio_features.h | 29 +- include/linux/virtio_pci_modern.h | 8 +- include/net/netfilter/nf_conntrack_count.h | 15 +- include/ras/ras_event.h | 49 ++- include/sound/tas2781.h | 2 +- include/target/target_core_base.h | 12 +- include/uapi/linux/pidfd.h | 1 + include/uapi/sound/asound.h | 2 +- include/ufs/ufshcd.h | 1 - io_uring/io_uring.c | 10 +- io_uring/kbuf.c | 10 +- io_uring/zcrx.c | 16 +- kernel/bpf/hashtab.c | 10 +- kernel/bpf/helpers.c | 3 + kernel/bpf/rqspinlock.c | 36 +- kernel/bpf/stackmap.c | 62 ++-- kernel/bpf/syscall.c | 6 +- kernel/bpf/trampoline.c | 4 +- kernel/bpf/verifier.c | 89 +++-- kernel/cgroup/cpuset.c | 35 +- kernel/cgroup/namespace.c | 2 +- kernel/cpu.c | 25 +- kernel/dma/pool.c | 2 +- kernel/events/core.c | 22 +- kernel/locking/locktorture.c | 8 +- kernel/resource.c | 10 +- kernel/sched/fair.c | 17 +- kernel/sched/stats.h | 7 +- kernel/task_work.c | 8 +- kernel/time/timer_migration.c | 264 ++++++++------- lib/vsprintf.c | 6 +- net/bpf/test_run.c | 5 + net/core/dev.h | 1 - net/core/filter.c | 16 +- net/core/netpoll.c | 2 +- net/hsr/hsr_device.c | 20 ++ net/hsr/hsr_slave.c | 7 +- net/ipv6/ip6_fib.c | 4 + net/mac80211/aes_cmac.c | 63 +++- net/mac80211/aes_cmac.h | 8 +- net/mac80211/wpa.c | 20 +- net/netfilter/nf_conncount.c | 195 +++++++---- net/netfilter/nft_connlimit.c | 34 +- net/netfilter/nft_flow_offload.c | 9 +- net/netfilter/xt_connlimit.c | 14 +- net/openvswitch/conntrack.c | 16 +- net/sched/sch_cake.c | 60 ++-- net/sctp/socket.c | 5 +- scripts/cc-can-link.sh | 2 +- scripts/lib/kdoc/kdoc_parser.py | 16 +- scripts/package/install-extmod-build | 2 +- security/integrity/ima/ima_main.c | 40 ++- security/integrity/ima/ima_policy.c | 2 +- security/landlock/errata/abi-1.h | 16 + security/landlock/fs.c | 40 ++- security/smack/smack.h | 3 + security/smack/smack_access.c | 93 +++-- security/smack/smack_lsm.c | 277 ++++++++++----- sound/firewire/dice/dice-extension.c | 4 +- sound/firewire/motu/motu-hwdep.c | 7 +- sound/hda/codecs/realtek/alc269.c | 2 + sound/hda/codecs/side-codecs/cs35l41_hda.c | 2 + sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 44 +-- sound/isa/wavefront/wavefront_midi.c | 2 + sound/isa/wavefront/wavefront_synth.c | 4 +- sound/soc/amd/acp/acp-i2s.c | 2 + sound/soc/amd/acp/acp-legacy-common.c | 30 +- sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 +- sound/soc/codecs/Kconfig | 5 + sound/soc/codecs/Makefile | 2 + sound/soc/codecs/ak4458.c | 10 +- sound/soc/codecs/ak5558.c | 10 +- sound/soc/codecs/nau8325.c | 3 +- sound/soc/codecs/tas2781-comlib-i2c.c | 2 +- sound/soc/codecs/tas2781-i2c.c | 2 +- sound/soc/fsl/fsl_xcvr.c | 2 +- sound/soc/intel/catpt/pcm.c | 4 +- sound/soc/sdca/sdca_functions.c | 2 +- tools/bpf/bpftool/sign.c | 6 + tools/include/nolibc/arch-x86.h | 6 +- tools/include/nolibc/dirent.h | 6 +- tools/include/nolibc/stdio.h | 4 + tools/include/nolibc/sys/wait.h | 18 +- tools/lib/bpf/btf.c | 4 +- tools/objtool/check.c | 3 +- tools/objtool/elf.c | 8 +- tools/perf/builtin-kvm.c | 2 +- tools/perf/builtin-record.c | 2 +- tools/perf/builtin-stat.c | 15 +- .../pmu-events/arch/s390/cf_z16/transaction.json | 8 +- .../pmu-events/arch/s390/cf_z17/transaction.json | 8 +- tools/perf/util/annotate.c | 2 +- .../util/arm-spe-decoder/arm-spe-pkt-decoder.c | 25 +- .../util/arm-spe-decoder/arm-spe-pkt-decoder.h | 15 +- tools/perf/util/bpf_counter.c | 7 +- tools/perf/util/bpf_lock_contention.c | 6 +- tools/perf/util/evsel.c | 2 +- tools/perf/util/genelf.c | 32 +- tools/perf/util/hist.c | 6 +- tools/perf/util/hist.h | 8 +- tools/perf/util/hwmon_pmu.c | 3 +- tools/perf/util/parse-events.c | 44 ++- tools/perf/util/parse-events.h | 3 +- tools/perf/util/parse-events.y | 2 +- tools/perf/util/symbol.c | 5 +- tools/power/x86/turbostat/turbostat.c | 12 +- tools/testing/selftests/bpf/.gitignore | 1 + tools/testing/selftests/bpf/Makefile | 6 +- .../selftests/bpf/prog_tests/kmem_cache_iter.c | 3 +- .../selftests/bpf/prog_tests/perf_branches.c | 22 +- .../testing/selftests/bpf/prog_tests/send_signal.c | 5 + .../selftests/bpf/progs/test_perf_branches.c | 3 + tools/testing/selftests/bpf/test_tag.c | 2 +- .../drivers/net/bonding/bond_macvlan_ipvlan.sh | 1 + tools/testing/selftests/landlock/Makefile | 2 +- .../tcp_syscall_bad_arg_sendmsg-empty-iov.pkt | 4 + .../net/packetdrill/tcp_zerocopy_basic.pkt | 2 + .../net/packetdrill/tcp_zerocopy_batch.pkt | 2 + .../net/packetdrill/tcp_zerocopy_client.pkt | 2 + .../net/packetdrill/tcp_zerocopy_closed.pkt | 2 + .../net/packetdrill/tcp_zerocopy_epoll_edge.pkt | 3 + .../packetdrill/tcp_zerocopy_epoll_exclusive.pkt | 3 + .../net/packetdrill/tcp_zerocopy_epoll_oneshot.pkt | 3 + .../packetdrill/tcp_zerocopy_fastopen-client.pkt | 2 + .../packetdrill/tcp_zerocopy_fastopen-server.pkt | 2 + .../net/packetdrill/tcp_zerocopy_maxfrags.pkt | 2 + .../net/packetdrill/tcp_zerocopy_small.pkt | 2 + tools/tracing/rtla/Makefile.rtla | 2 +- tools/tracing/rtla/src/common.c | 24 +- tools/tracing/rtla/src/osnoise_hist.c | 3 +- tools/tracing/rtla/src/osnoise_top.c | 3 +- tools/tracing/rtla/src/timerlat.c | 3 +- tools/tracing/rtla/src/timerlat_hist.c | 3 +- tools/tracing/rtla/src/timerlat_top.c | 3 +- tools/tracing/rtla/tests/osnoise.t | 6 +- tools/tracing/rtla/tests/timerlat.t | 4 +- 616 files changed, 6319 insertions(+), 3850 deletions(-)

4 days, 10 hours

20
645
0 0

[PATCH 6.1.y] net: openvswitch: fix middle attribute validation in push_nsh() action

by Adrian Yip

From: Ilya Maximets <i.maximets(a)ovn.org> [ Upstream commit 5ace7ef87f059d68b5f50837ef3e8a1a4870c36e ] The push_nsh() action structure looks like this: OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...)) The outermost OVS_ACTION_ATTR_PUSH_NSH attribute is OK'ed by the nla_for_each_nested() inside __ovs_nla_copy_actions(). The innermost OVS_NSH_KEY_ATTR_BASE/MD1/MD2 are OK'ed by the nla_for_each_nested() inside nsh_key_put_from_nlattr(). But nothing checks if the attribute in the middle is OK. We don't even check that this attribute is the OVS_KEY_ATTR_NSH. We just do a double unwrap with a pair of nla_data() calls - first time directly while calling validate_push_nsh() and the second time as part of the nla_for_each_nested() macro, which isn't safe, potentially causing invalid memory access if the size of this attribute is incorrect. The failure may not be noticed during validation due to larger netlink buffer, but cause trouble later during action execution where the buffer is allocated exactly to the size: BUG: KASAN: slab-out-of-bounds in nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch] Read of size 184 at addr ffff88816459a634 by task a.out/22624 CPU: 8 UID: 0 PID: 22624 6.18.0-rc7+ #115 PREEMPT(voluntary) Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x2c/0x390 kasan_report+0xdd/0x110 kasan_check_range+0x35/0x1b0 __asan_memcpy+0x20/0x60 nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch] push_nsh+0x82/0x120 [openvswitch] do_execute_actions+0x1405/0x2840 [openvswitch] ovs_execute_actions+0xd5/0x3b0 [openvswitch] ovs_packet_cmd_execute+0x949/0xdb0 [openvswitch] genl_family_rcv_msg_doit+0x1d6/0x2b0 genl_family_rcv_msg+0x336/0x580 genl_rcv_msg+0x9f/0x130 netlink_rcv_skb+0x11f/0x370 genl_rcv+0x24/0x40 netlink_unicast+0x73e/0xaa0 netlink_sendmsg+0x744/0xbf0 __sys_sendto+0x3d6/0x450 do_syscall_64+0x79/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Let's add some checks that the attribute is properly sized and it's the only one attribute inside the action. Technically, there is no real reason for OVS_KEY_ATTR_NSH to be there, as we know that we're pushing an NSH header already, it just creates extra nesting, but that's how uAPI works today. So, keeping as it is. Fixes: b2d0f5d5dc53 ("openvswitch: enable NSH support") Reported-by: Junvy Yang <zhuque(a)tencent.com> Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Acked-by: Eelco Chaudron echaudro(a)redhat.com Reviewed-by: Aaron Conole <aconole(a)redhat.com> Link: https://patch.msgid.link/20251204105334.900379-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> (cherry picked from commit 5ace7ef87f059d68b5f50837ef3e8a1a4870c36e) Signed-off-by: Adrian Yip <adrian.ytw(a)gmail.com> --- net/openvswitch/flow_netlink.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index d0b6e5872081..d4c8b4aa98b1 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -2786,13 +2786,20 @@ static int validate_and_copy_set_tun(const struct nlattr *attr, return err; } -static bool validate_push_nsh(const struct nlattr *attr, bool log) +static bool validate_push_nsh(const struct nlattr *a, bool log) { + struct nlattr *nsh_key = nla_data(a); struct sw_flow_match match; struct sw_flow_key key; + /* There must be one and only one NSH header. */ + if (!nla_ok(nsh_key, nla_len(a)) || + nla_total_size(nla_len(nsh_key)) != nla_len(a) || + nla_type(nsh_key) != OVS_KEY_ATTR_NSH) + return false; + ovs_match_init(&match, &key, true, NULL); - return !nsh_key_put_from_nlattr(attr, &match, false, true, log); + return !nsh_key_put_from_nlattr(nsh_key, &match, false, true, log); } /* Return false if there are any non-masked bits set. @@ -3346,7 +3353,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, return -EINVAL; } mac_proto = MAC_PROTO_NONE; - if (!validate_push_nsh(nla_data(a), log)) + if (!validate_push_nsh(a, log)) return -EINVAL; break; -- 2.52.0

4 days, 10 hours

1
0
0 0

[PATCH] powerpc/kexec: Enable SMT before waking offline CPUs

by Nysal Jan K.A.

If SMT is disabled or a partial SMT state is enabled, when a new kernel image is loaded for kexec, on reboot the following warning is observed: kexec: Waking offline cpu 228. WARNING: CPU: 0 PID: 9062 at arch/powerpc/kexec/core_64.c:223 kexec_prepare_cpus+0x1b0/0x1bc [snip] NIP kexec_prepare_cpus+0x1b0/0x1bc LR kexec_prepare_cpus+0x1a0/0x1bc Call Trace: kexec_prepare_cpus+0x1a0/0x1bc (unreliable) default_machine_kexec+0x160/0x19c machine_kexec+0x80/0x88 kernel_kexec+0xd0/0x118 __do_sys_reboot+0x210/0x2c4 system_call_exception+0x124/0x320 system_call_vectored_common+0x15c/0x2ec This occurs as add_cpu() fails due to cpu_bootable() returning false for CPUs that fail the cpu_smt_thread_allowed() check or non primary threads if SMT is disabled. Fix the issue by enabling SMT and resetting the number of SMT threads to the number of threads per core, before attempting to wake up all present CPUs. Fixes: 38253464bc82 ("cpu/SMT: Create topology_smt_thread_allowed()") Reported-by: Sachin P Bappalige <sachinpb(a)linux.ibm.com> Cc: stable(a)vger.kernel.org # v6.6+ Signed-off-by: Nysal Jan K.A. <nysal(a)linux.ibm.com> --- arch/powerpc/kexec/core_64.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/powerpc/kexec/core_64.c b/arch/powerpc/kexec/core_64.c index 222aa326dace..ff6df43720c4 100644 --- a/arch/powerpc/kexec/core_64.c +++ b/arch/powerpc/kexec/core_64.c @@ -216,6 +216,11 @@ static void wake_offline_cpus(void) { int cpu = 0; + lock_device_hotplug(); + cpu_smt_num_threads = threads_per_core; + cpu_smt_control = CPU_SMT_ENABLED; + unlock_device_hotplug(); + for_each_present_cpu(cpu) { if (!cpu_online(cpu)) { printk(KERN_INFO "kexec: Waking offline cpu %d.\n", -- 2.51.0

4 days, 11 hours

5
7
0 0

[PATCH] erofs: fix unexpected EIO under memory pressure

by Junbeom Yeom

erofs readahead could fail with ENOMEM under the memory pressure because it tries to alloc_page with GFP_NOWAIT | GFP_NORETRY, while GFP_KERNEL for a regular read. And if readahead fails (with non-uptodate folios), the original request will then fall back to synchronous read, and `.read_folio()` should return appropriate errnos. However, in scenarios where readahead and read operations compete, read operation could return an unintended EIO because of an incorrect error propagation. To resolve this, this patch modifies the behavior so that, when the PCL is for read(which means pcl.besteffort is true), it attempts actual decompression instead of propagating the privios error except initial EIO. - Page size: 4K - The original size of FileA: 16K - Compress-ratio per PCL: 50% (Uncompressed 8K -> Compressed 4K) [page0, page1] [page2, page3] [PCL0]---------[PCL1] - functions declaration: . pread(fd, buf, count, offset) . readahead(fd, offset, count) - Thread A tries to read the last 4K - Thread B tries to do readahead 8K from 4K - RA, besteffort == false - R, besteffort == true <process A> <process B> pread(FileA, buf, 4K, 12K) do readahead(page3) // failed with ENOMEM wait_lock(page3) if (!uptodate(page3)) goto do_read readahead(FileA, 4K, 8K) // Here create PCL-chain like below: // [null, page1] [page2, null] // [PCL0:RA]-----[PCL1:RA] ... do read(page3) // found [PCL1:RA] and add page3 into it, // and then, change PCL1 from RA to R ... // Now, PCL-chain is as below: // [null, page1] [page2, page3] // [PCL0:RA]-----[PCL1:R] // try to decompress PCL-chain... z_erofs_decompress_queue err = 0; // failed with ENOMEM, so page 1 // only for RA will not be uptodated. // it's okay. err = decompress([PCL0:RA], err) // However, ENOMEM propagated to next // PCL, even though PCL is not only // for RA but also for R. As a result, // it just failed with ENOMEM without // trying any decompression, so page2 // and page3 will not be uptodated. ** BUG HERE ** --> err = decompress([PCL1:R], err) return err as ENOMEM ... wait_lock(page3) if (!uptodate(page3)) return EIO <-- Return an unexpected EIO! ... Fixes: 2349d2fa02db ("erofs: sunset unneeded NOFAILs") Cc: stable(a)vger.kernel.org Reviewed-by: Jaewook Kim <jw5454.kim(a)samsung.com> Reviewed-by: Sungjong Seo <sj1557.seo(a)samsung.com> Signed-off-by: Junbeom Yeom <junbeom.yeom(a)samsung.com> --- fs/erofs/zdata.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c index 27b1f44d10ce..86bf6e087d34 100644 --- a/fs/erofs/zdata.c +++ b/fs/erofs/zdata.c @@ -1414,11 +1414,15 @@ static int z_erofs_decompress_queue(const struct z_erofs_decompressqueue *io, }; struct z_erofs_pcluster *next; int err = io->eio ? -EIO : 0; + int io_err = err; for (; be.pcl != Z_EROFS_PCLUSTER_TAIL; be.pcl = next) { + int propagate_err; + DBG_BUGON(!be.pcl); next = READ_ONCE(be.pcl->next); - err = z_erofs_decompress_pcluster(&be, err) ?: err; + propagate_err = READ_ONCE(be.pcl->besteffort) ? io_err : err; + err = z_erofs_decompress_pcluster(&be, propagate_err) ?: err; } return err; } -- 2.34.1

4 days, 11 hours

2
3
0 0

[PATCH v2] net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()

by Xiaolei Wang

In the non-RT kernel, local_bh_disable() merely disables preemption, whereas it maps to an actual spin lock in the RT kernel. Consequently, when attempting to refill RX buffers via netdev_alloc_skb() in macb_mac_link_up(), a deadlock scenario arises as follows: Chain caused by macb_mac_link_up(): &bp->lock --> (softirq_ctrl.lock) Chain caused by macb_start_xmit(): (softirq_ctrl.lock) --> _xmit_ETHER#2 --> &bp->lock Notably, invoking the mog_init_rings() callback upon link establishment is unnecessary. Instead, we can exclusively call mog_init_rings() within the ndo_open() callback. This adjustment resolves the deadlock issue. Given that mog_init_rings() is only applicable to non-MACB_CAPS_MACB_IS_EMAC cases, we can simply move it to macb_open() and simultaneously eliminate the MACB_CAPS_MACB_IS_EMAC check. Fixes: 633e98a711ac ("net: macb: use resolved link config in mac_link_up()") Cc: stable(a)vger.kernel.org Suggested-by: Kevin Hao <kexin.hao(a)windriver.com> Signed-off-by: Xiaolei Wang <xiaolei.wang(a)windriver.com> --- V1: https://patchwork.kernel.org/project/netdevbpf/patch/20251128103647.351259-… V2: Update the correct lock dependency chain and add the Fix tag. drivers/net/ethernet/cadence/macb_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c index ca2386b83473..064fccdcf699 100644 --- a/drivers/net/ethernet/cadence/macb_main.c +++ b/drivers/net/ethernet/cadence/macb_main.c @@ -744,7 +744,6 @@ static void macb_mac_link_up(struct phylink_config *config, /* Initialize rings & buffers as clearing MACB_BIT(TE) in link down * cleared the pipeline and control registers. */ - bp->macbgem_ops.mog_init_rings(bp); macb_init_buffers(bp); for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) @@ -2991,6 +2990,8 @@ static int macb_open(struct net_device *dev) goto pm_exit; } + bp->macbgem_ops.mog_init_rings(bp); + for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { napi_enable(&queue->napi_rx); napi_enable(&queue->napi_tx); -- 2.43.0

4 days, 11 hours

3
2
0 0

[PATCH] crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode

by Thorsten Blum

The local variable 'i' is initialized with -EINVAL, but the for loop immediately overwrites it and -EINVAL is never returned. If no empty compression mode can be found, the function would return the out-of-bounds index IAA_COMP_MODES_MAX, which would cause an invalid array access in add_iaa_compression_mode(). Fix both issues by returning either a valid index or -EINVAL. Cc: stable(a)vger.kernel.org Fixes: b190447e0fa3 ("crypto: iaa - Add compression mode management along with fixed mode") Signed-off-by: Thorsten Blum <thorsten.blum(a)linux.dev> --- drivers/crypto/intel/iaa/iaa_crypto_main.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/crypto/intel/iaa/iaa_crypto_main.c b/drivers/crypto/intel/iaa/iaa_crypto_main.c index 23f585219fb4..8ee2a55ec449 100644 --- a/drivers/crypto/intel/iaa/iaa_crypto_main.c +++ b/drivers/crypto/intel/iaa/iaa_crypto_main.c @@ -221,15 +221,13 @@ static struct iaa_compression_mode *iaa_compression_modes[IAA_COMP_MODES_MAX]; static int find_empty_iaa_compression_mode(void) { - int i = -EINVAL; + int i; - for (i = 0; i < IAA_COMP_MODES_MAX; i++) { - if (iaa_compression_modes[i]) - continue; - break; - } + for (i = 0; i < IAA_COMP_MODES_MAX; i++) + if (!iaa_compression_modes[i]) + return i; - return i; + return -EINVAL; } static struct iaa_compression_mode *find_iaa_compression_mode(const char *name, int *idx) -- Thorsten Blum <thorsten.blum(a)linux.dev> GPG: 1D60 735E 8AEF 3BE4 73B6 9D84 7336 78FD 8DFE EAD4

4 days, 14 hours

3
2
0 0

[PATCH] crypto: octeontx: Fix length check to avoid truncation in ucode_load_store

by Thorsten Blum

OTX_CPT_UCODE_NAME_LENGTH limits the microcode name to 64 bytes. If a user writes a string of exactly 64 characters, the original code used 'strlen(buf) > 64' to check the length, but then strscpy() copies only 63 characters before adding a NUL terminator, silently truncating the copied string. Fix this off-by-one error by using 'count' directly for the length check to ensure long names are rejected early and copied without truncation. Cc: stable(a)vger.kernel.org Fixes: d9110b0b01ff ("crypto: marvell - add support for OCTEON TX CPT engine") Signed-off-by: Thorsten Blum <thorsten.blum(a)linux.dev> --- drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c b/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c index 9f5601c0280b..417a48f41350 100644 --- a/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c +++ b/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c @@ -1326,7 +1326,7 @@ static ssize_t ucode_load_store(struct device *dev, int del_grp_idx = -1; int ucode_idx = 0; - if (strlen(buf) > OTX_CPT_UCODE_NAME_LENGTH) + if (count >= OTX_CPT_UCODE_NAME_LENGTH) return -EINVAL; eng_grps = container_of(attr, struct otx_cpt_eng_grps, ucode_load_attr); -- Thorsten Blum <thorsten.blum(a)linux.dev> GPG: 1D60 735E 8AEF 3BE4 73B6 9D84 7336 78FD 8DFE EAD4

4 days, 14 hours

2
1
0 0

[PATCH v3 1/2] drm/xe/uapi: disallow bind queue sharing

by Matthew Auld

Currently this is very broken if someone attempts to create a bind queue and share it across multiple VMs. For example currently we assume it is safe to acquire the user VM lock to protect some of the bind queue state, but if allow sharing the bind queue with multiple VMs then this quickly breaks down. To fix this reject using a bind queue with any VM that is not the same VM that was originally passed when creating the bind queue. This a uAPI change, however this was more of an oversight on kernel side that we didn't reject this, and expectation is that userspace shouldn't be using bind queues in this way, so in theory this change should go unnoticed. Based on a patch from Matt Brost. v2 (Matt B): - Hold the vm lock over queue create, to ensure it can't be closed as we attach the user_vm to the queue. - Make sure we actually check for NULL user_vm in destruction path. v3: - Fix error path handling. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Reported-by: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Signed-off-by: Matthew Auld <matthew.auld(a)intel.com> Cc: José Roberto de Souza <jose.souza(a)intel.com> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Michal Mrozek <michal.mrozek(a)intel.com> Cc: Carl Zhang <carl.zhang(a)intel.com> Cc: <stable(a)vger.kernel.org> # v6.8+ Acked-by: José Roberto de Souza <jose.souza(a)intel.com> --- drivers/gpu/drm/xe/xe_exec_queue.c | 32 +++++++++++++++++++++++- drivers/gpu/drm/xe/xe_exec_queue.h | 1 + drivers/gpu/drm/xe/xe_exec_queue_types.h | 6 +++++ drivers/gpu/drm/xe/xe_sriov_vf_ccs.c | 2 +- drivers/gpu/drm/xe/xe_vm.c | 7 +++++- 5 files changed, 45 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c index 8724f8de67e2..779d7e7e2d2e 100644 --- a/drivers/gpu/drm/xe/xe_exec_queue.c +++ b/drivers/gpu/drm/xe/xe_exec_queue.c @@ -328,6 +328,7 @@ struct xe_exec_queue *xe_exec_queue_create_class(struct xe_device *xe, struct xe * @xe: Xe device. * @tile: tile which bind exec queue belongs to. * @flags: exec queue creation flags + * @user_vm: The user VM which this exec queue belongs to * @extensions: exec queue creation extensions * * Normalize bind exec queue creation. Bind exec queue is tied to migration VM @@ -341,6 +342,7 @@ struct xe_exec_queue *xe_exec_queue_create_class(struct xe_device *xe, struct xe */ struct xe_exec_queue *xe_exec_queue_create_bind(struct xe_device *xe, struct xe_tile *tile, + struct xe_vm *user_vm, u32 flags, u64 extensions) { struct xe_gt *gt = tile->primary_gt; @@ -377,6 +379,9 @@ struct xe_exec_queue *xe_exec_queue_create_bind(struct xe_device *xe, xe_exec_queue_put(q); return ERR_PTR(err); } + + if (user_vm) + q->user_vm = xe_vm_get(user_vm); } return q; @@ -407,6 +412,11 @@ void xe_exec_queue_destroy(struct kref *ref) xe_exec_queue_put(eq); } + if (q->user_vm) { + xe_vm_put(q->user_vm); + q->user_vm = NULL; + } + q->ops->destroy(q); } @@ -742,6 +752,22 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data, XE_IOCTL_DBG(xe, eci[0].engine_instance != 0)) return -EINVAL; + vm = xe_vm_lookup(xef, args->vm_id); + if (XE_IOCTL_DBG(xe, !vm)) + return -ENOENT; + + err = down_read_interruptible(&vm->lock); + if (err) { + xe_vm_put(vm); + return err; + } + + if (XE_IOCTL_DBG(xe, xe_vm_is_closed_or_banned(vm))) { + up_read(&vm->lock); + xe_vm_put(vm); + return -ENOENT; + } + for_each_tile(tile, xe, id) { struct xe_exec_queue *new; @@ -749,9 +775,11 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data, if (id) flags |= EXEC_QUEUE_FLAG_BIND_ENGINE_CHILD; - new = xe_exec_queue_create_bind(xe, tile, flags, + new = xe_exec_queue_create_bind(xe, tile, vm, flags, args->extensions); if (IS_ERR(new)) { + up_read(&vm->lock); + xe_vm_put(vm); err = PTR_ERR(new); if (q) goto put_exec_queue; @@ -763,6 +791,8 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data, list_add_tail(&new->multi_gt_list, &q->multi_gt_link); } + up_read(&vm->lock); + xe_vm_put(vm); } else { logical_mask = calc_validate_logical_mask(xe, eci, args->width, diff --git a/drivers/gpu/drm/xe/xe_exec_queue.h b/drivers/gpu/drm/xe/xe_exec_queue.h index fda4d4f9bda8..37a9da22f420 100644 --- a/drivers/gpu/drm/xe/xe_exec_queue.h +++ b/drivers/gpu/drm/xe/xe_exec_queue.h @@ -28,6 +28,7 @@ struct xe_exec_queue *xe_exec_queue_create_class(struct xe_device *xe, struct xe u32 flags, u64 extensions); struct xe_exec_queue *xe_exec_queue_create_bind(struct xe_device *xe, struct xe_tile *tile, + struct xe_vm *user_vm, u32 flags, u64 extensions); void xe_exec_queue_fini(struct xe_exec_queue *q); diff --git a/drivers/gpu/drm/xe/xe_exec_queue_types.h b/drivers/gpu/drm/xe/xe_exec_queue_types.h index 771ffe35cd0c..3a4263c92b3d 100644 --- a/drivers/gpu/drm/xe/xe_exec_queue_types.h +++ b/drivers/gpu/drm/xe/xe_exec_queue_types.h @@ -54,6 +54,12 @@ struct xe_exec_queue { struct kref refcount; /** @vm: VM (address space) for this exec queue */ struct xe_vm *vm; + /** + * @user_vm: User VM (address space) for this exec queue (bind queues + * only) + */ + struct xe_vm *user_vm; + /** @class: class of this exec queue */ enum xe_engine_class class; /** diff --git a/drivers/gpu/drm/xe/xe_sriov_vf_ccs.c b/drivers/gpu/drm/xe/xe_sriov_vf_ccs.c index 052a5071e69f..db023fb66a27 100644 --- a/drivers/gpu/drm/xe/xe_sriov_vf_ccs.c +++ b/drivers/gpu/drm/xe/xe_sriov_vf_ccs.c @@ -350,7 +350,7 @@ int xe_sriov_vf_ccs_init(struct xe_device *xe) flags = EXEC_QUEUE_FLAG_KERNEL | EXEC_QUEUE_FLAG_PERMANENT | EXEC_QUEUE_FLAG_MIGRATE; - q = xe_exec_queue_create_bind(xe, tile, flags, 0); + q = xe_exec_queue_create_bind(xe, tile, NULL, flags, 0); if (IS_ERR(q)) { err = PTR_ERR(q); goto err_ret; diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c index f9989a7a710c..7973d654540a 100644 --- a/drivers/gpu/drm/xe/xe_vm.c +++ b/drivers/gpu/drm/xe/xe_vm.c @@ -1614,7 +1614,7 @@ struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags, struct xe_file *xef) if (!vm->pt_root[id]) continue; - q = xe_exec_queue_create_bind(xe, tile, create_flags, 0); + q = xe_exec_queue_create_bind(xe, tile, vm, create_flags, 0); if (IS_ERR(q)) { err = PTR_ERR(q); goto err_close; @@ -3571,6 +3571,11 @@ int xe_vm_bind_ioctl(struct drm_device *dev, void *data, struct drm_file *file) } } + if (XE_IOCTL_DBG(xe, q && vm != q->user_vm)) { + err = -EINVAL; + goto put_exec_queue; + } + /* Ensure all UNMAPs visible */ xe_svm_flush(vm); -- 2.51.1

4 days, 14 hours

4
5
0 0

[PATCH v2 2/5] usb: phy: isp1301: fix non-OF device reference imbalance

by Johan Hovold

A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301_get_client() helper only increases the reference count for the returned I2C device in the OF case. Increment the reference count also for non-OF so that the caller can decrement it unconditionally. Note that this is inherently racy just as using the returned I2C device is since nothing is preventing the PHY driver from being unbound while in use. Fixes: c84117912bdd ("USB: lpc32xx_udc: Fix error handling in probe") Cc: stable(a)vger.kernel.org Cc: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/phy/phy-isp1301.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c index f9b5c411aee4..2940f0c84e1b 100644 --- a/drivers/usb/phy/phy-isp1301.c +++ b/drivers/usb/phy/phy-isp1301.c @@ -149,7 +149,12 @@ struct i2c_client *isp1301_get_client(struct device_node *node) return client; /* non-DT: only one ISP1301 chip supported */ - return isp1301_i2c_client; + if (isp1301_i2c_client) { + get_device(&isp1301_i2c_client->dev); + return isp1301_i2c_client; + } + + return NULL; } EXPORT_SYMBOL_GPL(isp1301_get_client); -- 2.51.2

4 days, 14 hours

2
2
0 0

[PATCH] ocfs2: handle OCFS2_SUPER_BLOCK_FL flag in system dinode

by Prithvi Tambewagh

When ocfs2_populate_inode() is called during mount process, if the flag OCFS2_SUPER_BLOCK_FL is set in on-disk system dinode, then BUG() is triggered, causing kernel to panic. This is indicative of metadata corruption. This is fixed by calling ocfs2_error() to print the error log and the corresponding inode is marked as 'bad', so that it is not used further during the mount process. It is ensured that the fact of that inode being bad is propagated to caller ocfs2_populate_inode() i.e. ocfs2_read_locked_inode() using is_bad_inode() and further behind along the call trace as well. Reported-by: syzbot+779d072a1067a8b1a917(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=779d072a1067a8b1a917 Tested-by: syzbot+779d072a1067a8b1a917(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Signed-off-by: Prithvi Tambewagh <activprithvi(a)gmail.com> --- fs/ocfs2/inode.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c index 12e5d1f73325..f439dc801845 100644 --- a/fs/ocfs2/inode.c +++ b/fs/ocfs2/inode.c @@ -347,7 +347,12 @@ void ocfs2_populate_inode(struct inode *inode, struct ocfs2_dinode *fe, } else if (fe->i_flags & cpu_to_le32(OCFS2_SUPER_BLOCK_FL)) { /* we can't actually hit this as read_inode can't * handle superblocks today ;-) */ - BUG(); + ocfs2_error(sb, + "System Inode %llu has " + "OCFS2_SUPER_BLOCK_FL set", + (unsigned long long)le64_to_cpu(fe->i_blkno)); + make_bad_inode(inode); + return; } switch (inode->i_mode & S_IFMT) { @@ -555,6 +560,11 @@ static int ocfs2_read_locked_inode(struct inode *inode, ocfs2_populate_inode(inode, fe, 0); + if (is_bad_inode(inode)) { + status = -EIO; + goto bail; + } + BUG_ON(args->fi_blkno != le64_to_cpu(fe->i_blkno)); if (buffer_dirty(bh) && !buffer_jbd(bh)) { @@ -576,7 +586,7 @@ static int ocfs2_read_locked_inode(struct inode *inode, if (can_lock) ocfs2_inode_unlock(inode, lock_level); - if (status < 0) + if (status < 0 && !is_bad_inode(inode)) make_bad_inode(inode); brelse(bh); base-commit: d76bb1ebb5587f66b0f8b8099bfbb44722bc08b3 -- 2.43.0

4 days, 14 hours

3
2
0 0

FAILED: patch "[PATCH] hsr: hold rcu and dev lock for hsr_get_port_ndev" failed to apply to 6.12-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.12-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y git checkout FETCH_HEAD git cherry-pick -x 847748fc66d08a89135a74e29362a66ba4e3ab15 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2025121829-aloof-cresting-f057@gregkh' --subject-prefix 'PATCH 6.12.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 847748fc66d08a89135a74e29362a66ba4e3ab15 Mon Sep 17 00:00:00 2001 From: Hangbin Liu <liuhangbin(a)gmail.com> Date: Fri, 5 Sep 2025 09:15:33 +0000 Subject: [PATCH] hsr: hold rcu and dev lock for hsr_get_port_ndev hsr_get_port_ndev calls hsr_for_each_port, which need to hold rcu lock. On the other hand, before return the port device, we need to hold the device reference to avoid UaF in the caller function. Suggested-by: Paolo Abeni <pabeni(a)redhat.com> Fixes: 9c10dd8eed74 ("net: hsr: Create and export hsr_get_port_ndev()") Signed-off-by: Hangbin Liu <liuhangbin(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20250905091533.377443-4-liuhangbin@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> diff --git a/drivers/net/ethernet/ti/icssg/icssg_prueth.c b/drivers/net/ethernet/ti/icssg/icssg_prueth.c index dadce6009791..e42d0fdefee1 100644 --- a/drivers/net/ethernet/ti/icssg/icssg_prueth.c +++ b/drivers/net/ethernet/ti/icssg/icssg_prueth.c @@ -654,7 +654,7 @@ static void icssg_prueth_hsr_fdb_add_del(struct prueth_emac *emac, static int icssg_prueth_hsr_add_mcast(struct net_device *ndev, const u8 *addr) { - struct net_device *real_dev; + struct net_device *real_dev, *port_dev; struct prueth_emac *emac; u8 vlan_id, i; @@ -663,11 +663,15 @@ static int icssg_prueth_hsr_add_mcast(struct net_device *ndev, const u8 *addr) if (is_hsr_master(real_dev)) { for (i = HSR_PT_SLAVE_A; i < HSR_PT_INTERLINK; i++) { - emac = netdev_priv(hsr_get_port_ndev(real_dev, i)); - if (!emac) + port_dev = hsr_get_port_ndev(real_dev, i); + emac = netdev_priv(port_dev); + if (!emac) { + dev_put(port_dev); return -EINVAL; + } icssg_prueth_hsr_fdb_add_del(emac, addr, vlan_id, true); + dev_put(port_dev); } } else { emac = netdev_priv(real_dev); @@ -679,7 +683,7 @@ static int icssg_prueth_hsr_add_mcast(struct net_device *ndev, const u8 *addr) static int icssg_prueth_hsr_del_mcast(struct net_device *ndev, const u8 *addr) { - struct net_device *real_dev; + struct net_device *real_dev, *port_dev; struct prueth_emac *emac; u8 vlan_id, i; @@ -688,11 +692,15 @@ static int icssg_prueth_hsr_del_mcast(struct net_device *ndev, const u8 *addr) if (is_hsr_master(real_dev)) { for (i = HSR_PT_SLAVE_A; i < HSR_PT_INTERLINK; i++) { - emac = netdev_priv(hsr_get_port_ndev(real_dev, i)); - if (!emac) + port_dev = hsr_get_port_ndev(real_dev, i); + emac = netdev_priv(port_dev); + if (!emac) { + dev_put(port_dev); return -EINVAL; + } icssg_prueth_hsr_fdb_add_del(emac, addr, vlan_id, false); + dev_put(port_dev); } } else { emac = netdev_priv(real_dev); diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c index 702da1f9aaa9..fbbc3ccf9df6 100644 --- a/net/hsr/hsr_device.c +++ b/net/hsr/hsr_device.c @@ -675,9 +675,14 @@ struct net_device *hsr_get_port_ndev(struct net_device *ndev, struct hsr_priv *hsr = netdev_priv(ndev); struct hsr_port *port; + rcu_read_lock(); hsr_for_each_port(hsr, port) - if (port->type == pt) + if (port->type == pt) { + dev_hold(port->dev); + rcu_read_unlock(); return port->dev; + } + rcu_read_unlock(); return NULL; } EXPORT_SYMBOL(hsr_get_port_ndev);

4 days, 16 hours

3
2
0 0

[PATCH v2 3/5] usb: ohci-nxp: fix device leak on probe failure

by Johan Hovold

Make sure to drop the reference taken when looking up the PHY I2C device during probe on probe failure (e.g. probe deferral) and on driver unbind. Fixes: 73108aa90cbf ("USB: ohci-nxp: Use isp1301 driver") Cc: stable(a)vger.kernel.org # 3.5 Reported-by: Ma Ke <make24(a)iscas.ac.cn> Link: https://lore.kernel.org/lkml/20251117013428.21840-1-make24@iscas.ac.cn/ Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/host/ohci-nxp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/host/ohci-nxp.c b/drivers/usb/host/ohci-nxp.c index 24d5a1dc5056..509ca7d8d513 100644 --- a/drivers/usb/host/ohci-nxp.c +++ b/drivers/usb/host/ohci-nxp.c @@ -223,6 +223,7 @@ static int ohci_hcd_nxp_probe(struct platform_device *pdev) fail_resource: usb_put_hcd(hcd); fail_disable: + put_device(&isp1301_i2c_client->dev); isp1301_i2c_client = NULL; return ret; } @@ -234,6 +235,7 @@ static void ohci_hcd_nxp_remove(struct platform_device *pdev) usb_remove_hcd(hcd); ohci_nxp_stop_hc(); usb_put_hcd(hcd); + put_device(&isp1301_i2c_client->dev); isp1301_i2c_client = NULL; } -- 2.51.2

4 days, 20 hours

3
2
0 0

[PATCH v2 1/5] usb: gadget: lpc32xx_udc: fix clock imbalance in error path

by Johan Hovold

A recent change fixing a device reference leak introduced a clock imbalance by reusing an error path so that the clock may be disabled before having been enabled. Note that the clock framework allows for passing in NULL clocks so there is no risk for a NULL pointer dereference. Also drop the bogus I2C client NULL check added by the offending commit as the pointer has already been verified to be non-NULL. Fixes: c84117912bdd ("USB: lpc32xx_udc: Fix error handling in probe") Cc: stable(a)vger.kernel.org Cc: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/gadget/udc/lpc32xx_udc.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c index 73c0f28a8585..a962d4294fbe 100644 --- a/drivers/usb/gadget/udc/lpc32xx_udc.c +++ b/drivers/usb/gadget/udc/lpc32xx_udc.c @@ -3020,7 +3020,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev) pdev->dev.dma_mask = &lpc32xx_usbd_dmamask; retval = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); if (retval) - goto i2c_fail; + goto err_put_client; udc->board = &lpc32xx_usbddata; @@ -3040,7 +3040,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev) udc->udp_irq[i] = platform_get_irq(pdev, i); if (udc->udp_irq[i] < 0) { retval = udc->udp_irq[i]; - goto i2c_fail; + goto err_put_client; } } @@ -3048,7 +3048,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev) if (IS_ERR(udc->udp_baseaddr)) { dev_err(udc->dev, "IO map failure\n"); retval = PTR_ERR(udc->udp_baseaddr); - goto i2c_fail; + goto err_put_client; } /* Get USB device clock */ @@ -3056,14 +3056,14 @@ static int lpc32xx_udc_probe(struct platform_device *pdev) if (IS_ERR(udc->usb_slv_clk)) { dev_err(udc->dev, "failed to acquire USB device clock\n"); retval = PTR_ERR(udc->usb_slv_clk); - goto i2c_fail; + goto err_put_client; } /* Enable USB device clock */ retval = clk_prepare_enable(udc->usb_slv_clk); if (retval < 0) { dev_err(udc->dev, "failed to start USB device clock\n"); - goto i2c_fail; + goto err_put_client; } /* Setup deferred workqueue data */ @@ -3165,9 +3165,10 @@ static int lpc32xx_udc_probe(struct platform_device *pdev) dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE, udc->udca_v_base, udc->udca_p_base); i2c_fail: - if (udc->isp1301_i2c_client) - put_device(&udc->isp1301_i2c_client->dev); clk_disable_unprepare(udc->usb_slv_clk); +err_put_client: + put_device(&udc->isp1301_i2c_client->dev); + dev_err(udc->dev, "%s probe failed, %d\n", driver_name, retval); return retval; @@ -3195,10 +3196,9 @@ static void lpc32xx_udc_remove(struct platform_device *pdev) dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE, udc->udca_v_base, udc->udca_p_base); - if (udc->isp1301_i2c_client) - put_device(&udc->isp1301_i2c_client->dev); - clk_disable_unprepare(udc->usb_slv_clk); + + put_device(&udc->isp1301_i2c_client->dev); } #ifdef CONFIG_PM -- 2.51.2

4 days, 20 hours

2
1
0 0

[PATCH v6] drm/pagemap, drm/xe: Ensure that the devmem allocation is idle before use

by Thomas Hellström

In situations where no system memory is migrated to devmem, and in upcoming patches where another GPU is performing the migration to the newly allocated devmem buffer, there is nothing to ensure any ongoing clear to the devmem allocation or async eviction from the devmem allocation is complete. Address that by passing a struct dma_fence down to the copy functions, and ensure it is waited for before migration is marked complete. v3: - New patch. v4: - Update the logic used for determining when to wait for the pre_migrate_fence. - Update the logic used for determining when to warn for the pre_migrate_fence since the scheduler fences apparently can signal out-of-order. v5: - Fix a UAF (CI) - Remove references to source P2P migration (Himal) - Put the pre_migrate_fence after migration. v6: - Pipeline the pre_migrate_fence dependency (Matt Brost) Fixes: c5b3eb5a906c ("drm/xe: Add GPUSVM device memory copy vfunc functions") Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: <stable(a)vger.kernel.org> # v6.15+ Signed-off-by: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> --- drivers/gpu/drm/drm_pagemap.c | 17 +++++++++--- drivers/gpu/drm/xe/xe_migrate.c | 25 +++++++++++++---- drivers/gpu/drm/xe/xe_migrate.h | 6 ++-- drivers/gpu/drm/xe/xe_svm.c | 49 +++++++++++++++++++++++++-------- include/drm/drm_pagemap.h | 17 ++++++++++-- 5 files changed, 88 insertions(+), 26 deletions(-) diff --git a/drivers/gpu/drm/drm_pagemap.c b/drivers/gpu/drm/drm_pagemap.c index 37d7cfbbb3e8..06c1bd8fc4d1 100644 --- a/drivers/gpu/drm/drm_pagemap.c +++ b/drivers/gpu/drm/drm_pagemap.c @@ -3,6 +3,7 @@ * Copyright © 2024-2025 Intel Corporation */ +#include <linux/dma-fence.h> #include <linux/dma-mapping.h> #include <linux/migrate.h> #include <linux/pagemap.h> @@ -408,10 +409,14 @@ int drm_pagemap_migrate_to_devmem(struct drm_pagemap_devmem *devmem_allocation, drm_pagemap_get_devmem_page(page, zdd); } - err = ops->copy_to_devmem(pages, pagemap_addr, npages); + err = ops->copy_to_devmem(pages, pagemap_addr, npages, + devmem_allocation->pre_migrate_fence); if (err) goto err_finalize; + dma_fence_put(devmem_allocation->pre_migrate_fence); + devmem_allocation->pre_migrate_fence = NULL; + /* Upon success bind devmem allocation to range and zdd */ devmem_allocation->timeslice_expiration = get_jiffies_64() + msecs_to_jiffies(timeslice_ms); @@ -596,7 +601,7 @@ int drm_pagemap_evict_to_ram(struct drm_pagemap_devmem *devmem_allocation) for (i = 0; i < npages; ++i) pages[i] = migrate_pfn_to_page(src[i]); - err = ops->copy_to_ram(pages, pagemap_addr, npages); + err = ops->copy_to_ram(pages, pagemap_addr, npages, NULL); if (err) goto err_finalize; @@ -732,7 +737,7 @@ static int __drm_pagemap_migrate_to_ram(struct vm_area_struct *vas, for (i = 0; i < npages; ++i) pages[i] = migrate_pfn_to_page(migrate.src[i]); - err = ops->copy_to_ram(pages, pagemap_addr, npages); + err = ops->copy_to_ram(pages, pagemap_addr, npages, NULL); if (err) goto err_finalize; @@ -813,11 +818,14 @@ EXPORT_SYMBOL_GPL(drm_pagemap_pagemap_ops_get); * @ops: Pointer to the operations structure for GPU SVM device memory * @dpagemap: The struct drm_pagemap we're allocating from. * @size: Size of device memory allocation + * @pre_migrate_fence: Fence to wait for or pipeline behind before migration starts. + * (May be NULL). */ void drm_pagemap_devmem_init(struct drm_pagemap_devmem *devmem_allocation, struct device *dev, struct mm_struct *mm, const struct drm_pagemap_devmem_ops *ops, - struct drm_pagemap *dpagemap, size_t size) + struct drm_pagemap *dpagemap, size_t size, + struct dma_fence *pre_migrate_fence) { init_completion(&devmem_allocation->detached); devmem_allocation->dev = dev; @@ -825,6 +833,7 @@ void drm_pagemap_devmem_init(struct drm_pagemap_devmem *devmem_allocation, devmem_allocation->ops = ops; devmem_allocation->dpagemap = dpagemap; devmem_allocation->size = size; + devmem_allocation->pre_migrate_fence = pre_migrate_fence; } EXPORT_SYMBOL_GPL(drm_pagemap_devmem_init); diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c index f3b66b55acfb..284b575346ee 100644 --- a/drivers/gpu/drm/xe/xe_migrate.c +++ b/drivers/gpu/drm/xe/xe_migrate.c @@ -2113,6 +2113,7 @@ static struct dma_fence *xe_migrate_vram(struct xe_migrate *m, unsigned long sram_offset, struct drm_pagemap_addr *sram_addr, u64 vram_addr, + struct dma_fence *deps, const enum xe_migrate_copy_dir dir) { struct xe_gt *gt = m->tile->primary_gt; @@ -2201,6 +2202,14 @@ static struct dma_fence *xe_migrate_vram(struct xe_migrate *m, xe_sched_job_add_migrate_flush(job, MI_INVALIDATE_TLB); + if (deps && !dma_fence_is_signaled(deps)) { + dma_fence_get(deps); + err = drm_sched_job_add_dependency(&job->drm, deps); + if (err) + dma_fence_wait(deps, false); + err = 0; + } + mutex_lock(&m->job_mutex); xe_sched_job_arm(job); fence = dma_fence_get(&job->drm.s_fence->finished); @@ -2226,6 +2235,8 @@ static struct dma_fence *xe_migrate_vram(struct xe_migrate *m, * @npages: Number of pages to migrate. * @src_addr: Array of DMA information (source of migrate) * @dst_addr: Device physical address of VRAM (destination of migrate) + * @deps: struct dma_fence representing the dependencies that need + * to be signaled before migration. * * Copy from an array dma addresses to a VRAM device physical address * @@ -2235,10 +2246,11 @@ static struct dma_fence *xe_migrate_vram(struct xe_migrate *m, struct dma_fence *xe_migrate_to_vram(struct xe_migrate *m, unsigned long npages, struct drm_pagemap_addr *src_addr, - u64 dst_addr) + u64 dst_addr, + struct dma_fence *deps) { return xe_migrate_vram(m, npages * PAGE_SIZE, 0, src_addr, dst_addr, - XE_MIGRATE_COPY_TO_VRAM); + deps, XE_MIGRATE_COPY_TO_VRAM); } /** @@ -2247,6 +2259,8 @@ struct dma_fence *xe_migrate_to_vram(struct xe_migrate *m, * @npages: Number of pages to migrate. * @src_addr: Device physical address of VRAM (source of migrate) * @dst_addr: Array of DMA information (destination of migrate) + * @deps: struct dma_fence representing the dependencies that need + * to be signaled before migration. * * Copy from a VRAM device physical address to an array dma addresses * @@ -2256,10 +2270,11 @@ struct dma_fence *xe_migrate_to_vram(struct xe_migrate *m, struct dma_fence *xe_migrate_from_vram(struct xe_migrate *m, unsigned long npages, u64 src_addr, - struct drm_pagemap_addr *dst_addr) + struct drm_pagemap_addr *dst_addr, + struct dma_fence *deps) { return xe_migrate_vram(m, npages * PAGE_SIZE, 0, dst_addr, src_addr, - XE_MIGRATE_COPY_TO_SRAM); + deps, XE_MIGRATE_COPY_TO_SRAM); } static void xe_migrate_dma_unmap(struct xe_device *xe, @@ -2435,7 +2450,7 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo, __fence = xe_migrate_vram(m, current_bytes, (unsigned long)buf & ~PAGE_MASK, &pagemap_addr[current_page], - vram_addr, write ? + vram_addr, NULL, write ? XE_MIGRATE_COPY_TO_VRAM : XE_MIGRATE_COPY_TO_SRAM); if (IS_ERR(__fence)) { diff --git a/drivers/gpu/drm/xe/xe_migrate.h b/drivers/gpu/drm/xe/xe_migrate.h index 464c05dde1ba..1522afb37dcf 100644 --- a/drivers/gpu/drm/xe/xe_migrate.h +++ b/drivers/gpu/drm/xe/xe_migrate.h @@ -116,12 +116,14 @@ int xe_migrate_init(struct xe_migrate *m); struct dma_fence *xe_migrate_to_vram(struct xe_migrate *m, unsigned long npages, struct drm_pagemap_addr *src_addr, - u64 dst_addr); + u64 dst_addr, + struct dma_fence *deps); struct dma_fence *xe_migrate_from_vram(struct xe_migrate *m, unsigned long npages, u64 src_addr, - struct drm_pagemap_addr *dst_addr); + struct drm_pagemap_addr *dst_addr, + struct dma_fence *deps); struct dma_fence *xe_migrate_copy(struct xe_migrate *m, struct xe_bo *src_bo, diff --git a/drivers/gpu/drm/xe/xe_svm.c b/drivers/gpu/drm/xe/xe_svm.c index 93550c7c84ac..a985148b6820 100644 --- a/drivers/gpu/drm/xe/xe_svm.c +++ b/drivers/gpu/drm/xe/xe_svm.c @@ -472,7 +472,8 @@ static void xe_svm_copy_us_stats_incr(struct xe_gt *gt, static int xe_svm_copy(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages, const enum xe_svm_copy_dir dir) + unsigned long npages, const enum xe_svm_copy_dir dir, + struct dma_fence *pre_migrate_fence) { struct xe_vram_region *vr = NULL; struct xe_gt *gt = NULL; @@ -561,7 +562,8 @@ static int xe_svm_copy(struct page **pages, __fence = xe_migrate_from_vram(vr->migrate, i - pos + incr, vram_addr, - &pagemap_addr[pos]); + &pagemap_addr[pos], + pre_migrate_fence); } else { vm_dbg(&xe->drm, "COPY TO VRAM - 0x%016llx -> 0x%016llx, NPAGES=%ld", @@ -570,13 +572,14 @@ static int xe_svm_copy(struct page **pages, __fence = xe_migrate_to_vram(vr->migrate, i - pos + incr, &pagemap_addr[pos], - vram_addr); + vram_addr, + pre_migrate_fence); } if (IS_ERR(__fence)) { err = PTR_ERR(__fence); goto err_out; } - + pre_migrate_fence = NULL; dma_fence_put(fence); fence = __fence; } @@ -599,20 +602,22 @@ static int xe_svm_copy(struct page **pages, vram_addr, (u64)pagemap_addr[pos].addr, 1); __fence = xe_migrate_from_vram(vr->migrate, 1, vram_addr, - &pagemap_addr[pos]); + &pagemap_addr[pos], + pre_migrate_fence); } else { vm_dbg(&xe->drm, "COPY TO VRAM - 0x%016llx -> 0x%016llx, NPAGES=%d", (u64)pagemap_addr[pos].addr, vram_addr, 1); __fence = xe_migrate_to_vram(vr->migrate, 1, &pagemap_addr[pos], - vram_addr); + vram_addr, + pre_migrate_fence); } if (IS_ERR(__fence)) { err = PTR_ERR(__fence); goto err_out; } - + pre_migrate_fence = NULL; dma_fence_put(fence); fence = __fence; } @@ -625,6 +630,8 @@ static int xe_svm_copy(struct page **pages, dma_fence_wait(fence, false); dma_fence_put(fence); } + if (pre_migrate_fence) + dma_fence_wait(pre_migrate_fence, false); /* * XXX: We can't derive the GT here (or anywhere in this functions, but @@ -641,16 +648,20 @@ static int xe_svm_copy(struct page **pages, static int xe_svm_copy_to_devmem(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages) + unsigned long npages, + struct dma_fence *pre_migrate_fence) { - return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_VRAM); + return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_VRAM, + pre_migrate_fence); } static int xe_svm_copy_to_ram(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages) + unsigned long npages, + struct dma_fence *pre_migrate_fence) { - return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_SRAM); + return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_SRAM, + pre_migrate_fence); } static struct xe_bo *to_xe_bo(struct drm_pagemap_devmem *devmem_allocation) @@ -663,6 +674,7 @@ static void xe_svm_devmem_release(struct drm_pagemap_devmem *devmem_allocation) struct xe_bo *bo = to_xe_bo(devmem_allocation); struct xe_device *xe = xe_bo_device(bo); + dma_fence_put(devmem_allocation->pre_migrate_fence); xe_bo_put_async(bo); xe_pm_runtime_put(xe); } @@ -857,6 +869,7 @@ static int xe_drm_pagemap_populate_mm(struct drm_pagemap *dpagemap, unsigned long timeslice_ms) { struct xe_vram_region *vr = container_of(dpagemap, typeof(*vr), dpagemap); + struct dma_fence *pre_migrate_fence = NULL; struct xe_device *xe = vr->xe; struct device *dev = xe->drm.dev; struct drm_buddy_block *block; @@ -883,8 +896,20 @@ static int xe_drm_pagemap_populate_mm(struct drm_pagemap *dpagemap, break; } + /* Ensure that any clearing or async eviction will complete before migration. */ + if (!dma_resv_test_signaled(bo->ttm.base.resv, DMA_RESV_USAGE_KERNEL)) { + err = dma_resv_get_singleton(bo->ttm.base.resv, DMA_RESV_USAGE_KERNEL, + &pre_migrate_fence); + if (err) + dma_resv_wait_timeout(bo->ttm.base.resv, DMA_RESV_USAGE_KERNEL, + false, MAX_SCHEDULE_TIMEOUT); + else if (pre_migrate_fence) + dma_fence_enable_sw_signaling(pre_migrate_fence); + } + drm_pagemap_devmem_init(&bo->devmem_allocation, dev, mm, - &dpagemap_devmem_ops, dpagemap, end - start); + &dpagemap_devmem_ops, dpagemap, end - start, + pre_migrate_fence); blocks = &to_xe_ttm_vram_mgr_resource(bo->ttm.resource)->blocks; list_for_each_entry(block, blocks, link) diff --git a/include/drm/drm_pagemap.h b/include/drm/drm_pagemap.h index f6e7e234c089..70a7991f784f 100644 --- a/include/drm/drm_pagemap.h +++ b/include/drm/drm_pagemap.h @@ -8,6 +8,7 @@ #define NR_PAGES(order) (1U << (order)) +struct dma_fence; struct drm_pagemap; struct drm_pagemap_zdd; struct device; @@ -174,6 +175,8 @@ struct drm_pagemap_devmem_ops { * @pages: Pointer to array of device memory pages (destination) * @pagemap_addr: Pointer to array of DMA information (source) * @npages: Number of pages to copy + * @pre_migrate_fence: dma-fence to wait for before migration start. + * May be NULL. * * Copy pages to device memory. If the order of a @pagemap_addr entry * is greater than 0, the entry is populated but subsequent entries @@ -183,13 +186,16 @@ struct drm_pagemap_devmem_ops { */ int (*copy_to_devmem)(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages); + unsigned long npages, + struct dma_fence *pre_migrate_fence); /** * @copy_to_ram: Copy to system RAM (required for migration) * @pages: Pointer to array of device memory pages (source) * @pagemap_addr: Pointer to array of DMA information (destination) * @npages: Number of pages to copy + * @pre_migrate_fence: dma-fence to wait for before migration start. + * May be NULL. * * Copy pages to system RAM. If the order of a @pagemap_addr entry * is greater than 0, the entry is populated but subsequent entries @@ -199,7 +205,8 @@ struct drm_pagemap_devmem_ops { */ int (*copy_to_ram)(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages); + unsigned long npages, + struct dma_fence *pre_migrate_fence); }; /** @@ -212,6 +219,8 @@ struct drm_pagemap_devmem_ops { * @dpagemap: The struct drm_pagemap of the pages this allocation belongs to. * @size: Size of device memory allocation * @timeslice_expiration: Timeslice expiration in jiffies + * @pre_migrate_fence: Fence to wait for or pipeline behind before migration starts. + * (May be NULL). */ struct drm_pagemap_devmem { struct device *dev; @@ -221,6 +230,7 @@ struct drm_pagemap_devmem { struct drm_pagemap *dpagemap; size_t size; u64 timeslice_expiration; + struct dma_fence *pre_migrate_fence; }; int drm_pagemap_migrate_to_devmem(struct drm_pagemap_devmem *devmem_allocation, @@ -238,7 +248,8 @@ struct drm_pagemap *drm_pagemap_page_to_dpagemap(struct page *page); void drm_pagemap_devmem_init(struct drm_pagemap_devmem *devmem_allocation, struct device *dev, struct mm_struct *mm, const struct drm_pagemap_devmem_ops *ops, - struct drm_pagemap *dpagemap, size_t size); + struct drm_pagemap *dpagemap, size_t size, + struct dma_fence *pre_migrate_fence); int drm_pagemap_populate_mm(struct drm_pagemap *dpagemap, unsigned long start, unsigned long end, -- 2.51.1

4 days, 22 hours

2
1
0 0

[to-be-updated] mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/memory-failure: fix missing ->mf_stats count in hugetlb poison has been removed from the -mm tree. Its filename was mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison.patch This patch was dropped because an updated version will be issued ------------------------------------------------------ From: Jane Chu <jane.chu(a)oracle.com> Subject: mm/memory-failure: fix missing ->mf_stats count in hugetlb poison Date: Tue, 16 Dec 2025 14:56:21 -0700 When a newly poisoned subpage ends up in an already poisoned hugetlb folio, 'num_poisoned_pages' is incremented, but the per node ->mf_stats is not. Fix the inconsistency by designating action_result() to update them both. Link: https://lkml.kernel.org/r/20251216215621.920093-1-jane.chu@oracle.com Fixes: 18f41fa616ee ("mm: memory-failure: bump memory failure stats to pglist_data") Signed-off-by: Jane Chu <jane.chu(a)oracle.com> Cc: David Rientjes <rientjes(a)google.com> Cc: Jiaqi Yan <jiaqiyan(a)google.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Miaohe Lin <linmiaohe(a)huawei.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: William Roche <william.roche(a)oracle.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: "David Hildenbrand (Red Hat)" <david(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/hugetlb.h | 4 ++-- include/linux/mm.h | 4 ++-- mm/hugetlb.c | 4 ++-- mm/memory-failure.c | 22 +++++++++++++--------- 4 files changed, 19 insertions(+), 15 deletions(-) --- a/include/linux/hugetlb.h~mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison +++ a/include/linux/hugetlb.h @@ -156,7 +156,7 @@ long hugetlb_unreserve_pages(struct inod bool folio_isolate_hugetlb(struct folio *folio, struct list_head *list); int get_hwpoison_hugetlb_folio(struct folio *folio, bool *hugetlb, bool unpoison); int get_huge_page_for_hwpoison(unsigned long pfn, int flags, - bool *migratable_cleared); + bool *migratable_cleared, bool *samepg); void folio_putback_hugetlb(struct folio *folio); void move_hugetlb_state(struct folio *old_folio, struct folio *new_folio, int reason); void hugetlb_fix_reserve_counts(struct inode *inode); @@ -418,7 +418,7 @@ static inline int get_hwpoison_hugetlb_f } static inline int get_huge_page_for_hwpoison(unsigned long pfn, int flags, - bool *migratable_cleared) + bool *migratable_cleared, bool *samepg) { return 0; } --- a/include/linux/mm.h~mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison +++ a/include/linux/mm.h @@ -4351,7 +4351,7 @@ extern int soft_offline_page(unsigned lo extern const struct attribute_group memory_failure_attr_group; extern void memory_failure_queue(unsigned long pfn, int flags); extern int __get_huge_page_for_hwpoison(unsigned long pfn, int flags, - bool *migratable_cleared); + bool *migratable_cleared, bool *samepg); void num_poisoned_pages_inc(unsigned long pfn); void num_poisoned_pages_sub(unsigned long pfn, long i); #else @@ -4360,7 +4360,7 @@ static inline void memory_failure_queue( } static inline int __get_huge_page_for_hwpoison(unsigned long pfn, int flags, - bool *migratable_cleared) + bool *migratable_cleared, bool *samepg) { return 0; } --- a/mm/hugetlb.c~mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison +++ a/mm/hugetlb.c @@ -7132,12 +7132,12 @@ int get_hwpoison_hugetlb_folio(struct fo } int get_huge_page_for_hwpoison(unsigned long pfn, int flags, - bool *migratable_cleared) + bool *migratable_cleared, bool *samepg) { int ret; spin_lock_irq(&hugetlb_lock); - ret = __get_huge_page_for_hwpoison(pfn, flags, migratable_cleared); + ret = __get_huge_page_for_hwpoison(pfn, flags, migratable_cleared, samepg); spin_unlock_irq(&hugetlb_lock); return ret; } --- a/mm/memory-failure.c~mm-memory-failure-fix-missing-mf_stats-count-in-hugetlb-poison +++ a/mm/memory-failure.c @@ -1883,7 +1883,8 @@ static unsigned long __folio_free_raw_hw return count; } -static int folio_set_hugetlb_hwpoison(struct folio *folio, struct page *page) +static int folio_set_hugetlb_hwpoison(struct folio *folio, struct page *page, + bool *samepg) { struct llist_head *head; struct raw_hwp_page *raw_hwp; @@ -1899,17 +1900,16 @@ static int folio_set_hugetlb_hwpoison(st return -EHWPOISON; head = raw_hwp_list_head(folio); llist_for_each_entry(p, head->first, node) { - if (p->page == page) + if (p->page == page) { + *samepg = true; return -EHWPOISON; + } } raw_hwp = kmalloc(sizeof(struct raw_hwp_page), GFP_ATOMIC); if (raw_hwp) { raw_hwp->page = page; llist_add(&raw_hwp->node, head); - /* the first error event will be counted in action_result(). */ - if (ret) - num_poisoned_pages_inc(page_to_pfn(page)); } else { /* * Failed to save raw error info. We no longer trace all @@ -1966,7 +1966,7 @@ void folio_clear_hugetlb_hwpoison(struct * -EHWPOISON - the hugepage is already hwpoisoned */ int __get_huge_page_for_hwpoison(unsigned long pfn, int flags, - bool *migratable_cleared) + bool *migratable_cleared, bool *samepg) { struct page *page = pfn_to_page(pfn); struct folio *folio = page_folio(page); @@ -1991,7 +1991,7 @@ int __get_huge_page_for_hwpoison(unsigne goto out; } - if (folio_set_hugetlb_hwpoison(folio, page)) { + if (folio_set_hugetlb_hwpoison(folio, page, samepg)) { ret = -EHWPOISON; goto out; } @@ -2024,11 +2024,12 @@ static int try_memory_failure_hugetlb(un struct page *p = pfn_to_page(pfn); struct folio *folio; unsigned long page_flags; + bool samepg = false; bool migratable_cleared = false; *hugetlb = 1; retry: - res = get_huge_page_for_hwpoison(pfn, flags, &migratable_cleared); + res = get_huge_page_for_hwpoison(pfn, flags, &migratable_cleared, &samepg); if (res == 2) { /* fallback to normal page handling */ *hugetlb = 0; return 0; @@ -2037,7 +2038,10 @@ retry: folio = page_folio(p); res = kill_accessing_process(current, folio_pfn(folio), flags); } - action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); + if (samepg) + action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED); + else + action_result(pfn, MF_MSG_HUGE, MF_FAILED); return res; } else if (res == -EBUSY) { if (!(flags & MF_NO_RETRY)) { _ Patches currently in -mm which might be from jane.chu(a)oracle.com are

4 days, 22 hours

1
0
0 0

+ lib-buildid-use-__kernel_read-for-sleepable-context.patch added to mm-nonmm-unstable branch

by Andrew Morton

The patch titled Subject: lib/buildid: use __kernel_read() for sleepable context has been added to the -mm mm-nonmm-unstable branch. Its filename is lib-buildid-use-__kernel_read-for-sleepable-context.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-nonmm-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Shakeel Butt <shakeel.butt(a)linux.dev> Subject: lib/buildid: use __kernel_read() for sleepable context Date: Thu, 18 Dec 2025 12:55:05 -0800 For the sleepable context, convert freader to use __kernel_read() instead of direct page cache access via read_cache_folio(). This simplifies the faultable code path by using the standard kernel file reading interface which handles all the complexity of reading file data. At the moment we are not changing the code for non-sleepable context which uses filemap_get_folio() and only succeeds if the target folios are already in memory and up-to-date. The reason is to keep the patch simple and easier to backport to stable kernels. Syzbot repro does not crash the kernel anymore and the selftests run successfully. In the follow up we will make __kernel_read() with IOCB_NOWAIT work for non-sleepable contexts. In addition, I would like to replace the secretmem check with a more generic approach and will add fstest for the buildid code. Link: https://lkml.kernel.org/r/20251218205505.2415840-1-shakeel.butt@linux.dev Fixes: ad41251c290d ("lib/buildid: implement sleepable build_id_parse() API") Signed-off-by: Shakeel Butt <shakeel.butt(a)linux.dev>Reported-by: syzbot+09b7d050e4806540153d(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=09b7d050e4806540153d Reviewed-by: Christoph Hellwig <hch(a)lst.de> Cc: Alexei Starovoitov <ast(a)kernel.org> Cc: Andrii Nakryiko <andrii(a)kernel.org> Cc: Daniel Borkman <daniel(a)iogearbox.net> Cc: "Darrick J. Wong" <djwong(a)kernel.org> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/buildid.c | 47 +++++++++++++++++++++++++++++++++++------------ 1 file changed, 35 insertions(+), 12 deletions(-) --- a/lib/buildid.c~lib-buildid-use-__kernel_read-for-sleepable-context +++ a/lib/buildid.c @@ -5,6 +5,7 @@ #include <linux/elf.h> #include <linux/kernel.h> #include <linux/pagemap.h> +#include <linux/fs.h> #include <linux/secretmem.h> #define BUILD_ID 3 @@ -37,6 +38,29 @@ static void freader_put_folio(struct fre r->folio = NULL; } +/* + * Data is read directly into r->buf. Returns pointer to the buffer + * on success, NULL on failure with r->err set. + */ +static const void *freader_fetch_sync(struct freader *r, loff_t file_off, size_t sz) +{ + ssize_t ret; + loff_t pos = file_off; + char *buf = r->buf; + + do { + ret = __kernel_read(r->file, buf, sz, &pos); + if (ret <= 0) { + r->err = ret ?: -EIO; + return NULL; + } + buf += ret; + sz -= ret; + } while (sz > 0); + + return r->buf; +} + static int freader_get_folio(struct freader *r, loff_t file_off) { /* check if we can just reuse current folio */ @@ -46,20 +70,9 @@ static int freader_get_folio(struct frea freader_put_folio(r); - /* reject secretmem folios created with memfd_secret() */ - if (secretmem_mapping(r->file->f_mapping)) - return -EFAULT; - + /* only use page cache lookup - fail if not already cached */ r->folio = filemap_get_folio(r->file->f_mapping, file_off >> PAGE_SHIFT); - /* if sleeping is allowed, wait for the page, if necessary */ - if (r->may_fault && (IS_ERR(r->folio) || !folio_test_uptodate(r->folio))) { - filemap_invalidate_lock_shared(r->file->f_mapping); - r->folio = read_cache_folio(r->file->f_mapping, file_off >> PAGE_SHIFT, - NULL, r->file); - filemap_invalidate_unlock_shared(r->file->f_mapping); - } - if (IS_ERR(r->folio) || !folio_test_uptodate(r->folio)) { if (!IS_ERR(r->folio)) folio_put(r->folio); @@ -97,6 +110,16 @@ const void *freader_fetch(struct freader return r->data + file_off; } + /* reject secretmem folios created with memfd_secret() */ + if (secretmem_mapping(r->file->f_mapping)) { + r->err = -EFAULT; + return NULL; + } + + /* use __kernel_read() for sleepable context */ + if (r->may_fault) + return freader_fetch_sync(r, file_off, sz); + /* fetch or reuse folio for given file offset */ r->err = freader_get_folio(r, file_off); if (r->err) _ Patches currently in -mm which might be from shakeel.butt(a)linux.dev are mm-memcg-fix-unit-conversion-for-k-macro-in-oom-log.patch lib-buildid-use-__kernel_read-for-sleepable-context.patch

4 days, 23 hours

1
0
0 0

[PATCH 1/2] af_unix: don't post cmsg for SO_INQ unless explicitly asked for

by Jens Axboe

A previous commit added SO_INQ support for AF_UNIX (SOCK_STREAM), but it posts a SCM_INQ cmsg even if just msg->msg_get_inq is set. This is incorrect, as ->msg_get_inq is just the caller asking for the remainder to be passed back in msg->msg_inq, it has nothing to do with cmsg. The original commit states that this is done to make sockets io_uring-friendly", but it's actually incorrect as io_uring doesn't use cmsg headers internally at all, and it's actively wrong as this means that cmsg's are always posted if someone does recvmsg via io_uring. Fix that up by only posting cmsg if u->recvmsg_inq is set. Cc: stable(a)vger.kernel.org Fixes: df30285b3670 ("af_unix: Introduce SO_INQ.") Reported-by: Julian Orth <ju.orth(a)gmail.com> Link: https://github.com/axboe/liburing/issues/1509 Signed-off-by: Jens Axboe <axboe(a)kernel.dk> --- net/unix/af_unix.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 55cdebfa0da0..110d716087b5 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -3086,12 +3086,16 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, mutex_unlock(&u->iolock); if (msg) { + bool do_cmsg; + scm_recv_unix(sock, msg, &scm, flags); - if (READ_ONCE(u->recvmsg_inq) || msg->msg_get_inq) { + do_cmsg = READ_ONCE(u->recvmsg_inq); + if (do_cmsg || msg->msg_get_inq) { msg->msg_inq = READ_ONCE(u->inq_len); - put_cmsg(msg, SOL_SOCKET, SCM_INQ, - sizeof(msg->msg_inq), &msg->msg_inq); + if (do_cmsg) + put_cmsg(msg, SOL_SOCKET, SCM_INQ, + sizeof(msg->msg_inq), &msg->msg_inq); } } else { scm_destroy(&scm); -- 2.51.0

4 days, 23 hours

2
4
0 0

[PATCH v5 03/24] drm/pagemap, drm/xe: Ensure that the devmem allocation is idle before use

by Thomas Hellström

In situations where no system memory is migrated to devmem, and in upcoming patches where another GPU is performing the migration to the newly allocated devmem buffer, there is nothing to ensure any ongoing clear to the devmem allocation or async eviction from the devmem allocation is complete. Address that by passing a struct dma_fence down to the copy functions, and ensure it is waited for before migration is marked complete. v3: - New patch. v4: - Update the logic used for determining when to wait for the pre_migrate_fence. - Update the logic used for determining when to warn for the pre_migrate_fence since the scheduler fences apparently can signal out-of-order. v5: - Fix a UAF (CI) - Remove references to source P2P migration (Himal) - Put the pre_migrate_fence after migration. Fixes: c5b3eb5a906c ("drm/xe: Add GPUSVM device memory copy vfunc functions") Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: <stable(a)vger.kernel.org> # v6.15+ Signed-off-by: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> --- drivers/gpu/drm/drm_pagemap.c | 17 ++++++--- drivers/gpu/drm/xe/xe_svm.c | 65 ++++++++++++++++++++++++++++++----- include/drm/drm_pagemap.h | 17 +++++++-- 3 files changed, 83 insertions(+), 16 deletions(-) diff --git a/drivers/gpu/drm/drm_pagemap.c b/drivers/gpu/drm/drm_pagemap.c index 4cf8f54e5a27..ac3832f85190 100644 --- a/drivers/gpu/drm/drm_pagemap.c +++ b/drivers/gpu/drm/drm_pagemap.c @@ -3,6 +3,7 @@ * Copyright © 2024-2025 Intel Corporation */ +#include <linux/dma-fence.h> #include <linux/dma-mapping.h> #include <linux/migrate.h> #include <linux/pagemap.h> @@ -408,10 +409,14 @@ int drm_pagemap_migrate_to_devmem(struct drm_pagemap_devmem *devmem_allocation, drm_pagemap_get_devmem_page(page, zdd); } - err = ops->copy_to_devmem(pages, pagemap_addr, npages); + err = ops->copy_to_devmem(pages, pagemap_addr, npages, + devmem_allocation->pre_migrate_fence); if (err) goto err_finalize; + dma_fence_put(devmem_allocation->pre_migrate_fence); + devmem_allocation->pre_migrate_fence = NULL; + /* Upon success bind devmem allocation to range and zdd */ devmem_allocation->timeslice_expiration = get_jiffies_64() + msecs_to_jiffies(timeslice_ms); @@ -596,7 +601,7 @@ int drm_pagemap_evict_to_ram(struct drm_pagemap_devmem *devmem_allocation) for (i = 0; i < npages; ++i) pages[i] = migrate_pfn_to_page(src[i]); - err = ops->copy_to_ram(pages, pagemap_addr, npages); + err = ops->copy_to_ram(pages, pagemap_addr, npages, NULL); if (err) goto err_finalize; @@ -719,7 +724,7 @@ static int __drm_pagemap_migrate_to_ram(struct vm_area_struct *vas, for (i = 0; i < npages; ++i) pages[i] = migrate_pfn_to_page(migrate.src[i]); - err = ops->copy_to_ram(pages, pagemap_addr, npages); + err = ops->copy_to_ram(pages, pagemap_addr, npages, NULL); if (err) goto err_finalize; @@ -800,11 +805,14 @@ EXPORT_SYMBOL_GPL(drm_pagemap_pagemap_ops_get); * @ops: Pointer to the operations structure for GPU SVM device memory * @dpagemap: The struct drm_pagemap we're allocating from. * @size: Size of device memory allocation + * @pre_migrate_fence: Fence to wait for or pipeline behind before migration starts. + * (May be NULL). */ void drm_pagemap_devmem_init(struct drm_pagemap_devmem *devmem_allocation, struct device *dev, struct mm_struct *mm, const struct drm_pagemap_devmem_ops *ops, - struct drm_pagemap *dpagemap, size_t size) + struct drm_pagemap *dpagemap, size_t size, + struct dma_fence *pre_migrate_fence) { init_completion(&devmem_allocation->detached); devmem_allocation->dev = dev; @@ -812,6 +820,7 @@ void drm_pagemap_devmem_init(struct drm_pagemap_devmem *devmem_allocation, devmem_allocation->ops = ops; devmem_allocation->dpagemap = dpagemap; devmem_allocation->size = size; + devmem_allocation->pre_migrate_fence = pre_migrate_fence; } EXPORT_SYMBOL_GPL(drm_pagemap_devmem_init); diff --git a/drivers/gpu/drm/xe/xe_svm.c b/drivers/gpu/drm/xe/xe_svm.c index bab8e6cbe53d..b806a1fce188 100644 --- a/drivers/gpu/drm/xe/xe_svm.c +++ b/drivers/gpu/drm/xe/xe_svm.c @@ -472,11 +472,12 @@ static void xe_svm_copy_us_stats_incr(struct xe_gt *gt, static int xe_svm_copy(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages, const enum xe_svm_copy_dir dir) + unsigned long npages, const enum xe_svm_copy_dir dir, + struct dma_fence *pre_migrate_fence) { struct xe_vram_region *vr = NULL; struct xe_gt *gt = NULL; - struct xe_device *xe; + struct xe_device *xe = NULL; struct dma_fence *fence = NULL; unsigned long i; #define XE_VRAM_ADDR_INVALID ~0x0ull @@ -485,6 +486,16 @@ static int xe_svm_copy(struct page **pages, bool sram = dir == XE_SVM_COPY_TO_SRAM; ktime_t start = xe_gt_stats_ktime_get(); + if (pre_migrate_fence && dma_fence_is_container(pre_migrate_fence)) { + /* + * This would typically be a composite fence operation on the destination memory. + * Ensure that the other GPU operation on the destination is complete. + */ + err = dma_fence_wait(pre_migrate_fence, true); + if (err) + return err; + } + /* * This flow is complex: it locates physically contiguous device pages, * derives the starting physical address, and performs a single GPU copy @@ -621,10 +632,28 @@ static int xe_svm_copy(struct page **pages, err_out: /* Wait for all copies to complete */ - if (fence) { + if (fence) dma_fence_wait(fence, false); - dma_fence_put(fence); + + /* + * If migrating to devmem, we should have pipelined the migration behind + * the pre_migrate_fence. Verify that this is indeed likely. If we + * didn't perform any copying, just wait for the pre_migrate_fence. + */ + if (pre_migrate_fence && !dma_fence_is_signaled(pre_migrate_fence)) { + if (xe && fence && + (pre_migrate_fence->context != fence->context || + dma_fence_is_later(pre_migrate_fence, fence))) { + drm_WARN(&xe->drm, true, "Unsignaled pre-migrate fence"); + drm_warn(&xe->drm, "fence contexts: %llu %llu. container %d\n", + (unsigned long long)fence->context, + (unsigned long long)pre_migrate_fence->context, + dma_fence_is_container(pre_migrate_fence)); + } + + dma_fence_wait(pre_migrate_fence, false); } + dma_fence_put(fence); /* * XXX: We can't derive the GT here (or anywhere in this functions, but @@ -641,16 +670,20 @@ static int xe_svm_copy(struct page **pages, static int xe_svm_copy_to_devmem(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages) + unsigned long npages, + struct dma_fence *pre_migrate_fence) { - return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_VRAM); + return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_VRAM, + pre_migrate_fence); } static int xe_svm_copy_to_ram(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages) + unsigned long npages, + struct dma_fence *pre_migrate_fence) { - return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_SRAM); + return xe_svm_copy(pages, pagemap_addr, npages, XE_SVM_COPY_TO_SRAM, + pre_migrate_fence); } static struct xe_bo *to_xe_bo(struct drm_pagemap_devmem *devmem_allocation) @@ -663,6 +696,7 @@ static void xe_svm_devmem_release(struct drm_pagemap_devmem *devmem_allocation) struct xe_bo *bo = to_xe_bo(devmem_allocation); struct xe_device *xe = xe_bo_device(bo); + dma_fence_put(devmem_allocation->pre_migrate_fence); xe_bo_put_async(bo); xe_pm_runtime_put(xe); } @@ -857,6 +891,7 @@ static int xe_drm_pagemap_populate_mm(struct drm_pagemap *dpagemap, unsigned long timeslice_ms) { struct xe_vram_region *vr = container_of(dpagemap, typeof(*vr), dpagemap); + struct dma_fence *pre_migrate_fence = NULL; struct xe_device *xe = vr->xe; struct device *dev = xe->drm.dev; struct drm_buddy_block *block; @@ -883,8 +918,20 @@ static int xe_drm_pagemap_populate_mm(struct drm_pagemap *dpagemap, break; } + /* Ensure that any clearing or async eviction will complete before migration. */ + if (!dma_resv_test_signaled(bo->ttm.base.resv, DMA_RESV_USAGE_KERNEL)) { + err = dma_resv_get_singleton(bo->ttm.base.resv, DMA_RESV_USAGE_KERNEL, + &pre_migrate_fence); + if (err) + dma_resv_wait_timeout(bo->ttm.base.resv, DMA_RESV_USAGE_KERNEL, + false, MAX_SCHEDULE_TIMEOUT); + else if (pre_migrate_fence) + dma_fence_enable_sw_signaling(pre_migrate_fence); + } + drm_pagemap_devmem_init(&bo->devmem_allocation, dev, mm, - &dpagemap_devmem_ops, dpagemap, end - start); + &dpagemap_devmem_ops, dpagemap, end - start, + pre_migrate_fence); blocks = &to_xe_ttm_vram_mgr_resource(bo->ttm.resource)->blocks; list_for_each_entry(block, blocks, link) diff --git a/include/drm/drm_pagemap.h b/include/drm/drm_pagemap.h index f6e7e234c089..70a7991f784f 100644 --- a/include/drm/drm_pagemap.h +++ b/include/drm/drm_pagemap.h @@ -8,6 +8,7 @@ #define NR_PAGES(order) (1U << (order)) +struct dma_fence; struct drm_pagemap; struct drm_pagemap_zdd; struct device; @@ -174,6 +175,8 @@ struct drm_pagemap_devmem_ops { * @pages: Pointer to array of device memory pages (destination) * @pagemap_addr: Pointer to array of DMA information (source) * @npages: Number of pages to copy + * @pre_migrate_fence: dma-fence to wait for before migration start. + * May be NULL. * * Copy pages to device memory. If the order of a @pagemap_addr entry * is greater than 0, the entry is populated but subsequent entries @@ -183,13 +186,16 @@ struct drm_pagemap_devmem_ops { */ int (*copy_to_devmem)(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages); + unsigned long npages, + struct dma_fence *pre_migrate_fence); /** * @copy_to_ram: Copy to system RAM (required for migration) * @pages: Pointer to array of device memory pages (source) * @pagemap_addr: Pointer to array of DMA information (destination) * @npages: Number of pages to copy + * @pre_migrate_fence: dma-fence to wait for before migration start. + * May be NULL. * * Copy pages to system RAM. If the order of a @pagemap_addr entry * is greater than 0, the entry is populated but subsequent entries @@ -199,7 +205,8 @@ struct drm_pagemap_devmem_ops { */ int (*copy_to_ram)(struct page **pages, struct drm_pagemap_addr *pagemap_addr, - unsigned long npages); + unsigned long npages, + struct dma_fence *pre_migrate_fence); }; /** @@ -212,6 +219,8 @@ struct drm_pagemap_devmem_ops { * @dpagemap: The struct drm_pagemap of the pages this allocation belongs to. * @size: Size of device memory allocation * @timeslice_expiration: Timeslice expiration in jiffies + * @pre_migrate_fence: Fence to wait for or pipeline behind before migration starts. + * (May be NULL). */ struct drm_pagemap_devmem { struct device *dev; @@ -221,6 +230,7 @@ struct drm_pagemap_devmem { struct drm_pagemap *dpagemap; size_t size; u64 timeslice_expiration; + struct dma_fence *pre_migrate_fence; }; int drm_pagemap_migrate_to_devmem(struct drm_pagemap_devmem *devmem_allocation, @@ -238,7 +248,8 @@ struct drm_pagemap *drm_pagemap_page_to_dpagemap(struct page *page); void drm_pagemap_devmem_init(struct drm_pagemap_devmem *devmem_allocation, struct device *dev, struct mm_struct *mm, const struct drm_pagemap_devmem_ops *ops, - struct drm_pagemap *dpagemap, size_t size); + struct drm_pagemap *dpagemap, size_t size, + struct dma_fence *pre_migrate_fence); int drm_pagemap_populate_mm(struct drm_pagemap *dpagemap, unsigned long start, unsigned long end, -- 2.51.1

5 days, 1 hour

2
3
0 0

[PATCH 6.17 000/507] 6.17.13-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.17.13 release. There are 507 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.13-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.17.13-rc1 Junrui Luo <moonafterrain(a)outlook.com> ALSA: wavefront: Fix integer overflow in sample size validation Denis Arefev <arefev(a)swemel.ru> ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() Antheas Kapenekakis <lkml(a)antheas.dev> ALSA: hda/tas2781: fix speaker id retrieval for multiple probes Antheas Kapenekakis <lkml(a)antheas.dev> ALSA: hda/realtek: Add match for ASUS Xbox Ally projects Junrui Luo <moonafterrain(a)outlook.com> ALSA: dice: fix buffer overflow in detect_stream_formats() Sven Peter <sven(a)kernel.org> usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required Duoming Zhou <duoming(a)zju.edu.cn> usb: typec: ucsi: fix use-after-free caused by uec->work Diogo Ivo <diogo.ivo(a)tecnico.ulisboa.pt> usb: phy: Initialize struct usb_phy list_head Duoming Zhou <duoming(a)zju.edu.cn> usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe() Haotien Hsu <haotienh(a)nvidia.com> usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt Evan Li <evan.li(a)linux.alibaba.com> perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common() Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: fix memory leak in ocfs2_merge_rec_left() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> cpu: Make atomic hotplug callbacks run with interrupts disabled on UP Dan Carpenter <dan.carpenter(a)linaro.org> irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() Thaumy Cheng <thaumy.love(a)gmail.com> perf/core: Fix missing read event generation on task exit Duoming Zhou <duoming(a)zju.edu.cn> scsi: imm: Fix use-after-free bug caused by unfinished delayed work Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> efi/cper: Adjust infopfx size to accept an extra space Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> efi/cper: Add a new helper function to print bitmasks Haotian Zhang <vulab(a)iscas.ac.cn> dm log-writes: Add missing set_freezable() for freezable kthread Alexey Simakov <bigalex934(a)gmail.com> dm-raid: fix possible NULL dereference with undefined raid type Hemalatha Pinnamreddy <hemalatha.pinnamreddy2(a)amd.com> ASoC: amd: acp: update tdm channels for specific DAI Mohamed Khalfella <mkhalfella(a)purestorage.com> block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian(a)intel.com> drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation Jani Nikula <jani.nikula(a)intel.com> drm/{i915, xe}/fbdev: deduplicate struct drm_mode_fb_cmd2 init Jani Nikula <jani.nikula(a)intel.com> drm/{i915, xe}/fbdev: pass struct drm_device to intel_fbdev_fb_alloc() Jani Nikula <jani.nikula(a)intel.com> drm/i915/fbdev: make intel_framebuffer_create() error return handling explicit Jani Nikula <jani.nikula(a)intel.com> drm/xe/fbdev: use the same 64-byte stride alignment as i915 Liyuan Pang <pangliyuan1(a)huawei.com> ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() Junrui Luo <moonafterrain(a)outlook.com> ALSA: firewire-motu: add bounds check in put_user loop for DSP events Nuno Sá <nuno.sa(a)analog.com> rtc: max31335: Fix ignored return value in set_alarm Haotian Zhang <vulab(a)iscas.ac.cn> rtc: gamecube: Check the return value of ioremap() Xiaogang Chen <xiaogang.chen(a)amd.com> drm/amdkfd: Use huge page size to check split svm range alignment Andres J Rosa <andyrosa(a)gmail.com> ALSA: uapi: Fix typo in asound.h comment Dave Kleikamp <dave.kleikamp(a)oracle.com> dma/pool: eliminate alloc_pages warning in atomic_pool_expand Troy Mitchell <troy.mitchell(a)linux.spacemit.com> i2c: spacemit: fix detect issue Kathara Sasikumar <katharasasikumar007(a)gmail.com> docs: hwmon: fix link to g762 devicetree binding David Howells <dhowells(a)redhat.com> cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 David Howells <dhowells(a)redhat.com> cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1 René Rebe <rene(a)exactco.de> drm/nouveau: fix circular dep oops from vendored i2c encoder Madhur Kumar <madhurkumar004(a)gmail.com> drm/nouveau: refactor deprecated strcpy Junrui Luo <moonafterrain(a)outlook.com> ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events Mark Brown <broonie(a)kernel.org> regulator: fixed: Rely on the core freeing the enable GPIO Dan Carpenter <dan.carpenter(a)linaro.org> drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() Israel Rukshin <israelr(a)nvidia.com> nvme-auth: use kvfree() for memory allocated with kvcalloc() Shaurya Rane <ssrane_b23(a)ee.vjti.ac.in> block: fix memory leak in __blkdev_issue_zero_pages shechenglong <shechenglong(a)xfusion.com> block: fix comment for op_is_zone_mgmt() to include RESET_ALL Cong Zhang <cong.zhang(a)oss.qualcomm.com> blk-mq: Abort suspend when wakeup events are pending Daeho Jeong <daehojeong(a)google.com> f2fs: revert summary entry count from 2048 to 512 in 16kb block support Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: ak5558: Disable regulator when error happens Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: ak4458: Disable regulator when error happens Hemalatha Pinnamreddy <hemalatha.pinnamreddy2(a)amd.com> ASoC: amd: acp: Audio is not resuming after s0ix Haotian Zhang <vulab(a)iscas.ac.cn> ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() Anton Khirnov <anton(a)khirnov.net> platform/x86: asus-wmi: use brightness_set_blocking() for kbd led Armin Wolf <W_Armin(a)gmx.de> fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Fix inheritance of the block sizes when automounting Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags Trond Myklebust <trond.myklebust(a)hammerspace.com> Revert "nfs: ignore SB_RDONLY when mounting nfs" Trond Myklebust <trond.myklebust(a)hammerspace.com> Revert "nfs: clear SB_RDONLY before getting superblock" Trond Myklebust <trond.myklebust(a)hammerspace.com> Revert "nfs: ignore SB_RDONLY when remounting nfs" Akash Goel <akash.goel(a)arm.com> drm/panthor: Prevent potential UAF in group creation Chia-I Wu <olvaffe(a)gmail.com> panthor: save task pid and comm in panthor_group Jonathan Curley <jcurley(a)purestorage.com> NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Initialise verifiers for visible dentries in nfs_atomic_open() Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Initialise verifiers for visible dentries in readdir and lookup Armin Wolf <W_Armin(a)gmx.de> fs/nls: Fix utf16 to utf8 conversion Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Avoid changing nlink when file removes and attribute updates race Abel Vesa <abel.vesa(a)linaro.org> kbuild: install-extmod-build: Properly fix CC expansion when ccache is used James Le Cuirot <chewi(a)gentoo.org> kbuild: install-extmod-build: Fix when given dir outside the build dir Haotian Zhang <vulab(a)iscas.ac.cn> rtc: amlogic-a4: fix double free caused by devm Daeho Jeong <daehojeong(a)google.com> f2fs: maintain one time GC mode is enabled during whole zoned GC cycle Xi Pardee <xi.pardee(a)linux.intel.com> platform/x86:intel/pmc: Update Arrow Lake telemetry GUID John Stultz <jstultz(a)google.com> sched/core: Fix psi_dequeue() for Proxy Execution xupengbo <xupengbo(a)oppo.com> sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out Eric Sandeen <sandeen(a)redhat.com> 9p: fix cache/debug options printing in v9fs_show_options Abdun Nihaal <nihaal(a)cse.iitm.ac.in> fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() Haotian Zhang <vulab(a)iscas.ac.cn> pinctrl: single: Fix incorrect type for error return variable Ian Rogers <irogers(a)google.com> perf hist: In init, ensure mem_info is put on error paths Namhyung Kim <namhyung(a)kernel.org> perf tools: Fix split kallsyms DSO counting Namhyung Kim <namhyung(a)kernel.org> perf tools: Mark split kallsyms DSOs as loaded Namhyung Kim <namhyung(a)kernel.org> perf jitdump: Add sym/str-tables to build-ID generation Xiang Mei <xmei5(a)asu.edu> net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: xrs700x: reject unsupported HSR configurations Xiaoliang Yang <xiaoliang.yang_1(a)nxp.com> net: hsr: create an API to get hsr port type Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: fix BCM5325/65 ARL entry VIDs Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: add support for bcm63xx ARL entry format Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: fix CPU port unicast ARL entries for BCM5325/65 Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: use same ARL search result offset for BCM5325/65 Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: add support for 5389/5397/5398 ARL entry format Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: move ARL entry functions into ops struct Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: split reading search entry into their own functions Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: provide accessors for accessing ARL_SRCH_CTL Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: move writing ARL entries into their own functions Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: move reading ARL entries into their own function Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: b53_arl_read{,25}(): use the entry for comparision Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: fix extracting VID from entry for BCM5325/65 Jonas Gorski <jonas.gorski(a)gmail.com> net: dsa: b53: fix VLAN_ID_IDX write size for BCM5325/65 Johan Hovold <johan(a)kernel.org> clk: keystone: fix compile testing Yu Kuai <yukuai(a)fnnas.com> md/raid5: fix IO hang when array is broken with IO inflight Alexandru Gagniuc <mr.nuke.me(a)gmail.com> remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs Kumar Kartikeya Dwivedi <memxor(a)gmail.com> rqspinlock: Use trylock fallback when per-CPU rqnode is busy Kumar Kartikeya Dwivedi <memxor(a)gmail.com> rqspinlock: Enclose lock/unlock within lock entry acquisitions Ivan Stepchenko <sid(a)itb.spb.ru> mtd: lpddr_cmds: fix signed shifts in lpddr_cmds Breno Leitao <leitao(a)debian.org> net: netpoll: initialize work queue before error checks Hangbin Liu <liuhangbin(a)gmail.com> selftests: bonding: add delay before each xvlan_over_bond connectivity check Robert Marko <robimarko(a)gmail.com> net: phy: aquantia: check for NVMEM deferral Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Use RCU for error/request triggers to avoid circular locking Tianchu Chen <flynnnchen(a)tencent.com> spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Haotian Zhang <vulab(a)iscas.ac.cn> mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> net: stmmac: fix rx limit check in stmmac_rx_zc() Michal Schmidt <mschmidt(a)redhat.com> iavf: Implement settime64 with -EOPNOTSUPP Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nft_connlimit: update the count if add was skipped Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nf_conncount: rework API to use sk_buff directly Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: check for maximum number of encapsulations in bridge vlan Ilias Stamatis <ilstam(a)amazon.com> Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" sparkhuang <huangshaobo3(a)xiaomi.com> regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex Marek Szyprowski <m.szyprowski(a)samsung.com> ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend Marek Szyprowski <m.szyprowski(a)samsung.com> ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend Marek Szyprowski <m.szyprowski(a)samsung.com> ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend Marek Szyprowski <m.szyprowski(a)samsung.com> ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend Mikhail Kshevetskiy <mikhail.kshevetskiy(a)iopsys.eu> spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: catpt: Fix error path in hw_params() Michael S. Tsirkin <mst(a)redhat.com> virtio: clean up features qword/dword terms Alok Tiwari <alok.a.tiwari(a)oracle.com> vdpa/pds: use %pe for ERR_PTR() in event handler registration Mike Christie <michael.christie(a)oracle.com> vhost: Fix kthread worker cgroup failure handling Alok Tiwari <alok.a.tiwari(a)oracle.com> vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues Michael S. Tsirkin <mst(a)redhat.com> virtio: fix virtqueue_set_affinity() docs Michael S. Tsirkin <mst(a)redhat.com> virtio: fix grammar in virtio_queue_info docs Michael S. Tsirkin <mst(a)redhat.com> virtio: fix whitespace in virtio_config_ops Michael S. Tsirkin <mst(a)redhat.com> virtio: fix typo in virtio_device_ready() comment Alok Tiwari <alok.a.tiwari(a)oracle.com> virtio_vdpa: fix misleading return in void function Guenter Roeck <linux(a)roeck-us.net> of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node Willem de Bruijn <willemb(a)google.com> selftests/net: packetdrill: pass send_omit_free to MSG_ZEROCOPY tests Yongjian Sun <sunyongjian1(a)huawei.com> ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation Kevin Brodsky <kevin.brodsky(a)arm.com> ublk: prevent invalid access with DEBUG René Rebe <rene(a)exactco.de> ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 Haotian Zhang <vulab(a)iscas.ac.cn> hwmon: sy7636a: Fix regulator_enable resource leak on error path Dan Carpenter <dan.carpenter(a)linaro.org> drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() Will Rosenberg <whrosenb(a)asu.edu> kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> misc: rp1: Fix an error handling path in rp1_probe() Haotian Zhang <vulab(a)iscas.ac.cn> greybus: gb-beagleplay: Fix timeout handling in bootloader functions Alexandre Courbot <acourbot(a)nvidia.com> firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_xcvr: clear the channel status control memory Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Prevent recursive memory reclaim Jaroslav Kysela <perex(a)perex.cz> ASoC: nau8325: add missing build config Jaroslav Kysela <perex(a)perex.cz> ASoC: nau8325: use simple i2c probe function Johan Hovold <johan(a)kernel.org> clocksource/drivers/nxp-stm: Prevent driver unbind Johan Hovold <johan(a)kernel.org> clocksource/drivers/nxp-stm: Fix section mismatches Johan Hovold <johan(a)kernel.org> clocksource/drivers/stm: Fix double deregistration on probe failure Haotian Zhang <vulab(a)iscas.ac.cn> clocksource/drivers/ralink: Fix resource leaks in init error path Akash Goel <akash.goel(a)arm.com> drm/panthor: Avoid adding of kernel BOs to extobj list Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY Krzysztof Czurylo <krzysztof.czurylo(a)intel.com> RDMA/irdma: Fix data race in irdma_free_pble Krzysztof Czurylo <krzysztof.czurylo(a)intel.com> RDMA/irdma: Fix data race in irdma_sc_ccq_arm Stephan Gerhold <stephan.gerhold(a)linaro.org> iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal Randy Dunlap <rdunlap(a)infradead.org> backlight: lp855x: Fix lp855x.h kernel-doc warnings Luca Ceresoli <luca.ceresoli(a)bootlin.com> backlight: led-bl: Add devlink to supplier LEDs Ria Thomas <ria.thomas(a)morsemicro.com> wifi: ieee80211: correct FILS status codes Christoph Hellwig <hch(a)lst.de> iomap: always run error completions in user context David Gow <davidgow(a)google.com> um: Don't rename vmap to kernel_vmap Timur Tabi <ttabi(a)nvidia.com> drm/nouveau: restrict the flush page to a 32-bit address Shawn Lin <shawn.lin(a)rock-chips.com> PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition Filipe Manana <fdmanana(a)suse.com> btrfs: fix leaf leak in an error path in btrfs_del_items() Boris Burkov <boris(a)bur.io> btrfs: fix racy bitfield write in btrfs_clear_space_info_full() Miquel Sabaté Solà <mssola(a)mssola.com> btrfs: fix double free of qgroup record after failure to add delayed ref head Ryan Huang <tzukui(a)google.com> iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables Jianglei Nie <niejianglei2021(a)163.com> staging: fbtft: core: fix potential memory leak in fbtft_probe_common() Dinh Nguyen <dinguyen(a)kernel.org> firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc Zilin Guan <zilin(a)seu.edu.cn> mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: skip deflink accounting for offchannel links Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event() Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart() Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: fix MLD group index assignment Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: set link_valid field when initializing wcid Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: fix teardown command for an MLD peer Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv() Howard Hsu <howard-yh.hsu(a)mediatek.com> wifi: mt76: mt7996: fix implicit beamforming support for mt7992 StanleyYP Wang <StanleyYP.Wang(a)mediatek.com> wifi: mt76: mt7996: fix max nss value when getting rx chainmask Fedor Pchelkin <pchelkin(a)ispras.ru> Revert "wifi: mt76: mt792x: improve monitor interface handling" Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7921: add MBSSID support Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: add MBSSID support Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks Felix Fietkau <nbd(a)nbd.name> wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() Shenghao Ding <shenghao-ding(a)ti.com> ASoC: tas2781: correct the wrong period Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ahash - Zero positive err value in ahash_update_finish Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ahash - Fix crypto_ahash_import with partial block data Selvin Xavier <selvin.xavier(a)broadcom.com> RDMA/bnxt_re: Pass correct flag for dma mr creation Selvin Xavier <selvin.xavier(a)broadcom.com> RDMA/bnxt_re: Fix the inline size for GenP7 devices Gao Xiang <xiang(a)kernel.org> erofs: limit the level of fs stacking for file-backed mounts Gao Xiang <xiang(a)kernel.org> erofs: correct FSDAX detection Fangyu Yu <fangyu.yu(a)linux.alibaba.com> RISC-V: KVM: Fix guest page fault within HLV* instructions Pengjie Zhang <zhangpengjie2(a)huawei.com> PM / devfreq: hisi: Fix potential UAF in OPP handling Haotian Zhang <vulab(a)iscas.ac.cn> crypto: ccree - Correctly handle return of sg_nents_for_len Haotian Zhang <vulab(a)iscas.ac.cn> crypto: starfive - Correctly handle return of sg_nents_for_len Matt Bobrowski <mattbobrowski(a)google.com> selftests/bpf: Improve reliability of test_perf_branches_no_hw() Matt Bobrowski <mattbobrowski(a)google.com> selftests/bpf: skip test_perf_branches_hw() on unsupported platforms Dan Carpenter <dan.carpenter(a)linaro.org> regulator: pca9450: Fix error code in probe() Gopi Krishna Menon <krishnagopi487(a)gmail.com> usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE Jisheng Zhang <jszhang(a)kernel.org> usb: dwc2: fix hang during suspend if set as peripheral Jisheng Zhang <jszhang(a)kernel.org> usb: dwc2: fix hang during shutdown if set as peripheral Oliver Neukum <oneukum(a)suse.com> usb: chaoskey: fix locking for O_NONBLOCK Zhao Yipeng <zhaoyipeng5(a)huawei.com> ima: Handle error code returned by ima_filter_rule_match() Jason Tian <jason(a)os.amperecomputing.com> RAS: Report all ARM processor CPER information to userspace Seungjin Bae <eeodqql09(a)gmail.com> wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() Charles Mirabile <cmirabil(a)redhat.com> clk: spacemit: Set clk_hw_onecell_data::num before using flex array Chen Ridong <chenridong(a)huawei.com> cpuset: Treat cpusets in attaching as populated Alexander Dahl <ada(a)thorsis.com> net: phy: adin1100: Fix software power-down ready condition Matt Bobrowski <mattbobrowski(a)google.com> selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Fix missing dash in HIDE DisCo property Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode Xiaolei Wang <xiaolei.wang(a)windriver.com> phy: freescale: Initialize priv->lock Shawn Lin <shawn.lin(a)rock-chips.com> phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562 Yao Zi <ziyao(a)disroot.org> phy: rockchip: naneng-combphy: Add SoC prefix to register definitions Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() Fenglin Wu <fenglin.wu(a)oss.qualcomm.com> leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM Yuntao Wang <yuntao.wang(a)linux.dev> of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho() Yuntao Wang <yuntao.wang(a)linux.dev> of/fdt: Consolidate duplicate code into helper functions Haotian Zhang <vulab(a)iscas.ac.cn> mfd: mt6358-irq: Fix missing irq_domain_remove() in error path Haotian Zhang <vulab(a)iscas.ac.cn> mfd: mt6397-irq: Fix missing irq_domain_remove() in error path Chien Wong <m(a)xv97.com> wifi: mac80211: fix CMAC functions not handling errors Aashish Sharma <aashish(a)aashishsharma.net> iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb Vladimir Oltean <vladimir.oltean(a)nxp.com> net: phy: realtek: create rtl8211f_config_rgmii_delay() Zilin Guan <zilin(a)seu.edu.cn> scsi: qla2xxx: Fix improper freeing of purex item Shawn Lin <shawn.lin(a)rock-chips.com> scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> pwm: bcm2835: Make sure the channel is enabled after pwm_request() Leo Yan <leo.yan(a)arm.com> perf arm_spe: Fix memset subclass in operation Fernando Fernandez Mancera <fmancera(a)suse.de> ipv6: clear RA flags when adding a static route Longbin Li <looong.bin(a)gmail.com> spi: sophgo: Fix incorrect use of bus width value macros Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Improve MX rail fallback in RPMH vote init Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Fix the gemnoc workaround Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Flush LRZ cache before PT switch Jay Liu <jay.liu(a)mediatek.com> drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue Edward Adam Davis <eadavis(a)qq.com> fs/ntfs3: Prevent memory leaks in add sub record Edward Adam Davis <eadavis(a)qq.com> fs/ntfs3: out1 also needs to put mi Ovidiu Panait <ovidiu.panait.rb(a)renesas.com> net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit Pu Lehui <pulehui(a)huawei.com> bpf: Fix invalid prog->stats access when update_effective_progs fails Inochi Amaoto <inochiama(a)gmail.com> net: stmmac: dwmac-sophgo: Add phy interface filter Inochi Amaoto <inochiama(a)gmail.com> net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> drm/msm/a2xx: stop over-complaining about the legacy firmware Huiwen He <hehuiwen(a)kylinos.cn> drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos() Huiwen He <hehuiwen(a)kylinos.cn> drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs() Guenter Roeck <linux(a)roeck-us.net> block/blk-throttle: Fix throttle slice time for SSDs Alexander Stein <alexander.stein(a)ew.tq-group.com> arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name Sergey Bashirov <sergeybashirov(a)gmail.com> NFSD/blocklayout: Fix minlength check in proc_layoutget Al Viro <viro(a)zeniv.linux.org.uk> tracefs: fix a leak in eventfs_create_events_dir() Al Viro <viro(a)zeniv.linux.org.uk> fuse_ctl_add_conn(): fix nlink breakage in case of early failure Haotian Zhang <vulab(a)iscas.ac.cn> watchdog: starfive: Fix resource leak in probe error path Haotian Zhang <vulab(a)iscas.ac.cn> watchdog: wdat_wdt: Fix ACPI table leak in probe function Nuno Das Neves <nunodasneves(a)linux.microsoft.com> mshv: Fix create memory region overlap check Roman Kisel <romank(a)linux.microsoft.com> Drivers: hv: Free msginfo when the buffer fails to decrypt Roman Kisel <romank(a)linux.microsoft.com> Drivers: hv: Allocate encrypted buffers when requested Roman Kisel <romank(a)linux.microsoft.com> Drivers: hv: VMBus protocol version 6.0 Nuno Das Neves <nunodasneves(a)linux.microsoft.com> mshv: Fix deposit memory in MSHV_ROOT_HVCALL Martin KaFai Lau <martin.lau(a)kernel.org> bpf: Check skb->transport_header is set in bpf_skb_check_mtu Alexei Starovoitov <ast(a)kernel.org> selftests/bpf: Fix failure paths in send_signal test Menglong Dong <menglong8.dong(a)gmail.com> bpf: Handle return value of ftrace_set_filter_ip in register_fentry Sahil Chandna <chandna.sahil(a)gmail.com> bpf: Prevent nesting overflow in bpf_try_get_buffers Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> PCI: Prevent resource tree corruption when BAR resize fails Rene Rebe <rene(a)exactco.de> ps3disk: use memcpy_{from,to}_bvec index Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype Praveen Talari <praveen.talari(a)oss.qualcomm.com> arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm Aleksei Nikiforov <aleksei.nikiforov(a)linux.ibm.com> s390/fpu: Fix false-positive kmsan report in fpu_vstl() Zilin Guan <zilin(a)seu.edu.cn> crypto: iaa - Fix incorrect return value in save_iaa_wq() FUKAUMI Naoki <naoki(a)radxa.com> arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C FUKAUMI Naoki <naoki(a)radxa.com> arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A FUKAUMI Naoki <naoki(a)radxa.com> arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A Siddharth Vadapalli <s-vadapalli(a)ti.com> PCI: keystone: Exit ks_pcie_probe() for invalid mode Leon Hwang <leon.hwang(a)linux.dev> bpf: Free special fields when update [lru_,]percpu_hash maps Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix deadlock between context destroy and job timeout Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Clear mailbox interrupt register during channel creation Haotian Zhang <vulab(a)iscas.ac.cn> leds: netxbig: Fix GPIO descriptor leak in error paths Haotian Zhang <vulab(a)iscas.ac.cn> scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls Haotian Zhang <vulab(a)iscas.ac.cn> ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: use correct endian in ocfs2_dinode_has_extents Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> lib/vsprintf: Check pointer before dereferencing in time_and_date() Haotian Zhang <vulab(a)iscas.ac.cn> clk: renesas: r9a06g032: Fix memory leak in error path Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> clk: renesas: r9a09g077: Propagate rate changes to parent clocks Jayesh Choudhary <j-choudhary(a)ti.com> drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook Jayesh Choudhary <j-choudhary(a)ti.com> drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features Namhyung Kim <namhyung(a)kernel.org> perf tools: Fix missing feature check for inherit + SAMPLE_READ Leo Yan <leo.yan(a)arm.com> coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF Leo Yan <leo.yan(a)arm.com> coresight: etm4x: Add context synchronization before enabling trace Leo Yan <leo.yan(a)arm.com> coresight: etm4x: Correct polling IDLE bit Leo Yan <leo.yan(a)arm.com> coresight: etm3x: Always set tracer's device mode on target CPU Leo Yan <leo.yan(a)arm.com> coresight: etm4x: Always set tracer's device mode on target CPU Leo Yan <leo.yan(a)arm.com> coresight: Change device mode to atomic type Zheng Qixing <zhengqixing(a)huawei.com> nbd: defer config unlock in nbd_genl_connect Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() Long Li <leo.lilong(a)huawei.com> macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/32: Fix unpaired stwcx. on interrupt exit Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: Fix size calculation for hot-removed memory ranges Gautham R. Shenoy <gautham.shenoy(a)amd.com> cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs Li Nan <linan122(a)huawei.com> md: delete md_redundancy_group when array is becoming inactive Bean Huo <beanhuo(a)micron.com> scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() Akash Goel <akash.goel(a)arm.com> drm/panthor: Fix potential memleak of vma structure Edward Adam Davis <eadavis(a)qq.com> ntfs3: init run lock for extend inode Carl Worth <carl(a)os.amperecomputing.com> coresight: tmc: add the handle of the event to the path Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties Ma Ke <make24(a)iscas.ac.cn> RDMA/rtrs: server: Fix error handling in get_or_create_srv Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> dt-bindings: PCI: amlogic: Fix the register name of the DBI region Rodrigo Gobbi <rodrigo.gobbi.7(a)gmail.com> iio: imu: bmi270: fix dev_err_probe error msg Johan Hovold <johan(a)kernel.org> staging: most: remove broken i2c driver Mike McGowen <mike.mcgowen(a)microchip.com> scsi: smartpqi: Fix device resources accessed after device removal Haotian Zhang <vulab(a)iscas.ac.cn> scsi: stex: Fix reboot_notifier leak in probe error path Zheng Qixing <zhengqixing(a)huawei.com> nbd: defer config put in recv_work Xiao Ni <xni(a)redhat.com> md: avoid repeated calls to del_gendisk Yun Zhou <yun.zhou(a)windriver.com> md: fix rcu protection in md_wakeup_thread Xiao Ni <xni(a)redhat.com> md: delete mddev kobj before deleting gendisk kobj Gabor Juhos <j4g8y7(a)gmail.com> regulator: core: disable supply if enabling main regulator fails Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Correct large PEBS flag check Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86: Fix NULL event access and potential PEBS record loss Pavel Begunkov <asml.silence(a)gmail.com> io_uring: use WRITE_ONCE for user shared memory Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix dma_fence leak when job is canceled Zhang Yi <yi.zhang(a)huawei.com> ext4: correct the checking of quota files before moving extents Manish Dharanenthiran <manish.dharanenthiran(a)oss.qualcomm.com> wifi: ath12k: Fix timeout error during beacon stats retrieval Haotian Zhang <vulab(a)iscas.ac.cn> mfd: da9055: Fix missing regmap_del_irq_chip() in error path Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw89: usb: fix leak in rtw89_usb_write_port() Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler() Wang Liang <wangliang74(a)huawei.com> locktorture: Fix memory leak in param_set_cpumask() Usama Arif <usamaarif642(a)gmail.com> efi/libstub: Fix page table access in 5-level to 4-level paging transition Usama Arif <usamaarif642(a)gmail.com> x86/boot: Fix page table access in 5-level to 4-level paging transition Xiaoqi Zhuang <xiaoqi.zhuang(a)oss.qualcomm.com> coresight: ETR: Fix ETR buffer use-after-free issue Peter Zijlstra <peterz(a)infradead.org> entry,unwind/deferred: Fix unwind_reset_info() placement Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible Yegor Yefremov <yegorslists(a)googlemail.com> ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels Alan Maguire <alan.maguire(a)oracle.com> libbpf: Fix parsing of multi-split BTF Vishwaroop A <va(a)nvidia.com> spi: tegra210-quad: Fix timeout handling Christian Brauner <brauner(a)kernel.org> cleanup: fix scoped_class() Songtang Liu <liusongtang(a)bytedance.com> iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show Thomas Richard (TI.com) <thomas.richard(a)bootlin.com> firmware: ti_sci: Set IO Isolation only if the firmware is capable Boris Brezillon <boris.brezillon(a)collabora.com> drm/panthor: Fix UAF on kernel BO VA nodes Ketil Johnsen <ketil.johnsen(a)arm.com> drm/panthor: Fix race with suspend during unplug Ketil Johnsen <ketil.johnsen(a)arm.com> drm/panthor: Fix UAF race between device unplug and FW event processing Boris Brezillon <boris.brezillon(a)collabora.com> drm/panthor: Fix group_free_queue() for partially initialized queues Boris Brezillon <boris.brezillon(a)collabora.com> drm/panthor: Handle errors returned by drm_sched_entity_init() Tingmao Wang <m(a)maowtm.org> fs/9p: Don't open remote file with APPEND mode when writeback cache is used Mike Christie <michael.christie(a)oracle.com> scsi: target: Fix LUN/device R/W and total command stats Bart Van Assche <bvanassche(a)acm.org> scsi: target: Do not write NUL characters into ASCII configfs output Ahelenia Ziemiańska <nabijaczleweli(a)nabijaczleweli.xyz> power: supply: apm_power: only unset own apm_get_power_status Ivan Abramov <i.abramov(a)mt-integration.ru> power: supply: wm831x: Check wm831x_set_bits() return value Murad Masimov <m.masimov(a)mt-integration.ru> power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() Ivan Abramov <i.abramov(a)mt-integration.ru> power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() Ivan Abramov <i.abramov(a)mt-integration.ru> power: supply: max17040: Check iio_read_channel_processed() return code Ivan Abramov <i.abramov(a)mt-integration.ru> power: supply: cw2015: Check devm_delayed_work_autocancel() return code Haotian Zhang <vulab(a)iscas.ac.cn> power: supply: rt5033_charger: Fix device node reference leaks Frederic Weisbecker <frederic(a)kernel.org> timers/migration: Fix imbalanced NUMA trees Frederic Weisbecker <frederic(a)kernel.org> timers/migration: Remove locking on group connection Frederic Weisbecker <frederic(a)kernel.org> timers/migration: Convert "while" loops to use "for" Shuai Xue <xueshuai(a)linux.alibaba.com> perf record: skip synthesize event when open evsel failed Namhyung Kim <namhyung(a)kernel.org> perf lock contention: Load kernel map before lookup Geert Uytterhoeven <geert+renesas(a)glider.be> drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() Marek Vasut <marek.vasut+renesas(a)mailbox.org> arm64: dts: renesas: sparrow-hawk: Fix full-size DP connector node name and labels Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: debugfs: Fix incorrect error handling for NULL path Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix incorrect command state for timed out job Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS Rameshkumar Sundaram <rameshkumar.sundaram(a)oss.qualcomm.com> wifi: ath12k: unassign arvif on scan vdev create failure Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath12k: fix error handling in creating hardware group Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath12k: fix reusing m3 memory Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() Jacob Keller <jacob.e.keller(a)intel.com> docs: kdoc: fix duplicate section warning message Arnd Bergmann <arnd(a)arndb.de> random: use offstack cpumask when necessary Stanley Chu <yschu(a)nuvoton.com> i3c: master: svc: Prevent incomplete IBI transaction Frank Li <Frank.Li(a)nxp.com> i3c: fix refcount inconsistency in i3c_master_register Christian Brauner <brauner(a)kernel.org> pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info Christian Brauner <brauner(a)kernel.org> pidfs: add missing PIDFD_INFO_SIZE_VER1 Tomasz Rusinowicz <tomasz.rusinowicz(a)intel.com> accel/ivpu: Fix race condition when unbinding BOs Danilo Krummrich <dakr(a)kernel.org> drm: nova: select NOVA_CORE Haotian Zhang <vulab(a)iscas.ac.cn> pinctrl: stm32: fix hwspinlock resource leak in probe function Haotian Zhang <vulab(a)iscas.ac.cn> soc: qcom: smem: fix hwspinlock resource leak in probe error paths Taniya Das <taniya.das(a)oss.qualcomm.com> clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops Benjamin Berg <benjamin.berg(a)intel.com> tools/nolibc/dirent: avoid errno in readdir_r Benjamin Berg <benjamin.berg(a)intel.com> tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set Sebastian Reichel <sre(a)kernel.org> media: ov02c10: Fix default vertical flip Maciej Falkowski <maciej.falkowski(a)linux.intel.com> accel/ivpu: Remove skip of dma unmap for imported buffers Tengda Wu <wutengda(a)huaweicloud.com> x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() Peter Zijlstra <peterz(a)infradead.org> task_work: Fix NMI race condition Zhang Rui <rui.zhang(a)intel.com> perf/x86/intel/cstate: Remove PC3 support from LunarLake Arnaud Lecomte <contact(a)arnaud-lcm.com> bpf: Fix stackmap overflow check in __bpf_get_stackid() Arnaud Lecomte <contact(a)arnaud-lcm.com> bpf: Refactor stack map trace depth calculation into helper function Josh Poimboeuf <jpoimboe(a)kernel.org> perf: Remove get_perf_callchain() init_nr argument Haotian Zhang <vulab(a)iscas.ac.cn> mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove Aryan Srivastava <aryan.srivastava(a)alliedtelesis.co.nz> mtd: nand: relax ECC parameter validation check Aryan Srivastava <aryan.srivastava(a)alliedtelesis.co.nz> Revert "mtd: rawnand: marvell: fix layouts" Li Qiang <liqiang01(a)kylinos.cn> wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/userq: fix SDMA and compute validation Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: add userq object va track helpers Wolfram Sang <wsa+renesas(a)sang-engineering.com> ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties Wolfram Sang <wsa+renesas(a)sang-engineering.com> ARM: dts: renesas: gose: Remove superfluous port property Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rxe: Fix null deref on srq->rq.queue after resize failure Loic Poulain <loic.poulain(a)oss.qualcomm.com> arm64: dts: qcom: qcm2290: Fix camss register prop ordering Loic Poulain <loic.poulain(a)oss.qualcomm.com> arm64: dts: qcom: qcm2290: Add CCI node Kuniyuki Iwashima <kuniyu(a)google.com> sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Fix PTP for VSC8574 and VSC8572 Michal Suchanek <msuchanek(a)suse.de> perf hwmon_pmu: Fix uninitialized variable warning Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> arm64: dts: qcom: sdm845-starqltechn: Fix i2c-gpio node name Alexander Martinz <amartinz(a)shiftphones.com> arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory Neil Armstrong <neil.armstrong(a)linaro.org> arm64: dts: qcom: sm8650: set ufs as dma coherent Luca Weiss <luca.weiss(a)fairphone.com> arm64: dts: qcom: qcm6490-fairphone-fp5: Add supplies to simple-fb node Gergo Koteles <soyer(a)irl.hu> arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider Dzmitry Sankouski <dsankouski(a)gmail.com> arm64: dts: qcom: sdm845-starqltechn: fix max77705 interrupts Eric Gonçalves <ghatto404(a)gmail.com> arm64: dts: qcom: starqltechn: remove extra empty line Dzmitry Sankouski <dsankouski(a)gmail.com> arm64: dts: qcom: sdm845-starqltechn: remove (address|size)-cells Krishna Kurapati <krishna.kurapati(a)oss.qualcomm.com> arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller Krishna Kurapati <krishna.kurapati(a)oss.qualcomm.com> arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller Peng Fan <peng.fan(a)nxp.com> firmware: imx: scu-irq: fix OF node leak in Randolph Sapp <rs(a)ti.com> arm64: dts: ti: k3-am62p: Fix memory ranges for GPU Bhanu Seshu Kumar Valluri <bhanuseshukumar(a)gmail.com> PCI: endpoint: pci-epf-test: Fix sleeping function being called from atomic context Thomas Richard <thomas.richard(a)bootlin.com> leds: upboard: Fix module alias Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath12k: restore register window after global reset Len Brown <len.brown(a)intel.com> tools/power turbostat: Regression fix Uncore MHz printed in hex Heiko Carstens <hca(a)linux.ibm.com> s390/ap: Don't leak debug feature files if AP instructions are not available Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Move the ufshcd_enable_intr() declaration Heiko Carstens <hca(a)linux.ibm.com> s390/smp: Fix fallback CPU detection Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath11k: fix peer HE MCS assignment Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath11k: fix VHT MCS assignment nieweiqiang <nieweiqiang(a)huawei.com> crypto: hisilicon/qm - restore original qos values Thorsten Blum <thorsten.blum(a)linux.dev> crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Haotian Zhang <vulab(a)iscas.ac.cn> soc: qcom: gsbi: fix double disable caused by devm Luca Weiss <luca.weiss(a)fairphone.com> clk: qcom: camcc-sm7150: Fix PLL config of PLL2 Luca Weiss <luca.weiss(a)fairphone.com> clk: qcom: camcc-sm6350: Fix PLL config of PLL2 Luo Jie <quic_luoj(a)quicinc.com> clk: qcom: gcc-ipq5424: Correct the icc_first_node_id Taniya Das <taniya.das(a)oss.qualcomm.com> clk: qcom: gcc-sm8750: Add a new frequency for sdcc2 clock Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> clk: qcom: rpmh: Define RPMH_IPA_CLK on QCS615 Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other Sherry Sun <sherry.sun(a)nxp.com> tty: serial: imx: Only configure the wake register when device is set as wakeup source Jiri Slaby (SUSE) <jirislaby(a)kernel.org> tty: introduce tty_port_tty guard() Li Qiang <liqiang01(a)kylinos.cn> uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe Geert Uytterhoeven <geert+renesas(a)glider.be> PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 Peter Griffin <peter.griffin(a)linaro.org> arm64: dts: exynos: gs101: fix sysreg_apm reg property Tianyou Li <tianyou.li(a)intel.com> perf annotate: Check return value of evsel__get_arch() properly Joy Zou <joy.zou(a)nxp.com> arm64: dts: imx95-15x15-evk: add fan-supply property for pwm-fan Tim Harvey <tharvey(a)gateworks.com> arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 Tim Harvey <tharvey(a)gateworks.com> arm64: dts: imx8mp-venice-gw702x: remove off-board uart Tim Harvey <tharvey(a)gateworks.com> arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl Tim Harvey <tharvey(a)gateworks.com> arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props Bart Van Assche <bvanassche(a)acm.org> block/mq-deadline: Switch back to a single dispatch list Bart Van Assche <bvanassche(a)acm.org> block/mq-deadline: Introduce dd_start_request() T Pratham <t-pratham(a)ti.com> crypto: aead - Fix reqsize handling Randy Dunlap <rdunlap(a)infradead.org> firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> inet: Avoid ehash lookup race in inet_ehash_insert() Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets Sidharth Seela <sidharthseela(a)gmail.com> ntfs3: Fix uninit buffer allocated by __getname() Raphael Pinsonneault-Thibeault <rpthibeault(a)gmail.com> ntfs3: fix uninit memory after failed mi_read in mi_format_new Herbert Xu <herbert(a)gondor.apana.org.au> crypto: authenc - Correctly pass EINPROGRESS back up to the caller Johan Hovold <johan(a)kernel.org> irqchip/qcom-irq-combiner: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/starfive-jh8100: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/renesas-rzg2l: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/imx-mu-msi: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/irq-brcmstb-l2: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/irq-bcm7120-l2: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/irq-bcm7038-l1: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/bcm2712-mip: Fix section mismatch Johan Hovold <johan(a)kernel.org> irqchip/bcm2712-mip: Fix OF node reference imbalance Fernand Sieber <sieberf(a)amazon.com> sched/fair: Forfeit vruntime on yield Pradeep Kumar Chitrapu <quic_pradeepc(a)quicinc.com> wifi: ath12k: fix TX and RX MCS rate configurations in HE mode Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath12k: fix VHT MCS assignment Sarika Sharma <sarika.sharma(a)oss.qualcomm.com> wifi: ath12k: Fix MSDU buffer types handling in RX error path Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath11k: restore register window after global reset Kang Yang <kang.yang(a)oss.qualcomm.com> wifi: ath10k: move recovery check logic into a new work Ian Rogers <irogers(a)google.com> perf parse-events: Fix legacy cache events if event is duplicated in a PMU Wludzik, Jozef <jozef.wludzik(a)intel.com> accel/ivpu: Fix race condition when mapping dmabuf Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix weak symbol detection Dylan Hatch <dylanbhatch(a)google.com> objtool: Fix standalone --hacks=jump_label Peng Fan <peng.fan(a)nxp.com> remoteproc: imx_rproc: Fix runtime PM cleanup and improve remove path Mavroudis Chatzilazaridis <mavchatz(a)protonmail.com> HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() Cyrille Pitchen <cyrille.pitchen(a)microchip.com> drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() Marek Vasut <marek.vasut+renesas(a)mailbox.org> clk: renesas: cpg-mssr: Read back reset registers to assure values latched Marek Vasut <marek.vasut+renesas(a)mailbox.org> clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback Biju Das <biju.das.jz(a)bp.renesas.com> pinctrl: renesas: rzg2l: Fix PMC restore Roberto Sassu <roberto.sassu(a)huawei.com> ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook Ian Rogers <irogers(a)google.com> perf bpf_counter: Fix opening of "any"(-1) CPU events Seungjin Bae <eeodqql09(a)gmail.com> USB: Fix descriptor count when handling invalid MBIM extended descriptor Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> tools/nolibc: handle NULL wstatus argument to waitpid() Siddharth Chintamaneni <sidchintamaneni(a)gmail.com> bpf: Cleanup unused func args in rqspinlock implementation Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/vgem-fence: Fix potential deadlock on release Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Fix DCT active percent format Jacek Lawrynowicz <jacek.lawrynowicz(a)linux.intel.com> accel/ivpu: Make function parameter names consistent Jacek Lawrynowicz <jacek.lawrynowicz(a)linux.intel.com> accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() Jacek Lawrynowicz <jacek.lawrynowicz(a)linux.intel.com> accel/ivpu: Rework bind/unbind of imported buffers Guido Günther <agx(a)sigxcpu.org> drm/panel: visionox-rm69299: Don't clear all mode flags Guido Günther <agx(a)sigxcpu.org> drm/panel: visionox-rm69299: Fix clock frequency for SHIFT6mq Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail Mainak Sen <msen(a)nvidia.com> gpu: host1x: Fix race in syncpt alloc/free Konstantin Andreev <andreev(a)swemel.ru> smack: fix bug: setting task label silently ignores input garbage Konstantin Andreev <andreev(a)swemel.ru> smack: fix bug: unprivileged task can create labels Konstantin Andreev <andreev(a)swemel.ru> smack: fix bug: invalid label of unix socket file Konstantin Andreev <andreev(a)swemel.ru> smack: always "instantiate" inode in smack_inode_init_security() Konstantin Andreev <andreev(a)swemel.ru> smack: deduplicate xattr setting in smack_inode_init_security() Konstantin Andreev <andreev(a)swemel.ru> smack: fix bug: SMACK64TRANSMUTE set on non-directory Konstantin Andreev <andreev(a)swemel.ru> smack: deduplicate "does access rule request transmutation" ------------- Diffstat: Documentation/admin-guide/LSM/Smack.rst | 16 +- .../bindings/clock/qcom,x1e80100-gcc.yaml | 62 +- .../devicetree/bindings/pci/amlogic,axg-pcie.yaml | 6 +- Documentation/hwmon/g762.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/renesas/r8a7793-gose.dts | 1 - .../arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts | 2 - arch/arm/boot/dts/samsung/exynos4210-i9100.dts | 1 + arch/arm/boot/dts/samsung/exynos4210-trats.dts | 1 + .../boot/dts/samsung/exynos4210-universal_c210.dts | 1 + arch/arm/boot/dts/samsung/exynos4412-midas.dtsi | 1 + .../dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi | 8 +- .../boot/dts/ti/omap/am335x-netcom-plus-2xx.dts | 8 +- arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts | 2 +- arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 +- arch/arm/include/asm/word-at-a-time.h | 10 +- arch/arm64/boot/dts/exynos/google/gs101.dtsi | 4 +- .../boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 - .../boot/dts/freescale/imx8mp-venice-gw702x.dtsi | 51 -- .../boot/dts/freescale/imx8mp-venice-gw72xx.dtsi | 11 - arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts | 1 + .../arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi | 4 +- arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 + arch/arm64/boot/dts/qcom/qcm2290.dtsi | 60 +- arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts | 2 + arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts | 5 + arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 2 +- .../arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 4 +- .../boot/dts/qcom/sdm845-samsung-starqltechn.dts | 17 +- arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 + arch/arm64/boot/dts/qcom/x1e80100.dtsi | 12 +- .../boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 6 +- arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts | 1 + arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 15 +- arch/arm64/boot/dts/ti/k3-am62p.dtsi | 2 +- arch/powerpc/kernel/entry_32.S | 10 +- arch/powerpc/kexec/ranges.c | 2 +- arch/powerpc/mm/book3s64/hash_utils.c | 10 +- arch/powerpc/mm/ptdump/hashpagetable.c | 6 + arch/riscv/kvm/vcpu_insn.c | 22 + arch/s390/include/asm/fpu-insn.h | 3 + arch/s390/kernel/smp.c | 1 + arch/um/Makefile | 12 +- arch/x86/boot/compressed/pgtable_64.c | 11 +- arch/x86/events/core.c | 5 +- arch/x86/events/intel/core.c | 7 +- arch/x86/events/intel/cstate.c | 3 +- arch/x86/kernel/dumpstack.c | 23 +- block/blk-lib.c | 6 +- block/blk-mq.c | 35 +- block/blk-throttle.c | 9 +- block/mq-deadline.c | 129 ++-- crypto/aead.c | 1 + crypto/ahash.c | 18 +- crypto/asymmetric_keys/asymmetric_type.c | 12 +- crypto/authenc.c | 75 ++- drivers/accel/amdxdna/aie2_ctx.c | 22 +- drivers/accel/amdxdna/amdxdna_ctx.c | 1 + drivers/accel/amdxdna/amdxdna_ctx.h | 1 + drivers/accel/amdxdna/amdxdna_mailbox.c | 1 + drivers/accel/ivpu/ivpu_fw.h | 2 +- drivers/accel/ivpu/ivpu_gem.c | 97 ++- drivers/accel/ivpu/ivpu_gem.h | 2 +- drivers/accel/ivpu/ivpu_hw_btrs.c | 2 +- drivers/accel/ivpu/ivpu_hw_btrs.h | 2 +- drivers/accel/ivpu/ivpu_job.c | 6 +- drivers/accel/ivpu/ivpu_pm.c | 9 +- drivers/acpi/apei/ghes.c | 27 +- drivers/acpi/processor_core.c | 2 +- drivers/acpi/property.c | 1 + drivers/base/firmware_loader/Kconfig | 2 +- drivers/block/nbd.c | 5 +- drivers/block/ps3disk.c | 4 + drivers/block/ublk_drv.c | 4 +- drivers/char/random.c | 19 +- drivers/clk/Makefile | 3 +- drivers/clk/qcom/camcc-sm6350.c | 13 +- drivers/clk/qcom/camcc-sm7150.c | 6 +- drivers/clk/qcom/camcc-sm8550.c | 10 + drivers/clk/qcom/clk-rpmh.c | 1 + drivers/clk/qcom/gcc-ipq5424.c | 3 +- drivers/clk/qcom/gcc-qcs615.c | 6 +- drivers/clk/qcom/gcc-sm8750.c | 1 + drivers/clk/qcom/gcc-x1e80100.c | 698 ++++++++++++++++++++- drivers/clk/renesas/r9a06g032-clocks.c | 6 +- drivers/clk/renesas/r9a09g077-cpg.c | 4 +- drivers/clk/renesas/renesas-cpg-mssr.c | 57 +- drivers/clk/spacemit/ccu-k1.c | 4 +- drivers/clocksource/timer-nxp-stm.c | 23 +- drivers/clocksource/timer-ralink.c | 11 +- drivers/cpufreq/amd-pstate.c | 2 +- drivers/crypto/ccree/cc_buffer_mgr.c | 6 +- drivers/crypto/hisilicon/qm.c | 14 +- drivers/crypto/intel/iaa/iaa_crypto_main.c | 2 +- drivers/crypto/starfive/jh7110-hash.c | 6 +- drivers/devfreq/hisi_uncore_freq.c | 3 +- drivers/firmware/efi/cper-arm.c | 52 +- drivers/firmware/efi/cper.c | 60 ++ drivers/firmware/efi/libstub/x86-5lvl.c | 4 +- drivers/firmware/imx/imx-scu-irq.c | 4 +- drivers/firmware/stratix10-svc.c | 1 + drivers/firmware/ti_sci.c | 21 +- drivers/firmware/ti_sci.h | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 44 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 12 +- drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 31 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 46 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +- drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 27 +- drivers/gpu/drm/drm_plane.c | 8 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 43 +- drivers/gpu/drm/i915/display/intel_fbdev_fb.c | 42 +- drivers/gpu/drm/i915/display/intel_fbdev_fb.h | 8 +- drivers/gpu/drm/imagination/pvr_device.c | 2 +- drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 +- drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 34 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 10 +- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h | 6 - drivers/gpu/drm/msm/msm_gpu.c | 21 +- .../gpu/drm/nouveau/dispnv04/nouveau_i2c_encoder.c | 20 - .../drm/nouveau/include/dispnv04/i2c/encoder_i2c.h | 19 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 6 +- drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c | 2 +- drivers/gpu/drm/nova/Kconfig | 1 + drivers/gpu/drm/panel/panel-visionox-rm69299.c | 4 +- drivers/gpu/drm/panthor/panthor_device.c | 4 +- drivers/gpu/drm/panthor/panthor_gem.c | 20 +- drivers/gpu/drm/panthor/panthor_mmu.c | 18 +- drivers/gpu/drm/panthor/panthor_sched.c | 44 +- drivers/gpu/drm/tidss/tidss_dispc.c | 93 ++- drivers/gpu/drm/tidss/tidss_dispc.h | 3 - drivers/gpu/drm/tidss/tidss_drv.h | 2 + drivers/gpu/drm/tidss/tidss_oldi.c | 22 + drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 32 +- drivers/gpu/host1x/syncpt.c | 4 +- drivers/greybus/gb-beagleplay.c | 12 +- drivers/hid/hid-logitech-hidpp.c | 9 +- drivers/hv/channel.c | 73 ++- drivers/hv/hyperv_vmbus.h | 5 +- drivers/hv/mshv_root_main.c | 89 ++- drivers/hv/ring_buffer.c | 5 +- drivers/hv/vmbus_drv.c | 12 + drivers/hwmon/sy7636a-hwmon.c | 7 +- drivers/hwtracing/coresight/coresight-etm-perf.c | 1 + drivers/hwtracing/coresight/coresight-etm3x-core.c | 59 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 103 ++- drivers/hwtracing/coresight/coresight-etm4x.h | 3 - drivers/hwtracing/coresight/coresight-tmc-etr.c | 10 +- drivers/i2c/busses/i2c-k1.c | 19 +- drivers/i3c/master.c | 8 +- drivers/i3c/master/svc-i3c-master.c | 22 +- drivers/iio/imu/bmi270/bmi270_spi.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 +- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 +- drivers/infiniband/hw/bnxt_re/qplib_sp.h | 2 +- drivers/infiniband/hw/irdma/cm.c | 2 +- drivers/infiniband/hw/irdma/ctrl.c | 3 + drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/pble.c | 6 +- drivers/infiniband/hw/irdma/verbs.c | 15 +- drivers/infiniband/hw/irdma/verbs.h | 3 +- drivers/infiniband/sw/rxe/rxe_srq.c | 7 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- drivers/interconnect/debugfs-client.c | 7 +- drivers/interconnect/qcom/msm8996.c | 1 + drivers/iommu/amd/debugfs.c | 2 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 +- drivers/iommu/intel/iommu.h | 2 +- drivers/irqchip/irq-bcm2712-mip.c | 3 +- drivers/irqchip/irq-bcm7038-l1.c | 8 +- drivers/irqchip/irq-bcm7120-l2.c | 17 +- drivers/irqchip/irq-brcmstb-l2.c | 12 +- drivers/irqchip/irq-imx-mu-msi.c | 14 +- drivers/irqchip/irq-mchp-eic.c | 2 +- drivers/irqchip/irq-renesas-rzg2l.c | 6 +- drivers/irqchip/irq-starfive-jh8100-intc.c | 3 +- drivers/irqchip/qcom-irq-combiner.c | 2 +- drivers/leds/leds-netxbig.c | 36 +- drivers/leds/leds-upboard.c | 2 +- drivers/leds/rgb/leds-qcom-lpg.c | 4 +- drivers/macintosh/mac_hid.c | 3 +- drivers/md/dm-log-writes.c | 1 + drivers/md/dm-raid.c | 2 + drivers/md/md.c | 23 +- drivers/md/md.h | 9 +- drivers/md/raid5.c | 6 +- drivers/media/i2c/ov02c10.c | 2 +- drivers/mfd/da9055-core.c | 1 + drivers/mfd/mt6358-irq.c | 1 + drivers/mfd/mt6397-irq.c | 1 + drivers/misc/rp1/rp1_pci.c | 3 + drivers/mtd/lpddr/lpddr_cmds.c | 8 +- drivers/mtd/nand/raw/lpc32xx_slc.c | 2 + drivers/mtd/nand/raw/marvell_nand.c | 13 +- drivers/mtd/nand/raw/nand_base.c | 13 +- drivers/mtd/nand/raw/renesas-nand-controller.c | 5 +- drivers/net/dsa/b53/b53_common.c | 331 ++++++---- drivers/net/dsa/b53/b53_priv.h | 111 +++- drivers/net/dsa/b53/b53_regs.h | 41 +- drivers/net/dsa/xrs700x/xrs700x.c | 11 + drivers/net/ethernet/intel/iavf/iavf_ptp.c | 7 + drivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c | 20 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c | 3 +- drivers/net/phy/adin1100.c | 2 +- drivers/net/phy/aquantia/aquantia_firmware.c | 2 +- drivers/net/phy/mscc/mscc_main.c | 6 +- drivers/net/phy/phy-core.c | 43 ++ drivers/net/phy/realtek/realtek_main.c | 65 +- drivers/net/wireless/ath/ath10k/core.c | 20 +- drivers/net/wireless/ath/ath10k/core.h | 2 +- drivers/net/wireless/ath/ath10k/mac.c | 2 +- drivers/net/wireless/ath/ath11k/mac.c | 8 +- drivers/net/wireless/ath/ath11k/pci.c | 20 +- drivers/net/wireless/ath/ath11k/wmi.c | 20 +- drivers/net/wireless/ath/ath11k/wmi.h | 2 + drivers/net/wireless/ath/ath12k/core.c | 24 +- drivers/net/wireless/ath/ath12k/core.h | 1 - drivers/net/wireless/ath/ath12k/dp_rx.c | 70 ++- drivers/net/wireless/ath/ath12k/hal_rx.c | 10 +- drivers/net/wireless/ath/ath12k/mac.c | 16 +- drivers/net/wireless/ath/ath12k/pci.c | 20 +- drivers/net/wireless/ath/ath12k/qmi.c | 11 +- drivers/net/wireless/ath/ath12k/qmi.h | 5 +- drivers/net/wireless/ath/ath12k/wmi.c | 23 +- drivers/net/wireless/ath/ath12k/wmi.h | 2 + drivers/net/wireless/ath/ath12k/wow.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/d3.c | 4 + drivers/net/wireless/mediatek/mt76/mt76.h | 9 + drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 4 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 25 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 23 +- drivers/net/wireless/mediatek/mt76/mt792x_core.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 95 ++- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 34 +- drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 1 + drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 9 +- drivers/net/wireless/mediatek/mt76/wed.c | 10 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 27 +- drivers/net/wireless/realtek/rtw89/usb.c | 13 +- drivers/net/wireless/st/cw1200/bh.c | 6 +- drivers/nvme/host/auth.c | 2 +- drivers/of/fdt.c | 57 +- drivers/of/of_kunit_helpers.c | 5 +- drivers/pci/controller/Kconfig | 7 +- drivers/pci/controller/dwc/pci-keystone.c | 2 + drivers/pci/controller/dwc/pcie-designware.h | 2 +- drivers/pci/endpoint/functions/pci-epf-test.c | 5 +- drivers/pci/setup-bus.c | 5 + drivers/phy/freescale/phy-fsl-imx8qm-hsio.c | 5 +- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 20 +- drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 530 ++++++++-------- drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 27 +- drivers/pinctrl/pinctrl-single.c | 7 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 6 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- drivers/platform/x86/asus-wmi.c | 8 +- drivers/platform/x86/intel/pmc/core.h | 2 +- drivers/power/supply/apm_power.c | 3 +- drivers/power/supply/cw2015_battery.c | 8 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/power/supply/rt5033_charger.c | 2 + drivers/power/supply/rt9467-charger.c | 6 +- drivers/power/supply/wm831x_power.c | 10 +- drivers/pwm/pwm-bcm2835.c | 28 +- drivers/ras/ras.c | 40 +- drivers/regulator/core.c | 37 +- drivers/regulator/fixed.c | 11 +- drivers/regulator/pca9450-regulator.c | 7 +- drivers/remoteproc/imx_rproc.c | 9 +- drivers/remoteproc/qcom_q6v5_wcss.c | 8 +- drivers/rtc/rtc-amlogic-a4.c | 4 - drivers/rtc/rtc-gamecube.c | 4 + drivers/rtc/rtc-max31335.c | 6 +- drivers/s390/crypto/ap_bus.c | 8 +- drivers/scsi/imm.c | 1 + drivers/scsi/qla2xxx/qla_nvme.c | 2 +- drivers/scsi/sim710.c | 2 + drivers/scsi/smartpqi/smartpqi_init.c | 19 + drivers/scsi/stex.c | 1 + drivers/soc/qcom/qcom_gsbi.c | 8 - drivers/soc/qcom/smem.c | 3 +- drivers/spi/spi-airoha-snfi.c | 25 +- drivers/spi/spi-ch341.c | 2 +- drivers/spi/spi-sg2044-nor.c | 4 +- drivers/spi/spi-tegra210-quad.c | 22 +- drivers/staging/fbtft/fbtft-core.c | 4 +- drivers/staging/most/Kconfig | 2 - drivers/staging/most/Makefile | 1 - drivers/staging/most/i2c/Kconfig | 13 - drivers/staging/most/i2c/Makefile | 4 - drivers/staging/most/i2c/i2c.c | 374 ----------- drivers/target/target_core_configfs.c | 1 - drivers/target/target_core_stat.c | 24 +- drivers/tty/serial/imx.c | 14 + drivers/ufs/core/ufshcd-priv.h | 2 + drivers/ufs/core/ufshcd.c | 2 +- drivers/ufs/host/ufs-rockchip.c | 19 +- drivers/uio/uio_fsl_elbc_gpcm.c | 7 + drivers/usb/core/message.c | 2 +- drivers/usb/dwc2/platform.c | 17 +- drivers/usb/dwc3/host.c | 5 +- drivers/usb/gadget/legacy/raw_gadget.c | 3 + drivers/usb/gadget/udc/tegra-xudc.c | 6 - drivers/usb/misc/chaoskey.c | 16 +- drivers/usb/phy/phy.c | 4 + drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 2 + drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +- drivers/vdpa/pds/vdpa_dev.c | 2 +- drivers/vfio/pci/vfio_pci_core.c | 68 +- drivers/vfio/pci/vfio_pci_intrs.c | 52 +- drivers/vfio/pci/vfio_pci_priv.h | 4 + drivers/vhost/net.c | 12 +- drivers/vhost/vhost.c | 4 +- drivers/video/backlight/led_bl.c | 13 + drivers/video/fbdev/ssd1307fb.c | 4 +- drivers/virtio/virtio.c | 12 +- drivers/virtio/virtio_debug.c | 10 +- drivers/virtio/virtio_pci_modern_dev.c | 6 +- drivers/virtio/virtio_vdpa.c | 2 +- drivers/watchdog/starfive-wdt.c | 4 +- drivers/watchdog/wdat_wdt.c | 64 +- fs/9p/v9fs.c | 4 +- fs/9p/vfs_file.c | 11 +- fs/9p/vfs_inode.c | 3 +- fs/9p/vfs_inode_dotl.c | 2 +- fs/btrfs/block-group.c | 6 +- fs/btrfs/ctree.c | 2 +- fs/btrfs/delayed-ref.c | 43 +- fs/btrfs/space-info.c | 22 +- fs/btrfs/space-info.h | 6 +- fs/erofs/super.c | 38 +- fs/ext4/mballoc.c | 49 +- fs/ext4/move_extent.c | 2 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/gc.c | 132 ++-- fs/f2fs/recovery.c | 2 +- fs/f2fs/segment.c | 38 +- fs/f2fs/segment.h | 8 +- fs/f2fs/super.c | 14 + fs/f2fs/sysfs.c | 7 + fs/fuse/control.c | 19 +- fs/gfs2/glock.c | 5 +- fs/gfs2/inode.c | 15 + fs/gfs2/inode.h | 1 + fs/gfs2/ops_fstype.c | 2 +- fs/iomap/direct-io.c | 13 +- fs/kernfs/dir.c | 5 +- fs/nfs/client.c | 21 +- fs/nfs/dir.c | 27 +- fs/nfs/internal.h | 3 +- fs/nfs/namespace.c | 11 +- fs/nfs/nfs4client.c | 18 +- fs/nfs/nfs4proc.c | 27 +- fs/nfs/pnfs.c | 1 + fs/nfs/super.c | 33 +- fs/nfsd/blocklayout.c | 4 +- fs/nls/nls_base.c | 27 +- fs/ntfs3/frecord.c | 8 +- fs/ntfs3/fsntfs.c | 9 +- fs/ntfs3/inode.c | 2 + fs/ocfs2/alloc.c | 1 - fs/ocfs2/inode.c | 10 +- fs/ocfs2/move_extents.c | 8 +- fs/pidfs.c | 2 + fs/smb/client/cifssmb.c | 2 +- fs/smb/client/smb2pdu.c | 2 +- fs/tracefs/event_inode.c | 3 +- include/asm-generic/mshyperv.h | 17 +- include/asm-generic/rqspinlock.h | 60 +- include/dt-bindings/clock/qcom,x1e80100-gcc.h | 61 ++ include/hyperv/hvgdk_mini.h | 1 + include/linux/blk_types.h | 5 +- include/linux/cleanup.h | 15 +- include/linux/coresight.h | 35 +- include/linux/cper.h | 12 +- include/linux/f2fs_fs.h | 5 +- include/linux/filter.h | 12 +- include/linux/firmware/qcom/qcom_tzmem.h | 15 +- include/linux/hyperv.h | 69 +- include/linux/ieee80211.h | 4 +- include/linux/if_hsr.h | 9 + include/linux/irq-entry-common.h | 2 +- include/linux/nfs_fs_sb.h | 5 + include/linux/of_fdt.h | 9 + include/linux/perf_event.h | 2 +- include/linux/phy.h | 3 + include/linux/platform_data/lp855x.h | 4 +- include/linux/ras.h | 16 +- include/linux/rculist_nulls.h | 59 ++ include/linux/soc/mediatek/mtk_wed.h | 1 + include/linux/tty_port.h | 14 + include/linux/vfio_pci_core.h | 10 +- include/linux/virtio.h | 2 +- include/linux/virtio_config.h | 10 +- include/linux/virtio_features.h | 29 +- include/linux/virtio_pci_modern.h | 8 +- include/net/netfilter/nf_conntrack_count.h | 15 +- include/net/sock.h | 13 + include/ras/ras_event.h | 49 +- include/sound/tas2781.h | 2 +- include/target/target_core_base.h | 12 +- include/uapi/linux/pidfd.h | 1 + include/uapi/sound/asound.h | 2 +- include/ufs/ufshcd.h | 1 - io_uring/io_uring.c | 10 +- kernel/bpf/hashtab.c | 10 +- kernel/bpf/helpers.c | 3 + kernel/bpf/rqspinlock.c | 36 +- kernel/bpf/stackmap.c | 66 +- kernel/bpf/syscall.c | 3 + kernel/bpf/trampoline.c | 4 +- kernel/cgroup/cpuset.c | 35 +- kernel/cpu.c | 25 +- kernel/dma/pool.c | 2 +- kernel/events/callchain.c | 12 +- kernel/events/core.c | 24 +- kernel/locking/locktorture.c | 8 +- kernel/resource.c | 10 +- kernel/sched/fair.c | 17 +- kernel/sched/stats.h | 7 +- kernel/task_work.c | 8 +- kernel/time/timer_migration.c | 264 ++++---- lib/vsprintf.c | 6 +- net/core/filter.c | 9 +- net/core/netpoll.c | 2 +- net/hsr/hsr_device.c | 20 + net/hsr/hsr_slave.c | 7 +- net/ipv4/inet_hashtables.c | 8 +- net/ipv4/inet_timewait_sock.c | 35 +- net/ipv6/ip6_fib.c | 4 + net/mac80211/aes_cmac.c | 63 +- net/mac80211/aes_cmac.h | 8 +- net/mac80211/wpa.c | 20 +- net/netfilter/nf_conncount.c | 195 ++++-- net/netfilter/nft_connlimit.c | 34 +- net/netfilter/nft_flow_offload.c | 9 +- net/netfilter/xt_connlimit.c | 14 +- net/openvswitch/conntrack.c | 16 +- net/sched/sch_cake.c | 60 +- net/sctp/socket.c | 5 +- scripts/lib/kdoc/kdoc_parser.py | 16 +- scripts/package/install-extmod-build | 2 +- security/integrity/ima/ima_main.c | 40 +- security/integrity/ima/ima_policy.c | 2 +- security/smack/smack.h | 3 + security/smack/smack_access.c | 93 ++- security/smack/smack_lsm.c | 277 +++++--- sound/firewire/dice/dice-extension.c | 4 +- sound/firewire/motu/motu-hwdep.c | 7 +- sound/hda/codecs/realtek/alc269.c | 2 + sound/hda/codecs/side-codecs/cs35l41_hda.c | 2 + sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 44 +- sound/isa/wavefront/wavefront_synth.c | 4 +- sound/soc/amd/acp/acp-i2s.c | 2 + sound/soc/amd/acp/acp-legacy-common.c | 30 +- sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 +- sound/soc/codecs/Kconfig | 5 + sound/soc/codecs/Makefile | 2 + sound/soc/codecs/ak4458.c | 10 +- sound/soc/codecs/ak5558.c | 10 +- sound/soc/codecs/nau8325.c | 3 +- sound/soc/codecs/tas2781-i2c.c | 2 +- sound/soc/fsl/fsl_xcvr.c | 2 +- sound/soc/intel/catpt/pcm.c | 4 +- sound/soc/sdca/sdca_functions.c | 2 +- tools/include/nolibc/dirent.h | 6 +- tools/include/nolibc/stdio.h | 4 + tools/include/nolibc/sys/wait.h | 18 +- tools/lib/bpf/btf.c | 4 +- tools/objtool/check.c | 3 +- tools/objtool/elf.c | 8 +- tools/perf/builtin-record.c | 2 +- tools/perf/builtin-stat.c | 13 + tools/perf/util/annotate.c | 2 +- .../util/arm-spe-decoder/arm-spe-pkt-decoder.c | 25 +- .../util/arm-spe-decoder/arm-spe-pkt-decoder.h | 15 +- tools/perf/util/bpf_counter.c | 7 +- tools/perf/util/bpf_lock_contention.c | 6 +- tools/perf/util/evsel.c | 2 +- tools/perf/util/genelf.c | 32 +- tools/perf/util/hist.c | 6 +- tools/perf/util/hwmon_pmu.c | 3 +- tools/perf/util/parse-events.c | 28 +- tools/perf/util/parse-events.h | 3 +- tools/perf/util/parse-events.y | 2 +- tools/perf/util/symbol.c | 5 +- tools/power/x86/turbostat/turbostat.c | 12 +- .../selftests/bpf/prog_tests/kmem_cache_iter.c | 3 +- .../selftests/bpf/prog_tests/perf_branches.c | 22 +- .../testing/selftests/bpf/prog_tests/send_signal.c | 5 + .../selftests/bpf/progs/test_perf_branches.c | 3 + .../drivers/net/bonding/bond_macvlan_ipvlan.sh | 1 + .../tcp_syscall_bad_arg_sendmsg-empty-iov.pkt | 4 + .../net/packetdrill/tcp_zerocopy_basic.pkt | 2 + .../net/packetdrill/tcp_zerocopy_batch.pkt | 2 + .../net/packetdrill/tcp_zerocopy_client.pkt | 2 + .../net/packetdrill/tcp_zerocopy_closed.pkt | 2 + .../net/packetdrill/tcp_zerocopy_epoll_edge.pkt | 3 + .../packetdrill/tcp_zerocopy_epoll_exclusive.pkt | 3 + .../net/packetdrill/tcp_zerocopy_epoll_oneshot.pkt | 3 + .../packetdrill/tcp_zerocopy_fastopen-client.pkt | 2 + .../packetdrill/tcp_zerocopy_fastopen-server.pkt | 2 + .../net/packetdrill/tcp_zerocopy_maxfrags.pkt | 2 + .../net/packetdrill/tcp_zerocopy_small.pkt | 2 + 513 files changed, 6158 insertions(+), 3322 deletions(-)

5 days, 1 hour

5
515
0 0

[PATCH] hwmon: (ibmpex) Fix use-after-free in sysfs removal

by Junrui Luo

There is a use-after-free vulnerability in the ibmpex driver where the driver frees the sensors array while sysfs read operations via ibmpex_show_sensor() are still in progress. Fix this by reordering cleanup operations in ibmpex_bmc_delete(). Reported-by: Yuhao Jiang <danisjiang(a)gmail.com> Reported-by: Junrui Luo <moonafterrain(a)outlook.com> Fixes: 57c7c3a0fdea ("hwmon: IBM power meter driver") Cc: stable(a)vger.kernel.org Signed-off-by: Junrui Luo <moonafterrain(a)outlook.com> --- drivers/hwmon/ibmpex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/ibmpex.c b/drivers/hwmon/ibmpex.c index 228c5f6c6f38..578549f44154 100644 --- a/drivers/hwmon/ibmpex.c +++ b/drivers/hwmon/ibmpex.c @@ -508,6 +508,7 @@ static void ibmpex_bmc_delete(struct ibmpex_bmc_data *data) { int i, j; + hwmon_device_unregister(data->hwmon_dev); device_remove_file(data->bmc_device, &sensor_dev_attr_reset_high_low.dev_attr); device_remove_file(data->bmc_device, &dev_attr_name.attr); @@ -522,7 +523,6 @@ static void ibmpex_bmc_delete(struct ibmpex_bmc_data *data) list_del(&data->list); dev_set_drvdata(data->bmc_device, NULL); - hwmon_device_unregister(data->hwmon_dev); ipmi_destroy_user(data->user); kfree(data->sensors); kfree(data); --- base-commit: cfd4039213e7b5a828c5b78e1b5235cac91af53d change-id: 20251218-fixes-25f078f93a1c Best regards, -- Junrui Luo <moonafterrain(a)outlook.com>

5 days, 2 hours

2
1
0 0

[PATCH AUTOSEL 6.18-6.6] iomap: adjust read range correctly for non-block-aligned positions

by Sasha Levin

From: Joanne Koong <joannelkoong(a)gmail.com> [ Upstream commit 7aa6bc3e8766990824f66ca76c19596ce10daf3e ] iomap_adjust_read_range() assumes that the position and length passed in are block-aligned. This is not always the case however, as shown in the syzbot generated case for erofs. This causes too many bytes to be skipped for uptodate blocks, which results in returning the incorrect position and length to read in. If all the blocks are uptodate, this underflows length and returns a position beyond the folio. Fix the calculation to also take into account the block offset when calculating how many bytes can be skipped for uptodate blocks. Signed-off-by: Joanne Koong <joannelkoong(a)gmail.com> Tested-by: syzbot(a)syzkaller.appspotmail.com Reviewed-by: Brian Foster <bfoster(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- LLM Generated explanations, may be completely bogus: Now I have all the information needed for a comprehensive analysis. Let me compile my findings. --- ## COMPREHENSIVE ANALYSIS: iomap_adjust_read_range() Bug Fix ### 1. COMMIT MESSAGE ANALYSIS **Subject:** `iomap: adjust read range correctly for non-block-aligned positions` **Key Points from Message:** - The function `iomap_adjust_read_range()` **assumes block-aligned positions**, but this assumption is violated - Bug was discovered via **syzbot testing with erofs** filesystem - Causes "too many bytes to be skipped for uptodate blocks" - Results in **incorrect position and length to read** - If all blocks are uptodate: **underflows length** and **returns position beyond the folio** **Tags Analysis:** - ✅ `Tested-by: syzbot(a)syzkaller.appspotmail.com` - Automated testing confirmed - ✅ `Reviewed-by: Brian Foster <bfoster(a)redhat.com>` - Red Hat filesystem expert - ✅ `Reviewed-by: Christoph Hellwig <hch(a)lst.de>` - Major iomap author - ✅ `Signed-off-by: Christian Brauner <brauner(a)kernel.org>` - VFS maintainer - ❌ **No `Cc: stable(a)vger.kernel.org`** tag - ❌ **No `Fixes:` tag** pointing to original buggy commit ### 2. CODE CHANGE ANALYSIS **Bug Location:** `fs/iomap/buffered-io.c`, function `iomap_adjust_read_range()` **The Buggy Code (lines 246-253 before fix):** ```c for (i = first; i <= last; i++) { if (!ifs_block_is_uptodate(ifs, i)) break; *pos += block_size; // Bug: assumes pos is block-aligned poff += block_size; plen -= block_size; first++; } ``` **Technical Root Cause:** When `*pos` has a sub-block offset (e.g., `pos = 512` in a 1024-byte block): - `first = poff >> block_bits` computes the block index correctly (block 0) - But the loop skips a full `block_size` per block, ignoring the offset **Example demonstrating the bug:** - Block size: 1024 bytes - Position: 512 (half-way into block 0) - Block 0 is uptodate **Old buggy calculation:** - Skip full 1024 bytes → `pos = 1536`, overshoots by 512 bytes - `plen -= 1024` → underflows if `plen < 1024` **Fixed calculation:** ```c blocks_skipped = i - first; if (blocks_skipped) { unsigned long block_offset = *pos & (block_size - 1); // = 512 unsigned bytes_skipped = (blocks_skipped << block_bits) - block_offset; // = 1024 - 512 = 512 *pos += bytes_skipped; // Correct: pos = 1024 poff += bytes_skipped; plen -= bytes_skipped; } ``` **Consequences of the Bug:** 1. **Integer underflow**: `plen` becomes huge (wraps around as unsigned) 2. **Position beyond folio**: `*pos` can point past the folio boundary 3. **Incorrect read ranges**: Wrong data read, potential corruption 4. **Potential crashes**: Invalid memory access from bad ranges ### 3. CLASSIFICATION - **Type:** BUG FIX (arithmetic/logic error causing incorrect calculations) - **NOT:** Feature addition, cleanup, or optimization - **Severity:** HIGH - affects filesystem data integrity - **Scope:** Core iomap buffered I/O infrastructure ### 4. SCOPE AND RISK ASSESSMENT **Change Size:** - 13 insertions, 6 deletions - Single file: `fs/iomap/buffered-io.c` - Localized to one function **Risk Level:** LOW - Fix is mathematically straightforward - Does not change control flow significantly - Well-reviewed by iomap experts - Tested by syzbot **Affected Subsystem:** `fs/iomap/` - mature, widely-used infrastructure **Affected Filesystems:** Multiple major filesystems use iomap: - **XFS** - Primary enterprise Linux filesystem - **GFS2** - Cluster filesystem - **erofs** - Read-only filesystem (Android) - **zonefs** - Zoned storage filesystem - **fuse** - User-space filesystems ### 5. USER IMPACT **Who is affected?** - ALL users of XFS, GFS2, erofs, zonefs, and fuse filesystems - Particularly affects systems with: - Block sizes smaller than page size - Partial folio reads/writes at non-block-aligned offsets **How severe?** - Can cause **incorrect data reads** - Potential **data corruption** in read paths - Possible **kernel crashes** from invalid memory access - **Data integrity** issues for critical filesystems **Triggered by:** syzbot (automated fuzzing) - confirms this is a real triggerable bug ### 6. STABILITY INDICATORS - ✅ `Tested-by: syzbot` - Confirmed fix works - ✅ Two expert reviewers (Brian Foster, Christoph Hellwig) - ✅ Merged by VFS maintainer (Christian Brauner) - ⚠️ Relatively new commit (September 2025) ### 7. DEPENDENCY CHECK **Bug Origin:** Commit `9dc55f1389f95` ("iomap: add support for sub- pagesize buffered I/O without buffer heads") from **v4.19-rc1** (2018) **Dependencies for backport:** - The fix is self-contained - May need minor adaptation for older kernels: - v5.x: Uses `struct iomap_page` and pages (not folios) - v6.x: Uses `struct iomap_folio_state` and folios - Core logic remains the same across versions **Related commits:** - `8e3c15ee0d292` - Minor loop syntax change (`for` → `while`), NOT a dependency - `9d875e0eef8ec` - Related fix for unaligned END offsets (separate issue) ### 8. HISTORICAL CONTEXT The bug has existed for **~6 years** (since v4.19). It was latent because: - Most callers pass block-aligned positions - erofs triggered an edge case with non-aligned positions - syzbot's extensive testing exposed it The original code assumed callers would always pass block-aligned positions, which is a reasonable assumption violated in specific edge cases. --- ## BACKPORT RECOMMENDATION ### Arguments FOR backporting: 1. **Fixes a real bug** discovered by automated testing (syzbot) 2. **Affects critical filesystems** (XFS, GFS2) used in production 3. **Small, surgical fix** - 13 lines added, 6 removed 4. **Low regression risk** - mathematically correct fix 5. **Expert-reviewed** by iomap maintainers 6. **Bug existed since v4.19** - all stable trees are affected 7. **Can cause data integrity issues** - serious for a filesystem bug ### Arguments AGAINST backporting: 1. **No `Cc: stable` tag** - maintainers didn't explicitly request backport 2. **No `Fixes:` tag** - doesn't identify the buggy commit 3. **Relatively new commit** - hasn't had extensive mainline testing yet 4. **Needs adaptation** for older kernels (page vs folio APIs) ### Conclusion: Despite the missing stable tags, this commit should be backported because: - It fixes a **real, triggerable bug** found by syzbot - The bug can cause **incorrect data reads and potential corruption** - It affects **major filesystems** (XFS, GFS2) used in production environments - The fix is **small, contained, and well-reviewed** - The **risk of NOT fixing** (data corruption) outweighs the risk of the fix (minimal) The absence of `Cc: stable` may be an oversight, as this clearly meets stable criteria. **YES** fs/iomap/buffered-io.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index 8b847a1e27f13..1c95a0a7b302d 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -240,17 +240,24 @@ static void iomap_adjust_read_range(struct inode *inode, struct folio *folio, * to avoid reading in already uptodate ranges. */ if (ifs) { - unsigned int i; + unsigned int i, blocks_skipped; /* move forward for each leading block marked uptodate */ - for (i = first; i <= last; i++) { + for (i = first; i <= last; i++) if (!ifs_block_is_uptodate(ifs, i)) break; - *pos += block_size; - poff += block_size; - plen -= block_size; - first++; + + blocks_skipped = i - first; + if (blocks_skipped) { + unsigned long block_offset = *pos & (block_size - 1); + unsigned bytes_skipped = + (blocks_skipped << block_bits) - block_offset; + + *pos += bytes_skipped; + poff += bytes_skipped; + plen -= bytes_skipped; } + first = i; /* truncate len if we find any trailing uptodate block(s) */ while (++i <= last) { -- 2.51.0

5 days, 3 hours

2
2
0 0

[PATCH 0/2] net: qrtr: Drop the MHI 'auto_queue' feature

by Manivannan Sadhasivam via B4 Relay

Hi, This series intends to fix the race between the MHI stack and the MHI client drivers due to the MHI 'auto_queue' feature. As it turns out often, the best way to fix an issue in a feature is to drop the feature itself and this series does exactly that. There is no real benefit in having the 'auto_queue' feature in the MHI stack, other than saving a few lines of code in the client drivers. Since the QRTR is the only client driver which makes use of this feature, this series reworks the QRTR driver to manage the buffer on its own. Testing ======= Tested on Qcom X1E based Lenovo Thinkpad T14s laptop with WLAN device. Merge Strategy ============== Since this series modifies many subsystem drivers, I'd like to get acks from relevant subsystem maintainers and take the series through MHI tree. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> --- Manivannan Sadhasivam (2): net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels bus: mhi: host: Drop the auto_queue support drivers/accel/qaic/mhi_controller.c | 44 ------------------- drivers/bus/mhi/host/init.c | 10 ----- drivers/bus/mhi/host/internal.h | 3 -- drivers/bus/mhi/host/main.c | 81 +---------------------------------- drivers/bus/mhi/host/pci_generic.c | 20 +-------- drivers/net/wireless/ath/ath11k/mhi.c | 4 -- drivers/net/wireless/ath/ath12k/mhi.c | 4 -- include/linux/mhi.h | 14 ------ net/qrtr/mhi.c | 67 ++++++++++++++++++++++++----- 9 files changed, 60 insertions(+), 187 deletions(-) --- base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8 change-id: 20251217-qrtr-fix-c058251d8d1a Best regards, -- Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com>

5 days, 4 hours

4
4
0 0

[PATCH v5 01/24] drm/xe/svm: Fix a debug printout

by Thomas Hellström

Avoid spamming the log with drm_info(). Use drm_dbg() instead. Fixes: cc795e041034 ("drm/xe/svm: Make xe_svm_range_needs_migrate_to_vram() public") Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> Cc: <stable(a)vger.kernel.org> # v6.17+ Signed-off-by: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> --- drivers/gpu/drm/xe/xe_svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xe/xe_svm.c b/drivers/gpu/drm/xe/xe_svm.c index 93550c7c84ac..bab8e6cbe53d 100644 --- a/drivers/gpu/drm/xe/xe_svm.c +++ b/drivers/gpu/drm/xe/xe_svm.c @@ -937,7 +937,7 @@ bool xe_svm_range_needs_migrate_to_vram(struct xe_svm_range *range, struct xe_vm xe_assert(vm->xe, IS_DGFX(vm->xe)); if (xe_svm_range_in_vram(range)) { - drm_info(&vm->xe->drm, "Range is already in VRAM\n"); + drm_dbg(&vm->xe->drm, "Range is already in VRAM\n"); return false; } -- 2.51.1

5 days, 4 hours

1
0
0 0

[PATCH] RDMA/cxgb4: fix a memory leak in pass_accept_req() error path

by Wentao Liang

In the alloc_ep_skb_list() failure path, the c4iw_put_ep() is incorrectly used instead of the kfree(). Since the child_ep's reference count hasn't been properly established at this point, the c4iw_put_ep() won't actually free the memory, resulting in permanent memory leak. Fix by releasing child_ep correctly in the fail path. Fixes: 4a740838bf44 ("RDMA/iw_cxgb4: Low resource fixes for connection manager") Cc: stable(a)vger.kernel.org Signed-off-by: Wentao Liang <vulab(a)iscas.ac.cn> --- drivers/infiniband/hw/cxgb4/cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c index b3b45c49077d..a09eeb48775f 100644 --- a/drivers/infiniband/hw/cxgb4/cm.c +++ b/drivers/infiniband/hw/cxgb4/cm.c @@ -2665,7 +2665,7 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb) } goto out; fail: - c4iw_put_ep(&child_ep->com); + kfree(child_ep); reject: reject_cr(dev, hwtid, skb); out: -- 2.34.1

5 days, 4 hours

2
1
0 0

[PATCH] RDMA/cxgb4: fix dst refcount leak in pass_accept_req() error path

by Wentao Liang

Add missing dst_release() when alloc_ep_skb_list() fails to prevent reference count leak of the dst obtained from route lookup. Fixes: 4a740838bf44 ("RDMA/iw_cxgb4: Low resource fixes for connection manager") Cc: stable(a)vger.kernel.org Signed-off-by: Wentao Liang <vulab(a)iscas.ac.cn> --- drivers/infiniband/hw/cxgb4/cm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c index b3b45c49077d..3490b8920cf0 100644 --- a/drivers/infiniband/hw/cxgb4/cm.c +++ b/drivers/infiniband/hw/cxgb4/cm.c @@ -2665,6 +2665,7 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb) } goto out; fail: + dst_release(dst); c4iw_put_ep(&child_ep->com); reject: reject_cr(dev, hwtid, skb); -- 2.34.1

5 days, 5 hours

2
1
0 0

[PATCH v5] w1: therm: Fix off-by-one buffer overflow in alarms_store

by Thorsten Blum

The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy 'buf', which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index 'size'. Fix this by parsing the 'buf' parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code. Cc: stable(a)vger.kernel.org Fixes: e2c94d6f5720 ("w1_therm: adding alarm sysfs entry") Signed-off-by: Thorsten Blum <thorsten.blum(a)linux.dev> --- Compile-tested only. Changes in v5: - Replace gotos with return size (Krzysztof) - Link to v4: https://lore.kernel.org/lkml/20251111204422.41993-2-thorsten.blum@linux.dev/ Changes in v4: - Use simple_strtoll because kstrtoint also parses long long internally - Return -ERANGE in addition to -EINVAL to match kstrtoint's behavior - Remove any changes unrelated to fixing the buffer overflow (Krzysztof) while maintaining the same behavior and return values as before - Link to v3: https://lore.kernel.org/lkml/20251030155614.447905-1-thorsten.blum@linux.de… Changes in v3: - Add integer range check for 'temp' to match kstrtoint() behavior - Explicitly cast 'temp' to int when calling int_to_short() - Link to v2: https://lore.kernel.org/lkml/20251029130045.70127-2-thorsten.blum@linux.dev/ Changes in v2: - Fix buffer overflow instead of truncating the copy using strscpy() - Parse buffer directly using simple_strtol() as suggested by David - Update patch subject and description - Link to v1: https://lore.kernel.org/lkml/20251017170047.114224-2-thorsten.blum@linux.de… --- drivers/w1/slaves/w1_therm.c | 63 ++++++++++++------------------------ 1 file changed, 20 insertions(+), 43 deletions(-) diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c index 9ccedb3264fb..5c4e40883400 100644 --- a/drivers/w1/slaves/w1_therm.c +++ b/drivers/w1/slaves/w1_therm.c @@ -1836,55 +1836,36 @@ static ssize_t alarms_store(struct device *device, struct w1_slave *sl = dev_to_w1_slave(device); struct therm_info info; u8 new_config_register[3]; /* array of data to be written */ - int temp, ret; - char *token = NULL; + long long temp; + int ret = 0; s8 tl, th; /* 1 byte per value + temp ring order */ - char *p_args, *orig; - - p_args = orig = kmalloc(size, GFP_KERNEL); - /* Safe string copys as buf is const */ - if (!p_args) { - dev_warn(device, - "%s: error unable to allocate memory %d\n", - __func__, -ENOMEM); - return size; - } - strcpy(p_args, buf); - - /* Split string using space char */ - token = strsep(&p_args, " "); - - if (!token) { - dev_info(device, - "%s: error parsing args %d\n", __func__, -EINVAL); - goto free_m; - } - - /* Convert 1st entry to int */ - ret = kstrtoint (token, 10, &temp); + const char *p = buf; + char *endp; + + temp = simple_strtoll(p, &endp, 10); + if (p == endp || *endp != ' ') + ret = -EINVAL; + else if (temp < INT_MIN || temp > INT_MAX) + ret = -ERANGE; if (ret) { dev_info(device, "%s: error parsing args %d\n", __func__, ret); - goto free_m; + return size; } tl = int_to_short(temp); - /* Split string using space char */ - token = strsep(&p_args, " "); - if (!token) { - dev_info(device, - "%s: error parsing args %d\n", __func__, -EINVAL); - goto free_m; - } - /* Convert 2nd entry to int */ - ret = kstrtoint (token, 10, &temp); + p = endp + 1; + temp = simple_strtoll(p, &endp, 10); + if (p == endp) + ret = -EINVAL; + else if (temp < INT_MIN || temp > INT_MAX) + ret = -ERANGE; if (ret) { dev_info(device, "%s: error parsing args %d\n", __func__, ret); - goto free_m; + return size; } - /* Prepare to cast to short by eliminating out of range values */ th = int_to_short(temp); @@ -1905,7 +1886,7 @@ static ssize_t alarms_store(struct device *device, dev_info(device, "%s: error reading from the slave device %d\n", __func__, ret); - goto free_m; + return size; } /* Write data in the device RAM */ @@ -1913,7 +1894,7 @@ static ssize_t alarms_store(struct device *device, dev_info(device, "%s: Device not supported by the driver %d\n", __func__, -ENODEV); - goto free_m; + return size; } ret = SLAVE_SPECIFIC_FUNC(sl)->write_data(sl, new_config_register); @@ -1922,10 +1903,6 @@ static ssize_t alarms_store(struct device *device, "%s: error writing to the slave device %d\n", __func__, ret); -free_m: - /* free allocated memory */ - kfree(orig); - return size; } -- Thorsten Blum <thorsten.blum(a)linux.dev> GPG: 1D60 735E 8AEF 3BE4 73B6 9D84 7336 78FD 8DFE EAD4

5 days, 5 hours

2
2
0 0

[PATCH v2] net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write

by Deepanshu Kartikey

A deadlock can occur between nfc_unregister_device() and rfkill_fop_write() due to lock ordering inversion between device_lock and rfkill_global_mutex. The problematic lock order is: Thread A (rfkill_fop_write): rfkill_fop_write() mutex_lock(&rfkill_global_mutex) rfkill_set_block() nfc_rfkill_set_block() nfc_dev_down() device_lock(&dev->dev) <- waits for device_lock Thread B (nfc_unregister_device): nfc_unregister_device() device_lock(&dev->dev) rfkill_unregister() mutex_lock(&rfkill_global_mutex) <- waits for rfkill_global_mutex This creates a classic ABBA deadlock scenario. Fix this by moving rfkill_unregister() and rfkill_destroy() outside the device_lock critical section. Store the rfkill pointer in a local variable before releasing the lock, then call rfkill_unregister() after releasing device_lock. This change is safe because rfkill_fop_write() holds rfkill_global_mutex while calling the rfkill callbacks, and rfkill_unregister() also acquires rfkill_global_mutex before cleanup. Therefore, rfkill_unregister() will wait for any ongoing callback to complete before proceeding, and device_del() is only called after rfkill_unregister() returns, preventing any use-after-free. The similar lock ordering in nfc_register_device() (device_lock -> rfkill_global_mutex via rfkill_register) is safe because during registration the device is not yet in rfkill_list, so no concurrent rfkill operations can occur on this device. Fixes: 3e3b5dfcd16a ("NFC: reorder the logic in nfc_{un,}register_device") Cc: stable(a)vger.kernel.org Reported-by: syzbot+4ef89409a235d804c6c2(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4ef89409a235d804c6c2 Link: https://lore.kernel.org/all/20251217054908.178907-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey <kartikey406(a)gmail.com> --- v2: - Added explanation of why UAF is not possible - Added explanation of why nfc_register_device() is safe - Added Fixes and Cc: stable tags - Fixed blank line after variable declaration (kept it) --- net/nfc/core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/nfc/core.c b/net/nfc/core.c index ae1c842f9c64..82f023f37754 100644 --- a/net/nfc/core.c +++ b/net/nfc/core.c @@ -1154,6 +1154,7 @@ EXPORT_SYMBOL(nfc_register_device); void nfc_unregister_device(struct nfc_dev *dev) { int rc; + struct rfkill *rfk = NULL; pr_debug("dev_name=%s\n", dev_name(&dev->dev)); @@ -1164,13 +1165,17 @@ void nfc_unregister_device(struct nfc_dev *dev) device_lock(&dev->dev); if (dev->rfkill) { - rfkill_unregister(dev->rfkill); - rfkill_destroy(dev->rfkill); + rfk = dev->rfkill; dev->rfkill = NULL; } dev->shutting_down = true; device_unlock(&dev->dev); + if (rfk) { + rfkill_unregister(rfk); + rfkill_destroy(rfk); + } + if (dev->ops->check_presence) { timer_delete_sync(&dev->check_pres_timer); cancel_work_sync(&dev->check_pres_work); -- 2.43.0

5 days, 5 hours

2
1
0 0

[PATCH] ext4: xattr: fix wrong search.here in clone_block

by Jinchao Wang

syzbot reported a KASAN out-of-bounds Read in ext4_xattr_set_entry()[1]. When xattr_find_entry() returns -ENODATA, search.here still points to the position after the last valid entry. ext4_xattr_block_set() clones the xattr block because the original block maybe shared and must not be modified in place. In the clone_block, search.here is recomputed unconditionally from the old offset, which may place it past search.first. This results in a negative reset size and an out-of-bounds memmove() in ext4_xattr_set_entry(). Fix this by initializing search.here correctly when search.not_found is set. [1] https://syzkaller.appspot.com/bug?extid=f792df426ff0f5ceb8d1 Fixes: fd48e9acdf2 (ext4: Unindent codeblock in ext4_xattr_block_set) Cc: stable(a)vger.kernel.org Reported-by: syzbot+f792df426ff0f5ceb8d1(a)syzkaller.appspotmail.com Signed-off-by: Jinchao Wang <wangjinchao600(a)gmail.com> --- fs/ext4/xattr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 2e02efbddaac..cc30abeb7f30 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1980,7 +1980,10 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode, goto cleanup; s->first = ENTRY(header(s->base)+1); header(s->base)->h_refcount = cpu_to_le32(1); - s->here = ENTRY(s->base + offset); + if (s->not_found) + s->here = s->first; + else + s->here = ENTRY(s->base + offset); s->end = s->base + bs->bh->b_size; /* -- 2.43.0

5 days, 5 hours

3
5
0 0

[PATCH v2] net: nfc: nci: Fix parameter validation for packet data

by Michael Thalmeier

Since commit 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") communication with nci nfc chips is not working any more. The mentioned commit tries to fix access of uninitialized data, but failed to understand that in some cases the data packet is of variable length and can therefore not be compared to the maximum packet length given by the sizeof(struct). For these cases it is only possible to check for minimum packet length. Fixes: 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") Cc: stable(a)vger.kernel.org Signed-off-by: Michael Thalmeier <michael.thalmeier(a)hale.at> --- Changes in v2: - Reference correct commit hash --- net/nfc/nci/ntf.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c index 418b84e2b260..5161e94f067f 100644 --- a/net/nfc/nci/ntf.c +++ b/net/nfc/nci/ntf.c @@ -58,7 +58,8 @@ static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, struct nci_conn_info *conn_info; int i; - if (skb->len < sizeof(struct nci_core_conn_credit_ntf)) + /* Minimal packet size for num_entries=1 is 1 x __u8 + 1 x conn_credit_entry */ + if (skb->len < (sizeof(__u8) + sizeof(struct conn_credit_entry))) return -EINVAL; ntf = (struct nci_core_conn_credit_ntf *)skb->data; @@ -364,7 +365,8 @@ static int nci_rf_discover_ntf_packet(struct nci_dev *ndev, const __u8 *data; bool add_target = true; - if (skb->len < sizeof(struct nci_rf_discover_ntf)) + /* Minimal packet size is 5 if rf_tech_specific_params_len=0 */ + if (skb->len < (5 * sizeof(__u8))) return -EINVAL; data = skb->data; @@ -596,7 +598,10 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, const __u8 *data; int err = NCI_STATUS_OK; - if (skb->len < sizeof(struct nci_rf_intf_activated_ntf)) + /* Minimal packet size is 11 if + * f_tech_specific_params_len=0 and activation_params_len=0 + */ + if (skb->len < (11 * sizeof(__u8))) return -EINVAL; data = skb->data; -- 2.52.0

5 days, 5 hours

2
1
0 0

[PATCH v2] i2c: riic: Move suspend handling to NOIRQ phase

by Tommaso Merciai

Commit 53326135d0e0 ("i2c: riic: Add suspend/resume support") added suspend support for the Renesas I2C driver and following this change on RZ/G3E the following WARNING is seen on entering suspend ... [ 134.275704] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [ 134.285536] ------------[ cut here ]------------ [ 134.290298] i2c i2c-2: Transfer while suspended [ 134.295174] WARNING: drivers/i2c/i2c-core.h:56 at __i2c_smbus_xfer+0x1e4/0x214, CPU#0: systemd-sleep/388 [ 134.365507] Tainted: [W]=WARN [ 134.368485] Hardware name: Renesas SMARC EVK version 2 based on r9a09g047e57 (DT) [ 134.375961] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 134.382935] pc : __i2c_smbus_xfer+0x1e4/0x214 [ 134.387329] lr : __i2c_smbus_xfer+0x1e4/0x214 [ 134.391717] sp : ffff800083f23860 [ 134.395040] x29: ffff800083f23860 x28: 0000000000000000 x27: ffff800082ed5d60 [ 134.402226] x26: 0000001f4395fd74 x25: 0000000000000007 x24: 0000000000000001 [ 134.409408] x23: 0000000000000000 x22: 000000000000006f x21: ffff800083f23936 [ 134.416589] x20: ffff0000c090e140 x19: ffff0000c090e0d0 x18: 0000000000000006 [ 134.423771] x17: 6f63657320313030 x16: 2e30206465737061 x15: ffff800083f23280 [ 134.430953] x14: 0000000000000000 x13: ffff800082b16ce8 x12: 0000000000000f09 [ 134.438134] x11: 0000000000000503 x10: ffff800082b6ece8 x9 : ffff800082b16ce8 [ 134.445315] x8 : 00000000ffffefff x7 : ffff800082b6ece8 x6 : 80000000fffff000 [ 134.452495] x5 : 0000000000000504 x4 : 0000000000000000 x3 : 0000000000000000 [ 134.459672] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c9ee9e80 [ 134.466851] Call trace: [ 134.469311] __i2c_smbus_xfer+0x1e4/0x214 (P) [ 134.473715] i2c_smbus_xfer+0xbc/0x120 [ 134.477507] i2c_smbus_read_byte_data+0x4c/0x84 [ 134.482077] isl1208_i2c_read_time+0x44/0x178 [rtc_isl1208] [ 134.487703] isl1208_rtc_read_time+0x14/0x20 [rtc_isl1208] [ 134.493226] __rtc_read_time+0x44/0x88 [ 134.497012] rtc_read_time+0x3c/0x68 [ 134.500622] rtc_suspend+0x9c/0x170 The warning is triggered because I2C transfers can still be attempted while the controller is already suspended, due to inappropriate ordering of the system sleep callbacks. If the controller is autosuspended, there is no way to wake it up once runtime PM disabled (in suspend_late()). During system resume, the I2C controller will be available only after runtime PM is re-enabled (in resume_early()). However, this may be too late for some devices. Wake up the controller in the suspend() callback while runtime PM is still enabled. The I2C controller will remain available until the suspend_noirq() callback (pm_runtime_force_suspend()) is called. During resume, the I2C controller can be restored by the resume_noirq() callback (pm_runtime_force_resume()). Finally, the resume() callback re-enables autosuspend. As a result, the I2C controller can remain available until the system enters suspend_noirq() and from resume_noirq(). Cc: stable(a)vger.kernel.org Fixes: 53326135d0e0 ("i2c: riic: Add suspend/resume support") Signed-off-by: Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> --- v1->v2: - Taking as reference commit: 4262df2a69c3 ("i2c: imx-lpi2c: make controller available until the system enters suspend_noirq() and from resume_noirq().") reworked the patch with a similar approach. Updated commit body accordingly. drivers/i2c/busses/i2c-riic.c | 46 +++++++++++++++++++++++++++++------ 1 file changed, 39 insertions(+), 7 deletions(-) diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c index 3e8f126cb7f7..9e3595b3623e 100644 --- a/drivers/i2c/busses/i2c-riic.c +++ b/drivers/i2c/busses/i2c-riic.c @@ -670,12 +670,39 @@ static const struct riic_of_data riic_rz_t2h_info = { static int riic_i2c_suspend(struct device *dev) { - struct riic_dev *riic = dev_get_drvdata(dev); - int ret; + /* + * Some I2C devices may need the I2C controller to remain active + * during resume_noirq() or suspend_noirq(). If the controller is + * autosuspended, there is no way to wake it up once runtime PM is + * disabled (in suspend_late()). + * + * During system resume, the I2C controller will be available only + * after runtime PM is re-enabled (in resume_early()). However, this + * may be too late for some devices. + * + * Wake up the controller in the suspend() callback while runtime PM + * is still enabled. The I2C controller will remain available until + * the suspend_noirq() callback (pm_runtime_force_suspend()) is + * called. During resume, the I2C controller can be restored by the + * resume_noirq() callback (pm_runtime_force_resume()). + * + * Finally, the resume() callback re-enables autosuspend, ensuring + * the I2C controller remains available until the system enters + * suspend_noirq() and from resume_noirq(). + */ + return pm_runtime_resume_and_get(dev); +} - ret = pm_runtime_resume_and_get(dev); - if (ret) - return ret; +static int riic_i2c_resume(struct device *dev) +{ + pm_runtime_put_autosuspend(dev); + + return 0; +} + +static int riic_i2c_suspend_noirq(struct device *dev) +{ + struct riic_dev *riic = dev_get_drvdata(dev); i2c_mark_adapter_suspended(&riic->adapter); @@ -683,12 +710,12 @@ static int riic_i2c_suspend(struct device *dev) riic_clear_set_bit(riic, ICCR1_ICE, 0, RIIC_ICCR1); pm_runtime_mark_last_busy(dev); - pm_runtime_put_sync(dev); + pm_runtime_force_suspend(dev); return reset_control_assert(riic->rstc); } -static int riic_i2c_resume(struct device *dev) +static int riic_i2c_resume_noirq(struct device *dev) { struct riic_dev *riic = dev_get_drvdata(dev); int ret; @@ -697,6 +724,10 @@ static int riic_i2c_resume(struct device *dev) if (ret) return ret; + ret = pm_runtime_force_resume(dev); + if (ret) + return ret; + ret = riic_init_hw(riic); if (ret) { /* @@ -714,6 +745,7 @@ static int riic_i2c_resume(struct device *dev) } static const struct dev_pm_ops riic_i2c_pm_ops = { + NOIRQ_SYSTEM_SLEEP_PM_OPS(riic_i2c_suspend_noirq, riic_i2c_resume_noirq) SYSTEM_SLEEP_PM_OPS(riic_i2c_suspend, riic_i2c_resume) }; -- 2.43.0

5 days, 5 hours

1
0
0 0

[PATCH v5 0/2] Enable 1GHz OPP am335x-bonegreen-eco

by Kory Maincent (TI.com)

The vdd_mpu regulator maximum voltage was previously limited to 1.2985V, which prevented the CPU from reaching the 1GHz operating point. This limitation was put in place because voltage changes were not working correctly, causing the board to stall when attempting higher frequencies. Increase the maximum voltage to 1.3515V to allow the full 1GHz OPP to be used. Add a TPS65219 PMIC driver fixes that properly implement the LOCK register handling, to make voltage transitions work reliably. Changes in v5: - Add a error message. - Link to v4: https://lore.kernel.org/r/20251112-fix_tps65219-v4-0-696a0f55d5d8@bootlin.c… Changes in v4: - Move the registers unlock in the probe instead of a custom regmap write operation. - Link to v3: https://lore.kernel.org/r/20251112-fix_tps65219-v3-0-e49bab4c01ce@bootlin.c… Changes in v3: - Remove an unused variable - Link to v2: https://lore.kernel.org/r/20251106-fix_tps65219-v2-0-a7d608c4272f@bootlin.c… Changes in v2: - Setup a custom regmap_bus only for the TPS65214 instead of checking the chip_id every time reg_write is called. - Add the am335x-bonegreen-eco devicetree change in the same patch series. Signed-off-by: Kory Maincent (TI.com) <kory.maincent(a)bootlin.com> --- Kory Maincent (TI.com) (2): mfd: tps65219: Implement LOCK register handling for TPS65214 ARM: dts: am335x-bonegreen-eco: Enable 1GHz OPP by increasing vdd_mpu voltage arch/arm/boot/dts/ti/omap/am335x-bonegreen-eco.dts | 2 +- drivers/mfd/tps65219.c | 9 +++++++++ include/linux/mfd/tps65219.h | 2 ++ 3 files changed, 12 insertions(+), 1 deletion(-) --- base-commit: 2bb202416d33347102b12bbd1db4837fb6685617 change-id: 20251106-fix_tps65219-dd62141d22cf Best regards, -- Köry Maincent, Bootlin Embedded Linux and kernel engineering https://bootlin.com

5 days, 5 hours

1
1
0 0

[PATCH 2/2] af_unix: only post SO_INQ cmsg for non-error case

by Jens Axboe

As is done for TCP sockets, don't post an SCM_INQ cmsg for an error case. Only post them for the non-error case, which is when unix_stream_read_generic will return >= 0. Cc: stable(a)vger.kernel.org Fixes: df30285b3670 ("af_unix: Introduce SO_INQ.") Reported-by: Julian Orth <ju.orth(a)gmail.com> Link: https://github.com/axboe/liburing/issues/1509 Signed-off-by: Jens Axboe <axboe(a)kernel.dk> --- net/unix/af_unix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 110d716087b5..72dc5d5bcac8 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -3091,7 +3091,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, scm_recv_unix(sock, msg, &scm, flags); do_cmsg = READ_ONCE(u->recvmsg_inq); - if (do_cmsg || msg->msg_get_inq) { + if ((do_cmsg || msg->msg_get_inq) && (copied ?: err) >= 0) { msg->msg_inq = READ_ONCE(u->inq_len); if (do_cmsg) put_cmsg(msg, SOL_SOCKET, SCM_INQ, -- 2.51.0

5 days, 6 hours

1
0
0 0

[PATCH REGRESSION v3] drm/panel: simple: restore connector_type fallback

by Ludovic Desroches

The switch from devm_kzalloc() + drm_panel_init() to devm_drm_panel_alloc() introduced a regression. Several panel descriptors do not set connector_type. For those panels, panel_simple_probe() used to compute a connector type (currently DPI as a fallback) and pass that value to drm_panel_init(). After the conversion to devm_drm_panel_alloc(), the call unconditionally used desc->connector_type instead, ignoring the computed fallback and potentially passing DRM_MODE_CONNECTOR_Unknown, which drm_panel_bridge_add() does not allow. Move the connector_type validation / fallback logic before the devm_drm_panel_alloc() call and pass the computed connector_type to devm_drm_panel_alloc(), so panels without an explicit connector_type once again get the DPI default. Signed-off-by: Ludovic Desroches <ludovic.desroches(a)microchip.com> Fixes: de04bb0089a9 ("drm/panel/panel-simple: Use the new allocation in place of devm_kzalloc()") Cc: stable(a)vger.kernel.org --- Changes in v3: - Add the tag "Cc: stable(a)vger.kernel.org" in the sign-off area. - Link to v2: https://lore.kernel.org/r/20251126-lcd_panel_connector_type_fix-v2-1-c15835… Changes in v2: - Fix a warning introduced by the code move. There is no need to jump to free_ddc, we can directly return from the function. - Link to v1: https://lore.kernel.org/r/20251121-lcd_panel_connector_type_fix-v1-1-fdbbef… --- drivers/gpu/drm/panel/panel-simple.c | 89 ++++++++++++++++++------------------ 1 file changed, 44 insertions(+), 45 deletions(-) diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c index 0019de93be1b663f55b04160606363cd043ab38b..5fd75b3939c635ca3e5b293ea37a759f479fa3f8 100644 --- a/drivers/gpu/drm/panel/panel-simple.c +++ b/drivers/gpu/drm/panel/panel-simple.c @@ -623,49 +623,6 @@ static struct panel_simple *panel_simple_probe(struct device *dev) if (IS_ERR(desc)) return ERR_CAST(desc); - panel = devm_drm_panel_alloc(dev, struct panel_simple, base, - &panel_simple_funcs, desc->connector_type); - if (IS_ERR(panel)) - return ERR_CAST(panel); - - panel->desc = desc; - - panel->supply = devm_regulator_get(dev, "power"); - if (IS_ERR(panel->supply)) - return ERR_CAST(panel->supply); - - panel->enable_gpio = devm_gpiod_get_optional(dev, "enable", - GPIOD_OUT_LOW); - if (IS_ERR(panel->enable_gpio)) - return dev_err_cast_probe(dev, panel->enable_gpio, - "failed to request GPIO\n"); - - err = of_drm_get_panel_orientation(dev->of_node, &panel->orientation); - if (err) { - dev_err(dev, "%pOF: failed to get orientation %d\n", dev->of_node, err); - return ERR_PTR(err); - } - - ddc = of_parse_phandle(dev->of_node, "ddc-i2c-bus", 0); - if (ddc) { - panel->ddc = of_find_i2c_adapter_by_node(ddc); - of_node_put(ddc); - - if (!panel->ddc) - return ERR_PTR(-EPROBE_DEFER); - } - - if (!of_device_is_compatible(dev->of_node, "panel-dpi") && - !of_get_display_timing(dev->of_node, "panel-timing", &dt)) - panel_simple_parse_panel_timing_node(dev, panel, &dt); - - if (desc->connector_type == DRM_MODE_CONNECTOR_LVDS) { - /* Optional data-mapping property for overriding bus format */ - err = panel_simple_override_nondefault_lvds_datamapping(dev, panel); - if (err) - goto free_ddc; - } - connector_type = desc->connector_type; /* Catch common mistakes for panels. */ switch (connector_type) { @@ -690,8 +647,7 @@ static struct panel_simple *panel_simple_probe(struct device *dev) break; case DRM_MODE_CONNECTOR_eDP: dev_warn(dev, "eDP panels moved to panel-edp\n"); - err = -EINVAL; - goto free_ddc; + return ERR_PTR(-EINVAL); case DRM_MODE_CONNECTOR_DSI: if (desc->bpc != 6 && desc->bpc != 8) dev_warn(dev, "Expected bpc in {6,8} but got: %u\n", desc->bpc); @@ -720,6 +676,49 @@ static struct panel_simple *panel_simple_probe(struct device *dev) break; } + panel = devm_drm_panel_alloc(dev, struct panel_simple, base, + &panel_simple_funcs, connector_type); + if (IS_ERR(panel)) + return ERR_CAST(panel); + + panel->desc = desc; + + panel->supply = devm_regulator_get(dev, "power"); + if (IS_ERR(panel->supply)) + return ERR_CAST(panel->supply); + + panel->enable_gpio = devm_gpiod_get_optional(dev, "enable", + GPIOD_OUT_LOW); + if (IS_ERR(panel->enable_gpio)) + return dev_err_cast_probe(dev, panel->enable_gpio, + "failed to request GPIO\n"); + + err = of_drm_get_panel_orientation(dev->of_node, &panel->orientation); + if (err) { + dev_err(dev, "%pOF: failed to get orientation %d\n", dev->of_node, err); + return ERR_PTR(err); + } + + ddc = of_parse_phandle(dev->of_node, "ddc-i2c-bus", 0); + if (ddc) { + panel->ddc = of_find_i2c_adapter_by_node(ddc); + of_node_put(ddc); + + if (!panel->ddc) + return ERR_PTR(-EPROBE_DEFER); + } + + if (!of_device_is_compatible(dev->of_node, "panel-dpi") && + !of_get_display_timing(dev->of_node, "panel-timing", &dt)) + panel_simple_parse_panel_timing_node(dev, panel, &dt); + + if (desc->connector_type == DRM_MODE_CONNECTOR_LVDS) { + /* Optional data-mapping property for overriding bus format */ + err = panel_simple_override_nondefault_lvds_datamapping(dev, panel); + if (err) + goto free_ddc; + } + dev_set_drvdata(dev, panel); /* --- base-commit: ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d change-id: 20251121-lcd_panel_connector_type_fix-f00fe3766a42 Best regards, -- Ludovic Desroches <ludovic.desroches(a)microchip.com>

5 days, 6 hours

2
1
0 0

[PATCH 3/5] usb: ohci-nxp: fix device leak on probe failure

by Johan Hovold

Make sure to drop the reference taken when looking up the PHY I2C device during probe on probe failure (e.g. probe deferral) and on driver unbind. Fixes: 73108aa90cbf ("USB: ohci-nxp: Use isp1301 driver") Cc: stable(a)vger.kernel.org # 3.5 Reported-by: Ma Ke <make24(a)iscas.ac.cn> Link: https://lore.kernel.org/lkml/20251117013428.21840-1-make24@iscas.ac.cn/ Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/host/ohci-nxp.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/usb/host/ohci-nxp.c b/drivers/usb/host/ohci-nxp.c index 24d5a1dc5056..9a05828bbba1 100644 --- a/drivers/usb/host/ohci-nxp.c +++ b/drivers/usb/host/ohci-nxp.c @@ -169,13 +169,13 @@ static int ohci_hcd_nxp_probe(struct platform_device *pdev) ret = dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); if (ret) - goto fail_disable; + goto err_put_client; dev_dbg(&pdev->dev, "%s: " DRIVER_DESC " (nxp)\n", hcd_name); if (usb_disabled()) { dev_err(&pdev->dev, "USB is disabled\n"); ret = -ENODEV; - goto fail_disable; + goto err_put_client; } /* Enable USB host clock */ @@ -183,7 +183,7 @@ static int ohci_hcd_nxp_probe(struct platform_device *pdev) if (IS_ERR(usb_host_clk)) { dev_err(&pdev->dev, "failed to acquire and start USB OHCI clock\n"); ret = PTR_ERR(usb_host_clk); - goto fail_disable; + goto err_put_client; } isp1301_configure(); @@ -192,7 +192,7 @@ static int ohci_hcd_nxp_probe(struct platform_device *pdev) if (!hcd) { dev_err(&pdev->dev, "Failed to allocate HC buffer\n"); ret = -ENOMEM; - goto fail_disable; + goto err_put_client; } hcd->regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res); @@ -222,7 +222,8 @@ static int ohci_hcd_nxp_probe(struct platform_device *pdev) ohci_nxp_stop_hc(); fail_resource: usb_put_hcd(hcd); -fail_disable: +err_put_client: + put_device(&isp1301_i2c_client->dev); isp1301_i2c_client = NULL; return ret; } @@ -234,6 +235,7 @@ static void ohci_hcd_nxp_remove(struct platform_device *pdev) usb_remove_hcd(hcd); ohci_nxp_stop_hc(); usb_put_hcd(hcd); + put_device(&isp1301_i2c_client->dev); isp1301_i2c_client = NULL; } -- 2.51.2

5 days, 6 hours

1
0
0 0

[PATCH 2/5] usb: phy: isp1301: fix non-OF device reference imbalance

by Johan Hovold

A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301_get_client() helper only increases the reference count for the returned I2C device in the OF case. Increment the reference count also for non-OF so that the caller can decrement it unconditionally. Note that this is inherently racy just as using the returned I2C device is since nothing is preventing the PHY driver from being unbound while in use. Fixes: c84117912bdd ("USB: lpc32xx_udc: Fix error handling in probe") Cc: stable(a)vger.kernel.org Cc: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/phy/phy-isp1301.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c index f9b5c411aee4..2940f0c84e1b 100644 --- a/drivers/usb/phy/phy-isp1301.c +++ b/drivers/usb/phy/phy-isp1301.c @@ -149,7 +149,12 @@ struct i2c_client *isp1301_get_client(struct device_node *node) return client; /* non-DT: only one ISP1301 chip supported */ - return isp1301_i2c_client; + if (isp1301_i2c_client) { + get_device(&isp1301_i2c_client->dev); + return isp1301_i2c_client; + } + + return NULL; } EXPORT_SYMBOL_GPL(isp1301_get_client); -- 2.51.2

5 days, 6 hours

1
0
0 0

[PATCH 1/5] usb: gadget: lpc32xx_udc: fix clock imbalance in error path

by Johan Hovold

A recent change fixing a device reference leak introduced a clock imbalance by reusing an error path so that the clock may be disabled before having been enabled. Note that the clock framework allows for passing in NULL clocks so there is no risk for a NULL pointer dereference. Also drop the bogus I2C client NULL check added by the offending commit as the pointer has already been verified to be non-NULL. Fixes: c84117912bdd ("USB: lpc32xx_udc: Fix error handling in probe") Cc: stable(a)vger.kernel.org Cc: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/gadget/udc/lpc32xx_udc.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c index 73c0f28a8585..a962d4294fbe 100644 --- a/drivers/usb/gadget/udc/lpc32xx_udc.c +++ b/drivers/usb/gadget/udc/lpc32xx_udc.c @@ -3020,7 +3020,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev) pdev->dev.dma_mask = &lpc32xx_usbd_dmamask; retval = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); if (retval) - goto i2c_fail; + goto err_put_client; udc->board = &lpc32xx_usbddata; @@ -3040,7 +3040,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev) udc->udp_irq[i] = platform_get_irq(pdev, i); if (udc->udp_irq[i] < 0) { retval = udc->udp_irq[i]; - goto i2c_fail; + goto err_put_client; } } @@ -3048,7 +3048,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev) if (IS_ERR(udc->udp_baseaddr)) { dev_err(udc->dev, "IO map failure\n"); retval = PTR_ERR(udc->udp_baseaddr); - goto i2c_fail; + goto err_put_client; } /* Get USB device clock */ @@ -3056,14 +3056,14 @@ static int lpc32xx_udc_probe(struct platform_device *pdev) if (IS_ERR(udc->usb_slv_clk)) { dev_err(udc->dev, "failed to acquire USB device clock\n"); retval = PTR_ERR(udc->usb_slv_clk); - goto i2c_fail; + goto err_put_client; } /* Enable USB device clock */ retval = clk_prepare_enable(udc->usb_slv_clk); if (retval < 0) { dev_err(udc->dev, "failed to start USB device clock\n"); - goto i2c_fail; + goto err_put_client; } /* Setup deferred workqueue data */ @@ -3165,9 +3165,10 @@ static int lpc32xx_udc_probe(struct platform_device *pdev) dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE, udc->udca_v_base, udc->udca_p_base); i2c_fail: - if (udc->isp1301_i2c_client) - put_device(&udc->isp1301_i2c_client->dev); clk_disable_unprepare(udc->usb_slv_clk); +err_put_client: + put_device(&udc->isp1301_i2c_client->dev); + dev_err(udc->dev, "%s probe failed, %d\n", driver_name, retval); return retval; @@ -3195,10 +3196,9 @@ static void lpc32xx_udc_remove(struct platform_device *pdev) dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE, udc->udca_v_base, udc->udca_p_base); - if (udc->isp1301_i2c_client) - put_device(&udc->isp1301_i2c_client->dev); - clk_disable_unprepare(udc->usb_slv_clk); + + put_device(&udc->isp1301_i2c_client->dev); } #ifdef CONFIG_PM -- 2.51.2

5 days, 6 hours

1
0
0 0

RE: CES 2026: Audience Breakdown & Leads

by Jessica Garcia

Hi , I hope my previous email reached you and you've had the chance to read it. Let me know if you need more specifics on the numbers and associated expenses. Regards Jessica Marketing Manager Campaign Data Leads., Please reply with REMOVE if you don't wish to receive further emails -----Original Message----- From: Jessica Garcia Subject: CES 2026: Audience Breakdown & Leads Hi , Trust you're in good spirits. Is the idea of buying the CES 2026 attendees' details for your marketing efforts something you'd like to explore? Expo Name: Consumer Electronics Show 2026 Total Number of records: 40,000 records List includes: Company Name, Contact Name, Job Title, Mailing Address, Phone, Emails, etc. Best chance to connect with participants Feel free to contact me if you are interested in acquiring this list so that I can share pricing information with you Hoping for your prompt feedback. Regards Jessica Marketing Manager Campaign Data Leads., Please reply with REMOVE if you don't wish to receive further emails

5 days, 7 hours

1
0
0 0

[PATCH] i2c: riic: Move suspend handling to NOIRQ phase

by Tommaso Merciai

Commit 53326135d0e0 ("i2c: riic: Add suspend/resume support") added suspend support for the Renesas I2C driver and following this change on RZ/G3E the following WARNING is seen on entering suspend ... [ 134.275704] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [ 134.285536] ------------[ cut here ]------------ [ 134.290298] i2c i2c-2: Transfer while suspended [ 134.295174] WARNING: drivers/i2c/i2c-core.h:56 at __i2c_smbus_xfer+0x1e4/0x214, CPU#0: systemd-sleep/388 [ 134.365507] Tainted: [W]=WARN [ 134.368485] Hardware name: Renesas SMARC EVK version 2 based on r9a09g047e57 (DT) [ 134.375961] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 134.382935] pc : __i2c_smbus_xfer+0x1e4/0x214 [ 134.387329] lr : __i2c_smbus_xfer+0x1e4/0x214 [ 134.391717] sp : ffff800083f23860 [ 134.395040] x29: ffff800083f23860 x28: 0000000000000000 x27: ffff800082ed5d60 [ 134.402226] x26: 0000001f4395fd74 x25: 0000000000000007 x24: 0000000000000001 [ 134.409408] x23: 0000000000000000 x22: 000000000000006f x21: ffff800083f23936 [ 134.416589] x20: ffff0000c090e140 x19: ffff0000c090e0d0 x18: 0000000000000006 [ 134.423771] x17: 6f63657320313030 x16: 2e30206465737061 x15: ffff800083f23280 [ 134.430953] x14: 0000000000000000 x13: ffff800082b16ce8 x12: 0000000000000f09 [ 134.438134] x11: 0000000000000503 x10: ffff800082b6ece8 x9 : ffff800082b16ce8 [ 134.445315] x8 : 00000000ffffefff x7 : ffff800082b6ece8 x6 : 80000000fffff000 [ 134.452495] x5 : 0000000000000504 x4 : 0000000000000000 x3 : 0000000000000000 [ 134.459672] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c9ee9e80 [ 134.466851] Call trace: [ 134.469311] __i2c_smbus_xfer+0x1e4/0x214 (P) [ 134.473715] i2c_smbus_xfer+0xbc/0x120 [ 134.477507] i2c_smbus_read_byte_data+0x4c/0x84 [ 134.482077] isl1208_i2c_read_time+0x44/0x178 [rtc_isl1208] [ 134.487703] isl1208_rtc_read_time+0x14/0x20 [rtc_isl1208] [ 134.493226] __rtc_read_time+0x44/0x88 [ 134.497012] rtc_read_time+0x3c/0x68 [ 134.500622] rtc_suspend+0x9c/0x170 The warning is triggered because I2C transfers can still be attempted while the controller is already suspended, due to inappropriate ordering of the system sleep callbacks. Fix this by moving the system sleep suspend/resume callbacks to the NOIRQ phase, ensuring the adapter is fully quiesced after late suspend and properly resumed before the early resume phase. To support NOIRQ resume, the hardware initialization path must not invoke runtime PM APIs. Split the init code so that the low-level hardware setup can be executed without pm_runtime_get/put(). This avoids violating the constraint introduced by commit 1e2ef05bb8cf ("PM: Limit race conditions between runtime PM and system sleep (v2)"), which forbids runtime PM calls during early resume. Cc: stable(a)vger.kernel.org Fixes: 53326135d0e0 ("i2c: riic: Add suspend/resume support") Signed-off-by: Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> --- drivers/i2c/busses/i2c-riic.c | 65 ++++++++++++++++++++++------------- 1 file changed, 41 insertions(+), 24 deletions(-) diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c index 3e8f126cb7f7..9acc8936cdf7 100644 --- a/drivers/i2c/busses/i2c-riic.c +++ b/drivers/i2c/busses/i2c-riic.c @@ -349,9 +349,8 @@ static const struct i2c_algorithm riic_algo = { .functionality = riic_func, }; -static int riic_init_hw(struct riic_dev *riic) +static int __riic_init_hw(struct riic_dev *riic) { - int ret; unsigned long rate; unsigned long ns_per_tick; int total_ticks, cks, brl, brh; @@ -431,10 +430,6 @@ static int riic_init_hw(struct riic_dev *riic) rate / total_ticks, ((brl + 3) * 100) / (brl + brh + 6), t->scl_fall_ns / ns_per_tick, t->scl_rise_ns / ns_per_tick, cks, brl, brh); - ret = pm_runtime_resume_and_get(dev); - if (ret) - return ret; - /* Changing the order of accessing IICRST and ICE may break things! */ riic_writeb(riic, ICCR1_IICRST | ICCR1_SOWP, RIIC_ICCR1); riic_clear_set_bit(riic, 0, ICCR1_ICE, RIIC_ICCR1); @@ -451,10 +446,25 @@ static int riic_init_hw(struct riic_dev *riic) riic_clear_set_bit(riic, ICCR1_IICRST, 0, RIIC_ICCR1); - pm_runtime_put_autosuspend(dev); return 0; } +static int riic_init_hw(struct riic_dev *riic) +{ + struct device *dev = riic->adapter.dev.parent; + int ret; + + ret = pm_runtime_resume_and_get(dev); + if (ret) + return ret; + + ret = __riic_init_hw(riic); + + pm_runtime_put_autosuspend(dev); + + return ret; +} + static int riic_get_scl(struct i2c_adapter *adap) { struct riic_dev *riic = i2c_get_adapdata(adap); @@ -572,6 +582,8 @@ static int riic_i2c_probe(struct platform_device *pdev) i2c_parse_fw_timings(dev, &riic->i2c_t, true); + platform_set_drvdata(pdev, riic); + /* Default 0 to save power. Can be overridden via sysfs for lower latency. */ pm_runtime_set_autosuspend_delay(dev, 0); pm_runtime_use_autosuspend(dev); @@ -585,8 +597,6 @@ static int riic_i2c_probe(struct platform_device *pdev) if (ret) goto out; - platform_set_drvdata(pdev, riic); - dev_info(dev, "registered with %dHz bus speed\n", riic->i2c_t.bus_freq_hz); return 0; @@ -668,27 +678,17 @@ static const struct riic_of_data riic_rz_t2h_info = { .num_irqs = ARRAY_SIZE(riic_rzt2h_irqs), }; -static int riic_i2c_suspend(struct device *dev) +static int riic_i2c_runtime_suspend(struct device *dev) { struct riic_dev *riic = dev_get_drvdata(dev); - int ret; - - ret = pm_runtime_resume_and_get(dev); - if (ret) - return ret; - - i2c_mark_adapter_suspended(&riic->adapter); /* Disable output on SDA, SCL pins. */ riic_clear_set_bit(riic, ICCR1_ICE, 0, RIIC_ICCR1); - pm_runtime_mark_last_busy(dev); - pm_runtime_put_sync(dev); - return reset_control_assert(riic->rstc); } -static int riic_i2c_resume(struct device *dev) +static int riic_i2c_runtime_resume(struct device *dev) { struct riic_dev *riic = dev_get_drvdata(dev); int ret; @@ -697,7 +697,7 @@ static int riic_i2c_resume(struct device *dev) if (ret) return ret; - ret = riic_init_hw(riic); + ret = __riic_init_hw(riic); if (ret) { /* * In case this happens there is no way to recover from this @@ -708,13 +708,30 @@ static int riic_i2c_resume(struct device *dev) return ret; } + return 0; +} + +static int riic_i2c_suspend(struct device *dev) +{ + struct riic_dev *riic = dev_get_drvdata(dev); + + i2c_mark_adapter_suspended(&riic->adapter); + + return pm_runtime_force_suspend(dev); +} + +static int riic_i2c_resume(struct device *dev) +{ + struct riic_dev *riic = dev_get_drvdata(dev); + i2c_mark_adapter_resumed(&riic->adapter); - return 0; + return pm_runtime_force_resume(dev); } static const struct dev_pm_ops riic_i2c_pm_ops = { - SYSTEM_SLEEP_PM_OPS(riic_i2c_suspend, riic_i2c_resume) + NOIRQ_SYSTEM_SLEEP_PM_OPS(riic_i2c_suspend, riic_i2c_resume) + RUNTIME_PM_OPS(riic_i2c_runtime_suspend, riic_i2c_runtime_resume, NULL) }; static const struct of_device_id riic_i2c_dt_ids[] = { -- 2.43.0

5 days, 7 hours

4
7
0 0

[for-linus][PATCH 2/4] tracing: Do not register unsupported perf events

by Steven Rostedt

From: Steven Rostedt <rostedt(a)goodmis.org> Synthetic events currently do not have a function to register perf events. This leads to calling the tracepoint register functions with a NULL function pointer which triggers: ------------[ cut here ]------------ WARNING: kernel/tracepoint.c:175 at tracepoint_add_func+0x357/0x370, CPU#2: perf/2272 Modules linked in: kvm_intel kvm irqbypass CPU: 2 UID: 0 PID: 2272 Comm: perf Not tainted 6.18.0-ftest-11964-ge022764176fc-dirty #323 PREEMPTLAZY Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:tracepoint_add_func+0x357/0x370 Code: 28 9c e8 4c 0b f5 ff eb 0f 4c 89 f7 48 c7 c6 80 4d 28 9c e8 ab 89 f4 ff 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc <0f> 0b 49 c7 c6 ea ff ff ff e9 ee fe ff ff 0f 0b e9 f9 fe ff ff 0f RSP: 0018:ffffabc0c44d3c40 EFLAGS: 00010246 RAX: 0000000000000001 RBX: ffff9380aa9e4060 RCX: 0000000000000000 RDX: 000000000000000a RSI: ffffffff9e1d4a98 RDI: ffff937fcf5fd6c8 RBP: 0000000000000001 R08: 0000000000000007 R09: ffff937fcf5fc780 R10: 0000000000000003 R11: ffffffff9c193910 R12: 000000000000000a R13: ffffffff9e1e5888 R14: 0000000000000000 R15: ffffabc0c44d3c78 FS: 00007f6202f5f340(0000) GS:ffff93819f00f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d3162281a8 CR3: 0000000106a56003 CR4: 0000000000172ef0 Call Trace: <TASK> tracepoint_probe_register+0x5d/0x90 synth_event_reg+0x3c/0x60 perf_trace_event_init+0x204/0x340 perf_trace_init+0x85/0xd0 perf_tp_event_init+0x2e/0x50 perf_try_init_event+0x6f/0x230 ? perf_event_alloc+0x4bb/0xdc0 perf_event_alloc+0x65a/0xdc0 __se_sys_perf_event_open+0x290/0x9f0 do_syscall_64+0x93/0x7b0 ? entry_SYSCALL_64_after_hwframe+0x76/0x7e ? trace_hardirqs_off+0x53/0xc0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Instead, have the code return -ENODEV, which doesn't warn and has perf error out with: # perf record -e synthetic:futex_wait Error: The sys_perf_event_open() syscall returned with 19 (No such device) for event (synthetic:futex_wait). "dmesg | grep -i perf" may provide additional information. Ideally perf should support synthetic events, but for now just fix the warning. The support can come later. Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Arnaldo Carvalho de Melo <acme(a)kernel.org> Cc: Jiri Olsa <jolsa(a)kernel.org> Cc: Namhyung Kim <namhyung(a)kernel.org> Link: https://patch.msgid.link/20251216182440.147e4453@gandalf.local.home Fixes: 4b147936fa509 ("tracing: Add support for 'synthetic' events") Reported-by: Ian Rogers <irogers(a)google.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> --- kernel/trace/trace_events.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index b16a5a158040..76067529db61 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -700,6 +700,8 @@ int trace_event_reg(struct trace_event_call *call, #ifdef CONFIG_PERF_EVENTS case TRACE_REG_PERF_REGISTER: + if (!call->class->perf_probe) + return -ENODEV; return tracepoint_probe_register(call->tp, call->class->perf_probe, call); -- 2.51.0

5 days, 7 hours

1
0
0 0

Linux 6.17.13

by Greg Kroah-Hartman

Note, this is the LAST release of the 6.17.y kernel tree. It is now end-of-life, all users must move to the 6.18.y kernel branch at this point in time. I'm announcing the release of the 6.17.13 kernel. All users of the 6.17 kernel series must upgrade. The updated 6.17.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.17.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/admin-guide/LSM/Smack.rst | 16 Documentation/devicetree/bindings/clock/qcom,x1e80100-gcc.yaml | 62 Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml | 6 Documentation/hwmon/g762.rst | 2 Makefile | 2 arch/arm/boot/dts/renesas/r8a7793-gose.dts | 1 arch/arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts | 2 arch/arm/boot/dts/samsung/exynos4210-i9100.dts | 1 arch/arm/boot/dts/samsung/exynos4210-trats.dts | 1 arch/arm/boot/dts/samsung/exynos4210-universal_c210.dts | 1 arch/arm/boot/dts/samsung/exynos4412-midas.dtsi | 1 arch/arm/boot/dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi | 8 arch/arm/boot/dts/ti/omap/am335x-netcom-plus-2xx.dts | 8 arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts | 2 arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 arch/arm/include/asm/word-at-a-time.h | 10 arch/arm64/boot/dts/exynos/google/gs101.dtsi | 4 arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi | 51 arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi | 11 arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts | 1 arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi | 4 arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 arch/arm64/boot/dts/qcom/qcm2290.dtsi | 60 arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts | 2 arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts | 5 arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 2 arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 4 arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts | 17 arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 arch/arm64/boot/dts/qcom/x1e80100.dtsi | 12 arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 6 arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts | 1 arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 15 arch/arm64/boot/dts/ti/k3-am62p.dtsi | 2 arch/powerpc/kernel/entry_32.S | 10 arch/powerpc/kexec/ranges.c | 2 arch/powerpc/mm/book3s64/hash_utils.c | 10 arch/powerpc/mm/ptdump/hashpagetable.c | 6 arch/riscv/kvm/vcpu_insn.c | 22 arch/s390/include/asm/fpu-insn.h | 3 arch/s390/kernel/smp.c | 1 arch/um/Makefile | 12 arch/x86/boot/compressed/pgtable_64.c | 11 arch/x86/events/core.c | 5 arch/x86/events/intel/core.c | 7 arch/x86/events/intel/cstate.c | 3 arch/x86/kernel/dumpstack.c | 23 block/blk-lib.c | 6 block/blk-mq.c | 35 block/blk-throttle.c | 9 block/mq-deadline.c | 129 - crypto/aead.c | 1 crypto/ahash.c | 18 crypto/asymmetric_keys/asymmetric_type.c | 14 crypto/authenc.c | 75 - drivers/accel/amdxdna/aie2_ctx.c | 22 drivers/accel/amdxdna/amdxdna_ctx.c | 1 drivers/accel/amdxdna/amdxdna_ctx.h | 1 drivers/accel/amdxdna/amdxdna_mailbox.c | 1 drivers/accel/ivpu/ivpu_fw.h | 2 drivers/accel/ivpu/ivpu_gem.c | 97 - drivers/accel/ivpu/ivpu_gem.h | 2 drivers/accel/ivpu/ivpu_hw_btrs.c | 2 drivers/accel/ivpu/ivpu_hw_btrs.h | 2 drivers/accel/ivpu/ivpu_job.c | 6 drivers/accel/ivpu/ivpu_pm.c | 9 drivers/acpi/apei/ghes.c | 27 drivers/acpi/processor_core.c | 2 drivers/acpi/property.c | 1 drivers/base/firmware_loader/Kconfig | 2 drivers/block/nbd.c | 5 drivers/block/ps3disk.c | 4 drivers/block/ublk_drv.c | 4 drivers/char/random.c | 19 drivers/clk/Makefile | 3 drivers/clk/qcom/camcc-sm6350.c | 13 drivers/clk/qcom/camcc-sm7150.c | 6 drivers/clk/qcom/camcc-sm8550.c | 10 drivers/clk/qcom/gcc-ipq5424.c | 3 drivers/clk/qcom/gcc-qcs615.c | 6 drivers/clk/qcom/gcc-sm8750.c | 1 drivers/clk/qcom/gcc-x1e80100.c | 698 +++++++++- drivers/clk/renesas/r9a06g032-clocks.c | 6 drivers/clk/renesas/r9a09g077-cpg.c | 4 drivers/clk/renesas/renesas-cpg-mssr.c | 57 drivers/clk/spacemit/ccu-k1.c | 4 drivers/clocksource/timer-nxp-stm.c | 23 drivers/clocksource/timer-ralink.c | 11 drivers/cpufreq/amd-pstate.c | 2 drivers/crypto/ccree/cc_buffer_mgr.c | 6 drivers/crypto/hisilicon/qm.c | 14 drivers/crypto/intel/iaa/iaa_crypto_main.c | 2 drivers/crypto/starfive/jh7110-hash.c | 6 drivers/devfreq/hisi_uncore_freq.c | 3 drivers/firmware/efi/cper-arm.c | 52 drivers/firmware/efi/cper.c | 60 drivers/firmware/efi/libstub/x86-5lvl.c | 4 drivers/firmware/imx/imx-scu-irq.c | 4 drivers/firmware/stratix10-svc.c | 1 drivers/firmware/ti_sci.c | 21 drivers/firmware/ti_sci.h | 2 drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 44 drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 12 drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 31 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 46 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 27 drivers/gpu/drm/drm_plane.c | 8 drivers/gpu/drm/i915/display/intel_fbdev.c | 43 drivers/gpu/drm/i915/display/intel_fbdev_fb.c | 42 drivers/gpu/drm/i915/display/intel_fbdev_fb.h | 8 drivers/gpu/drm/imagination/pvr_device.c | 2 drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 2 drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 34 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 10 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h | 6 drivers/gpu/drm/msm/msm_gpu.c | 21 drivers/gpu/drm/nouveau/dispnv04/nouveau_i2c_encoder.c | 20 drivers/gpu/drm/nouveau/include/dispnv04/i2c/encoder_i2c.h | 19 drivers/gpu/drm/nouveau/nouveau_fence.c | 6 drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c | 2 drivers/gpu/drm/nova/Kconfig | 1 drivers/gpu/drm/panel/panel-visionox-rm69299.c | 4 drivers/gpu/drm/panthor/panthor_device.c | 4 drivers/gpu/drm/panthor/panthor_gem.c | 20 drivers/gpu/drm/panthor/panthor_mmu.c | 18 drivers/gpu/drm/panthor/panthor_sched.c | 44 drivers/gpu/drm/tidss/tidss_dispc.c | 93 - drivers/gpu/drm/tidss/tidss_dispc.h | 3 drivers/gpu/drm/tidss/tidss_drv.h | 2 drivers/gpu/drm/tidss/tidss_oldi.c | 22 drivers/gpu/drm/vgem/vgem_fence.c | 2 drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 32 drivers/gpu/host1x/syncpt.c | 4 drivers/greybus/gb-beagleplay.c | 12 drivers/hid/hid-logitech-hidpp.c | 9 drivers/hv/mshv_root_main.c | 89 - drivers/hwmon/sy7636a-hwmon.c | 7 drivers/hwtracing/coresight/coresight-etm-perf.c | 1 drivers/hwtracing/coresight/coresight-etm3x-core.c | 59 drivers/hwtracing/coresight/coresight-etm4x-core.c | 103 - drivers/hwtracing/coresight/coresight-etm4x.h | 3 drivers/hwtracing/coresight/coresight-tmc-etr.c | 10 drivers/i2c/busses/i2c-k1.c | 19 drivers/i3c/master.c | 8 drivers/i3c/master/svc-i3c-master.c | 22 drivers/iio/imu/bmi270/bmi270_spi.c | 2 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 drivers/infiniband/hw/bnxt_re/qplib_sp.h | 2 drivers/infiniband/hw/irdma/cm.c | 2 drivers/infiniband/hw/irdma/ctrl.c | 3 drivers/infiniband/hw/irdma/main.h | 2 drivers/infiniband/hw/irdma/pble.c | 6 drivers/infiniband/hw/irdma/verbs.c | 15 drivers/infiniband/hw/irdma/verbs.h | 3 drivers/infiniband/sw/rxe/rxe_srq.c | 7 drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 drivers/interconnect/debugfs-client.c | 7 drivers/interconnect/qcom/msm8996.c | 1 drivers/iommu/amd/debugfs.c | 2 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 drivers/iommu/intel/iommu.h | 2 drivers/irqchip/irq-bcm2712-mip.c | 3 drivers/irqchip/irq-bcm7038-l1.c | 8 drivers/irqchip/irq-bcm7120-l2.c | 17 drivers/irqchip/irq-brcmstb-l2.c | 12 drivers/irqchip/irq-imx-mu-msi.c | 14 drivers/irqchip/irq-mchp-eic.c | 2 drivers/irqchip/irq-renesas-rzg2l.c | 6 drivers/irqchip/irq-starfive-jh8100-intc.c | 3 drivers/irqchip/qcom-irq-combiner.c | 2 drivers/leds/leds-netxbig.c | 36 drivers/leds/leds-upboard.c | 2 drivers/leds/rgb/leds-qcom-lpg.c | 4 drivers/macintosh/mac_hid.c | 3 drivers/md/dm-log-writes.c | 1 drivers/md/dm-raid.c | 2 drivers/md/md.c | 23 drivers/md/md.h | 9 drivers/md/raid5.c | 6 drivers/mfd/da9055-core.c | 1 drivers/mfd/mt6358-irq.c | 1 drivers/mfd/mt6397-irq.c | 1 drivers/misc/rp1/rp1_pci.c | 3 drivers/mtd/lpddr/lpddr_cmds.c | 8 drivers/mtd/nand/raw/lpc32xx_slc.c | 2 drivers/mtd/nand/raw/marvell_nand.c | 13 drivers/mtd/nand/raw/nand_base.c | 13 drivers/mtd/nand/raw/renesas-nand-controller.c | 5 drivers/net/dsa/b53/b53_common.c | 315 +++- drivers/net/dsa/b53/b53_priv.h | 111 + drivers/net/dsa/b53/b53_regs.h | 41 drivers/net/dsa/xrs700x/xrs700x.c | 11 drivers/net/ethernet/intel/iavf/iavf_ptp.c | 7 drivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c | 20 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c | 3 drivers/net/phy/adin1100.c | 2 drivers/net/phy/aquantia/aquantia_firmware.c | 2 drivers/net/phy/mscc/mscc_main.c | 6 drivers/net/phy/phy-core.c | 43 drivers/net/phy/realtek/realtek_main.c | 65 drivers/net/wireless/ath/ath10k/core.c | 20 drivers/net/wireless/ath/ath10k/core.h | 2 drivers/net/wireless/ath/ath10k/mac.c | 2 drivers/net/wireless/ath/ath11k/mac.c | 8 drivers/net/wireless/ath/ath11k/pci.c | 20 drivers/net/wireless/ath/ath11k/wmi.c | 20 drivers/net/wireless/ath/ath11k/wmi.h | 2 drivers/net/wireless/ath/ath12k/core.c | 24 drivers/net/wireless/ath/ath12k/core.h | 1 drivers/net/wireless/ath/ath12k/dp_rx.c | 70 - drivers/net/wireless/ath/ath12k/hal_rx.c | 10 drivers/net/wireless/ath/ath12k/mac.c | 16 drivers/net/wireless/ath/ath12k/pci.c | 20 drivers/net/wireless/ath/ath12k/qmi.c | 11 drivers/net/wireless/ath/ath12k/qmi.h | 5 drivers/net/wireless/ath/ath12k/wmi.c | 23 drivers/net/wireless/ath/ath12k/wmi.h | 2 drivers/net/wireless/ath/ath12k/wow.c | 1 drivers/net/wireless/intel/iwlwifi/mld/d3.c | 4 drivers/net/wireless/mediatek/mt76/mt76.h | 9 drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 4 drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 25 drivers/net/wireless/mediatek/mt76/mt7925/main.c | 1 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 23 drivers/net/wireless/mediatek/mt76/mt792x_core.c | 7 drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 6 drivers/net/wireless/mediatek/mt76/mt7996/main.c | 95 - drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 30 drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 1 drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 9 drivers/net/wireless/mediatek/mt76/wed.c | 10 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 27 drivers/net/wireless/realtek/rtw89/usb.c | 13 drivers/net/wireless/st/cw1200/bh.c | 6 drivers/nvme/host/auth.c | 2 drivers/of/fdt.c | 57 drivers/of/of_kunit_helpers.c | 5 drivers/pci/controller/Kconfig | 7 drivers/pci/controller/dwc/pci-keystone.c | 2 drivers/pci/controller/dwc/pcie-designware.h | 2 drivers/pci/endpoint/functions/pci-epf-test.c | 5 drivers/pci/setup-bus.c | 5 drivers/phy/freescale/phy-fsl-imx8qm-hsio.c | 5 drivers/phy/renesas/phy-rcar-gen3-usb2.c | 20 drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 568 ++++---- drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 27 drivers/pinctrl/pinctrl-single.c | 7 drivers/pinctrl/renesas/pinctrl-rzg2l.c | 6 drivers/pinctrl/stm32/pinctrl-stm32.c | 2 drivers/platform/x86/asus-wmi.c | 8 drivers/platform/x86/intel/pmc/core.h | 2 drivers/power/supply/apm_power.c | 3 drivers/power/supply/cw2015_battery.c | 8 drivers/power/supply/max17040_battery.c | 6 drivers/power/supply/rt5033_charger.c | 2 drivers/power/supply/rt9467-charger.c | 6 drivers/power/supply/wm831x_power.c | 10 drivers/pwm/pwm-bcm2835.c | 28 drivers/ras/ras.c | 40 drivers/regulator/core.c | 37 drivers/regulator/fixed.c | 11 drivers/regulator/pca9450-regulator.c | 7 drivers/remoteproc/imx_rproc.c | 9 drivers/remoteproc/qcom_q6v5_wcss.c | 8 drivers/rtc/rtc-amlogic-a4.c | 4 drivers/rtc/rtc-gamecube.c | 4 drivers/rtc/rtc-max31335.c | 6 drivers/s390/crypto/ap_bus.c | 8 drivers/scsi/imm.c | 1 drivers/scsi/qla2xxx/qla_nvme.c | 2 drivers/scsi/sim710.c | 2 drivers/scsi/smartpqi/smartpqi_init.c | 19 drivers/scsi/stex.c | 1 drivers/soc/qcom/qcom_gsbi.c | 8 drivers/soc/qcom/smem.c | 3 drivers/spi/spi-airoha-snfi.c | 25 drivers/spi/spi-ch341.c | 2 drivers/spi/spi-sg2044-nor.c | 4 drivers/spi/spi-tegra210-quad.c | 22 drivers/staging/fbtft/fbtft-core.c | 4 drivers/staging/most/Kconfig | 2 drivers/staging/most/Makefile | 1 drivers/staging/most/i2c/Kconfig | 13 drivers/staging/most/i2c/Makefile | 4 drivers/staging/most/i2c/i2c.c | 374 ----- drivers/target/target_core_configfs.c | 1 drivers/target/target_core_stat.c | 24 drivers/tty/serial/imx.c | 14 drivers/ufs/core/ufshcd-priv.h | 2 drivers/ufs/core/ufshcd.c | 2 drivers/ufs/host/ufs-rockchip.c | 19 drivers/uio/uio_fsl_elbc_gpcm.c | 7 drivers/usb/core/message.c | 2 drivers/usb/dwc2/platform.c | 17 drivers/usb/dwc3/host.c | 5 drivers/usb/gadget/legacy/raw_gadget.c | 3 drivers/usb/gadget/udc/tegra-xudc.c | 6 drivers/usb/misc/chaoskey.c | 16 drivers/usb/phy/phy.c | 4 drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 2 drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 drivers/vdpa/pds/vdpa_dev.c | 2 drivers/vfio/pci/vfio_pci_core.c | 68 drivers/vfio/pci/vfio_pci_intrs.c | 52 drivers/vfio/pci/vfio_pci_priv.h | 4 drivers/vhost/net.c | 12 drivers/vhost/vhost.c | 4 drivers/video/backlight/led_bl.c | 13 drivers/video/fbdev/ssd1307fb.c | 4 drivers/virtio/virtio.c | 12 drivers/virtio/virtio_debug.c | 10 drivers/virtio/virtio_pci_modern_dev.c | 6 drivers/virtio/virtio_vdpa.c | 2 drivers/watchdog/starfive-wdt.c | 4 drivers/watchdog/wdat_wdt.c | 64 fs/9p/v9fs.c | 4 fs/9p/vfs_file.c | 11 fs/9p/vfs_inode.c | 3 fs/9p/vfs_inode_dotl.c | 2 fs/btrfs/block-group.c | 6 fs/btrfs/ctree.c | 2 fs/btrfs/delayed-ref.c | 43 fs/btrfs/space-info.c | 22 fs/btrfs/space-info.h | 6 fs/erofs/super.c | 38 fs/ext4/mballoc.c | 49 fs/ext4/move_extent.c | 2 fs/f2fs/f2fs.h | 2 fs/f2fs/gc.c | 134 + fs/f2fs/recovery.c | 2 fs/f2fs/segment.c | 38 fs/f2fs/segment.h | 8 fs/f2fs/super.c | 14 fs/f2fs/sysfs.c | 7 fs/fuse/control.c | 19 fs/gfs2/glock.c | 5 fs/gfs2/inode.c | 15 fs/gfs2/inode.h | 1 fs/gfs2/ops_fstype.c | 2 fs/iomap/direct-io.c | 13 fs/nfs/client.c | 21 fs/nfs/dir.c | 27 fs/nfs/internal.h | 3 fs/nfs/namespace.c | 11 fs/nfs/nfs4client.c | 18 fs/nfs/nfs4proc.c | 27 fs/nfs/pnfs.c | 1 fs/nfs/super.c | 33 fs/nfsd/blocklayout.c | 4 fs/nls/nls_base.c | 27 fs/ntfs3/frecord.c | 8 fs/ntfs3/fsntfs.c | 9 fs/ntfs3/inode.c | 2 fs/ocfs2/alloc.c | 1 fs/ocfs2/inode.c | 10 fs/ocfs2/move_extents.c | 8 fs/pidfs.c | 2 fs/smb/client/cifssmb.c | 2 fs/smb/client/smb2pdu.c | 2 fs/tracefs/event_inode.c | 3 include/asm-generic/mshyperv.h | 17 include/asm-generic/rqspinlock.h | 60 include/dt-bindings/clock/qcom,x1e80100-gcc.h | 61 include/linux/blk_types.h | 5 include/linux/cleanup.h | 15 include/linux/coresight.h | 35 include/linux/cper.h | 12 include/linux/f2fs_fs.h | 5 include/linux/filter.h | 12 include/linux/firmware/qcom/qcom_tzmem.h | 15 include/linux/ieee80211.h | 4 include/linux/if_hsr.h | 9 include/linux/irq-entry-common.h | 2 include/linux/nfs_fs_sb.h | 5 include/linux/of_fdt.h | 9 include/linux/perf_event.h | 2 include/linux/phy.h | 3 include/linux/platform_data/lp855x.h | 4 include/linux/ras.h | 16 include/linux/rculist_nulls.h | 59 include/linux/soc/mediatek/mtk_wed.h | 1 include/linux/tty_port.h | 14 include/linux/vfio_pci_core.h | 10 include/linux/virtio.h | 2 include/linux/virtio_config.h | 10 include/linux/virtio_features.h | 29 include/linux/virtio_pci_modern.h | 8 include/net/netfilter/nf_conntrack_count.h | 17 include/net/sock.h | 13 include/ras/ras_event.h | 49 include/sound/tas2781.h | 2 include/target/target_core_base.h | 12 include/uapi/linux/pidfd.h | 1 include/uapi/sound/asound.h | 2 include/ufs/ufshcd.h | 1 io_uring/io_uring.c | 10 kernel/bpf/hashtab.c | 10 kernel/bpf/helpers.c | 3 kernel/bpf/rqspinlock.c | 36 kernel/bpf/stackmap.c | 66 kernel/bpf/syscall.c | 3 kernel/bpf/trampoline.c | 4 kernel/cgroup/cpuset.c | 35 kernel/cpu.c | 25 kernel/dma/pool.c | 2 kernel/events/callchain.c | 12 kernel/events/core.c | 24 kernel/locking/locktorture.c | 8 kernel/resource.c | 10 kernel/sched/fair.c | 17 kernel/sched/stats.h | 7 kernel/task_work.c | 8 kernel/time/timer_migration.c | 250 +-- lib/vsprintf.c | 6 net/core/filter.c | 9 net/core/netpoll.c | 2 net/hsr/hsr_device.c | 20 net/hsr/hsr_slave.c | 7 net/ipv4/inet_hashtables.c | 8 net/ipv4/inet_timewait_sock.c | 35 net/ipv6/ip6_fib.c | 4 net/mac80211/aes_cmac.c | 63 net/mac80211/aes_cmac.h | 8 net/mac80211/wpa.c | 20 net/netfilter/nf_conncount.c | 187 +- net/netfilter/nft_connlimit.c | 34 net/netfilter/nft_flow_offload.c | 9 net/netfilter/xt_connlimit.c | 14 net/openvswitch/conntrack.c | 16 net/sched/sch_cake.c | 58 net/sctp/socket.c | 5 scripts/package/install-extmod-build | 2 security/integrity/ima/ima_main.c | 42 security/integrity/ima/ima_policy.c | 2 security/smack/smack.h | 3 security/smack/smack_access.c | 93 + security/smack/smack_lsm.c | 279 ++- sound/firewire/dice/dice-extension.c | 4 sound/firewire/motu/motu-hwdep.c | 7 sound/hda/codecs/realtek/alc269.c | 2 sound/hda/codecs/side-codecs/cs35l41_hda.c | 2 sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 44 sound/isa/wavefront/wavefront_synth.c | 4 sound/soc/amd/acp/acp-i2s.c | 2 sound/soc/amd/acp/acp-legacy-common.c | 30 sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 sound/soc/codecs/Kconfig | 5 sound/soc/codecs/Makefile | 2 sound/soc/codecs/ak4458.c | 10 sound/soc/codecs/ak5558.c | 10 sound/soc/codecs/nau8325.c | 7 sound/soc/codecs/tas2781-i2c.c | 2 sound/soc/fsl/fsl_xcvr.c | 2 sound/soc/intel/catpt/pcm.c | 4 sound/soc/sdca/sdca_functions.c | 2 tools/include/nolibc/dirent.h | 6 tools/include/nolibc/stdio.h | 4 tools/include/nolibc/sys/wait.h | 18 tools/lib/bpf/btf.c | 4 tools/objtool/check.c | 3 tools/objtool/elf.c | 8 tools/perf/builtin-record.c | 2 tools/perf/builtin-stat.c | 13 tools/perf/util/annotate.c | 2 tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.c | 25 tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.h | 15 tools/perf/util/bpf_counter.c | 7 tools/perf/util/bpf_lock_contention.c | 6 tools/perf/util/evsel.c | 2 tools/perf/util/genelf.c | 32 tools/perf/util/hist.c | 6 tools/perf/util/hwmon_pmu.c | 3 tools/perf/util/parse-events.c | 28 tools/perf/util/parse-events.h | 3 tools/perf/util/parse-events.y | 2 tools/perf/util/symbol.c | 5 tools/power/x86/turbostat/turbostat.c | 12 tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c | 3 tools/testing/selftests/bpf/prog_tests/perf_branches.c | 22 tools/testing/selftests/bpf/prog_tests/send_signal.c | 5 tools/testing/selftests/bpf/progs/test_perf_branches.c | 3 tools/testing/selftests/drivers/net/bonding/bond_macvlan_ipvlan.sh | 1 tools/testing/selftests/net/packetdrill/tcp_syscall_bad_arg_sendmsg-empty-iov.pkt | 4 tools/testing/selftests/net/packetdrill/tcp_zerocopy_basic.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_batch.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_client.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_closed.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_edge.pkt | 3 tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_exclusive.pkt | 3 tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_oneshot.pkt | 3 tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-client.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-server.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_maxfrags.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_small.pkt | 2 503 files changed, 6028 insertions(+), 3269 deletions(-) Aashish Sharma (1): iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb Abdun Nihaal (4): wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() Abel Vesa (1): kbuild: install-extmod-build: Properly fix CC expansion when ccache is used Ahelenia Ziemiańska (1): power: supply: apm_power: only unset own apm_get_power_status Akash Goel (3): drm/panthor: Fix potential memleak of vma structure drm/panthor: Avoid adding of kernel BOs to extobj list drm/panthor: Prevent potential UAF in group creation Akhil P Oommen (3): drm/msm/a6xx: Flush LRZ cache before PT switch drm/msm/a6xx: Fix the gemnoc workaround drm/msm/a6xx: Improve MX rail fallback in RPMH vote init Al Viro (2): fuse_ctl_add_conn(): fix nlink breakage in case of early failure tracefs: fix a leak in eventfs_create_events_dir() Alan Maguire (1): libbpf: Fix parsing of multi-split BTF Aleksei Nikiforov (1): s390/fpu: Fix false-positive kmsan report in fpu_vstl() Alex Deucher (1): drm/amdgpu/userq: fix SDMA and compute validation Alex Williamson (1): vfio/pci: Use RCU for error/request triggers to avoid circular locking Alexander Dahl (1): net: phy: adin1100: Fix software power-down ready condition Alexander Martinz (1): arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory Alexander Stein (1): arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz Alexandre Courbot (1): firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER Alexandru Gagniuc (1): remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs Alexei Starovoitov (1): selftests/bpf: Fix failure paths in send_signal test Alexey Kodanev (1): net: stmmac: fix rx limit check in stmmac_rx_zc() Alexey Simakov (1): dm-raid: fix possible NULL dereference with undefined raid type Alok Tiwari (3): virtio_vdpa: fix misleading return in void function vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues vdpa/pds: use %pe for ERR_PTR() in event handler registration Andreas Gruenbacher (1): gfs2: Prevent recursive memory reclaim Andres J Rosa (1): ALSA: uapi: Fix typo in asound.h comment Andy Shevchenko (1): lib/vsprintf: Check pointer before dereferencing in time_and_date() Antheas Kapenekakis (2): ALSA: hda/realtek: Add match for ASUS Xbox Ally projects ALSA: hda/tas2781: fix speaker id retrieval for multiple probes Anton Khirnov (1): platform/x86: asus-wmi: use brightness_set_blocking() for kbd led Armin Wolf (2): fs/nls: Fix utf16 to utf8 conversion fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() Arnaud Lecomte (2): bpf: Refactor stack map trace depth calculation into helper function bpf: Fix stackmap overflow check in __bpf_get_stackid() Arnd Bergmann (1): random: use offstack cpumask when necessary Aryan Srivastava (2): Revert "mtd: rawnand: marvell: fix layouts" mtd: nand: relax ECC parameter validation check Baochen Qiang (7): wifi: ath11k: restore register window after global reset wifi: ath12k: fix VHT MCS assignment wifi: ath11k: fix VHT MCS assignment wifi: ath11k: fix peer HE MCS assignment wifi: ath12k: restore register window after global reset wifi: ath12k: fix reusing m3 memory wifi: ath12k: fix error handling in creating hardware group Bart Van Assche (4): block/mq-deadline: Introduce dd_start_request() block/mq-deadline: Switch back to a single dispatch list scsi: ufs: core: Move the ufshcd_enable_intr() declaration scsi: target: Do not write NUL characters into ASCII configfs output Bean Huo (1): scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() Benjamin Berg (2): tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set tools/nolibc/dirent: avoid errno in readdir_r Bhanu Seshu Kumar Valluri (1): PCI: endpoint: pci-epf-test: Fix sleeping function being called from atomic context Biju Das (1): pinctrl: renesas: rzg2l: Fix PMC restore Boris Brezillon (3): drm/panthor: Handle errors returned by drm_sched_entity_init() drm/panthor: Fix group_free_queue() for partially initialized queues drm/panthor: Fix UAF on kernel BO VA nodes Boris Burkov (1): btrfs: fix racy bitfield write in btrfs_clear_space_info_full() Breno Leitao (1): net: netpoll: initialize work queue before error checks Carl Worth (1): coresight: tmc: add the handle of the event to the path Cezary Rojewski (1): ASoC: Intel: catpt: Fix error path in hw_params() Charles Keepax (1): ASoC: SDCA: Fix missing dash in HIDE DisCo property Charles Mirabile (1): clk: spacemit: Set clk_hw_onecell_data::num before using flex array Chen Ridong (1): cpuset: Treat cpusets in attaching as populated Chia-I Wu (1): panthor: save task pid and comm in panthor_group Chien Wong (1): wifi: mac80211: fix CMAC functions not handling errors Christian Brauner (3): pidfs: add missing PIDFD_INFO_SIZE_VER1 pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info cleanup: fix scoped_class() Christoph Hellwig (1): iomap: always run error completions in user context Christophe JAILLET (2): phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() misc: rp1: Fix an error handling path in rp1_probe() Christophe Leroy (1): powerpc/32: Fix unpaired stwcx. on interrupt exit Cong Zhang (1): blk-mq: Abort suspend when wakeup events are pending Cristian Ciocaltea (3): phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits Cyrille Pitchen (1): drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() Daeho Jeong (2): f2fs: maintain one time GC mode is enabled during whole zoned GC cycle f2fs: revert summary entry count from 2048 to 512 in 16kb block support Dan Carpenter (4): regulator: pca9450: Fix error code in probe() drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() Danilo Krummrich (1): drm: nova: select NOVA_CORE Dapeng Mi (2): perf/x86: Fix NULL event access and potential PEBS record loss perf/x86/intel: Correct large PEBS flag check Dave Kleikamp (1): dma/pool: eliminate alloc_pages warning in atomic_pool_expand David Gow (1): um: Don't rename vmap to kernel_vmap David Howells (2): cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1 cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 Denis Arefev (1): ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() Dibin Moolakadan Subrahmanian (1): drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation Dinh Nguyen (1): firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc Diogo Ivo (1): usb: phy: Initialize struct usb_phy list_head Dmitry Antipov (2): ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() ocfs2: fix memory leak in ocfs2_merge_rec_left() Dmitry Baryshkov (4): interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype drm/msm/a2xx: stop over-complaining about the legacy firmware Duoming Zhou (3): scsi: imm: Fix use-after-free bug caused by unfinished delayed work usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe() usb: typec: ucsi: fix use-after-free caused by uec->work Dylan Hatch (1): objtool: Fix standalone --hacks=jump_label Dzmitry Sankouski (2): arm64: dts: qcom: sdm845-starqltechn: remove (address|size)-cells arm64: dts: qcom: sdm845-starqltechn: fix max77705 interrupts Edward Adam Davis (3): ntfs3: init run lock for extend inode fs/ntfs3: out1 also needs to put mi fs/ntfs3: Prevent memory leaks in add sub record Eric Gonçalves (1): arm64: dts: qcom: starqltechn: remove extra empty line Eric Sandeen (1): 9p: fix cache/debug options printing in v9fs_show_options Evan Li (1): perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common() FUKAUMI Naoki (3): arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C Fangyu Yu (1): RISC-V: KVM: Fix guest page fault within HLV* instructions Fedor Pchelkin (3): wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler() wifi: rtw89: usb: fix leak in rtw89_usb_write_port() Revert "wifi: mt76: mt792x: improve monitor interface handling" Felix Fietkau (1): wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() Fenglin Wu (1): leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM Fernand Sieber (1): sched/fair: Forfeit vruntime on yield Fernando Fernandez Mancera (3): ipv6: clear RA flags when adding a static route netfilter: nf_conncount: rework API to use sk_buff directly netfilter: nft_connlimit: update the count if add was skipped Filipe Manana (1): btrfs: fix leaf leak in an error path in btrfs_del_items() Francesco Lavra (1): iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member Frank Li (1): i3c: fix refcount inconsistency in i3c_master_register Frederic Weisbecker (3): timers/migration: Convert "while" loops to use "for" timers/migration: Remove locking on group connection timers/migration: Fix imbalanced NUMA trees Gabor Juhos (1): regulator: core: disable supply if enabling main regulator fails Gao Xiang (2): erofs: correct FSDAX detection erofs: limit the level of fs stacking for file-backed mounts Gautham R. Shenoy (1): cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs Geert Uytterhoeven (2): PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() Gergo Koteles (1): arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider Gopi Krishna Menon (1): usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE Greg Kroah-Hartman (1): Linux 6.17.13 Guenter Roeck (2): block/blk-throttle: Fix throttle slice time for SSDs of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node Guido Günther (2): drm/panel: visionox-rm69299: Fix clock frequency for SHIFT6mq drm/panel: visionox-rm69299: Don't clear all mode flags Hangbin Liu (1): selftests: bonding: add delay before each xvlan_over_bond connectivity check Haotian Zhang (26): soc: qcom: gsbi: fix double disable caused by devm mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove soc: qcom: smem: fix hwspinlock resource leak in probe error paths pinctrl: stm32: fix hwspinlock resource leak in probe function power: supply: rt5033_charger: Fix device node reference leaks mfd: da9055: Fix missing regmap_del_irq_chip() in error path scsi: stex: Fix reboot_notifier leak in probe error path clk: renesas: r9a06g032: Fix memory leak in error path ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls leds: netxbig: Fix GPIO descriptor leak in error paths watchdog: wdat_wdt: Fix ACPI table leak in probe function watchdog: starfive: Fix resource leak in probe error path mfd: mt6397-irq: Fix missing irq_domain_remove() in error path mfd: mt6358-irq: Fix missing irq_domain_remove() in error path crypto: starfive - Correctly handle return of sg_nents_for_len crypto: ccree - Correctly handle return of sg_nents_for_len clocksource/drivers/ralink: Fix resource leaks in init error path greybus: gb-beagleplay: Fix timeout handling in bootloader functions hwmon: sy7636a: Fix regulator_enable resource leak on error path mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors pinctrl: single: Fix incorrect type for error return variable rtc: amlogic-a4: fix double free caused by devm ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() rtc: gamecube: Check the return value of ioremap() dm log-writes: Add missing set_freezable() for freezable kthread Haotien Hsu (1): usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt Heiko Carstens (2): s390/smp: Fix fallback CPU detection s390/ap: Don't leak debug feature files if AP instructions are not available Hemalatha Pinnamreddy (2): ASoC: amd: acp: Audio is not resuming after s0ix ASoC: amd: acp: update tdm channels for specific DAI Herbert Xu (3): crypto: authenc - Correctly pass EINPROGRESS back up to the caller crypto: ahash - Fix crypto_ahash_import with partial block data crypto: ahash - Zero positive err value in ahash_update_finish Horatiu Vultur (1): phy: mscc: Fix PTP for VSC8574 and VSC8572 Howard Hsu (1): wifi: mt76: mt7996: fix implicit beamforming support for mt7992 Huiwen He (2): drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs() drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos() Ian Rogers (3): perf bpf_counter: Fix opening of "any"(-1) CPU events perf parse-events: Fix legacy cache events if event is duplicated in a PMU perf hist: In init, ensure mem_info is put on error paths Ilias Stamatis (1): Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" Ilpo Järvinen (1): PCI: Prevent resource tree corruption when BAR resize fails Inochi Amaoto (2): net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay net: stmmac: dwmac-sophgo: Add phy interface filter Israel Rukshin (1): nvme-auth: use kvfree() for memory allocated with kvcalloc() Ivan Abramov (4): power: supply: cw2015: Check devm_delayed_work_autocancel() return code power: supply: max17040: Check iio_read_channel_processed() return code power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() power: supply: wm831x: Check wm831x_set_bits() return value Ivan Stepchenko (1): mtd: lpddr_cmds: fix signed shifts in lpddr_cmds Jacek Lawrynowicz (3): accel/ivpu: Rework bind/unbind of imported buffers accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() accel/ivpu: Make function parameter names consistent Jacob Moroni (1): RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY James Le Cuirot (1): kbuild: install-extmod-build: Fix when given dir outside the build dir Jani Nikula (4): drm/xe/fbdev: use the same 64-byte stride alignment as i915 drm/i915/fbdev: make intel_framebuffer_create() error return handling explicit drm/{i915, xe}/fbdev: pass struct drm_device to intel_fbdev_fb_alloc() drm/{i915, xe}/fbdev: deduplicate struct drm_mode_fb_cmd2 init Janusz Krzysztofik (1): drm/vgem-fence: Fix potential deadlock on release Jaroslav Kysela (2): ASoC: nau8325: use simple i2c probe function ASoC: nau8325: add missing build config Jason Tian (1): RAS: Report all ARM processor CPER information to userspace Jay Liu (1): drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue Jayesh Choudhary (2): drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook Jianglei Nie (1): staging: fbtft: core: fix potential memory leak in fbtft_probe_common() Jihed Chaibi (3): ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties Jiri Slaby (SUSE) (1): tty: introduce tty_port_tty guard() Jisheng Zhang (2): usb: dwc2: fix hang during shutdown if set as peripheral usb: dwc2: fix hang during suspend if set as peripheral Johan Hovold (14): irqchip/bcm2712-mip: Fix OF node reference imbalance irqchip/bcm2712-mip: Fix section mismatch irqchip/irq-bcm7038-l1: Fix section mismatch irqchip/irq-bcm7120-l2: Fix section mismatch irqchip/irq-brcmstb-l2: Fix section mismatch irqchip/imx-mu-msi: Fix section mismatch irqchip/renesas-rzg2l: Fix section mismatch irqchip/starfive-jh8100: Fix section mismatch irqchip/qcom-irq-combiner: Fix section mismatch staging: most: remove broken i2c driver clocksource/drivers/stm: Fix double deregistration on probe failure clocksource/drivers/nxp-stm: Fix section mismatches clocksource/drivers/nxp-stm: Prevent driver unbind clk: keystone: fix compile testing John Stultz (1): sched/core: Fix psi_dequeue() for Proxy Execution Jonas Gorski (14): net: dsa: b53: fix VLAN_ID_IDX write size for BCM5325/65 net: dsa: b53: fix extracting VID from entry for BCM5325/65 net: dsa: b53: b53_arl_read{,25}(): use the entry for comparision net: dsa: b53: move reading ARL entries into their own function net: dsa: b53: move writing ARL entries into their own functions net: dsa: b53: provide accessors for accessing ARL_SRCH_CTL net: dsa: b53: split reading search entry into their own functions net: dsa: b53: move ARL entry functions into ops struct net: dsa: b53: add support for 5389/5397/5398 ARL entry format net: dsa: b53: use same ARL search result offset for BCM5325/65 net: dsa: b53: fix CPU port unicast ARL entries for BCM5325/65 net: dsa: b53: add support for bcm63xx ARL entry format net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks net: dsa: b53: fix BCM5325/65 ARL entry VIDs Jonathan Curley (1): NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Joseph Qi (1): ocfs2: use correct endian in ocfs2_dinode_has_extents Josh Poimboeuf (2): objtool: Fix weak symbol detection perf: Remove get_perf_callchain() init_nr argument Joy Zou (1): arm64: dts: imx95-15x15-evk: add fan-supply property for pwm-fan Junrui Luo (4): ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events ALSA: firewire-motu: add bounds check in put_user loop for DSP events ALSA: dice: fix buffer overflow in detect_stream_formats() ALSA: wavefront: Fix integer overflow in sample size validation Kang Yang (1): wifi: ath10k: move recovery check logic into a new work Karol Wachowski (2): accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail accel/ivpu: Fix DCT active percent format Kathara Sasikumar (1): docs: hwmon: fix link to g762 devicetree binding Ketil Johnsen (2): drm/panthor: Fix UAF race between device unplug and FW event processing drm/panthor: Fix race with suspend during unplug Kevin Brodsky (1): ublk: prevent invalid access with DEBUG Konrad Dybcio (3): dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets arm64: dts: qcom: sdm845-starqltechn: Fix i2c-gpio node name Konstantin Andreev (7): smack: deduplicate "does access rule request transmutation" smack: fix bug: SMACK64TRANSMUTE set on non-directory smack: deduplicate xattr setting in smack_inode_init_security() smack: always "instantiate" inode in smack_inode_init_security() smack: fix bug: invalid label of unix socket file smack: fix bug: unprivileged task can create labels smack: fix bug: setting task label silently ignores input garbage Krishna Kurapati (2): arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller Krzysztof Czurylo (2): RDMA/irdma: Fix data race in irdma_sc_ccq_arm RDMA/irdma: Fix data race in irdma_free_pble Krzysztof Kozlowski (1): ASoC: codecs: nau8325: Silence uninitialized variables warnings Kuan-Wei Chiu (1): interconnect: debugfs: Fix incorrect error handling for NULL path Kumar Kartikeya Dwivedi (2): rqspinlock: Enclose lock/unlock within lock entry acquisitions rqspinlock: Use trylock fallback when per-CPU rqnode is busy Kuniyuki Iwashima (1): sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). Lad Prabhakar (1): clk: renesas: r9a09g077: Propagate rate changes to parent clocks Len Brown (1): tools/power turbostat: Regression fix Uncore MHz printed in hex Leo Yan (7): coresight: Change device mode to atomic type coresight: etm4x: Always set tracer's device mode on target CPU coresight: etm3x: Always set tracer's device mode on target CPU coresight: etm4x: Correct polling IDLE bit coresight: etm4x: Add context synchronization before enabling trace coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF perf arm_spe: Fix memset subclass in operation Leon Hwang (1): bpf: Free special fields when update [lru_,]percpu_hash maps Li Nan (1): md: delete md_redundancy_group when array is becoming inactive Li Qiang (2): uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload() Liyuan Pang (1): ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() Lizhi Hou (4): accel/amdxdna: Fix incorrect command state for timed out job accel/amdxdna: Fix dma_fence leak when job is canceled accel/amdxdna: Clear mailbox interrupt register during channel creation accel/amdxdna: Fix deadlock between context destroy and job timeout Loic Poulain (2): arm64: dts: qcom: qcm2290: Add CCI node arm64: dts: qcom: qcm2290: Fix camss register prop ordering Long Li (1): macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse Longbin Li (1): spi: sophgo: Fix incorrect use of bus width value macros Lorenzo Bianconi (4): wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event() wifi: mt76: mt7996: skip deflink accounting for offchannel links wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work() Luca Ceresoli (1): backlight: led-bl: Add devlink to supplier LEDs Luca Weiss (3): clk: qcom: camcc-sm6350: Fix PLL config of PLL2 clk: qcom: camcc-sm7150: Fix PLL config of PLL2 arm64: dts: qcom: qcm6490-fairphone-fp5: Add supplies to simple-fb node Luo Jie (1): clk: qcom: gcc-ipq5424: Correct the icc_first_node_id Ma Ke (1): RDMA/rtrs: server: Fix error handling in get_or_create_srv Maciej Falkowski (1): accel/ivpu: Remove skip of dma unmap for imported buffers Madhur Kumar (1): drm/nouveau: refactor deprecated strcpy Mainak Sen (1): gpu: host1x: Fix race in syncpt alloc/free Manish Dharanenthiran (1): wifi: ath12k: Fix timeout error during beacon stats retrieval Manivannan Sadhasivam (1): dt-bindings: PCI: amlogic: Fix the register name of the DBI region Marek Szyprowski (4): ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend Marek Vasut (3): clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback clk: renesas: cpg-mssr: Read back reset registers to assure values latched arm64: dts: renesas: sparrow-hawk: Fix full-size DP connector node name and labels Mark Brown (1): regulator: fixed: Rely on the core freeing the enable GPIO Markus Niebel (1): arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name Martin KaFai Lau (1): bpf: Check skb->transport_header is set in bpf_skb_check_mtu Matt Bobrowski (3): selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names selftests/bpf: skip test_perf_branches_hw() on unsupported platforms selftests/bpf: Improve reliability of test_perf_branches_no_hw() Mauro Carvalho Chehab (3): efi/cper: Add a new helper function to print bitmasks efi/cper: Adjust infopfx size to accept an extra space efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs Mavroudis Chatzilazaridis (1): HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() Menglong Dong (1): bpf: Handle return value of ftrace_set_filter_ip in register_fentry Michael S. Tsirkin (5): virtio: fix typo in virtio_device_ready() comment virtio: fix whitespace in virtio_config_ops virtio: fix grammar in virtio_queue_info docs virtio: fix virtqueue_set_affinity() docs virtio: clean up features qword/dword terms Michal Schmidt (1): iavf: Implement settime64 with -EOPNOTSUPP Michal Suchanek (1): perf hwmon_pmu: Fix uninitialized variable warning Mike Christie (2): scsi: target: Fix LUN/device R/W and total command stats vhost: Fix kthread worker cgroup failure handling Mike McGowen (1): scsi: smartpqi: Fix device resources accessed after device removal Mikhail Kshevetskiy (1): spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND Ming Yen Hsieh (2): wifi: mt76: mt7925: add MBSSID support wifi: mt76: mt7921: add MBSSID support Miquel Sabaté Solà (1): btrfs: fix double free of qgroup record after failure to add delayed ref head Mohamed Khalfella (1): block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock Murad Masimov (1): power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() Namhyung Kim (5): perf lock contention: Load kernel map before lookup perf tools: Fix missing feature check for inherit + SAMPLE_READ perf jitdump: Add sym/str-tables to build-ID generation perf tools: Mark split kallsyms DSOs as loaded perf tools: Fix split kallsyms DSO counting Neil Armstrong (1): arm64: dts: qcom: sm8650: set ufs as dma coherent Nuno Das Neves (2): mshv: Fix deposit memory in MSHV_ROOT_HVCALL mshv: Fix create memory region overlap check Nuno Sá (1): rtc: max31335: Fix ignored return value in set_alarm Oliver Neukum (1): usb: chaoskey: fix locking for O_NONBLOCK Ovidiu Panait (1): net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr() Pablo Neira Ayuso (1): netfilter: flowtable: check for maximum number of encapsulations in bridge vlan Pavel Begunkov (1): io_uring: use WRITE_ONCE for user shared memory Peng Fan (2): remoteproc: imx_rproc: Fix runtime PM cleanup and improve remove path firmware: imx: scu-irq: fix OF node leak in Pengjie Zhang (1): PM / devfreq: hisi: Fix potential UAF in OPP handling Peter Griffin (1): arm64: dts: exynos: gs101: fix sysreg_apm reg property Peter Zijlstra (2): task_work: Fix NMI race condition entry,unwind/deferred: Fix unwind_reset_info() placement Pradeep Kumar Chitrapu (1): wifi: ath12k: fix TX and RX MCS rate configurations in HE mode Praveen Talari (1): arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm Prike Liang (1): drm/amdgpu: add userq object va track helpers Pu Lehui (1): bpf: Fix invalid prog->stats access when update_effective_progs fails Rameshkumar Sundaram (1): wifi: ath12k: unassign arvif on scan vdev create failure Randolph Sapp (1): arm64: dts: ti: k3-am62p: Fix memory ranges for GPU Randy Dunlap (2): firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc backlight: lp855x: Fix lp855x.h kernel-doc warnings Raphael Pinsonneault-Thibeault (1): ntfs3: fix uninit memory after failed mi_read in mi_format_new Rene Rebe (1): ps3disk: use memcpy_{from,to}_bvec index René Rebe (2): ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 drm/nouveau: fix circular dep oops from vendored i2c encoder Ria Thomas (1): wifi: ieee80211: correct FILS status codes Ritesh Harjani (IBM) (2): powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format Robert Marko (1): net: phy: aquantia: check for NVMEM deferral Roberto Sassu (1): ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook Rodrigo Gobbi (1): iio: imu: bmi270: fix dev_err_probe error msg Ryan Huang (1): iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables Sahil Chandna (1): bpf: Prevent nesting overflow in bpf_try_get_buffers Sarika Sharma (1): wifi: ath12k: Fix MSDU buffer types handling in RX error path Sebastian Andrzej Siewior (1): cpu: Make atomic hotplug callbacks run with interrupts disabled on UP Selvin Xavier (2): RDMA/bnxt_re: Fix the inline size for GenP7 devices RDMA/bnxt_re: Pass correct flag for dma mr creation Sergey Bashirov (1): NFSD/blocklayout: Fix minlength check in proc_layoutget Seungjin Bae (2): USB: Fix descriptor count when handling invalid MBIM extended descriptor wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() Shaurya Rane (1): block: fix memory leak in __blkdev_issue_zero_pages Shawn Lin (3): scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562 PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition Shayne Chen (5): wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv() wifi: mt76: mt7996: fix teardown command for an MLD peer wifi: mt76: mt7996: set link_valid field when initializing wcid wifi: mt76: mt7996: fix MLD group index assignment wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart() Shenghao Ding (1): ASoC: tas2781: correct the wrong period Shengjiu Wang (3): ASoC: fsl_xcvr: clear the channel status control memory ASoC: ak4458: Disable regulator when error happens ASoC: ak5558: Disable regulator when error happens Sherry Sun (1): tty: serial: imx: Only configure the wake register when device is set as wakeup source Shuai Xue (1): perf record: skip synthesize event when open evsel failed Siddharth Chintamaneni (1): bpf: Cleanup unused func args in rqspinlock implementation Siddharth Vadapalli (1): PCI: keystone: Exit ks_pcie_probe() for invalid mode Sidharth Seela (1): ntfs3: Fix uninit buffer allocated by __getname() Songtang Liu (1): iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show Sourabh Jain (1): powerpc/kdump: Fix size calculation for hot-removed memory ranges Stanley Chu (1): i3c: master: svc: Prevent incomplete IBI transaction StanleyYP Wang (1): wifi: mt76: mt7996: fix max nss value when getting rx chainmask Stephan Gerhold (1): iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal Sven Peter (1): usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required T Pratham (1): crypto: aead - Fix reqsize handling Taniya Das (2): clk: qcom: gcc-sm8750: Add a new frequency for sdcc2 clock clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops Tengda Wu (1): x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() Thaumy Cheng (1): perf/core: Fix missing read event generation on task exit Thomas Richard (1): leds: upboard: Fix module alias Thomas Richard (TI.com) (1): firmware: ti_sci: Set IO Isolation only if the firmware is capable Thomas Weißschuh (1): tools/nolibc: handle NULL wstatus argument to waitpid() Thorsten Blum (1): crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Tianchu Chen (1): spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Tianyou Li (1): perf annotate: Check return value of evsel__get_arch() properly Tim Harvey (4): arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl arm64: dts: imx8mp-venice-gw702x: remove off-board uart arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 Timur Tabi (1): drm/nouveau: restrict the flush page to a 32-bit address Tingmao Wang (1): fs/9p: Don't open remote file with APPEND mode when writeback cache is used Tomasz Rusinowicz (1): accel/ivpu: Fix race condition when unbinding BOs Trond Myklebust (9): NFS: Avoid changing nlink when file removes and attribute updates race NFS: Initialise verifiers for visible dentries in readdir and lookup NFS: Initialise verifiers for visible dentries in nfs_atomic_open() NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state Revert "nfs: ignore SB_RDONLY when remounting nfs" Revert "nfs: clear SB_RDONLY before getting superblock" Revert "nfs: ignore SB_RDONLY when mounting nfs" NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags NFS: Fix inheritance of the block sizes when automounting Troy Mitchell (1): i2c: spacemit: fix detect issue Usama Arif (2): x86/boot: Fix page table access in 5-level to 4-level paging transition efi/libstub: Fix page table access in 5-level to 4-level paging transition Uwe Kleine-König (1): pwm: bcm2835: Make sure the channel is enabled after pwm_request() Vishwaroop A (1): spi: tegra210-quad: Fix timeout handling Vladimir Oltean (2): net: phy: realtek: create rtl8211f_config_rgmii_delay() net: dsa: xrs700x: reject unsupported HSR configurations Vladimir Zapolskiy (2): clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other Wang Liang (1): locktorture: Fix memory leak in param_set_cpumask() Willem de Bruijn (1): selftests/net: packetdrill: pass send_omit_free to MSG_ZEROCOPY tests Wludzik, Jozef (1): accel/ivpu: Fix race condition when mapping dmabuf Wolfram Sang (2): ARM: dts: renesas: gose: Remove superfluous port property ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties Xi Pardee (1): platform/x86:intel/pmc: Update Arrow Lake telemetry GUID Xiang Mei (1): net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop Xiao Ni (2): md: delete mddev kobj before deleting gendisk kobj md: avoid repeated calls to del_gendisk Xiaogang Chen (1): drm/amdkfd: Use huge page size to check split svm range alignment Xiaolei Wang (1): phy: freescale: Initialize priv->lock Xiaoliang Yang (1): net: hsr: create an API to get hsr port type Xiaoqi Zhuang (1): coresight: ETR: Fix ETR buffer use-after-free issue Xuanqiang Luo (3): rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() inet: Avoid ehash lookup race in inet_ehash_insert() inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() Yao Zi (1): phy: rockchip: naneng-combphy: Add SoC prefix to register definitions Yegor Yefremov (1): ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels Yongjian Sun (1): ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation Yu Kuai (1): md/raid5: fix IO hang when array is broken with IO inflight Yun Zhou (1): md: fix rcu protection in md_wakeup_thread Yuntao Wang (2): of/fdt: Consolidate duplicate code into helper functions of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho() Zhang Rui (1): perf/x86/intel/cstate: Remove PC3 support from LunarLake Zhang Yi (1): ext4: correct the checking of quota files before moving extents Zhao Yipeng (1): ima: Handle error code returned by ima_filter_rule_match() Zheng Qixing (2): nbd: defer config put in recv_work nbd: defer config unlock in nbd_genl_connect Zhu Yanjun (1): RDMA/rxe: Fix null deref on srq->rq.queue after resize failure Zilin Guan (3): crypto: iaa - Fix incorrect return value in save_iaa_wq() scsi: qla2xxx: Fix improper freeing of purex item mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() nieweiqiang (1): crypto: hisilicon/qm - restore original qos values shechenglong (1): block: fix comment for op_is_zone_mgmt() to include RESET_ALL sparkhuang (1): regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex xupengbo (1): sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out

5 days, 7 hours

1
1
0 0

Linux 6.18.2

by Greg Kroah-Hartman

I'm announcing the release of the 6.18.2 kernel. All users of the 6.18 kernel series must upgrade. The updated 6.18.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.18.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/admin-guide/LSM/Smack.rst | 16 Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml | 6 Documentation/hwmon/g762.rst | 2 Makefile | 2 arch/arm/boot/dts/renesas/r8a7793-gose.dts | 1 arch/arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts | 2 arch/arm/boot/dts/samsung/exynos4210-i9100.dts | 1 arch/arm/boot/dts/samsung/exynos4210-trats.dts | 1 arch/arm/boot/dts/samsung/exynos4210-universal_c210.dts | 1 arch/arm/boot/dts/samsung/exynos4412-midas.dtsi | 1 arch/arm/boot/dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi | 8 arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi | 2 arch/arm/boot/dts/ti/omap/am335x-boneblue.dts | 2 arch/arm/boot/dts/ti/omap/am335x-chiliboard.dts | 2 arch/arm/boot/dts/ti/omap/am335x-evm.dts | 2 arch/arm/boot/dts/ti/omap/am335x-evmsk.dts | 2 arch/arm/boot/dts/ti/omap/am335x-guardian.dts | 2 arch/arm/boot/dts/ti/omap/am335x-icev2.dts | 2 arch/arm/boot/dts/ti/omap/am335x-myirtech-myd.dts | 2 arch/arm/boot/dts/ti/omap/am335x-netcom-plus-2xx.dts | 8 arch/arm/boot/dts/ti/omap/am335x-osd3358-sm-red.dts | 2 arch/arm/boot/dts/ti/omap/am335x-pdu001.dts | 2 arch/arm/boot/dts/ti/omap/am335x-pocketbeagle.dts | 2 arch/arm/boot/dts/ti/omap/am335x-sl50.dts | 2 arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts | 2 arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 arch/arm/include/asm/word-at-a-time.h | 10 arch/arm64/boot/dts/amlogic/meson-g12b.dtsi | 4 arch/arm64/boot/dts/exynos/google/gs101.dtsi | 18 arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi | 51 - arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi | 11 arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts | 1 arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi | 4 arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 arch/arm64/boot/dts/nvidia/tegra234.dtsi | 61 + arch/arm64/boot/dts/qcom/ipq5424.dtsi | 2 arch/arm64/boot/dts/qcom/lemans.dtsi | 1 arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 arch/arm64/boot/dts/qcom/qcm2290.dtsi | 10 arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts | 2 arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts | 5 arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 2 arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 170 ++-- arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 4 arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts | 16 arch/arm64/boot/dts/qcom/sm8250-samsung-common.dtsi | 3 arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 arch/arm64/boot/dts/qcom/sm8750-mtp.dts | 6 arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 5 arch/arm64/boot/dts/qcom/x1e80100.dtsi | 12 arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 6 arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts | 1 arch/arm64/boot/dts/rockchip/rk3588-rock-5b-5bp-5t.dtsi | 4 arch/arm64/boot/dts/rockchip/rk3588-rock-5b-plus.dts | 5 arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts | 4 arch/arm64/boot/dts/rockchip/rk3588-rock-5t.dts | 4 arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 15 arch/arm64/boot/dts/ti/k3-am62p.dtsi | 2 arch/arm64/boot/dts/ti/k3-am69-sk.dts | 8 arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi | 4 arch/arm64/mm/mmu.c | 214 +++-- arch/arm64/mm/pageattr.c | 5 arch/powerpc/kernel/entry_32.S | 10 arch/powerpc/kexec/ranges.c | 2 arch/powerpc/mm/book3s64/hash_utils.c | 10 arch/powerpc/mm/ptdump/hashpagetable.c | 6 arch/riscv/kvm/vcpu_insn.c | 22 arch/s390/include/asm/fpu-insn.h | 3 arch/s390/kernel/smp.c | 1 arch/um/Kconfig | 1 arch/um/Makefile | 12 arch/um/include/asm/kasan.h | 4 arch/x86/boot/compressed/pgtable_64.c | 11 arch/x86/events/core.c | 5 arch/x86/events/intel/core.c | 7 arch/x86/events/intel/cstate.c | 3 arch/x86/kernel/dumpstack.c | 23 block/blk-lib.c | 6 block/blk-mq.c | 35 block/blk-throttle.c | 9 block/mq-deadline.c | 129 +-- crypto/aead.c | 1 crypto/ahash.c | 18 crypto/asymmetric_keys/asymmetric_type.c | 14 crypto/authenc.c | 75 +- drivers/accel/amdxdna/aie2_ctx.c | 22 drivers/accel/amdxdna/aie2_pci.c | 10 drivers/accel/amdxdna/amdxdna_ctx.c | 1 drivers/accel/amdxdna/amdxdna_ctx.h | 1 drivers/accel/amdxdna/amdxdna_gem.c | 47 - drivers/accel/amdxdna/amdxdna_mailbox.c | 1 drivers/accel/ivpu/ivpu_gem.c | 97 +- drivers/accel/ivpu/ivpu_gem.h | 2 drivers/accel/ivpu/ivpu_hw_btrs.c | 2 drivers/accel/ivpu/ivpu_hw_btrs.h | 2 drivers/accel/ivpu/ivpu_job.c | 6 drivers/accel/ivpu/ivpu_pm.c | 9 drivers/acpi/apei/ghes.c | 27 drivers/acpi/processor_core.c | 2 drivers/acpi/property.c | 1 drivers/base/firmware_loader/Kconfig | 2 drivers/block/nbd.c | 5 drivers/block/ps3disk.c | 4 drivers/block/ublk_drv.c | 4 drivers/char/random.c | 19 drivers/clk/Makefile | 3 drivers/clk/qcom/camcc-sm6350.c | 13 drivers/clk/qcom/camcc-sm7150.c | 6 drivers/clk/qcom/camcc-sm8550.c | 10 drivers/clk/qcom/gcc-glymur.c | 24 drivers/clk/qcom/gcc-ipq5424.c | 3 drivers/clk/qcom/gcc-qcs615.c | 6 drivers/clk/qcom/gcc-sm8750.c | 1 drivers/clk/qcom/tcsrcc-glymur.c | 54 - drivers/clk/renesas/r9a06g032-clocks.c | 6 drivers/clk/renesas/r9a09g077-cpg.c | 4 drivers/clk/renesas/renesas-cpg-mssr.c | 57 - drivers/clk/spacemit/ccu-k1.c | 4 drivers/clocksource/arm_arch_timer_mmio.c | 2 drivers/clocksource/timer-nxp-pit.c | 3 drivers/clocksource/timer-nxp-stm.c | 23 drivers/clocksource/timer-ralink.c | 11 drivers/cpufreq/amd-pstate.c | 2 drivers/crypto/ccree/cc_buffer_mgr.c | 6 drivers/crypto/hisilicon/qm.c | 14 drivers/crypto/intel/iaa/iaa_crypto_main.c | 2 drivers/crypto/starfive/jh7110-hash.c | 6 drivers/devfreq/hisi_uncore_freq.c | 3 drivers/firmware/efi/cper-arm.c | 52 - drivers/firmware/efi/cper.c | 60 + drivers/firmware/efi/libstub/x86-5lvl.c | 4 drivers/firmware/imx/imx-scu-irq.c | 4 drivers/firmware/stratix10-svc.c | 1 drivers/firmware/ti_sci.c | 21 drivers/firmware/ti_sci.h | 2 drivers/gpio/Kconfig | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 44 - drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 12 drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 31 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 46 - drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 4 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 27 drivers/gpu/drm/drm_plane.c | 8 drivers/gpu/drm/i915/display/intel_fbdev.c | 43 + drivers/gpu/drm/i915/display/intel_fbdev_fb.c | 42 - drivers/gpu/drm/i915/display/intel_fbdev_fb.h | 8 drivers/gpu/drm/imagination/pvr_device.c | 2 drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 2 drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 34 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 10 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h | 6 drivers/gpu/drm/msm/msm_gpu.c | 21 drivers/gpu/drm/nouveau/dispnv04/nouveau_i2c_encoder.c | 20 drivers/gpu/drm/nouveau/include/dispnv04/i2c/encoder_i2c.h | 19 drivers/gpu/drm/nouveau/nouveau_fence.c | 6 drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c | 2 drivers/gpu/drm/nova/Kconfig | 1 drivers/gpu/drm/panel/panel-novatek-nt35560.c | 8 drivers/gpu/drm/panel/panel-visionox-rm69299.c | 4 drivers/gpu/drm/panthor/panthor_device.c | 4 drivers/gpu/drm/panthor/panthor_gem.c | 20 drivers/gpu/drm/panthor/panthor_mmu.c | 18 drivers/gpu/drm/panthor/panthor_sched.c | 25 drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 4 drivers/gpu/drm/tidss/tidss_dispc.c | 93 +- drivers/gpu/drm/tidss/tidss_dispc.h | 3 drivers/gpu/drm/tidss/tidss_drv.h | 2 drivers/gpu/drm/tidss/tidss_oldi.c | 22 drivers/gpu/drm/vgem/vgem_fence.c | 2 drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 32 drivers/gpu/host1x/syncpt.c | 4 drivers/gpu/nova-core/firmware/gsp.rs | 8 drivers/greybus/gb-beagleplay.c | 12 drivers/hid/hid-logitech-hidpp.c | 9 drivers/hv/mshv_root_main.c | 89 +- drivers/hwmon/sy7636a-hwmon.c | 7 drivers/hwtracing/coresight/coresight-etm-perf.c | 1 drivers/hwtracing/coresight/coresight-etm3x-core.c | 59 + drivers/hwtracing/coresight/coresight-etm4x-core.c | 103 +- drivers/hwtracing/coresight/coresight-etm4x.h | 3 drivers/hwtracing/coresight/coresight-tmc-etr.c | 10 drivers/i2c/busses/i2c-k1.c | 19 drivers/i3c/master.c | 8 drivers/i3c/master/svc-i3c-master.c | 22 drivers/iio/imu/bmi270/bmi270_spi.c | 2 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 drivers/iio/industrialio-core.c | 17 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 drivers/infiniband/hw/bnxt_re/qplib_sp.h | 2 drivers/infiniband/hw/irdma/cm.c | 2 drivers/infiniband/hw/irdma/ctrl.c | 6 drivers/infiniband/hw/irdma/icrdma_if.c | 6 drivers/infiniband/hw/irdma/ig3rdma_if.c | 4 drivers/infiniband/hw/irdma/main.h | 2 drivers/infiniband/hw/irdma/pble.c | 6 drivers/infiniband/hw/irdma/puda.c | 1 drivers/infiniband/hw/irdma/uk.c | 31 drivers/infiniband/hw/irdma/user.h | 1 drivers/infiniband/hw/irdma/verbs.c | 24 drivers/infiniband/hw/irdma/verbs.h | 3 drivers/infiniband/sw/rxe/rxe_srq.c | 7 drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 drivers/interconnect/debugfs-client.c | 7 drivers/interconnect/qcom/msm8996.c | 1 drivers/iommu/amd/debugfs.c | 2 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 drivers/iommu/intel/Kconfig | 2 drivers/iommu/intel/iommu.h | 2 drivers/irqchip/irq-bcm2712-mip.c | 11 drivers/irqchip/irq-bcm7038-l1.c | 11 drivers/irqchip/irq-bcm7120-l2.c | 31 drivers/irqchip/irq-brcmstb-l2.c | 25 drivers/irqchip/irq-imx-mu-msi.c | 28 drivers/irqchip/irq-mchp-eic.c | 7 drivers/irqchip/irq-meson-gpio.c | 5 drivers/irqchip/irq-qcom-mpm.c | 6 drivers/irqchip/irq-renesas-rzg2l.c | 37 drivers/irqchip/irq-renesas-rzv2h.c | 32 drivers/irqchip/irq-starfive-jh8100-intc.c | 6 drivers/irqchip/irqchip.c | 10 drivers/irqchip/qcom-irq-combiner.c | 2 drivers/irqchip/qcom-pdc.c | 5 drivers/leds/leds-netxbig.c | 36 drivers/leds/leds-upboard.c | 2 drivers/leds/rgb/leds-qcom-lpg.c | 4 drivers/macintosh/mac_hid.c | 3 drivers/md/dm-log-writes.c | 1 drivers/md/dm-raid.c | 2 drivers/md/md.c | 92 +- drivers/md/md.h | 9 drivers/md/raid5.c | 6 drivers/mfd/da9055-core.c | 1 drivers/mfd/mt6358-irq.c | 1 drivers/mfd/mt6397-irq.c | 1 drivers/misc/rp1/rp1_pci.c | 3 drivers/mtd/lpddr/lpddr_cmds.c | 8 drivers/mtd/nand/raw/lpc32xx_slc.c | 2 drivers/mtd/nand/raw/marvell_nand.c | 13 drivers/mtd/nand/raw/nand_base.c | 13 drivers/mtd/nand/raw/renesas-nand-controller.c | 5 drivers/net/dsa/b53/b53_common.c | 315 +++++--- drivers/net/dsa/b53/b53_priv.h | 111 ++ drivers/net/dsa/b53/b53_regs.h | 41 - drivers/net/dsa/xrs700x/xrs700x.c | 11 drivers/net/ethernet/intel/iavf/iavf_ptp.c | 7 drivers/net/ethernet/intel/ice/devlink/devlink.c | 21 drivers/net/ethernet/intel/ice/ice.h | 4 drivers/net/ethernet/intel/ice/ice_common.c | 3 drivers/net/ethernet/intel/ice/ice_main.c | 169 ++-- drivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c | 20 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c | 3 drivers/net/phy/adin1100.c | 2 drivers/net/phy/aquantia/aquantia_firmware.c | 2 drivers/net/phy/mscc/mscc_main.c | 6 drivers/net/phy/phy-core.c | 43 + drivers/net/phy/realtek/realtek_main.c | 65 + drivers/net/vxlan/vxlan_core.c | 18 drivers/net/wireless/ath/ath10k/core.c | 20 drivers/net/wireless/ath/ath10k/core.h | 2 drivers/net/wireless/ath/ath10k/mac.c | 2 drivers/net/wireless/ath/ath11k/mac.c | 8 drivers/net/wireless/ath/ath11k/pci.c | 20 drivers/net/wireless/ath/ath11k/wmi.c | 20 drivers/net/wireless/ath/ath11k/wmi.h | 2 drivers/net/wireless/ath/ath12k/core.c | 24 drivers/net/wireless/ath/ath12k/core.h | 1 drivers/net/wireless/ath/ath12k/dp_rx.c | 70 + drivers/net/wireless/ath/ath12k/hal_rx.c | 10 drivers/net/wireless/ath/ath12k/mac.c | 28 drivers/net/wireless/ath/ath12k/pci.c | 20 drivers/net/wireless/ath/ath12k/qmi.c | 11 drivers/net/wireless/ath/ath12k/qmi.h | 5 drivers/net/wireless/ath/ath12k/wmi.c | 23 drivers/net/wireless/ath/ath12k/wmi.h | 2 drivers/net/wireless/ath/ath12k/wow.c | 1 drivers/net/wireless/intel/iwlwifi/mld/d3.c | 4 drivers/net/wireless/mediatek/mt76/mac80211.c | 2 drivers/net/wireless/mediatek/mt76/mt76.h | 9 drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 4 drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 drivers/net/wireless/mediatek/mt76/mt792x_core.c | 1 drivers/net/wireless/mediatek/mt76/mt7996/dma.c | 15 drivers/net/wireless/mediatek/mt76/mt7996/init.c | 19 drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 18 drivers/net/wireless/mediatek/mt76/mt7996/main.c | 115 +-- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 65 + drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 1 drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 drivers/net/wireless/mediatek/mt76/wed.c | 10 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 27 drivers/net/wireless/realtek/rtw89/usb.c | 13 drivers/net/wireless/st/cw1200/bh.c | 6 drivers/nvme/host/auth.c | 2 drivers/of/fdt.c | 85 +- drivers/of/of_kunit_helpers.c | 5 drivers/pci/controller/Kconfig | 7 drivers/pci/controller/cadence/pcie-sg2042.c | 3 drivers/pci/controller/dwc/pci-keystone.c | 2 drivers/pci/controller/dwc/pcie-designware.h | 2 drivers/pci/controller/dwc/pcie-stm32-ep.c | 41 - drivers/pci/endpoint/functions/pci-epf-test.c | 5 drivers/pci/setup-bus.c | 5 drivers/phy/freescale/phy-fsl-imx8qm-hsio.c | 5 drivers/phy/renesas/phy-rcar-gen3-usb2.c | 20 drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 15 drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 27 drivers/pinctrl/pinctrl-single.c | 7 drivers/pinctrl/qcom/pinctrl-glymur.c | 6 drivers/pinctrl/renesas/pinctrl-rzg2l.c | 6 drivers/pinctrl/stm32/pinctrl-stm32.c | 2 drivers/platform/x86/asus-wmi.c | 8 drivers/platform/x86/intel/pmc/core.h | 2 drivers/power/supply/apm_power.c | 3 drivers/power/supply/cw2015_battery.c | 8 drivers/power/supply/max17040_battery.c | 6 drivers/power/supply/qcom_battmgr.c | 26 drivers/power/supply/rt5033_charger.c | 2 drivers/power/supply/rt9467-charger.c | 6 drivers/power/supply/wm831x_power.c | 10 drivers/pwm/core.c | 5 drivers/pwm/pwm-bcm2835.c | 28 drivers/ras/ras.c | 40 + drivers/regulator/core.c | 37 drivers/regulator/fixed.c | 11 drivers/regulator/pca9450-regulator.c | 7 drivers/regulator/spacemit-p1.c | 4 drivers/remoteproc/imx_rproc.c | 9 drivers/remoteproc/qcom_q6v5_wcss.c | 8 drivers/rtc/rtc-amlogic-a4.c | 4 drivers/rtc/rtc-gamecube.c | 4 drivers/rtc/rtc-max31335.c | 6 drivers/s390/crypto/ap_bus.c | 8 drivers/scsi/imm.c | 1 drivers/scsi/qla2xxx/qla_nvme.c | 2 drivers/scsi/qla2xxx/qla_os.c | 20 drivers/scsi/qla2xxx/qla_target.c | 5 drivers/scsi/qla2xxx/qla_target.h | 1 drivers/scsi/sim710.c | 2 drivers/scsi/smartpqi/smartpqi_init.c | 19 drivers/scsi/stex.c | 1 drivers/soc/qcom/qcom_gsbi.c | 8 drivers/soc/qcom/smem.c | 3 drivers/soc/renesas/r9a08g045-sysc.c | 69 + drivers/soc/renesas/r9a09g047-sys.c | 79 ++ drivers/soc/renesas/r9a09g056-sys.c | 69 + drivers/soc/renesas/r9a09g057-sys.c | 101 ++ drivers/soc/renesas/rz-sysc.c | 2 drivers/soc/renesas/rz-sysc.h | 4 drivers/soc/samsung/exynos-pmu.c | 7 drivers/soc/tegra/fuse/speedo-tegra210.c | 62 + drivers/spi/spi-airoha-snfi.c | 25 drivers/spi/spi-ch341.c | 2 drivers/spi/spi-sg2044-nor.c | 4 drivers/spi/spi-tegra210-quad.c | 22 drivers/staging/fbtft/fbtft-core.c | 4 drivers/staging/most/Kconfig | 2 drivers/staging/most/Makefile | 1 drivers/staging/most/i2c/Kconfig | 13 drivers/staging/most/i2c/Makefile | 4 drivers/staging/most/i2c/i2c.c | 374 ---------- drivers/target/target_core_configfs.c | 1 drivers/target/target_core_stat.c | 24 drivers/tty/serial/imx.c | 14 drivers/ufs/core/ufshcd-priv.h | 2 drivers/ufs/core/ufshcd.c | 27 drivers/ufs/host/ufs-rockchip.c | 19 drivers/uio/uio_fsl_elbc_gpcm.c | 7 drivers/usb/core/message.c | 2 drivers/usb/dwc2/platform.c | 17 drivers/usb/dwc3/host.c | 5 drivers/usb/gadget/legacy/raw_gadget.c | 3 drivers/usb/gadget/udc/tegra-xudc.c | 6 drivers/usb/misc/chaoskey.c | 16 drivers/usb/phy/phy.c | 4 drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 2 drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 drivers/vdpa/pds/vdpa_dev.c | 2 drivers/vfio/pci/vfio_pci_core.c | 68 + drivers/vfio/pci/vfio_pci_intrs.c | 52 - drivers/vfio/pci/vfio_pci_priv.h | 4 drivers/vhost/net.c | 12 drivers/vhost/vhost.c | 4 drivers/video/backlight/led_bl.c | 13 drivers/video/fbdev/ssd1307fb.c | 4 drivers/virtio/virtio.c | 12 drivers/virtio/virtio_debug.c | 10 drivers/virtio/virtio_pci_modern_dev.c | 6 drivers/virtio/virtio_ring.c | 7 drivers/virtio/virtio_vdpa.c | 2 drivers/watchdog/starfive-wdt.c | 4 drivers/watchdog/wdat_wdt.c | 64 + fs/9p/v9fs.c | 4 fs/9p/vfs_file.c | 11 fs/9p/vfs_inode.c | 3 fs/9p/vfs_inode_dotl.c | 2 fs/btrfs/block-group.c | 6 fs/btrfs/ctree.c | 2 fs/btrfs/delayed-ref.c | 43 - fs/btrfs/scrub.c | 2 fs/btrfs/space-info.c | 22 fs/btrfs/space-info.h | 6 fs/erofs/super.c | 38 - fs/exfat/balloc.c | 2 fs/exfat/namei.c | 20 fs/ext4/mballoc.c | 49 - fs/ext4/move_extent.c | 2 fs/f2fs/f2fs.h | 2 fs/f2fs/gc.c | 134 ++- fs/f2fs/recovery.c | 2 fs/f2fs/segment.c | 38 - fs/f2fs/segment.h | 8 fs/f2fs/super.c | 14 fs/f2fs/sysfs.c | 7 fs/fuse/control.c | 19 fs/gfs2/glock.c | 5 fs/gfs2/inode.c | 15 fs/gfs2/inode.h | 1 fs/gfs2/ops_fstype.c | 2 fs/hfs/catalog.c | 2 fs/inode.c | 58 - fs/iomap/direct-io.c | 23 fs/nfs/client.c | 21 fs/nfs/dir.c | 27 fs/nfs/internal.h | 3 fs/nfs/localio.c | 4 fs/nfs/namespace.c | 11 fs/nfs/nfs4client.c | 18 fs/nfs/nfs4proc.c | 27 fs/nfs/pnfs.c | 1 fs/nfs/super.c | 33 fs/nfsd/blocklayout.c | 4 fs/nls/nls_base.c | 27 fs/ntfs3/frecord.c | 8 fs/ntfs3/fsntfs.c | 9 fs/ntfs3/inode.c | 7 fs/ocfs2/alloc.c | 1 fs/ocfs2/inode.c | 10 fs/ocfs2/move_extents.c | 8 fs/pidfs.c | 2 fs/smb/client/cifssmb.c | 2 fs/smb/client/smb2pdu.c | 2 fs/smb/client/smbdirect.c | 28 fs/smb/common/smbdirect/smbdirect_socket.h | 51 + fs/smb/server/transport_rdma.c | 40 - fs/tracefs/event_inode.c | 3 include/asm-generic/mshyperv.h | 17 include/asm-generic/rqspinlock.h | 60 - include/linux/blk_types.h | 5 include/linux/cleanup.h | 15 include/linux/coresight.h | 35 include/linux/cper.h | 12 include/linux/f2fs_fs.h | 5 include/linux/filter.h | 12 include/linux/firmware/qcom/qcom_tzmem.h | 15 include/linux/ieee80211.h | 4 include/linux/if_hsr.h | 9 include/linux/irq-entry-common.h | 2 include/linux/irqchip.h | 8 include/linux/netdevice.h | 1 include/linux/nfs_fs_sb.h | 5 include/linux/ns_common.h | 11 include/linux/of_fdt.h | 9 include/linux/phy.h | 3 include/linux/platform_data/lp855x.h | 4 include/linux/ras.h | 16 include/linux/soc/mediatek/mtk_wed.h | 1 include/linux/vfio_pci_core.h | 10 include/linux/virtio.h | 2 include/linux/virtio_config.h | 24 include/linux/virtio_features.h | 29 include/linux/virtio_pci_modern.h | 8 include/net/netfilter/nf_conntrack_count.h | 17 include/ras/ras_event.h | 49 + include/sound/tas2781.h | 2 include/target/target_core_base.h | 12 include/uapi/linux/pidfd.h | 1 include/uapi/sound/asound.h | 2 include/ufs/ufshcd.h | 1 io_uring/io_uring.c | 10 io_uring/kbuf.c | 10 io_uring/zcrx.c | 16 kernel/bpf/hashtab.c | 10 kernel/bpf/helpers.c | 3 kernel/bpf/rqspinlock.c | 36 kernel/bpf/stackmap.c | 62 + kernel/bpf/syscall.c | 6 kernel/bpf/trampoline.c | 4 kernel/bpf/verifier.c | 89 +- kernel/cgroup/cpuset.c | 35 kernel/cgroup/namespace.c | 2 kernel/cpu.c | 25 kernel/dma/pool.c | 2 kernel/events/core.c | 22 kernel/locking/locktorture.c | 8 kernel/resource.c | 10 kernel/sched/fair.c | 17 kernel/sched/stats.h | 7 kernel/task_work.c | 8 kernel/time/timer_migration.c | 250 +++--- lib/vsprintf.c | 6 net/bpf/test_run.c | 5 net/core/dev.h | 1 net/core/filter.c | 16 net/core/netpoll.c | 2 net/hsr/hsr_device.c | 20 net/hsr/hsr_slave.c | 7 net/ipv6/ip6_fib.c | 4 net/mac80211/aes_cmac.c | 63 + net/mac80211/aes_cmac.h | 8 net/mac80211/wpa.c | 20 net/netfilter/nf_conncount.c | 187 +++-- net/netfilter/nft_connlimit.c | 34 net/netfilter/nft_flow_offload.c | 9 net/netfilter/xt_connlimit.c | 14 net/openvswitch/conntrack.c | 16 net/sched/sch_cake.c | 58 - net/sctp/socket.c | 5 scripts/cc-can-link.sh | 2 scripts/package/install-extmod-build | 2 security/integrity/ima/ima_main.c | 42 - security/integrity/ima/ima_policy.c | 2 security/landlock/errata/abi-1.h | 16 security/landlock/fs.c | 40 - security/smack/smack.h | 3 security/smack/smack_access.c | 93 +- security/smack/smack_lsm.c | 279 ++++--- sound/firewire/dice/dice-extension.c | 4 sound/firewire/motu/motu-hwdep.c | 7 sound/hda/codecs/realtek/alc269.c | 2 sound/hda/codecs/side-codecs/cs35l41_hda.c | 2 sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 44 - sound/isa/wavefront/wavefront_midi.c | 2 sound/isa/wavefront/wavefront_synth.c | 4 sound/soc/amd/acp/acp-i2s.c | 2 sound/soc/amd/acp/acp-legacy-common.c | 30 sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 sound/soc/codecs/Kconfig | 5 sound/soc/codecs/Makefile | 2 sound/soc/codecs/ak4458.c | 10 sound/soc/codecs/ak5558.c | 10 sound/soc/codecs/nau8325.c | 7 sound/soc/codecs/tas2781-comlib-i2c.c | 2 sound/soc/codecs/tas2781-i2c.c | 2 sound/soc/fsl/fsl_xcvr.c | 2 sound/soc/intel/catpt/pcm.c | 4 sound/soc/sdca/sdca_functions.c | 2 tools/bpf/bpftool/sign.c | 6 tools/include/nolibc/arch-x86.h | 6 tools/include/nolibc/dirent.h | 6 tools/include/nolibc/stdio.h | 4 tools/include/nolibc/sys/wait.h | 18 tools/lib/bpf/btf.c | 4 tools/objtool/check.c | 3 tools/objtool/elf.c | 8 tools/perf/builtin-kvm.c | 2 tools/perf/builtin-record.c | 2 tools/perf/builtin-stat.c | 15 tools/perf/util/annotate.c | 2 tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.c | 25 tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.h | 15 tools/perf/util/bpf_counter.c | 7 tools/perf/util/bpf_lock_contention.c | 6 tools/perf/util/evsel.c | 2 tools/perf/util/genelf.c | 32 tools/perf/util/hist.c | 6 tools/perf/util/hwmon_pmu.c | 3 tools/perf/util/parse-events.c | 44 - tools/perf/util/parse-events.h | 3 tools/perf/util/parse-events.y | 2 tools/perf/util/symbol.c | 5 tools/power/x86/turbostat/turbostat.c | 12 tools/testing/selftests/bpf/.gitignore | 1 tools/testing/selftests/bpf/Makefile | 6 tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c | 3 tools/testing/selftests/bpf/prog_tests/perf_branches.c | 22 tools/testing/selftests/bpf/prog_tests/send_signal.c | 5 tools/testing/selftests/bpf/progs/test_perf_branches.c | 3 tools/testing/selftests/bpf/test_tag.c | 2 tools/testing/selftests/drivers/net/bonding/bond_macvlan_ipvlan.sh | 1 tools/testing/selftests/landlock/Makefile | 2 tools/testing/selftests/net/packetdrill/tcp_syscall_bad_arg_sendmsg-empty-iov.pkt | 4 tools/testing/selftests/net/packetdrill/tcp_zerocopy_basic.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_batch.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_client.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_closed.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_edge.pkt | 3 tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_exclusive.pkt | 3 tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_oneshot.pkt | 3 tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-client.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-server.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_maxfrags.pkt | 2 tools/testing/selftests/net/packetdrill/tcp_zerocopy_small.pkt | 2 tools/tracing/rtla/Makefile.rtla | 2 tools/tracing/rtla/src/common.c | 24 tools/tracing/rtla/src/osnoise_hist.c | 3 tools/tracing/rtla/src/osnoise_top.c | 3 tools/tracing/rtla/src/timerlat.c | 3 tools/tracing/rtla/src/timerlat_hist.c | 3 tools/tracing/rtla/src/timerlat_top.c | 3 tools/tracing/rtla/tests/osnoise.t | 6 tools/tracing/rtla/tests/timerlat.t | 4 609 files changed, 6273 insertions(+), 3819 deletions(-) Aaron Kling (1): soc/tegra: fuse: speedo-tegra210: Update speedo IDs Aashish Sharma (1): iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb Abdun Nihaal (4): wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() Abel Vesa (3): pinctrl: qcom: glymur: Drop unnecessary platform data from match table pinctrl: qcom: glymur: Fix the gpio and egpio pin functions kbuild: install-extmod-build: Properly fix CC expansion when ccache is used Ahelenia Ziemiańska (1): power: supply: apm_power: only unset own apm_get_power_status Akash Goel (3): drm/panthor: Fix potential memleak of vma structure drm/panthor: Avoid adding of kernel BOs to extobj list drm/panthor: Prevent potential UAF in group creation Akhil P Oommen (3): drm/msm/a6xx: Flush LRZ cache before PT switch drm/msm/a6xx: Fix the gemnoc workaround drm/msm/a6xx: Improve MX rail fallback in RPMH vote init Al Viro (2): fuse_ctl_add_conn(): fix nlink breakage in case of early failure tracefs: fix a leak in eventfs_create_events_dir() Alan Maguire (3): libbpf: Fix parsing of multi-split BTF bpftool: Allow bpftool to build with openssl < 3 selftests/bpf: Allow selftests to build with older xxd Aleksei Nikiforov (1): s390/fpu: Fix false-positive kmsan report in fpu_vstl() Alex Deucher (1): drm/amdgpu/userq: fix SDMA and compute validation Alex Williamson (1): vfio/pci: Use RCU for error/request triggers to avoid circular locking Alexander Dahl (1): net: phy: adin1100: Fix software power-down ready condition Alexander Martinz (1): arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory Alexander Stein (1): arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz Alexandre Courbot (1): firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER Alexandru Gagniuc (1): remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs Alexei Starovoitov (1): selftests/bpf: Fix failure paths in send_signal test Alexey Kodanev (1): net: stmmac: fix rx limit check in stmmac_rx_zc() Alexey Simakov (1): dm-raid: fix possible NULL dereference with undefined raid type Alok Tiwari (3): virtio_vdpa: fix misleading return in void function vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues vdpa/pds: use %pe for ERR_PTR() in event handler registration Andreas Gruenbacher (1): gfs2: Prevent recursive memory reclaim Andres J Rosa (1): ALSA: uapi: Fix typo in asound.h comment Andy Shevchenko (3): lib/vsprintf: Check pointer before dereferencing in time_and_date() iio: core: add missing mutex_destroy in iio_dev_release() iio: core: Clean up device correctly on iio_device_alloc() failure Aniket Limaye (1): arm64: dts: ti: k3-j784s4: Fix I2C pinmux pull configuration Anil Samal (1): RDMA/irdma: Add missing mutex destroy Antheas Kapenekakis (2): ALSA: hda/realtek: Add match for ASUS Xbox Ally projects ALSA: hda/tas2781: fix speaker id retrieval for multiple probes Antoine Tenart (1): net: vxlan: prevent NULL deref in vxlan_xmit_one Anton Khirnov (1): platform/x86: asus-wmi: use brightness_set_blocking() for kbd led Armin Wolf (2): fs/nls: Fix utf16 to utf8 conversion fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() Arnaud Lecomte (2): bpf: Refactor stack map trace depth calculation into helper function bpf: Fix stackmap overflow check in __bpf_get_stackid() Arnd Bergmann (3): random: use offstack cpumask when necessary drm/panel: novatek-nt35560: avoid on-stack device structure gpio: tb10x: fix OF_GPIO dependency Aryan Srivastava (2): Revert "mtd: rawnand: marvell: fix layouts" mtd: nand: relax ECC parameter validation check Baochen Qiang (7): wifi: ath11k: restore register window after global reset wifi: ath12k: fix VHT MCS assignment wifi: ath11k: fix VHT MCS assignment wifi: ath11k: fix peer HE MCS assignment wifi: ath12k: restore register window after global reset wifi: ath12k: fix reusing m3 memory wifi: ath12k: fix error handling in creating hardware group Baojun Xu (1): ASoC: tas2781: Correct the wrong chip ID for reset variable check Bart Van Assche (5): block/mq-deadline: Introduce dd_start_request() block/mq-deadline: Switch back to a single dispatch list scsi: ufs: core: Move the ufshcd_enable_intr() declaration scsi: target: Do not write NUL characters into ASCII configfs output scsi: ufs: core: Fix an error handler crash Bartlomiej Kubik (1): fs/ntfs3: Initialize allocated memory before use Bean Huo (1): scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() Benjamin Berg (2): tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set tools/nolibc/dirent: avoid errno in readdir_r Bhanu Seshu Kumar Valluri (1): PCI: endpoint: pci-epf-test: Fix sleeping function being called from atomic context Biju Das (1): pinctrl: renesas: rzg2l: Fix PMC restore Boris Brezillon (3): drm/panthor: Handle errors returned by drm_sched_entity_init() drm/panthor: Fix group_free_queue() for partially initialized queues drm/panthor: Fix UAF on kernel BO VA nodes Boris Burkov (1): btrfs: fix racy bitfield write in btrfs_clear_space_info_full() Breno Leitao (1): net: netpoll: initialize work queue before error checks Caleb Sander Mateos (1): io_uring/kbuf: use READ_ONCE() for userspace-mapped memory Carl Worth (1): coresight: tmc: add the handle of the event to the path Cezary Rojewski (1): ASoC: Intel: catpt: Fix error path in hw_params() Chaitanya S Prakash (1): arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors Charles Keepax (1): ASoC: SDCA: Fix missing dash in HIDE DisCo property Charles Mirabile (1): clk: spacemit: Set clk_hw_onecell_data::num before using flex array Chen Ridong (1): cpuset: Treat cpusets in attaching as populated Chen-Yu Tsai (1): arm64: dts: mediatek: mt8195: Fix address range for JPEG decoder core 1 Chien Wong (1): wifi: mac80211: fix CMAC functions not handling errors Christian Brauner (6): pidfs: add missing PIDFD_INFO_SIZE_VER1 pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info cgroup: add cgroup namespace to tree after owner is set ns: add NS_COMMON_INIT() ns: initialize ns_list_node for initial namespaces cleanup: fix scoped_class() Christian Bruel (2): PCI: stm32: Fix LTSSM EP race with start link PCI: stm32: Fix EP page_size alignment Christoph Hellwig (4): iomap: always run error completions in user context iomap: allocate s_dio_done_wq for async reads as well fs: refactor file timestamp update logic fs: lift the FMODE_NOCMTIME check into file_update_time_flags Christophe JAILLET (3): PCI: sg2042: Fix a reference count issue in sg2042_pcie_remove() phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() misc: rp1: Fix an error handling path in rp1_probe() Christophe Leroy (1): powerpc/32: Fix unpaired stwcx. on interrupt exit Christophe Leroy (CS GROUP) (1): um: Disable KASAN_INLINE when STATIC_LINK is selected Claudiu Beznea (2): soc: renesas: r9a09g056-sys: Populate max_register soc: renesas: rz-sysc: Populate readable_reg/writeable_reg in regmap config Cong Zhang (1): blk-mq: Abort suspend when wakeup events are pending Costa Shulyupin (1): tools/rtla: Fix unassigned nr_cpus Cristian Ciocaltea (3): phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits Cyrille Pitchen (1): drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() Daeho Jeong (2): f2fs: maintain one time GC mode is enabled during whole zoned GC cycle f2fs: revert summary entry count from 2048 to 512 in 16kb block support Dan Carpenter (5): hfs: fix potential use after free in hfs_correct_next_unused_CNID() regulator: pca9450: Fix error code in probe() drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() Daniel Borkmann (1): bpf: Do not let BPF test infra emit invalid GSO types to stack Danilo Krummrich (3): gpu: nova-core: gsp: remove useless conversion gpu: nova-core: gsp: do not unwrap() SGEntry drm: nova: select NOVA_CORE Dapeng Mi (2): perf/x86: Fix NULL event access and potential PEBS record loss perf/x86/intel: Correct large PEBS flag check Dave Kleikamp (1): dma/pool: eliminate alloc_pages warning in atomic_pool_expand David Gow (1): um: Don't rename vmap to kernel_vmap David Howells (2): cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1 cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 David Wei (2): net: export netdev_get_by_index_lock() io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock Denis Arefev (1): ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() Dev Jain (1): arm64/pageattr: Propagate return value from __change_memory_common Dibin Moolakadan Subrahmanian (1): drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation Dinh Nguyen (1): firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc Diogo Ivo (1): usb: phy: Initialize struct usb_phy list_head Dmitry Antipov (2): ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() ocfs2: fix memory leak in ocfs2_merge_rec_left() Dmitry Baryshkov (4): interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype drm/msm/a2xx: stop over-complaining about the legacy firmware Duoming Zhou (3): scsi: imm: Fix use-after-free bug caused by unfinished delayed work usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe() usb: typec: ucsi: fix use-after-free caused by uec->work Dylan Hatch (1): objtool: Fix standalone --hacks=jump_label Dzmitry Sankouski (2): arm64: dts: qcom: sdm845-starqltechn: remove (address|size)-cells arm64: dts: qcom: sdm845-starqltechn: fix max77705 interrupts Edward Adam Davis (4): ntfs3: init run lock for extend inode fs/ntfs3: out1 also needs to put mi fs/ntfs3: Prevent memory leaks in add sub record bpf: Fix exclusive map memory leak Eric Gonçalves (1): arm64: dts: qcom: sm8250-samsung-common: correct reserved pins Eric Huang (1): drm/amdkfd: assign AID to uuid in topology for SPX mode Eric Sandeen (1): 9p: fix cache/debug options printing in v9fs_show_options Evan Li (1): perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common() FUKAUMI Naoki (4): arm64: dts: rockchip: Fix USB Type-C host mode for Radxa ROCK 5B+/5T arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C Fangyu Yu (1): RISC-V: KVM: Fix guest page fault within HLV* instructions Fedor Pchelkin (3): wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler() wifi: rtw89: usb: fix leak in rtw89_usb_write_port() Revert "wifi: mt76: mt792x: improve monitor interface handling" Felix Fietkau (1): wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() Fenglin Wu (1): leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM Fernand Sieber (1): sched/fair: Forfeit vruntime on yield Fernando Fernandez Mancera (3): ipv6: clear RA flags when adding a static route netfilter: nf_conncount: rework API to use sk_buff directly netfilter: nft_connlimit: update the count if add was skipped Filipe Manana (1): btrfs: fix leaf leak in an error path in btrfs_del_items() Francesco Lavra (1): iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member Frank Li (1): i3c: fix refcount inconsistency in i3c_master_register Frederic Weisbecker (3): timers/migration: Convert "while" loops to use "for" timers/migration: Remove locking on group connection timers/migration: Fix imbalanced NUMA trees Gabor Juhos (1): regulator: core: disable supply if enabling main regulator fails Gao Xiang (2): erofs: correct FSDAX detection erofs: limit the level of fs stacking for file-backed mounts Gautham R. Shenoy (1): cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs Geert Uytterhoeven (3): PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() ARM: dts: am33xx: Add missing serial console speed Gergo Koteles (1): arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider Gopi Krishna Menon (1): usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE Greg Kroah-Hartman (1): Linux 6.18.2 Guenter Roeck (2): block/blk-throttle: Fix throttle slice time for SSDs of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node Guido Günther (2): drm/panel: visionox-rm69299: Fix clock frequency for SHIFT6mq drm/panel: visionox-rm69299: Don't clear all mode flags Guillaume La Roque (1): arm64: dts: amlogic: meson-g12b: Fix L2 cache reference for S922X CPUs Hangbin Liu (1): selftests: bonding: add delay before each xvlan_over_bond connectivity check Haotian Zhang (26): soc: qcom: gsbi: fix double disable caused by devm mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove soc: qcom: smem: fix hwspinlock resource leak in probe error paths pinctrl: stm32: fix hwspinlock resource leak in probe function power: supply: rt5033_charger: Fix device node reference leaks mfd: da9055: Fix missing regmap_del_irq_chip() in error path scsi: stex: Fix reboot_notifier leak in probe error path clk: renesas: r9a06g032: Fix memory leak in error path ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls leds: netxbig: Fix GPIO descriptor leak in error paths watchdog: wdat_wdt: Fix ACPI table leak in probe function watchdog: starfive: Fix resource leak in probe error path mfd: mt6397-irq: Fix missing irq_domain_remove() in error path mfd: mt6358-irq: Fix missing irq_domain_remove() in error path crypto: starfive - Correctly handle return of sg_nents_for_len crypto: ccree - Correctly handle return of sg_nents_for_len clocksource/drivers/ralink: Fix resource leaks in init error path greybus: gb-beagleplay: Fix timeout handling in bootloader functions hwmon: sy7636a: Fix regulator_enable resource leak on error path mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors pinctrl: single: Fix incorrect type for error return variable rtc: amlogic-a4: fix double free caused by devm ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() rtc: gamecube: Check the return value of ioremap() dm log-writes: Add missing set_freezable() for freezable kthread Haotien Hsu (1): usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt Heiko Carstens (2): s390/smp: Fix fallback CPU detection s390/ap: Don't leak debug feature files if AP instructions are not available Hemalatha Pinnamreddy (2): ASoC: amd: acp: Audio is not resuming after s0ix ASoC: amd: acp: update tdm channels for specific DAI Herbert Xu (3): crypto: authenc - Correctly pass EINPROGRESS back up to the caller crypto: ahash - Fix crypto_ahash_import with partial block data crypto: ahash - Zero positive err value in ahash_update_finish Horatiu Vultur (1): phy: mscc: Fix PTP for VSC8574 and VSC8572 Howard Hsu (1): wifi: mt76: mt7996: fix implicit beamforming support for mt7992 Huiwen He (2): drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs() drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos() Ian Rogers (6): perf bpf_counter: Fix opening of "any"(-1) CPU events perf parse-events: Fix legacy cache events if event is duplicated in a PMU perf parse-events: Make X modifier more respectful of groups perf kvm: Fix debug assertion perf hist: In init, ensure mem_info is put on error paths perf stat: Allow no events to open if this is a "--null" run Ilias Stamatis (1): Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" Ilpo Järvinen (1): PCI: Prevent resource tree corruption when BAR resize fails Inochi Amaoto (2): net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay net: stmmac: dwmac-sophgo: Add phy interface filter Israel Rukshin (1): nvme-auth: use kvfree() for memory allocated with kvcalloc() Ivan Abramov (4): power: supply: cw2015: Check devm_delayed_work_autocancel() return code power: supply: max17040: Check iio_read_channel_processed() return code power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() power: supply: wm831x: Check wm831x_set_bits() return value Ivan Pravdin (1): rtla: Fix -a overriding -t argument Ivan Stepchenko (1): mtd: lpddr_cmds: fix signed shifts in lpddr_cmds Jacek Lawrynowicz (2): accel/ivpu: Rework bind/unbind of imported buffers accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() Jacob Moroni (3): RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+ RDMA/irdma: Remove doorbell elision logic Jani Nikula (4): drm/xe/fbdev: use the same 64-byte stride alignment as i915 drm/i915/fbdev: make intel_framebuffer_create() error return handling explicit drm/{i915, xe}/fbdev: pass struct drm_device to intel_fbdev_fb_alloc() drm/{i915, xe}/fbdev: deduplicate struct drm_mode_fb_cmd2 init Janusz Krzysztofik (1): drm/vgem-fence: Fix potential deadlock on release Jaroslav Kysela (2): ASoC: nau8325: use simple i2c probe function ASoC: nau8325: add missing build config Jason Tian (1): RAS: Report all ARM processor CPER information to userspace Javier Martinez Canillas (1): regulator: spacemit: Align input supply name with the DT binding Jay Liu (1): drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue Jayesh Choudhary (2): drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook Jianglei Nie (1): staging: fbtft: core: fix potential memory leak in fbtft_probe_common() Jihed Chaibi (3): ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties Jijun Wang (1): RDMA/irdma: Fix SRQ shadow area address initialization Jisheng Zhang (2): usb: dwc2: fix hang during shutdown if set as peripheral usb: dwc2: fix hang during suspend if set as peripheral Johan Hovold (18): irqchip/bcm2712-mip: Fix OF node reference imbalance irqchip/bcm2712-mip: Fix section mismatch irqchip/irq-bcm7038-l1: Fix section mismatch irqchip/irq-bcm7120-l2: Fix section mismatch irqchip/irq-brcmstb-l2: Fix section mismatch irqchip/imx-mu-msi: Fix section mismatch irqchip/renesas-rzg2l: Fix section mismatch irqchip/starfive-jh8100: Fix section mismatch irqchip/qcom-irq-combiner: Fix section mismatch irqchip: Drop leftover brackets irqchip: Pass platform device to platform drivers staging: most: remove broken i2c driver clocksource/drivers/stm: Fix double deregistration on probe failure clocksource/drivers/arm_arch_timer_mmio: Prevent driver unbind clocksource/drivers/nxp-pit: Prevent driver unbind clocksource/drivers/nxp-stm: Fix section mismatches clocksource/drivers/nxp-stm: Prevent driver unbind clk: keystone: fix compile testing John Stultz (1): sched/core: Fix psi_dequeue() for Proxy Execution Jonas Gorski (14): net: dsa: b53: fix VLAN_ID_IDX write size for BCM5325/65 net: dsa: b53: fix extracting VID from entry for BCM5325/65 net: dsa: b53: b53_arl_read{,25}(): use the entry for comparision net: dsa: b53: move reading ARL entries into their own function net: dsa: b53: move writing ARL entries into their own functions net: dsa: b53: provide accessors for accessing ARL_SRCH_CTL net: dsa: b53: split reading search entry into their own functions net: dsa: b53: move ARL entry functions into ops struct net: dsa: b53: add support for 5389/5397/5398 ARL entry format net: dsa: b53: use same ARL search result offset for BCM5325/65 net: dsa: b53: fix CPU port unicast ARL entries for BCM5325/65 net: dsa: b53: add support for bcm63xx ARL entry format net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks net: dsa: b53: fix BCM5325/65 ARL entry VIDs Jonathan Curley (1): NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Joseph Qi (1): ocfs2: use correct endian in ocfs2_dinode_has_extents Josh Poimboeuf (1): objtool: Fix weak symbol detection Joy Zou (1): arm64: dts: imx95-15x15-evk: add fan-supply property for pwm-fan Junrui Luo (5): ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events ALSA: firewire-motu: add bounds check in put_user loop for DSP events ALSA: dice: fix buffer overflow in detect_stream_formats() ALSA: wavefront: Clear substream pointers on close ALSA: wavefront: Fix integer overflow in sample size validation Kang Yang (1): wifi: ath10k: move recovery check logic into a new work Karol Wachowski (2): accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail accel/ivpu: Fix DCT active percent format Kathara Sasikumar (1): docs: hwmon: fix link to g762 devicetree binding Kathiravan Thirumoorthy (1): arm64: dts: qcom: ipq5424: correct the TF-A reserved memory to 512K Ketil Johnsen (2): drm/panthor: Fix UAF race between device unplug and FW event processing drm/panthor: Fix race with suspend during unplug Kevin Brodsky (1): ublk: prevent invalid access with DEBUG Konrad Dybcio (1): arm64: dts: qcom: sdm845-starqltechn: Fix i2c-gpio node name Konstantin Andreev (7): smack: fix bug: SMACK64TRANSMUTE set on non-directory smack: deduplicate "does access rule request transmutation" smack: deduplicate xattr setting in smack_inode_init_security() smack: always "instantiate" inode in smack_inode_init_security() smack: fix bug: invalid label of unix socket file smack: fix bug: unprivileged task can create labels smack: fix bug: setting task label silently ignores input garbage Kriish Sharma (1): virtio: fix kernel-doc for mapping/free_coherent functions Krishna Chaitanya Chundru (1): arm64: dts: qcom: sm8750-mtp: move PCIe GPIOs to pcieport0 node Krishna Kurapati (3): arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller arm64: dts: qcom: lemans: Add missing quirk for HS only USB controller Krzysztof Czurylo (3): RDMA/irdma: Fix data race in irdma_sc_ccq_arm RDMA/irdma: Fix data race in irdma_free_pble RDMA/irdma: Fix SIGBUS in AEQ destroy Krzysztof Kozlowski (1): ASoC: codecs: nau8325: Silence uninitialized variables warnings Kuan-Wei Chiu (1): interconnect: debugfs: Fix incorrect error handling for NULL path Kumar Kartikeya Dwivedi (3): bpf: Fix sleepable context for async callbacks rqspinlock: Enclose lock/unlock within lock entry acquisitions rqspinlock: Use trylock fallback when per-CPU rqnode is busy Kuniyuki Iwashima (1): sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). Lad Prabhakar (1): clk: renesas: r9a09g077: Propagate rate changes to parent clocks Len Brown (1): tools/power turbostat: Regression fix Uncore MHz printed in hex Leo Yan (7): coresight: Change device mode to atomic type coresight: etm4x: Always set tracer's device mode on target CPU coresight: etm3x: Always set tracer's device mode on target CPU coresight: etm4x: Correct polling IDLE bit coresight: etm4x: Add context synchronization before enabling trace coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF perf arm_spe: Fix memset subclass in operation Leon Hwang (1): bpf: Free special fields when update [lru_,]percpu_hash maps Li Nan (2): md: delete md_redundancy_group when array is becoming inactive md: init bioset in mddev_init Li Qiang (2): uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload() Liyuan Pang (1): ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() Lizhi Hou (7): accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array() accel/amdxdna: Call dma_buf_vmap_unlocked() for imported object accel/amdxdna: Fix uninitialized return value accel/amdxdna: Fix incorrect command state for timed out job accel/amdxdna: Fix dma_fence leak when job is canceled accel/amdxdna: Clear mailbox interrupt register during channel creation accel/amdxdna: Fix deadlock between context destroy and job timeout Loic Poulain (1): arm64: dts: qcom: qcm2290: Fix camss register prop ordering Long Li (1): macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse Longbin Li (1): spi: sophgo: Fix incorrect use of bus width value macros Lorenzo Bianconi (8): wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache() wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event() wifi: mt76: Move mt76_abort_scan out of mt76_reset_device() wifi: mt76: mt7996: skip deflink accounting for offchannel links wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work() Luca Ceresoli (1): backlight: led-bl: Add devlink to supplier LEDs Luca Weiss (3): clk: qcom: camcc-sm6350: Fix PLL config of PLL2 clk: qcom: camcc-sm7150: Fix PLL config of PLL2 arm64: dts: qcom: qcm6490-fairphone-fp5: Add supplies to simple-fb node Luo Jie (1): clk: qcom: gcc-ipq5424: Correct the icc_first_node_id Ma Ke (1): RDMA/rtrs: server: Fix error handling in get_or_create_srv Maciej Falkowski (1): accel/ivpu: Remove skip of dma unmap for imported buffers Madhur Kumar (1): drm/nouveau: refactor deprecated strcpy Mainak Sen (1): gpu: host1x: Fix race in syncpt alloc/free Manish Dharanenthiran (1): wifi: ath12k: Fix timeout error during beacon stats retrieval Manivannan Sadhasivam (1): dt-bindings: PCI: amlogic: Fix the register name of the DBI region Marek Szyprowski (5): soc: samsung: exynos-pmu: Fix structure initialization ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend Marek Vasut (4): clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback clk: renesas: cpg-mssr: Read back reset registers to assure values latched drm/rcar-du: dsi: Fix missing parameter in RXSETR_...EN macros arm64: dts: renesas: sparrow-hawk: Fix full-size DP connector node name and labels Mark Brown (1): regulator: fixed: Rely on the core freeing the enable GPIO Markus Niebel (1): arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name Martin KaFai Lau (1): bpf: Check skb->transport_header is set in bpf_skb_check_mtu Martin Teichmann (1): bpf: properly verify tail call behavior Matt Bobrowski (3): selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names selftests/bpf: skip test_perf_branches_hw() on unsupported platforms selftests/bpf: Improve reliability of test_perf_branches_no_hw() Matthieu Buffet (1): selftests/landlock: Fix makefile header list Mauro Carvalho Chehab (3): efi/cper: Add a new helper function to print bitmasks efi/cper: Adjust infopfx size to accept an extra space efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs Mavroudis Chatzilazaridis (1): HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() Menglong Dong (1): bpf: Handle return value of ftrace_set_filter_ip in register_fentry Michael S. Tsirkin (8): virtio: fix typo in virtio_device_ready() comment virtio: fix whitespace in virtio_config_ops virtio: fix grammar in virtio_queue_info docs virtio: fix grammar in virtio_map_ops docs virtio: standardize Returns documentation style virtio: fix virtqueue_set_affinity() docs virtio: fix map ops comment virtio: clean up features qword/dword terms Michal Schmidt (1): iavf: Implement settime64 with -EOPNOTSUPP Michal Suchanek (1): perf hwmon_pmu: Fix uninitialized variable warning Mickaël Salaün (1): landlock: Fix handling of disconnected directories Mike Christie (2): scsi: target: Fix LUN/device R/W and total command stats vhost: Fix kthread worker cgroup failure handling Mike McGowen (1): scsi: smartpqi: Fix device resources accessed after device removal Mike Snitzer (2): nfs/localio: remove alignment size checking in nfs_is_local_dio_possible nfs/localio: remove 61 byte hole from needless ____cacheline_aligned Mikhail Kshevetskiy (1): spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND Miquel Sabaté Solà (1): btrfs: fix double free of qgroup record after failure to add delayed ref head Mohamed Khalfella (1): block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock Murad Masimov (1): power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() Mykyta Yatsenko (1): bpf: Fix handling maps with no BTF and non-constant offsets for the bpf_wq Namhyung Kim (5): perf lock contention: Load kernel map before lookup perf tools: Fix missing feature check for inherit + SAMPLE_READ perf jitdump: Add sym/str-tables to build-ID generation perf tools: Mark split kallsyms DSOs as loaded perf tools: Fix split kallsyms DSO counting Namjae Jeon (1): exfat: fix divide-by-zero in exfat_allocate_bitmap Neil Armstrong (1): arm64: dts: qcom: sm8650: set ufs as dma coherent Niklas Cassel (1): arm64: tegra: Add pinctrl definitions for pcie-ep nodes Nuno Das Neves (2): mshv: Fix deposit memory in MSHV_ROOT_HVCALL mshv: Fix create memory region overlap check Nuno Sá (1): rtc: max31335: Fix ignored return value in set_alarm Oliver Neukum (1): usb: chaoskey: fix locking for O_NONBLOCK Ovidiu Panait (1): net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr() Pablo Neira Ayuso (1): netfilter: flowtable: check for maximum number of encapsulations in bridge vlan Pavel Begunkov (1): io_uring: use WRITE_ONCE for user shared memory Peng Fan (2): remoteproc: imx_rproc: Fix runtime PM cleanup and improve remove path firmware: imx: scu-irq: fix OF node leak in Pengjie Zhang (1): PM / devfreq: hisi: Fix potential UAF in OPP handling Pengyu Luo (1): arm64: dts: qcom: sc8280xp: Fix shifted GPI DMA channels Peter Griffin (2): arm64: dts: exynos: gs101: fix clock module unit reg sizes arm64: dts: exynos: gs101: fix sysreg_apm reg property Peter Zijlstra (2): task_work: Fix NMI race condition entry,unwind/deferred: Fix unwind_reset_info() placement Pradeep Kumar Chitrapu (1): wifi: ath12k: fix TX and RX MCS rate configurations in HE mode Praveen Talari (1): arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm Prike Liang (1): drm/amdgpu: add userq object va track helpers Przemek Kitszel (8): ice: move service task start out of ice_init_pf() ice: move ice_init_interrupt_scheme() prior ice_init_pf() ice: ice_init_pf: destroy mutexes and xarrays on memory alloc failure ice: move udp_tunnel_nic and misc IRQ setup into ice_init_pf() ice: move ice_init_pf() out of ice_init_dev() ice: extract ice_init_dev() from ice_init() ice: move ice_deinit_dev() to the end of deinit paths ice: remove duplicate call to ice_deinit_hw() on error paths Pu Lehui (1): bpf: Fix invalid prog->stats access when update_effective_progs fails Qu Wenruo (1): btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() Rameshkumar Sundaram (2): wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create() wifi: ath12k: unassign arvif on scan vdev create failure Randolph Sapp (1): arm64: dts: ti: k3-am62p: Fix memory ranges for GPU Randy Dunlap (2): firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc backlight: lp855x: Fix lp855x.h kernel-doc warnings Raphael Pinsonneault-Thibeault (1): ntfs3: fix uninit memory after failed mi_read in mi_format_new Rene Rebe (1): ps3disk: use memcpy_{from,to}_bvec index René Rebe (2): ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 drm/nouveau: fix circular dep oops from vendored i2c encoder Ria Thomas (1): wifi: ieee80211: correct FILS status codes Ritesh Harjani (IBM) (2): powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format Robert Marko (1): net: phy: aquantia: check for NVMEM deferral Roberto Sassu (1): ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook Rodrigo Gobbi (1): iio: imu: bmi270: fix dev_err_probe error msg Ryan Huang (1): iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables Sahil Chandna (1): bpf: Prevent nesting overflow in bpf_try_get_buffers Sarika Sharma (1): wifi: ath12k: Fix MSDU buffer types handling in RX error path Sebastian Andrzej Siewior (1): cpu: Make atomic hotplug callbacks run with interrupts disabled on UP Selvin Xavier (2): RDMA/bnxt_re: Fix the inline size for GenP7 devices RDMA/bnxt_re: Pass correct flag for dma mr creation Sergey Bashirov (1): NFSD/blocklayout: Fix minlength check in proc_layoutget Seungjin Bae (2): USB: Fix descriptor count when handling invalid MBIM extended descriptor wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() Shaurya Rane (1): block: fix memory leak in __blkdev_issue_zero_pages Shawn Lin (4): scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3528 phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562 PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition Shayne Chen (7): wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv() wifi: mt76: mt7996: fix teardown command for an MLD peer wifi: mt76: mt7996: set link_valid field when initializing wcid wifi: mt76: mt7996: fix MLD group index assignment wifi: mt76: mt7996: fix MLO set key and group key issues wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart() wifi: mt76: mt7996: fix EMI rings for RRO Shenghao Ding (1): ASoC: tas2781: correct the wrong period Shengjiu Wang (3): ASoC: fsl_xcvr: clear the channel status control memory ASoC: ak4458: Disable regulator when error happens ASoC: ak5558: Disable regulator when error happens Sherry Sun (1): tty: serial: imx: Only configure the wake register when device is set as wakeup source Shuai Xue (1): perf record: skip synthesize event when open evsel failed Shuhao Fu (1): exfat: fix refcount leak in exfat_find Siddharth Chintamaneni (1): bpf: Cleanup unused func args in rqspinlock implementation Siddharth Vadapalli (1): PCI: keystone: Exit ks_pcie_probe() for invalid mode Sidharth Seela (1): ntfs3: Fix uninit buffer allocated by __getname() Songtang Liu (1): iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show Sourabh Jain (1): powerpc/kdump: Fix size calculation for hot-removed memory ranges Stanley Chu (1): i3c: master: svc: Prevent incomplete IBI transaction StanleyYP Wang (1): wifi: mt76: mt7996: fix max nss value when getting rx chainmask Stefan Metzmacher (4): smb: smbdirect: introduce SMBDIRECT_DEBUG_ERR_PTR() helper smb: smbdirect: introduce SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}() smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler() smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall() Stephan Gerhold (1): iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal Sven Peter (1): usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required T Pratham (1): crypto: aead - Fix reqsize handling Taniya Das (4): clk: qcom: gcc-sm8750: Add a new frequency for sdcc2 clock clk: qcom: gcc-glymur: Update the halt check flags for pipe clocks clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops clk: qcom: tcsrcc-glymur: Update register offsets for clock refs Tatyana Nikolova (1): RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2 Tengda Wu (1): x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() Thaumy Cheng (1): perf/core: Fix missing read event generation on task exit Thomas Richard (1): leds: upboard: Fix module alias Thomas Richard (TI.com) (1): firmware: ti_sci: Set IO Isolation only if the firmware is capable Thomas Weißschuh (2): tools/nolibc: handle NULL wstatus argument to waitpid() kbuild: don't enable CC_CAN_LINK if the dummy program generates warnings Thorsten Blum (1): crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Tianchu Chen (1): spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Tianyou Li (1): perf annotate: Check return value of evsel__get_arch() properly Tim Harvey (4): arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl arm64: dts: imx8mp-venice-gw702x: remove off-board uart arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 Timur Tabi (1): drm/nouveau: restrict the flush page to a 32-bit address Tingmao Wang (1): fs/9p: Don't open remote file with APPEND mode when writeback cache is used Tomas Glozar (3): tools/rtla: Fix --on-threshold always triggering rtla/tests: Extend action tests to 5s rtla/tests: Fix osnoise test calling timerlat Tomasz Rusinowicz (1): accel/ivpu: Fix race condition when unbinding BOs Tony Battersby (1): scsi: qla2xxx: Clear cmds after chip reset Trond Myklebust (9): NFS: Avoid changing nlink when file removes and attribute updates race NFS: Initialise verifiers for visible dentries in readdir and lookup NFS: Initialise verifiers for visible dentries in nfs_atomic_open() NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state Revert "nfs: ignore SB_RDONLY when remounting nfs" Revert "nfs: clear SB_RDONLY before getting superblock" Revert "nfs: ignore SB_RDONLY when mounting nfs" NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags NFS: Fix inheritance of the block sizes when automounting Troy Mitchell (1): i2c: spacemit: fix detect issue Usama Arif (2): x86/boot: Fix page table access in 5-level to 4-level paging transition efi/libstub: Fix page table access in 5-level to 4-level paging transition Uwe Kleine-König (3): pwm: Simplify printf to emit chip->npwm in $debugfs/pwm pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id pwm: bcm2835: Make sure the channel is enabled after pwm_request() Val Packett (4): arm64: dts: qcom: x1-dell-thena: Add missing pinctrl for eDP HPD arm64: dts: qcom: x1-dell-thena: remove dp data-lanes power: supply: qcom_battmgr: clamp charge control thresholds power: supply: qcom_battmgr: support disabling charge control Vineeth Pillai (Google) (1): iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD Vishwaroop A (1): spi: tegra210-quad: Fix timeout handling Vladimir Oltean (2): net: phy: realtek: create rtl8211f_config_rgmii_delay() net: dsa: xrs700x: reject unsupported HSR configurations Vladimir Zapolskiy (2): clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other Wang Liang (1): locktorture: Fix memory leak in param_set_cpumask() Willem de Bruijn (1): selftests/net: packetdrill: pass send_omit_free to MSG_ZEROCOPY tests Willy Tarreau (1): tools/nolibc: x86: fix section mismatch caused by asm "mem*" functions Wludzik, Jozef (1): accel/ivpu: Fix race condition when mapping dmabuf Wolfram Sang (2): ARM: dts: renesas: gose: Remove superfluous port property ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties Xi Pardee (1): platform/x86:intel/pmc: Update Arrow Lake telemetry GUID Xiang Mei (1): net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop Xiao Ni (2): md: delete mddev kobj before deleting gendisk kobj md: avoid repeated calls to del_gendisk Xiaogang Chen (1): drm/amdkfd: Use huge page size to check split svm range alignment Xiaolei Wang (1): phy: freescale: Initialize priv->lock Xiaoliang Yang (1): net: hsr: create an API to get hsr port type Xiaoqi Zhuang (1): coresight: ETR: Fix ETR buffer use-after-free issue Xing Guo (1): selftests/bpf: Update test_tag to use sha256 Yegor Yefremov (1): ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels Yongjian Sun (1): ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation Yu Kuai (1): md/raid5: fix IO hang when array is broken with IO inflight Yun Zhou (1): md: fix rcu protection in md_wakeup_thread Yuntao Wang (4): of/fdt: Consolidate duplicate code into helper functions of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr() of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range() of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho() Zhang Rui (1): perf/x86/intel/cstate: Remove PC3 support from LunarLake Zhang Yi (1): ext4: correct the checking of quota files before moving extents Zhao Yipeng (1): ima: Handle error code returned by ima_filter_rule_match() Zheng Qixing (2): nbd: defer config put in recv_work nbd: defer config unlock in nbd_genl_connect Zhu Yanjun (1): RDMA/rxe: Fix null deref on srq->rq.queue after resize failure Zilin Guan (3): crypto: iaa - Fix incorrect return value in save_iaa_wq() scsi: qla2xxx: Fix improper freeing of purex item mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() nieweiqiang (1): crypto: hisilicon/qm - restore original qos values shechenglong (1): block: fix comment for op_is_zone_mgmt() to include RESET_ALL sparkhuang (1): regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex xupengbo (1): sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out

5 days, 7 hours

1
1
0 0

Linux 6.12.63

by Greg Kroah-Hartman

I'm announcing the release of the 6.12.63 kernel. All users of the 6.12 kernel series must upgrade. The updated 6.12.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.12.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/ABI/testing/sysfs-fs-f2fs | 52 Documentation/admin-guide/LSM/Smack.rst | 16 Documentation/devicetree/bindings/clock/qcom,x1e80100-gcc.yaml | 62 Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml | 6 Documentation/hwmon/g762.rst | 2 Makefile | 2 arch/arm/boot/dts/renesas/r8a7793-gose.dts | 1 arch/arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts | 2 arch/arm/boot/dts/samsung/exynos4210-i9100.dts | 1 arch/arm/boot/dts/samsung/exynos4210-trats.dts | 1 arch/arm/boot/dts/samsung/exynos4210-universal_c210.dts | 1 arch/arm/boot/dts/samsung/exynos4412-midas.dtsi | 1 arch/arm/boot/dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi | 8 arch/arm/boot/dts/ti/omap/am335x-netcom-plus-2xx.dts | 8 arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts | 2 arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 arch/arm/include/asm/word-at-a-time.h | 10 arch/arm64/boot/dts/exynos/google/gs101.dtsi | 4 arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi | 51 arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi | 11 arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts | 5 arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 4 arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 arch/arm64/boot/dts/qcom/x1e80100.dtsi | 12 arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts | 1 arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 15 arch/arm64/boot/dts/ti/k3-am62p.dtsi | 2 arch/loongarch/kernel/machine_kexec.c | 22 arch/powerpc/kernel/entry_32.S | 10 arch/powerpc/kexec/ranges.c | 2 arch/powerpc/mm/book3s64/hash_utils.c | 10 arch/powerpc/mm/ptdump/hashpagetable.c | 6 arch/riscv/kvm/vcpu_insn.c | 22 arch/s390/kernel/smp.c | 1 arch/um/Makefile | 12 arch/x86/boot/compressed/pgtable_64.c | 11 arch/x86/events/intel/core.c | 4 arch/x86/events/intel/cstate.c | 3 arch/x86/kernel/dumpstack.c | 23 block/blk-lib.c | 6 block/blk-mq.c | 35 block/blk-throttle.c | 9 block/mq-deadline.c | 129 - crypto/asymmetric_keys/asymmetric_type.c | 14 crypto/authenc.c | 75 - drivers/accel/ivpu/ivpu_fw.h | 2 drivers/accel/ivpu/ivpu_hw_btrs.c | 2 drivers/accel/ivpu/ivpu_hw_btrs.h | 2 drivers/accel/ivpu/ivpu_job.c | 14 drivers/accel/ivpu/ivpu_pm.c | 9 drivers/acpi/apei/ghes.c | 27 drivers/acpi/processor_core.c | 2 drivers/acpi/property.c | 1 drivers/base/firmware_loader/Kconfig | 2 drivers/block/nbd.c | 5 drivers/block/ps3disk.c | 4 drivers/block/ublk_drv.c | 4 drivers/clk/Makefile | 3 drivers/clk/qcom/camcc-sm6350.c | 13 drivers/clk/qcom/camcc-sm7150.c | 6 drivers/clk/qcom/camcc-sm8550.c | 10 drivers/clk/qcom/gcc-x1e80100.c | 698 +++++++++- drivers/clk/renesas/r7s9210-cpg-mssr.c | 7 drivers/clk/renesas/r8a77970-cpg-mssr.c | 8 drivers/clk/renesas/r9a06g032-clocks.c | 6 drivers/clk/renesas/rcar-gen2-cpg.c | 5 drivers/clk/renesas/rcar-gen2-cpg.h | 3 drivers/clk/renesas/rcar-gen3-cpg.c | 6 drivers/clk/renesas/rcar-gen3-cpg.h | 3 drivers/clk/renesas/rcar-gen4-cpg.c | 6 drivers/clk/renesas/rcar-gen4-cpg.h | 3 drivers/clk/renesas/renesas-cpg-mssr.c | 150 +- drivers/clk/renesas/renesas-cpg-mssr.h | 20 drivers/clk/renesas/rzg2l-cpg.c | 3 drivers/cpufreq/amd-pstate.c | 2 drivers/crypto/ccree/cc_buffer_mgr.c | 6 drivers/crypto/hisilicon/qm.c | 14 drivers/crypto/intel/iaa/iaa_crypto_main.c | 2 drivers/crypto/starfive/jh7110-hash.c | 6 drivers/firmware/efi/cper-arm.c | 52 drivers/firmware/efi/cper.c | 60 drivers/firmware/efi/libstub/x86-5lvl.c | 4 drivers/firmware/imx/imx-scu-irq.c | 4 drivers/firmware/stratix10-svc.c | 1 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 46 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 27 drivers/gpu/drm/drm_plane.c | 8 drivers/gpu/drm/imagination/pvr_device.c | 2 drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 2 drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 34 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 10 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h | 6 drivers/gpu/drm/nouveau/nouveau_fence.c | 6 drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c | 2 drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 drivers/gpu/drm/panthor/panthor_device.c | 4 drivers/gpu/drm/panthor/panthor_gem.c | 20 drivers/gpu/drm/panthor/panthor_mmu.c | 18 drivers/gpu/drm/panthor/panthor_sched.c | 6 drivers/gpu/drm/vgem/vgem_fence.c | 2 drivers/gpu/host1x/syncpt.c | 4 drivers/greybus/gb-beagleplay.c | 12 drivers/hid/hid-logitech-hidpp.c | 9 drivers/hwmon/sy7636a-hwmon.c | 7 drivers/hwtracing/coresight/coresight-etm4x-core.c | 130 + drivers/i3c/master.c | 8 drivers/i3c/master/svc-i3c-master.c | 22 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 drivers/infiniband/hw/bnxt_re/qplib_sp.h | 2 drivers/infiniband/hw/irdma/cm.c | 2 drivers/infiniband/hw/irdma/ctrl.c | 3 drivers/infiniband/hw/irdma/main.h | 2 drivers/infiniband/hw/irdma/pble.c | 6 drivers/infiniband/hw/irdma/verbs.c | 15 drivers/infiniband/hw/irdma/verbs.h | 3 drivers/infiniband/sw/rxe/rxe_srq.c | 7 drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 drivers/interconnect/debugfs-client.c | 7 drivers/interconnect/qcom/msm8996.c | 1 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 drivers/iommu/intel/iommu.h | 2 drivers/irqchip/irq-bcm7038-l1.c | 8 drivers/irqchip/irq-bcm7120-l2.c | 17 drivers/irqchip/irq-brcmstb-l2.c | 12 drivers/irqchip/irq-imx-mu-msi.c | 14 drivers/irqchip/irq-mchp-eic.c | 2 drivers/irqchip/irq-renesas-rzg2l.c | 6 drivers/irqchip/irq-starfive-jh8100-intc.c | 3 drivers/irqchip/qcom-irq-combiner.c | 2 drivers/leds/leds-netxbig.c | 36 drivers/leds/rgb/leds-qcom-lpg.c | 4 drivers/macintosh/mac_hid.c | 3 drivers/md/dm-log-writes.c | 1 drivers/md/dm-raid.c | 2 drivers/md/md.c | 14 drivers/md/md.h | 8 drivers/md/raid5.c | 6 drivers/mfd/da9055-core.c | 1 drivers/mfd/mt6358-irq.c | 1 drivers/mfd/mt6397-irq.c | 1 drivers/mtd/lpddr/lpddr_cmds.c | 8 drivers/mtd/nand/raw/lpc32xx_slc.c | 2 drivers/mtd/nand/raw/marvell_nand.c | 13 drivers/mtd/nand/raw/nand_base.c | 13 drivers/mtd/nand/raw/renesas-nand-controller.c | 5 drivers/net/dsa/xrs700x/xrs700x.c | 11 drivers/net/ethernet/microchip/lan743x_main.c | 3 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 drivers/net/phy/adin1100.c | 2 drivers/net/phy/aquantia/aquantia_firmware.c | 2 drivers/net/phy/mscc/mscc_main.c | 6 drivers/net/wireless/ath/ath10k/bmi.c | 2 drivers/net/wireless/ath/ath10k/ce.c | 2 drivers/net/wireless/ath/ath10k/core.c | 22 drivers/net/wireless/ath/ath10k/core.h | 2 drivers/net/wireless/ath/ath10k/coredump.c | 2 drivers/net/wireless/ath/ath10k/debug.c | 2 drivers/net/wireless/ath/ath10k/htc.c | 3 drivers/net/wireless/ath/ath10k/htt_rx.c | 3 drivers/net/wireless/ath/ath10k/htt_tx.c | 2 drivers/net/wireless/ath/ath10k/mac.c | 36 drivers/net/wireless/ath/ath10k/trace.c | 2 drivers/net/wireless/ath/ath11k/mac.c | 8 drivers/net/wireless/ath/ath11k/pci.c | 20 drivers/net/wireless/ath/ath11k/wmi.c | 20 drivers/net/wireless/ath/ath11k/wmi.h | 2 drivers/net/wireless/ath/ath12k/wow.c | 1 drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 4 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 27 drivers/net/wireless/st/cw1200/bh.c | 6 drivers/nvme/host/auth.c | 2 drivers/of/of_kunit_helpers.c | 5 drivers/pci/controller/Kconfig | 7 drivers/pci/controller/dwc/pci-keystone.c | 2 drivers/pci/controller/dwc/pcie-designware.h | 2 drivers/phy/freescale/phy-fsl-imx8qm-hsio.c | 5 drivers/phy/renesas/phy-rcar-gen3-usb2.c | 20 drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 13 drivers/pinctrl/pinctrl-single.c | 7 drivers/pinctrl/renesas/pinctrl-rzg2l.c | 6 drivers/pinctrl/stm32/pinctrl-stm32.c | 2 drivers/platform/x86/asus-wmi.c | 8 drivers/platform/x86/intel/pmc/core.h | 2 drivers/power/supply/apm_power.c | 3 drivers/power/supply/cw2015_battery.c | 8 drivers/power/supply/max17040_battery.c | 6 drivers/power/supply/rt5033_charger.c | 2 drivers/power/supply/rt9467-charger.c | 6 drivers/power/supply/wm831x_power.c | 10 drivers/pwm/pwm-bcm2835.c | 28 drivers/ras/ras.c | 40 drivers/regulator/core.c | 37 drivers/regulator/fixed.c | 11 drivers/remoteproc/qcom_q6v5_wcss.c | 8 drivers/rtc/rtc-gamecube.c | 4 drivers/s390/crypto/ap_bus.c | 8 drivers/scsi/imm.c | 1 drivers/scsi/qla2xxx/qla_nvme.c | 2 drivers/scsi/sim710.c | 2 drivers/scsi/smartpqi/smartpqi_init.c | 19 drivers/scsi/stex.c | 1 drivers/soc/aspeed/aspeed-lpc-ctrl.c | 2 drivers/soc/aspeed/aspeed-lpc-snoop.c | 2 drivers/soc/aspeed/aspeed-p2a-ctrl.c | 2 drivers/soc/aspeed/aspeed-uart-routing.c | 2 drivers/soc/fsl/dpaa2-console.c | 2 drivers/soc/fsl/qe/qmc.c | 2 drivers/soc/fsl/qe/tsa.c | 2 drivers/soc/fujitsu/a64fx-diag.c | 2 drivers/soc/hisilicon/kunpeng_hccs.c | 2 drivers/soc/ixp4xx/ixp4xx-npe.c | 2 drivers/soc/ixp4xx/ixp4xx-qmgr.c | 2 drivers/soc/litex/litex_soc_ctrl.c | 2 drivers/soc/loongson/loongson2_guts.c | 2 drivers/soc/mediatek/mtk-devapc.c | 2 drivers/soc/mediatek/mtk-mmsys.c | 2 drivers/soc/mediatek/mtk-socinfo.c | 2 drivers/soc/microchip/mpfs-sys-controller.c | 2 drivers/soc/pxa/ssp.c | 2 drivers/soc/qcom/icc-bwmon.c | 2 drivers/soc/qcom/llcc-qcom.c | 2 drivers/soc/qcom/ocmem.c | 2 drivers/soc/qcom/pmic_glink.c | 2 drivers/soc/qcom/qcom_aoss.c | 2 drivers/soc/qcom/qcom_gsbi.c | 8 drivers/soc/qcom/qcom_stats.c | 2 drivers/soc/qcom/ramp_controller.c | 4 drivers/soc/qcom/rmtfs_mem.c | 2 drivers/soc/qcom/rpm-proc.c | 2 drivers/soc/qcom/rpm_master_stats.c | 2 drivers/soc/qcom/smem.c | 5 drivers/soc/qcom/smp2p.c | 2 drivers/soc/qcom/smsm.c | 6 drivers/soc/qcom/socinfo.c | 2 drivers/soc/rockchip/io-domain.c | 8 drivers/soc/samsung/exynos-chipid.c | 4 drivers/soc/tegra/cbb/tegra194-cbb.c | 2 drivers/soc/ti/k3-ringacc.c | 2 drivers/soc/ti/knav_dma.c | 4 drivers/soc/ti/knav_qmss_queue.c | 2 drivers/soc/ti/pm33xx.c | 2 drivers/soc/ti/pruss.c | 4 drivers/soc/ti/smartreflex.c | 2 drivers/soc/ti/wkup_m3_ipc.c | 2 drivers/soc/xilinx/xlnx_event_manager.c | 2 drivers/soc/xilinx/zynqmp_power.c | 2 drivers/spi/spi-airoha-snfi.c | 25 drivers/spi/spi-ch341.c | 2 drivers/spi/spi-tegra210-quad.c | 22 drivers/staging/fbtft/fbtft-core.c | 4 drivers/target/target_core_configfs.c | 1 drivers/ufs/core/ufshcd.c | 2 drivers/uio/uio_fsl_elbc_gpcm.c | 7 drivers/usb/core/message.c | 2 drivers/usb/dwc2/platform.c | 16 drivers/usb/dwc3/host.c | 5 drivers/usb/gadget/legacy/raw_gadget.c | 3 drivers/usb/gadget/udc/tegra-xudc.c | 6 drivers/usb/misc/chaoskey.c | 16 drivers/usb/phy/phy.c | 4 drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 drivers/vdpa/pds/vdpa_dev.c | 2 drivers/vfio/pci/vfio_pci_core.c | 68 drivers/vfio/pci/vfio_pci_intrs.c | 52 drivers/vfio/pci/vfio_pci_priv.h | 4 drivers/vhost/vhost.c | 4 drivers/video/backlight/led_bl.c | 13 drivers/video/fbdev/ssd1307fb.c | 4 drivers/virtio/virtio_vdpa.c | 2 drivers/watchdog/starfive-wdt.c | 4 drivers/watchdog/wdat_wdt.c | 64 fs/9p/v9fs.c | 4 fs/9p/vfs_file.c | 11 fs/9p/vfs_inode.c | 3 fs/9p/vfs_inode_dotl.c | 2 fs/btrfs/ctree.c | 2 fs/dcache.c | 46 fs/erofs/super.c | 16 fs/ext4/mballoc.c | 49 fs/ext4/move_extent.c | 2 fs/f2fs/debug.c | 3 fs/f2fs/f2fs.h | 20 fs/f2fs/file.c | 77 - fs/f2fs/gc.c | 21 fs/f2fs/gc.h | 2 fs/f2fs/inode.c | 14 fs/f2fs/shrinker.c | 90 + fs/f2fs/super.c | 8 fs/f2fs/sysfs.c | 101 + fs/gfs2/glock.c | 5 fs/gfs2/inode.c | 15 fs/gfs2/inode.h | 1 fs/gfs2/ops_fstype.c | 2 fs/iomap/direct-io.c | 77 - fs/nfs/client.c | 21 fs/nfs/dir.c | 27 fs/nfs/inode.c | 2 fs/nfs/internal.h | 3 fs/nfs/namespace.c | 11 fs/nfs/nfs4client.c | 18 fs/nfs/nfs4proc.c | 29 fs/nfs/pnfs.c | 1 fs/nfs/super.c | 33 fs/nfsd/blocklayout.c | 4 fs/nls/nls_base.c | 27 fs/ntfs3/frecord.c | 8 fs/ntfs3/fsntfs.c | 9 fs/ntfs3/inode.c | 2 fs/ocfs2/alloc.c | 1 fs/ocfs2/move_extents.c | 8 fs/smb/client/smb2pdu.c | 2 fs/tracefs/event_inode.c | 3 include/dt-bindings/clock/qcom,x1e80100-gcc.h | 63 include/linux/blk_types.h | 5 include/linux/blkdev.h | 2 include/linux/coresight.h | 25 include/linux/cper.h | 12 include/linux/dcache.h | 1 include/linux/filter.h | 12 include/linux/firmware/qcom/qcom_tzmem.h | 15 include/linux/ieee80211.h | 4 include/linux/if_hsr.h | 26 include/linux/nfs_fs_sb.h | 7 include/linux/nfs_xdr.h | 54 include/linux/perf_event.h | 2 include/linux/platform_data/lp855x.h | 4 include/linux/ras.h | 16 include/linux/rculist_nulls.h | 59 include/linux/vfio_pci_core.h | 10 include/linux/virtio_config.h | 8 include/net/dst.h | 16 include/net/netfilter/nf_conntrack_count.h | 17 include/net/sock.h | 13 include/ras/ras_event.h | 49 include/uapi/sound/asound.h | 2 kernel/bpf/hashtab.c | 10 kernel/bpf/stackmap.c | 66 kernel/bpf/syscall.c | 3 kernel/bpf/trampoline.c | 4 kernel/cgroup/cpuset.c | 35 kernel/dma/pool.c | 2 kernel/events/callchain.c | 12 kernel/events/core.c | 2 kernel/locking/locktorture.c | 8 kernel/resource.c | 46 kernel/sched/fair.c | 17 kernel/task_work.c | 8 lib/vsprintf.c | 6 net/core/dst.c | 2 net/core/filter.c | 9 net/hsr/hsr_device.c | 33 net/hsr/hsr_main.h | 10 net/hsr/hsr_slave.c | 12 net/ipv4/inet_hashtables.c | 8 net/ipv4/inet_timewait_sock.c | 35 net/ipv4/route.c | 4 net/ipv4/tcp_metrics.c | 6 net/ipv6/ip6_fib.c | 4 net/mac80211/aes_cmac.c | 63 net/mac80211/aes_cmac.h | 8 net/mac80211/wpa.c | 20 net/netfilter/nf_conncount.c | 187 +- net/netfilter/nft_connlimit.c | 34 net/netfilter/nft_flow_offload.c | 9 net/netfilter/xt_connlimit.c | 14 net/openvswitch/conntrack.c | 16 net/sched/sch_cake.c | 58 net/sctp/socket.c | 5 security/integrity/ima/ima_policy.c | 2 security/smack/smack.h | 3 security/smack/smack_access.c | 93 + security/smack/smack_lsm.c | 279 ++- sound/firewire/dice/dice-extension.c | 4 sound/firewire/motu/motu-hwdep.c | 7 sound/isa/wavefront/wavefront_synth.c | 4 sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 sound/soc/codecs/Kconfig | 5 sound/soc/codecs/Makefile | 2 sound/soc/codecs/ak4458.c | 10 sound/soc/codecs/ak5558.c | 10 sound/soc/codecs/nau8325.c | 7 sound/soc/codecs/tas2781-i2c.c | 2 sound/soc/fsl/fsl_xcvr.c | 2 sound/soc/intel/catpt/pcm.c | 4 tools/include/nolibc/stdio.h | 4 tools/lib/bpf/btf.c | 4 tools/objtool/check.c | 3 tools/objtool/elf.c | 8 tools/perf/builtin-record.c | 2 tools/perf/util/annotate.c | 2 tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.c | 37 tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.h | 26 tools/perf/util/bpf_lock_contention.c | 6 tools/perf/util/hist.c | 6 tools/perf/util/symbol.c | 5 tools/testing/selftests/bpf/prog_tests/perf_branches.c | 22 tools/testing/selftests/bpf/prog_tests/send_signal.c | 5 tools/testing/selftests/bpf/progs/test_perf_branches.c | 3 tools/testing/selftests/drivers/net/bonding/Makefile | 2 tools/testing/selftests/drivers/net/bonding/bond_macvlan.sh | 99 - tools/testing/selftests/drivers/net/bonding/bond_macvlan_ipvlan.sh | 97 + tools/testing/selftests/drivers/net/bonding/config | 1 410 files changed, 4297 insertions(+), 1926 deletions(-) Aashish Sharma (1): iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb Abdun Nihaal (4): wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() Ahelenia Ziemiańska (1): power: supply: apm_power: only unset own apm_get_power_status Akash Goel (2): drm/panthor: Fix potential memleak of vma structure drm/panthor: Avoid adding of kernel BOs to extobj list Akhil P Oommen (3): drm/msm/a6xx: Flush LRZ cache before PT switch drm/msm/a6xx: Fix the gemnoc workaround drm/msm/a6xx: Improve MX rail fallback in RPMH vote init Al Viro (1): tracefs: fix a leak in eventfs_create_events_dir() Alan Maguire (1): libbpf: Fix parsing of multi-split BTF Alex Williamson (1): vfio/pci: Use RCU for error/request triggers to avoid circular locking Alexander Dahl (1): net: phy: adin1100: Fix software power-down ready condition Alexander Martinz (1): arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory Alexandre Courbot (1): firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER Alexandru Gagniuc (1): remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs Alexei Starovoitov (1): selftests/bpf: Fix failure paths in send_signal test Alexey Kodanev (1): net: stmmac: fix rx limit check in stmmac_rx_zc() Alexey Simakov (1): dm-raid: fix possible NULL dereference with undefined raid type Alok Tiwari (3): virtio_vdpa: fix misleading return in void function vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues vdpa/pds: use %pe for ERR_PTR() in event handler registration Andreas Gruenbacher (1): gfs2: Prevent recursive memory reclaim Andres J Rosa (1): ALSA: uapi: Fix typo in asound.h comment Andrzej Kacprowski (1): accel/ivpu: Prevent runtime suspend during context abort work Andy Shevchenko (3): lib/vsprintf: Check pointer before dereferencing in time_and_date() resource: replace open coded resource_intersection() resource: introduce is_type_match() helper and use it Anton Khirnov (1): platform/x86: asus-wmi: use brightness_set_blocking() for kbd led Armin Wolf (2): fs/nls: Fix utf16 to utf8 conversion fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() Arnaud Lecomte (2): bpf: Refactor stack map trace depth calculation into helper function bpf: Fix stackmap overflow check in __bpf_get_stackid() Aryan Srivastava (2): Revert "mtd: rawnand: marvell: fix layouts" mtd: nand: relax ECC parameter validation check Baochen Qiang (3): wifi: ath11k: restore register window after global reset wifi: ath11k: fix VHT MCS assignment wifi: ath11k: fix peer HE MCS assignment Bart Van Assche (3): block/mq-deadline: Introduce dd_start_request() block/mq-deadline: Switch back to a single dispatch list scsi: target: Do not write NUL characters into ASCII configfs output Bean Huo (1): scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() Benjamin Berg (1): tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set Biju Das (1): pinctrl: renesas: rzg2l: Fix PMC restore Boris Brezillon (3): drm/panthor: Handle errors returned by drm_sched_entity_init() drm/panthor: Fix group_free_queue() for partially initialized queues drm/panthor: Fix UAF on kernel BO VA nodes Cezary Rojewski (1): ASoC: Intel: catpt: Fix error path in hw_params() Chao Yu (3): f2fs: fix to avoid running out of free segments f2fs: sysfs: add encoding_flags entry f2fs: introduce reserved_pin_section sysfs entry Chen Ridong (1): cpuset: Treat cpusets in attaching as populated Chien Wong (1): wifi: mac80211: fix CMAC functions not handling errors Christoph Hellwig (3): iomap: factor out a iomap_dio_done helper iomap: always run error completions in user context block: return unsigned int from queue_dma_alignment Christophe JAILLET (1): phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() Christophe Leroy (1): powerpc/32: Fix unpaired stwcx. on interrupt exit Cong Zhang (1): blk-mq: Abort suspend when wakeup events are pending Cristian Ciocaltea (2): phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits Cyrille Pitchen (1): drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() Daeho Jeong (4): f2fs: add carve_out sysfs node f2fs: add gc_boost_gc_multiple sysfs node f2fs: add gc_boost_gc_greedy sysfs node f2fs: maintain one time GC mode is enabled during whole zoned GC cycle Dan Carpenter (3): drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() Dapeng Mi (1): perf/x86/intel: Correct large PEBS flag check Dave Kleikamp (1): dma/pool: eliminate alloc_pages warning in atomic_pool_expand David Gow (1): um: Don't rename vmap to kernel_vmap David Howells (1): cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 Dinh Nguyen (1): firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc Diogo Ivo (1): usb: phy: Initialize struct usb_phy list_head Dmitry Antipov (2): ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() ocfs2: fix memory leak in ocfs2_merge_rec_left() Dmitry Baryshkov (4): interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype drm/msm/a2xx: stop over-complaining about the legacy firmware Duoming Zhou (1): scsi: imm: Fix use-after-free bug caused by unfinished delayed work Dylan Hatch (1): objtool: Fix standalone --hacks=jump_label Edward Adam Davis (3): ntfs3: init run lock for extend inode fs/ntfs3: out1 also needs to put mi fs/ntfs3: Prevent memory leaks in add sub record Eric Dumazet (4): net: hsr: remove one synchronize_rcu() from hsr_del_port() net: hsr: remove synchronize_rcu() from hsr_add_port() net: dst: introduce dst->dev_rcu tcp_metrics: use dst_dev_net_rcu() Eric Sandeen (1): 9p: fix cache/debug options printing in v9fs_show_options Etienne Champetier (1): selftests: bonding: add ipvlan over bond testing FUKAUMI Naoki (3): arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C Fangyu Yu (1): RISC-V: KVM: Fix guest page fault within HLV* instructions Fenglin Wu (1): leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM Fernand Sieber (1): sched/fair: Forfeit vruntime on yield Fernando Fernandez Mancera (3): ipv6: clear RA flags when adding a static route netfilter: nf_conncount: rework API to use sk_buff directly netfilter: nft_connlimit: update the count if add was skipped Filipe Manana (1): btrfs: fix leaf leak in an error path in btrfs_del_items() Francesco Lavra (1): iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member Frank Li (1): i3c: fix refcount inconsistency in i3c_master_register Gabor Juhos (1): regulator: core: disable supply if enabling main regulator fails Gao Xiang (1): erofs: limit the level of fs stacking for file-backed mounts Gautham R. Shenoy (1): cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs Geert Uytterhoeven (3): clk: renesas: Use str_on_off() helper PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() Gergo Koteles (1): arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider Gopi Krishna Menon (1): usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE Greg Kroah-Hartman (1): Linux 6.12.63 Guenter Roeck (2): block/blk-throttle: Fix throttle slice time for SSDs of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node Guido Günther (1): drm/panel: visionox-rm69299: Don't clear all mode flags Hangbin Liu (1): selftests: bonding: add delay before each xvlan_over_bond connectivity check Haotian Zhang (24): soc: qcom: gsbi: fix double disable caused by devm mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove soc: qcom: smem: fix hwspinlock resource leak in probe error paths pinctrl: stm32: fix hwspinlock resource leak in probe function power: supply: rt5033_charger: Fix device node reference leaks mfd: da9055: Fix missing regmap_del_irq_chip() in error path scsi: stex: Fix reboot_notifier leak in probe error path clk: renesas: r9a06g032: Fix memory leak in error path ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls leds: netxbig: Fix GPIO descriptor leak in error paths watchdog: wdat_wdt: Fix ACPI table leak in probe function watchdog: starfive: Fix resource leak in probe error path mfd: mt6397-irq: Fix missing irq_domain_remove() in error path mfd: mt6358-irq: Fix missing irq_domain_remove() in error path crypto: starfive - Correctly handle return of sg_nents_for_len crypto: ccree - Correctly handle return of sg_nents_for_len greybus: gb-beagleplay: Fix timeout handling in bootloader functions hwmon: sy7636a: Fix regulator_enable resource leak on error path mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors pinctrl: single: Fix incorrect type for error return variable ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() rtc: gamecube: Check the return value of ioremap() dm log-writes: Add missing set_freezable() for freezable kthread Haotien Hsu (1): usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt Heiko Carstens (2): s390/smp: Fix fallback CPU detection s390/ap: Don't leak debug feature files if AP instructions are not available Herbert Xu (1): crypto: authenc - Correctly pass EINPROGRESS back up to the caller Horatiu Vultur (1): phy: mscc: Fix PTP for VSC8574 and VSC8572 Huacai Chen (1): LoongArch: Add machine_kexec_mask_interrupts() implementation Ian Rogers (1): perf hist: In init, ensure mem_info is put on error paths Ilias Stamatis (1): Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" Israel Rukshin (1): nvme-auth: use kvfree() for memory allocated with kvcalloc() Ivan Abramov (4): power: supply: cw2015: Check devm_delayed_work_autocancel() return code power: supply: max17040: Check iio_read_channel_processed() return code power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() power: supply: wm831x: Check wm831x_set_bits() return value Ivan Stepchenko (1): mtd: lpddr_cmds: fix signed shifts in lpddr_cmds Jacek Lawrynowicz (1): accel/ivpu: Make function parameter names consistent Jacob Moroni (1): RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY Jaegeuk Kim (2): f2fs: keep POSIX_FADV_NOREUSE ranges f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages Janusz Krzysztofik (1): drm/vgem-fence: Fix potential deadlock on release Jaroslav Kysela (2): ASoC: nau8325: use simple i2c probe function ASoC: nau8325: add missing build config Jason Tian (1): RAS: Report all ARM processor CPER information to userspace Jay Liu (1): drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue Jeff Johnson (1): wifi: ath10k: Add missing include of export.h Jianglei Nie (1): staging: fbtft: core: fix potential memory leak in fbtft_probe_common() Jihed Chaibi (3): ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties Jisheng Zhang (3): usb: dwc2: disable platform lowlevel hw resources during shutdown usb: dwc2: fix hang during shutdown if set as peripheral usb: dwc2: fix hang during suspend if set as peripheral Johan Hovold (8): irqchip/irq-bcm7038-l1: Fix section mismatch irqchip/irq-bcm7120-l2: Fix section mismatch irqchip/irq-brcmstb-l2: Fix section mismatch irqchip/imx-mu-msi: Fix section mismatch irqchip/renesas-rzg2l: Fix section mismatch irqchip/starfive-jh8100: Fix section mismatch irqchip/qcom-irq-combiner: Fix section mismatch clk: keystone: fix compile testing Jonathan Curley (1): NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Josh Poimboeuf (2): objtool: Fix weak symbol detection perf: Remove get_perf_callchain() init_nr argument Junrui Luo (4): ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events ALSA: firewire-motu: add bounds check in put_user loop for DSP events ALSA: dice: fix buffer overflow in detect_stream_formats() ALSA: wavefront: Fix integer overflow in sample size validation Kang Yang (1): wifi: ath10k: move recovery check logic into a new work Karol Wachowski (2): accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail accel/ivpu: Fix DCT active percent format Kathara Sasikumar (1): docs: hwmon: fix link to g762 devicetree binding Ketil Johnsen (2): drm/panthor: Fix UAF race between device unplug and FW event processing drm/panthor: Fix race with suspend during unplug Kevin Brodsky (1): ublk: prevent invalid access with DEBUG Konrad Dybcio (2): dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets Konstantin Andreev (7): smack: deduplicate "does access rule request transmutation" smack: fix bug: SMACK64TRANSMUTE set on non-directory smack: deduplicate xattr setting in smack_inode_init_security() smack: always "instantiate" inode in smack_inode_init_security() smack: fix bug: invalid label of unix socket file smack: fix bug: unprivileged task can create labels smack: fix bug: setting task label silently ignores input garbage Krishna Kurapati (2): arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller Krzysztof Czurylo (2): RDMA/irdma: Fix data race in irdma_sc_ccq_arm RDMA/irdma: Fix data race in irdma_free_pble Krzysztof Kozlowski (1): ASoC: codecs: nau8325: Silence uninitialized variables warnings Kuan-Wei Chiu (1): interconnect: debugfs: Fix incorrect error handling for NULL path Kuniyuki Iwashima (1): sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). Leo Yan (6): coresight: Change device mode to atomic type coresight: etm4x: Correct polling IDLE bit coresight: etm4x: Extract the trace unit controlling coresight: etm4x: Add context synchronization before enabling trace perf arm-spe: Extend branch operations perf arm_spe: Fix memset subclass in operation Leon Hwang (1): bpf: Free special fields when update [lru_,]percpu_hash maps Li Qiang (1): uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe Liyuan Pang (1): ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() Loic Poulain (1): wifi: ath10k: Avoid vdev delete timeout when firmware is already down Long Li (1): macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse Luca Ceresoli (1): backlight: led-bl: Add devlink to supplier LEDs Luca Weiss (2): clk: qcom: camcc-sm6350: Fix PLL config of PLL2 clk: qcom: camcc-sm7150: Fix PLL config of PLL2 MD Danish Anwar (1): net: hsr: Create and export hsr_get_port_ndev() Ma Ke (1): RDMA/rtrs: server: Fix error handling in get_or_create_srv Madhur Kumar (1): drm/nouveau: refactor deprecated strcpy Mainak Sen (1): gpu: host1x: Fix race in syncpt alloc/free Manivannan Sadhasivam (1): dt-bindings: PCI: amlogic: Fix the register name of the DBI region Marek Szyprowski (4): ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend Marek Vasut (2): clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback clk: renesas: cpg-mssr: Read back reset registers to assure values latched Mark Brown (1): regulator: fixed: Rely on the core freeing the enable GPIO Martin KaFai Lau (1): bpf: Check skb->transport_header is set in bpf_skb_check_mtu Matt Bobrowski (2): selftests/bpf: skip test_perf_branches_hw() on unsupported platforms selftests/bpf: Improve reliability of test_perf_branches_no_hw() Mauro Carvalho Chehab (3): efi/cper: Add a new helper function to print bitmasks efi/cper: Adjust infopfx size to accept an extra space efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs Mavroudis Chatzilazaridis (1): HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() Menglong Dong (1): bpf: Handle return value of ftrace_set_filter_ip in register_fentry Michael S. Tsirkin (4): virtio: fix typo in virtio_device_ready() comment virtio: fix whitespace in virtio_config_ops virtio: fix grammar in virtio_queue_info docs virtio: fix virtqueue_set_affinity() docs Mike Christie (1): vhost: Fix kthread worker cgroup failure handling Mike McGowen (1): scsi: smartpqi: Fix device resources accessed after device removal Mikhail Kshevetskiy (1): spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND Mohamed Khalfella (1): block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock Murad Masimov (1): power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() Namhyung Kim (3): perf lock contention: Load kernel map before lookup perf tools: Mark split kallsyms DSOs as loaded perf tools: Fix split kallsyms DSO counting Neil Armstrong (1): arm64: dts: qcom: sm8650: set ufs as dma coherent NeilBrown (1): nfs/vfs: discard d_exact_alias() Oliver Neukum (1): usb: chaoskey: fix locking for O_NONBLOCK Pablo Neira Ayuso (1): netfilter: flowtable: check for maximum number of encapsulations in bridge vlan Peng Fan (1): firmware: imx: scu-irq: fix OF node leak in Peter Griffin (1): arm64: dts: exynos: gs101: fix sysreg_apm reg property Peter Zijlstra (1): task_work: Fix NMI race condition Pu Lehui (1): bpf: Fix invalid prog->stats access when update_effective_progs fails Randolph Sapp (1): arm64: dts: ti: k3-am62p: Fix memory ranges for GPU Randy Dunlap (2): firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc backlight: lp855x: Fix lp855x.h kernel-doc warnings Raphael Pinsonneault-Thibeault (1): ntfs3: fix uninit memory after failed mi_read in mi_format_new Rene Rebe (1): ps3disk: use memcpy_{from,to}_bvec index René Rebe (1): ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 Ria Thomas (1): wifi: ieee80211: correct FILS status codes Ritesh Harjani (IBM) (2): powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format Robert Marko (1): net: phy: aquantia: check for NVMEM deferral Ryan Huang (1): iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables Selvin Xavier (2): RDMA/bnxt_re: Fix the inline size for GenP7 devices RDMA/bnxt_re: Pass correct flag for dma mr creation Sergey Bashirov (1): NFSD/blocklayout: Fix minlength check in proc_layoutget Seungjin Bae (2): USB: Fix descriptor count when handling invalid MBIM extended descriptor wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() Shaurya Rane (1): block: fix memory leak in __blkdev_issue_zero_pages Shawn Lin (1): PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition Shenghao Ding (1): ASoC: tas2781: correct the wrong period Shengjiu Wang (3): ASoC: fsl_xcvr: clear the channel status control memory ASoC: ak4458: Disable regulator when error happens ASoC: ak5558: Disable regulator when error happens Shuai Xue (1): perf record: skip synthesize event when open evsel failed Siddharth Vadapalli (1): PCI: keystone: Exit ks_pcie_probe() for invalid mode Sidharth Seela (1): ntfs3: Fix uninit buffer allocated by __getname() Sourabh Jain (1): powerpc/kdump: Fix size calculation for hot-removed memory ranges Stanley Chu (1): i3c: master: svc: Prevent incomplete IBI transaction Stephan Gerhold (2): dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal Sven Peter (1): usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required Tengda Wu (1): x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() Thangaraj Samynathan (1): net: lan743x: Allocate rings outside ZONE_DMA Thierry Bultel (1): clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register Thorsten Blum (1): crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Tianchu Chen (1): spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Tianyou Li (1): perf annotate: Check return value of evsel__get_arch() properly Tim Harvey (4): arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl arm64: dts: imx8mp-venice-gw702x: remove off-board uart arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 Timur Tabi (1): drm/nouveau: restrict the flush page to a 32-bit address Tingmao Wang (1): fs/9p: Don't open remote file with APPEND mode when writeback cache is used Trond Myklebust (10): NFS: Avoid changing nlink when file removes and attribute updates race NFS: Initialise verifiers for visible dentries in readdir and lookup NFS: Initialise verifiers for visible dentries in nfs_atomic_open() NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state Revert "nfs: ignore SB_RDONLY when remounting nfs" Revert "nfs: clear SB_RDONLY before getting superblock" Revert "nfs: ignore SB_RDONLY when mounting nfs" NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags Expand the type of nfs_fattr->valid NFS: Fix inheritance of the block sizes when automounting Usama Arif (2): x86/boot: Fix page table access in 5-level to 4-level paging transition efi/libstub: Fix page table access in 5-level to 4-level paging transition Uwe Kleine-König (2): soc: Switch back to struct platform_driver::remove() pwm: bcm2835: Make sure the channel is enabled after pwm_request() Vishwaroop A (1): spi: tegra210-quad: Fix timeout handling Vladimir Oltean (1): net: dsa: xrs700x: reject unsupported HSR configurations Vladimir Zapolskiy (2): clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other Wang Liang (1): locktorture: Fix memory leak in param_set_cpumask() Wolfram Sang (2): ARM: dts: renesas: gose: Remove superfluous port property ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties Xi Pardee (1): platform/x86:intel/pmc: Update Arrow Lake telemetry GUID Xiang Mei (1): net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop Xiaogang Chen (1): drm/amdkfd: Use huge page size to check split svm range alignment Xiaolei Wang (1): phy: freescale: Initialize priv->lock Xiaoliang Yang (1): net: hsr: create an API to get hsr port type Xuanqiang Luo (3): rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() inet: Avoid ehash lookup race in inet_ehash_insert() inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() Yegor Yefremov (1): ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels Yongjian Sun (1): ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation Yu Kuai (1): md/raid5: fix IO hang when array is broken with IO inflight Yun Zhou (1): md: fix rcu protection in md_wakeup_thread Zhang Rui (1): perf/x86/intel/cstate: Remove PC3 support from LunarLake Zhang Yi (1): ext4: correct the checking of quota files before moving extents Zhao Yipeng (1): ima: Handle error code returned by ima_filter_rule_match() Zheng Qixing (2): nbd: defer config put in recv_work nbd: defer config unlock in nbd_genl_connect Zhu Yanjun (1): RDMA/rxe: Fix null deref on srq->rq.queue after resize failure Zilin Guan (3): crypto: iaa - Fix incorrect return value in save_iaa_wq() scsi: qla2xxx: Fix improper freeing of purex item mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() nieweiqiang (1): crypto: hisilicon/qm - restore original qos values shechenglong (1): block: fix comment for op_is_zone_mgmt() to include RESET_ALL sparkhuang (1): regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex xupengbo (1): sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out

5 days, 7 hours

1
1
0 0

[PATCH] rust: task: restrict Task::group_leader() to current

by Alice Ryhl

The Task::group_leader() method currently allows you to access the group_leader() of any task, for example one you hold a refcount to. But this is not safe in general since the group leader could change when a task exits. See for example commit a15f37a40145c ("kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths"). All existing users of Task::group_leader() call this method on current, which is guaranteed running, so there's not an actual issue in Rust code today. But to prevent code in the future from making this mistake, restrict Task::group_leader() so that it can only be called on current. There are some other cases where accessing task->group_leader is okay. For example it can be safe if you hold tasklist_lock or rcu_read_lock(). However, only supporting current->group_leader is sufficient for all in-tree Rust users of group_leader right now. Safe Rust functionality for accessing it under rcu or while holding tasklist_lock may be added in the future if required by any future Rust module. Reported-by: Oleg Nesterov <oleg(a)redhat.com> Closes: https://lore.kernel.org/all/aTLnV-5jlgfk1aRK@redhat.com/ Fixes: 313c4281bc9d ("rust: add basic `Task`") Cc: stable(a)vger.kernel.org Signed-off-by: Alice Ryhl <aliceryhl(a)google.com> --- The rust/kernel/task.rs file has had changes land through a few different trees: * Originally task.rs landed through Christian's tree together with file.rs and pid_namespace.rs * The change to add CurrentTask landed through Andrew Morton's tree together with mm.rs * There was a patch to mark some methods #[inline] that landed through tip via Boqun. I don't think there's a clear owner for this file, so to break ambiguity I'm doing to declare that this patch is intended for Andrew Morton's tree. Please let me know if you think a different tree is appropriate. --- rust/kernel/task.rs | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/rust/kernel/task.rs b/rust/kernel/task.rs index 49fad6de06740a9b9ad80b2f4b430cc28cd134fa..9440692a3a6d0d3f908d61d51dcd377a272f6957 100644 --- a/rust/kernel/task.rs +++ b/rust/kernel/task.rs @@ -204,18 +204,6 @@ pub fn as_ptr(&self) -> *mut bindings::task_struct { self.0.get() } - /// Returns the group leader of the given task. - pub fn group_leader(&self) -> &Task { - // SAFETY: The group leader of a task never changes after initialization, so reading this - // field is not a data race. - let ptr = unsafe { *ptr::addr_of!((*self.as_ptr()).group_leader) }; - - // SAFETY: The lifetime of the returned task reference is tied to the lifetime of `self`, - // and given that a task has a reference to its group leader, we know it must be valid for - // the lifetime of the returned task reference. - unsafe { &*ptr.cast() } - } - /// Returns the PID of the given task. pub fn pid(&self) -> Pid { // SAFETY: The pid of a task never changes after initialization, so reading this field is @@ -345,6 +333,18 @@ pub fn active_pid_ns(&self) -> Option<&PidNamespace> { // `release_task()` call. Some(unsafe { PidNamespace::from_ptr(active_ns) }) } + + /// Returns the group leader of the current task. + pub fn group_leader(&self) -> &Task { + // SAFETY: The group leader of a task never changes while the task is running, and `self` + // is the current task, which is guaranteed running. + let ptr = unsafe { (*self.as_ptr()).group_leader }; + + // SAFETY: `current.group_leader` stays valid for at least the duration in which `current` + // is running, and the signature of this function ensures that the returned `&Task` can + // only be used while `current` is still valid, thus still running. + unsafe { &*ptr.cast() } + } } // SAFETY: The type invariants guarantee that `Task` is always refcounted. --- base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8 change-id: 20251218-task-group-leader-a71931ced643 Best regards, -- Alice Ryhl <aliceryhl(a)google.com>

5 days, 7 hours

3
3
0 0

[PATCH] PNP: add a error handling in pnpacpi_init()

by Haoxiang Li

Add a error handling for pnp_register_protocol(), and if it fails, call put_device() to drop the device reference. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> --- drivers/pnp/pnpacpi/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c index a0927081a003..0b63e1748b7c 100644 --- a/drivers/pnp/pnpacpi/core.c +++ b/drivers/pnp/pnpacpi/core.c @@ -304,7 +304,10 @@ static int __init pnpacpi_init(void) return 0; } printk(KERN_INFO "pnp: PnP ACPI init\n"); - pnp_register_protocol(&pnpacpi_protocol); + if (pnp_register_protocol(&pnpacpi_protocol)) { + put_device(&pnpacpi_protocol.dev); + return 0; + } acpi_get_devices(NULL, pnpacpi_add_device_handler, NULL, NULL); printk(KERN_INFO "pnp: PnP ACPI: found %d devices\n", num); pnp_platform_devices = 1; -- 2.25.1

5 days, 7 hours

2
4
0 0

[PATCH v1 4/4] mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather

by David Hildenbrand (Red Hat)

As reported, ever since commit 1013af4f585f ("mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race") we can end up in some situations where we perform so many IPI broadcasts when unsharing hugetlb PMD page tables that it severely regresses some workloads. In particular, when we fork()+exit(), or when we munmap() a large area backed by many shared PMD tables, we perform one IPI broadcast per unshared PMD table. There are two optimizations to be had: (1) When we process (unshare) multiple such PMD tables, such as during exit(), it is sufficient to send a single IPI broadcast (as long as we respect locking rules) instead of one per PMD table. Locking prevents that any of these PMD tables could get reuse before we drop the lock. (2) When we are not the last sharer (> 2 users including us), there is no need to send the IPI broadcast. The shared PMD tables cannot become exclusive (fully unshared) before an IPI will be broadcasted by the last sharer. Concurrent GUP-fast could walk into a PMD table just before we unshared it. It could then succeed in grabbing a page from the shared page table even after munmap() etc succeeded (and supressed an IPI). But there is not difference compared to GUP-fast just sleeping for a while after grabbing the page and re-enabling IRQs. Most importantly, GUP-fast will never walk into page tables that are no-longer shared, because the last sharer will issue an IPI broadcast. (if ever required, checking whether the PUD changed in GUP-fast after grabbing the page like we do in the PTE case could handle this) So let's rework PMD sharing TLB flushing + IPI sync to use the mmu_gather infrastructure so we can implement these optimizations and demystify the code at least a bit. Extend the mmu_gather infrastructure to be able to deal with our special hugetlb PMD table sharing implementation. We'll consolidate the handling for (full) unsharing of PMD tables in tlb_unshare_pmd_ptdesc() and tlb_flush_unshared_tables(), and track in "struct mmu_gather" whether we had (full) unsharing of PMD tables. Because locking is very special (concurrent unsharing+reuse must be prevented), we disallow deferring flushing to tlb_finish_mmu() and instead require an explicit earlier call to tlb_flush_unshared_tables(). From hugetlb code, we call huge_pmd_unshare_flush() where we make sure that the expected lock protecting us from concurrent unsharing+reuse is still held. Check with a VM_WARN_ON_ONCE() in tlb_finish_mmu() that tlb_flush_unshared_tables() was properly called earlier. Document it all properly. Notes about tlb_remove_table_sync_one() interaction with unsharing: There are two fairly tricky things: (1) tlb_remove_table_sync_one() is a NOP on architectures without CONFIG_MMU_GATHER_RCU_TABLE_FREE. Here, the assumption is that the previous TLB flush would send an IPI to all relevant CPUs. Careful: some architectures like x86 only send IPIs to all relevant CPUs when tlb->freed_tables is set. The relevant architectures should be selecting MMU_GATHER_RCU_TABLE_FREE, but x86 might not do that in stable kernels and it might have been problematic before this patch. Also, the arch flushing behavior (independent of IPIs) is different when tlb->freed_tables is set. Do we have to enlighten them to also take care of tlb->unshared_tables? So far we didn't care, so hopefully we are fine. Of course, we could be setting tlb->freed_tables as well, but that might then unnecessarily flush too much, because the semantics of tlb->freed_tables are a bit fuzzy. This patch changes nothing in this regard. (2) tlb_remove_table_sync_one() is not a NOP on architectures with CONFIG_MMU_GATHER_RCU_TABLE_FREE that actually don't need a sync. Take x86 as an example: in the common case (!pv, !X86_FEATURE_INVLPGB) we still issue IPIs during TLB flushes and don't actually need the second tlb_remove_table_sync_one(). This optimized can be implemented on top of this, by checking e.g., in tlb_remove_table_sync_one() whether we really need IPIs. But as described in (1), it really must honor tlb->freed_tables then to send IPIs to all relevant CPUs. Further note that the ptdesc_pmd_pts_dec() in huge_pmd_share() is not a concern, as we are holding the i_mmap_lock the whole time, preventing concurrent unsharing. That ptdesc_pmd_pts_dec() usage will be removed separately as a cleanup later. There are plenty more cleanups to be had, but they have to wait until this is fixed. Fixes: 1013af4f585f ("mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race") Reported-by: Uschakow, Stanislav" <suschako(a)amazon.de> Closes: https://lore.kernel.org/all/4d3878531c76479d9f8ca9789dc6485d@amazon.de/ Cc: <stable(a)vger.kernel.org> Signed-off-by: David Hildenbrand (Red Hat) <david(a)kernel.org> --- include/asm-generic/tlb.h | 69 +++++++++++++++++++++- include/linux/hugetlb.h | 19 +++--- mm/hugetlb.c | 121 ++++++++++++++++++++++---------------- mm/mmu_gather.c | 6 ++ mm/mprotect.c | 2 +- mm/rmap.c | 25 +++++--- 6 files changed, 173 insertions(+), 69 deletions(-) diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h index 1fff717cae510..324a21f53b644 100644 --- a/include/asm-generic/tlb.h +++ b/include/asm-generic/tlb.h @@ -364,6 +364,17 @@ struct mmu_gather { unsigned int vma_huge : 1; unsigned int vma_pfn : 1; + /* + * Did we unshare (unmap) any shared page tables? + */ + unsigned int unshared_tables : 1; + + /* + * Did we unshare any page tables such that they are now exclusive + * and could get reused+modified by the new owner? + */ + unsigned int fully_unshared_tables : 1; + unsigned int batch_count; #ifndef CONFIG_MMU_GATHER_NO_GATHER @@ -400,6 +411,7 @@ static inline void __tlb_reset_range(struct mmu_gather *tlb) tlb->cleared_pmds = 0; tlb->cleared_puds = 0; tlb->cleared_p4ds = 0; + tlb->unshared_tables = 0; /* * Do not reset mmu_gather::vma_* fields here, we do not * call into tlb_start_vma() again to set them if there is an @@ -484,7 +496,7 @@ static inline void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb) * these bits. */ if (!(tlb->freed_tables || tlb->cleared_ptes || tlb->cleared_pmds || - tlb->cleared_puds || tlb->cleared_p4ds)) + tlb->cleared_puds || tlb->cleared_p4ds || tlb->unshared_tables)) return; tlb_flush(tlb); @@ -773,6 +785,61 @@ static inline bool huge_pmd_needs_flush(pmd_t oldpmd, pmd_t newpmd) } #endif +#ifdef CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING +static inline void tlb_unshare_pmd_ptdesc(struct mmu_gather *tlb, struct ptdesc *pt, + unsigned long addr) +{ + /* + * The caller must make sure that concurrent unsharing + exclusive + * reuse is impossible until tlb_flush_unshared_tables() was called. + */ + VM_WARN_ON_ONCE(!ptdesc_pmd_is_shared(pt)); + ptdesc_pmd_pts_dec(pt); + + /* Clearing a PUD pointing at a PMD table with PMD leaves. */ + tlb_flush_pmd_range(tlb, addr & PUD_MASK, PUD_SIZE); + + /* + * If the page table is now exclusively owned, we fully unshared + * a page table. + */ + if (!ptdesc_pmd_is_shared(pt)) + tlb->fully_unshared_tables = true; + tlb->unshared_tables = true; +} + +static inline void tlb_flush_unshared_tables(struct mmu_gather *tlb) +{ + /* + * As soon as the caller drops locks to allow for reuse of + * previously-shared tables, these tables could get modified and + * even reused outside of hugetlb context. So flush the TLB now. + * + * Note that we cannot defer the flush to a later point even if we are + * not the last sharer of the page table. + */ + if (tlb->unshared_tables) + tlb_flush_mmu_tlbonly(tlb); + + /* + * Similarly, we must make sure that concurrent GUP-fast will not + * walk previously-shared page tables that are getting modified+reused + * elsewhere. So broadcast an IPI to wait for any concurrent GUP-fast. + * + * We only perform this when we are the last sharer of a page table, + * as the IPI will reach all CPUs: any GUP-fast. + * + * Note that on configs where tlb_remove_table_sync_one() is a NOP, + * the expectation is that the tlb_flush_mmu_tlbonly() would have issued + * required IPIs already for us. + */ + if (tlb->fully_unshared_tables) { + tlb_remove_table_sync_one(); + tlb->fully_unshared_tables = false; + } +} +#endif /* CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING */ + #endif /* CONFIG_MMU */ #endif /* _ASM_GENERIC__TLB_H */ diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 03c8725efa289..63b248c6bfd47 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -240,8 +240,9 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma, pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, unsigned long sz); unsigned long hugetlb_mask_last_page(struct hstate *h); -int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep); +int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long addr, pte_t *ptep); +void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma); void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end); @@ -271,7 +272,7 @@ void hugetlb_vma_unlock_write(struct vm_area_struct *vma); int hugetlb_vma_trylock_write(struct vm_area_struct *vma); void hugetlb_vma_assert_locked(struct vm_area_struct *vma); void hugetlb_vma_lock_release(struct kref *kref); -long hugetlb_change_protection(struct vm_area_struct *vma, +long hugetlb_change_protection(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long address, unsigned long end, pgprot_t newprot, unsigned long cp_flags); void hugetlb_unshare_all_pmds(struct vm_area_struct *vma); @@ -300,13 +301,17 @@ static inline struct address_space *hugetlb_folio_mapping_lock_write( return NULL; } -static inline int huge_pmd_unshare(struct mm_struct *mm, - struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) +static inline int huge_pmd_unshare(struct mmu_gather *tlb, + struct vm_area_struct *vma, unsigned long addr, pte_t *ptep) { return 0; } +static inline void huge_pmd_unshare_flush(struct mmu_gather *tlb, + struct vm_area_struct *vma) +{ +} + static inline void adjust_range_if_pmd_sharing_possible( struct vm_area_struct *vma, unsigned long *start, unsigned long *end) @@ -432,7 +437,7 @@ static inline void move_hugetlb_state(struct folio *old_folio, { } -static inline long hugetlb_change_protection( +static inline long hugetlb_change_protection(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long address, unsigned long end, pgprot_t newprot, unsigned long cp_flags) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 3c77cdef12a32..3db94693a06fc 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5096,8 +5096,9 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, unsigned long last_addr_mask; pte_t *src_pte, *dst_pte; struct mmu_notifier_range range; - bool shared_pmd = false; + struct mmu_gather tlb; + tlb_gather_mmu(&tlb, vma->vm_mm); mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, mm, old_addr, old_end); adjust_range_if_pmd_sharing_possible(vma, &range.start, &range.end); @@ -5122,12 +5123,12 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, if (huge_pte_none(huge_ptep_get(mm, old_addr, src_pte))) continue; - if (huge_pmd_unshare(mm, vma, old_addr, src_pte)) { - shared_pmd = true; + if (huge_pmd_unshare(&tlb, vma, old_addr, src_pte)) { old_addr |= last_addr_mask; new_addr |= last_addr_mask; continue; } + tlb_remove_huge_tlb_entry(h, &tlb, src_pte, old_addr); dst_pte = huge_pte_alloc(mm, new_vma, new_addr, sz); if (!dst_pte) @@ -5136,13 +5137,13 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, move_huge_pte(vma, old_addr, new_addr, src_pte, dst_pte, sz); } - if (shared_pmd) - flush_hugetlb_tlb_range(vma, range.start, range.end); - else - flush_hugetlb_tlb_range(vma, old_end - len, old_end); + tlb_flush_mmu_tlbonly(&tlb); + huge_pmd_unshare_flush(&tlb, vma); + mmu_notifier_invalidate_range_end(&range); i_mmap_unlock_write(mapping); hugetlb_vma_unlock_write(vma); + tlb_finish_mmu(&tlb); return len + old_addr - old_end; } @@ -5161,7 +5162,6 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long sz = huge_page_size(h); bool adjust_reservation; unsigned long last_addr_mask; - bool force_flush = false; WARN_ON(!is_vm_hugetlb_page(vma)); BUG_ON(start & ~huge_page_mask(h)); @@ -5184,10 +5184,8 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, } ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, vma, address, ptep)) { + if (huge_pmd_unshare(tlb, vma, address, ptep)) { spin_unlock(ptl); - tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE); - force_flush = true; address |= last_addr_mask; continue; } @@ -5303,14 +5301,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, } tlb_end_vma(tlb, vma); - /* - * There is nothing protecting a previously-shared page table that we - * unshared through huge_pmd_unshare() from getting freed after we - * release i_mmap_rwsem, so flush the TLB now. If huge_pmd_unshare() - * succeeded, flush the range corresponding to the pud. - */ - if (force_flush) - tlb_flush_mmu_tlbonly(tlb); + huge_pmd_unshare_flush(tlb, vma); } void __hugetlb_zap_begin(struct vm_area_struct *vma, @@ -6399,7 +6390,7 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_pte, } #endif /* CONFIG_USERFAULTFD */ -long hugetlb_change_protection(struct vm_area_struct *vma, +long hugetlb_change_protection(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long address, unsigned long end, pgprot_t newprot, unsigned long cp_flags) { @@ -6409,7 +6400,6 @@ long hugetlb_change_protection(struct vm_area_struct *vma, pte_t pte; struct hstate *h = hstate_vma(vma); long pages = 0, psize = huge_page_size(h); - bool shared_pmd = false; struct mmu_notifier_range range; unsigned long last_addr_mask; bool uffd_wp = cp_flags & MM_CP_UFFD_WP; @@ -6452,7 +6442,7 @@ long hugetlb_change_protection(struct vm_area_struct *vma, } } ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, vma, address, ptep)) { + if (huge_pmd_unshare(tlb, vma, address, ptep)) { /* * When uffd-wp is enabled on the vma, unshare * shouldn't happen at all. Warn about it if it @@ -6461,7 +6451,6 @@ long hugetlb_change_protection(struct vm_area_struct *vma, WARN_ON_ONCE(uffd_wp || uffd_wp_resolve); pages++; spin_unlock(ptl); - shared_pmd = true; address |= last_addr_mask; continue; } @@ -6522,22 +6511,16 @@ long hugetlb_change_protection(struct vm_area_struct *vma, pte = huge_pte_clear_uffd_wp(pte); huge_ptep_modify_prot_commit(vma, address, ptep, old_pte, pte); pages++; + tlb_remove_huge_tlb_entry(h, tlb, ptep, address); } next: spin_unlock(ptl); cond_resched(); } - /* - * There is nothing protecting a previously-shared page table that we - * unshared through huge_pmd_unshare() from getting freed after we - * release i_mmap_rwsem, so flush the TLB now. If huge_pmd_unshare() - * succeeded, flush the range corresponding to the pud. - */ - if (shared_pmd) - flush_hugetlb_tlb_range(vma, range.start, range.end); - else - flush_hugetlb_tlb_range(vma, start, end); + + tlb_flush_mmu_tlbonly(tlb); + huge_pmd_unshare_flush(tlb, vma); /* * No need to call mmu_notifier_arch_invalidate_secondary_tlbs() we are * downgrading page table protection not changing it to point to a new @@ -6904,18 +6887,27 @@ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, return pte; } -/* - * unmap huge page backed by shared pte. +/** + * huge_pmd_unshare - Unmap a pmd table if it is shared by multiple users + * @tlb: the current mmu_gather. + * @vma: the vma covering the pmd table. + * @addr: the address we are trying to unshare. + * @ptep: pointer into the (pmd) page table. + * + * Called with the page table lock held, the i_mmap_rwsem held in write mode + * and the hugetlb vma lock held in write mode. * - * Called with page table lock held. + * Note: The caller must call huge_pmd_unshare_flush() before dropping the + * i_mmap_rwsem. * - * returns: 1 successfully unmapped a shared pte page - * 0 the underlying pte page is not shared, or it is the last user + * Returns: 1 if it was a shared PMD table and it got unmapped, or 0 if it + * was not a shared PMD table. */ -int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) +int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long addr, pte_t *ptep) { unsigned long sz = huge_page_size(hstate_vma(vma)); + struct mm_struct *mm = vma->vm_mm; pgd_t *pgd = pgd_offset(mm, addr); p4d_t *p4d = p4d_offset(pgd, addr); pud_t *pud = pud_offset(p4d, addr); @@ -6927,18 +6919,36 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, i_mmap_assert_write_locked(vma->vm_file->f_mapping); hugetlb_vma_assert_locked(vma); pud_clear(pud); - /* - * Once our caller drops the rmap lock, some other process might be - * using this page table as a normal, non-hugetlb page table. - * Wait for pending gup_fast() in other threads to finish before letting - * that happen. - */ - tlb_remove_table_sync_one(); - ptdesc_pmd_pts_dec(virt_to_ptdesc(ptep)); + + tlb_unshare_pmd_ptdesc(tlb, virt_to_ptdesc(ptep), addr); + mm_dec_nr_pmds(mm); return 1; } +/* + * huge_pmd_unshare_flush - Complete a sequence of huge_pmd_unshare() calls + * @tlb: the current mmu_gather. + * @vma: the vma covering the pmd table. + * + * Perform necessary TLB flushes or IPI broadcasts to synchronize PMD table + * unsharing with concurrent page table walkers (TLB, GUP-fast, etc.). + * + * This function must be called after a sequence of huge_pmd_unshare() + * calls while still holding the i_mmap_rwsem. + */ +void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma) +{ + /* + * We must synchronize page table unsharing such that nobody will + * try reusing a previously-shared page table while it might still + * be in use by previous sharers (TLB, GUP_fast). + */ + i_mmap_assert_write_locked(vma->vm_file->f_mapping); + + tlb_flush_unshared_tables(tlb); +} + #else /* !CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING */ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, @@ -6947,12 +6957,16 @@ pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma, return NULL; } -int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, pte_t *ptep) +int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long addr, pte_t *ptep) { return 0; } +void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma) +{ +} + void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end) { @@ -7219,6 +7233,7 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, unsigned long sz = huge_page_size(h); struct mm_struct *mm = vma->vm_mm; struct mmu_notifier_range range; + struct mmu_gather tlb; unsigned long address; spinlock_t *ptl; pte_t *ptep; @@ -7229,6 +7244,7 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, if (start >= end) return; + tlb_gather_mmu(&tlb, mm); flush_cache_range(vma, start, end); /* * No need to call adjust_range_if_pmd_sharing_possible(), because @@ -7248,10 +7264,10 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, if (!ptep) continue; ptl = huge_pte_lock(h, mm, ptep); - huge_pmd_unshare(mm, vma, address, ptep); + huge_pmd_unshare(&tlb, vma, address, ptep); spin_unlock(ptl); } - flush_hugetlb_tlb_range(vma, start, end); + huge_pmd_unshare_flush(&tlb, vma); if (take_locks) { i_mmap_unlock_write(vma->vm_file->f_mapping); hugetlb_vma_unlock_write(vma); @@ -7261,6 +7277,7 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma, * Documentation/mm/mmu_notifier.rst. */ mmu_notifier_invalidate_range_end(&range); + tlb_finish_mmu(&tlb); } /* diff --git a/mm/mmu_gather.c b/mm/mmu_gather.c index 247e3f9db6c7a..822a790127375 100644 --- a/mm/mmu_gather.c +++ b/mm/mmu_gather.c @@ -468,6 +468,12 @@ void tlb_gather_mmu_fullmm(struct mmu_gather *tlb, struct mm_struct *mm) */ void tlb_finish_mmu(struct mmu_gather *tlb) { + /* + * We expect an earlier huge_pmd_unshare_flush() call to sort this out, + * due to complicated locking requirements with page table unsharing. + */ + VM_WARN_ON_ONCE(tlb->fully_unshared_tables); + /* * If there are parallel threads are doing PTE changes on same range * under non-exclusive lock (e.g., mmap_lock read-side) but defer TLB diff --git a/mm/mprotect.c b/mm/mprotect.c index 283889e4f1cec..5c330e817129e 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -652,7 +652,7 @@ long change_protection(struct mmu_gather *tlb, #endif if (is_vm_hugetlb_page(vma)) - pages = hugetlb_change_protection(vma, start, end, newprot, + pages = hugetlb_change_protection(tlb, vma, start, end, newprot, cp_flags); else pages = change_protection_range(tlb, vma, start, end, newprot, diff --git a/mm/rmap.c b/mm/rmap.c index 748f48727a162..d6799afe11147 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -76,7 +76,7 @@ #include <linux/mm_inline.h> #include <linux/oom.h> -#include <asm/tlbflush.h> +#include <asm/tlb.h> #define CREATE_TRACE_POINTS #include <trace/events/migrate.h> @@ -2008,13 +2008,17 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma, * if unsuccessful. */ if (!anon) { + struct mmu_gather tlb; + VM_BUG_ON(!(flags & TTU_RMAP_LOCKED)); if (!hugetlb_vma_trylock_write(vma)) goto walk_abort; - if (huge_pmd_unshare(mm, vma, address, pvmw.pte)) { + + tlb_gather_mmu(&tlb, mm); + if (huge_pmd_unshare(&tlb, vma, address, pvmw.pte)) { hugetlb_vma_unlock_write(vma); - flush_tlb_range(vma, - range.start, range.end); + huge_pmd_unshare_flush(&tlb, vma); + tlb_finish_mmu(&tlb); /* * The PMD table was unmapped, * consequently unmapping the folio. @@ -2022,6 +2026,7 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma, goto walk_done; } hugetlb_vma_unlock_write(vma); + tlb_finish_mmu(&tlb); } pteval = huge_ptep_clear_flush(vma, address, pvmw.pte); if (pte_dirty(pteval)) @@ -2398,17 +2403,20 @@ static bool try_to_migrate_one(struct folio *folio, struct vm_area_struct *vma, * fail if unsuccessful. */ if (!anon) { + struct mmu_gather tlb; + VM_BUG_ON(!(flags & TTU_RMAP_LOCKED)); if (!hugetlb_vma_trylock_write(vma)) { page_vma_mapped_walk_done(&pvmw); ret = false; break; } - if (huge_pmd_unshare(mm, vma, address, pvmw.pte)) { - hugetlb_vma_unlock_write(vma); - flush_tlb_range(vma, - range.start, range.end); + tlb_gather_mmu(&tlb, mm); + if (huge_pmd_unshare(&tlb, vma, address, pvmw.pte)) { + hugetlb_vma_unlock_write(vma); + huge_pmd_unshare_flush(&tlb, vma); + tlb_finish_mmu(&tlb); /* * The PMD table was unmapped, * consequently unmapping the folio. @@ -2417,6 +2425,7 @@ static bool try_to_migrate_one(struct folio *folio, struct vm_area_struct *vma, break; } hugetlb_vma_unlock_write(vma); + tlb_finish_mmu(&tlb); } /* Nuke the hugetlb page table entry */ pteval = huge_ptep_clear_flush(vma, address, pvmw.pte); -- 2.52.0

5 days, 8 hours

3
9
0 0

December Order

by VARELT IMPORT SRL

5 days, 8 hours

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror